ZyXEL Communications ZyWALL5UTM 4.0 manuel d'utilisation

ZyW ALL 5/35/70 Series Internet Security Appliance User ’ s Guide V ersion 4.00 10/2005[...]

ZyWALL 5/35/70 Series User’s Guide Copyright 2 Copyright Copyright © 2005 by ZyXEL Communications Corpo ration. The contents of this publication may not be reprod uced in any part or as a wh ole, transcribed, stored in a retrieval system, tran slated into any language, or transmitted in any form or by any means, el ectronic, mec hanical , magnet[...]

ZyWALL 5/35/70 Series User’s Guide 3 Federal Communications Commissio n (FCC) Interference Statement Federal Communications Commission (FCC) Interference S t atement This device complies with Part 15 of FCC rul es. Operation is subject to the following two conditions: • This device may not cause harmful interference. • This device must accept[...]

ZyWALL 5/35/70 Series User’s Guide Federal Com munications Commission (FCC) Interf erence St atement 4[...]

ZyWALL 5/35/70 Series User’s Guide 5 Safety Warnings Safety W arnings For your safety , be sure to read and fo llow all warning notices and instructions. • Do NOT open the device or un it. Opening or removing covers can expose yo u to dangerous high vo ltage points or othe r risks. ONL Y qualified service personn el can service the device. Plea[...]

ZyWALL 5/35/70 Series User’s Guide ZyXEL Limited Warranty 6 ZyXEL Limited W arranty ZyXEL warrants to the original en d user (purchaser) that this product is free from any defects in materials or workmansh ip for a period of up to tw o years from the date of purchase . During the warranty period, and upon proof of purchase, should the product hav[...]

ZyWALL 5/35/70 Series User’s Guide 7 Customer Suppo rt Customer Support Please have the following information r eady when you contact customer support. • Product model and serial number . • W arranty Information. • Date that you received your device. • Brief description of the problem and the steps yo u took to solve i t. METHOD LOCATION [...]

ZyWALL 5/35/70 Series User’s Guide Customer Support 8 POLAND info@pl.zyxel.com +48-22-5286603 www.pl.zyxel .com ZyXEL Communications ul.Emilli Plater 53 00-1 13 W arszawa Poland +48-22-5206701 RUSSIA http://zyxel.ru/support +7-095-542-89-29 www .zyxel.ru ZyXEL Russia Ostrovityanova 37a S tr . Moscow , 1 1727 9 Russia sales@zyxel.ru +7-095-542-89-[...]

ZyWALL 5/35/70 Series User’s Guide 9 Customer Suppo rt[...]

ZyWALL 5/35/70 Series User’s Guide Table of Contents 10 T able of Content s Copyright .................................................. .......................................... ...................... 2 Federal Communications Commissi on (FCC) Interference S t atement ............... 3 Safety W arnings ....................................... ..[...]

ZyWALL 5/35/70 Series User’s Guide 11 Table of Contents Chapter 3 Wizard Setup .. .......................................... .......................................... .................... 80 3.1 Wizard Setup Overview ....................... ............. ............ ............. ................ ......... 80 3.2.1 ISP Parameters ..... ........[...]

ZyWALL 5/35/70 Series User’s Guide Table of Contents 12 7.4.2 Weighted Round Robin .... ............. ................ ............. ............. ................ 129 7.4.3 S pillover . ................ ............. ............. ................ ............. ............. ............. 129 7.5 TCP/IP Priority (Metric) ................ .......[...]

ZyWALL 5/35/70 Series User’s Guide 13 Table of Contents 9.1 1 .2 Encryption ...... ............. ............. ................ ............. ................ ............. ...183 9.12 WP A-PSK Application Exam ple .............. ................................................ ....... 184 9.13 Introduction to RADIU S ..................... ......[...]

ZyWALL 5/35/70 Series User’s Guide Table of Contents 14 Chapter 1 1 Firewall Screens ................................................. ........................................... ....... 210 1 1.1 Acc ess Methods ............... ............. ............. ................ ............. ................ ....... 210 1 1.2 Firewall Policies Overvie[...]

ZyWALL 5/35/70 Series User’s Guide 15 Table of Contents 13.3.3 Signature Actions ........... ................ ............. ................ ............. ............. 244 13.3.4 Configuring IDP Signatures ..... ... ............. ............. ............. ............ .......245 13.3.5.1 Query Example 1 ................. ............. ........[...]

ZyWALL 5/35/70 Series User’s Guide Table of Contents 16 16.6.2 Full Path URL Che cking .......... ................ ............. ............. ................ ...286 16.6.3 File Name URL Che cking .... ................. ............ ............. ............. .......... 286 Chapter 17 Content Filtering Report s .................................[...]

ZyWALL 5/35/70 Series User’s Guide 17 Table of Contents 19.7 ID T ype and Cont ent ............ ............. ................ ............. ................ ............. ...307 19.7.1 ID T ype and Conten t E xamples .................. ............. ............. ................ 308 19.8 IKE Phases ...................... ............. .........[...]

ZyWALL 5/35/70 Series User’s Guide Table of Contents 18 22.5.1 Default Server IP Address ... ............. ................ ............. ................ ....... 380 22.5.2 Port Forwarding: Services and Po rt Numbers ...... ............. ................ ...380 22.5.3 Configuring Servers Behind Port Forwarding (Example) ...................... 38[...]

ZyWALL 5/35/70 Series User’s Guide 19 Table of Contents 26.5 Name Server Record . ....................... ............. ............ ............. ............. .......... 415 26.5.1 Private DNS Server .......... ............. ............. ............. ................ ............. 415 26.6 System Screen ........... .......... ............. ..[...]

ZyWALL 5/35/70 Series User’s Guide Table of Contents 20 28.5 Using UPnP in Windows XP Example . ............. ............. ............. ................ ...457 28.5.1 Auto-discover Y our UPnP-enabled Network D evice ...... ................ ....... 458 28.5.2 Web Configurator Easy Access ............... ................ ............. ...........[...]

ZyWALL 5/35/70 Series User’s Guide 21 Table of Contents Chapter 32 Introducing the SMT ..................... ........................................... ............................ 496 32.1 Introduction to the SMT ..................... ............. ................ ................ ............. ...496 32.2 Accessing the SMT via the Console Po [...]

ZyWALL 5/35/70 Series User’s Guide Table of Contents 22 36.2 Ethernet Encapsulation . ............. ............. ............. ................ ............. ............. 528 36.3 Configuring the PPTP Client ...... ....... ......... ............. ............. ................ .......... 530 36.4 Configuring the PPPoE Client .............. ....[...]

ZyWALL 5/35/70 Series User’s Guide 23 Table of Contents Chapter 41 IP St atic Route Setup ......................................... ........................................... ....... 556 41.1 IP S tatic Route Setup .............. ................ ................ ............. ................ .......... 556 Chapter 42 Network Address T r anslat[...]

ZyWALL 5/35/70 Series User’s Guide Table of Contents 24 Chapter 45 SNMP Configuration ..................................................... ....................................... 594 45.1 SNMP Configuration .................. ............. ................ ............. ................ .......... 594 45.2 SNMP Trap s ..... ............. .......[...]

ZyWALL 5/35/70 Series User’s Guide 25 Table of Contents 47.5.6 TFTP Upload Command Example . ................................................ ....... 620 47.5.7 Uploading Via Consol e Port ..... ................ ............. ............. ................ ...620 47.5.8 Uploading Firmware F ile Via Console Port ....... ............. .............[...]

ZyWALL 5/35/70 Series User’s Guide Table of Contents 26 52.5.1.3 Java Permission s .... ............. ............. ................ ............. ............. 656 52.6 Packet Flow ... ............. ............. ................ ............. ................ ............. ............. 658 Appendix A Product Specifications ....................[...]

ZyWALL 5/35/70 Series User’s Guide 27 Table of Contents Certificates Commands ..................................... ........................................... ....... 762 Appendix Q Brute-Force Password Guessing Protecti on ................................... .................. 766 Appendix R Boot Commands ........................... ...........[...]

ZyWALL 5/35/70 Series User’s Guide List of Fi gures 28 List of Figures Figure 1 Secure Internet Acce ss via Cable, DSL or Wireless Modem ... ................ ............. 58 Figure 2 VPN Application ...... ............. ............. ................ ............. ............. ............. ............. 59 Figure 3 ZyW ALL 70 Front Panel .....[...]

ZyWALL 5/35/70 Series User’s Guide 29 List of Figures Figure 39 WLAN Port Role Ex ample ........ ............. ............. ............ ................. ............ ....... 1 14 Figure 40 LAN Port Roles .. ................ ............. ............. ............. ................ ............. ............. 1 15 Figure 41 Port Roles Change C[...]

ZyWALL 5/35/70 Series User’s Guide List of Fi gures 30 Figure 82 Wireless Card: WP A- PSK ............... ................................ ................. ............ ....... 190 Figure 83 Wireless Card: WP A ....................... ............. ............. ............. ................ ............. 191 Figure 84 Wireless Card: 802.1x + D[...]

ZyWALL 5/35/70 Series User’s Guide 31 List of Figures Figure 125 Anti-S pam: General . ................ ................ ................ ................ ................ .......... 266 Figure 126 Anti-S pam: External DB ...... .......... ....... ............. ................ ............. ............ ....... 268 Figure 127 Anti-S pam: Lists .[...]

ZyWALL 5/35/70 Series User’s Guide List of Fi gures 32 Figure 168 T rusted Remote Hosts ........ ................. ................ ................ ................ ............. 356 Figure 169 Remote Host Certificates ........... .......... ............. ................ ............. ............ ....... 357 Figure 170 Certificate Details ....[...]

ZyWALL 5/35/70 Series User’s Guide 33 List of Figures Figure 21 1 Login Screen (Internet Explorer) ... ............. ................ ............. ............. ............. 435 Figure 212 Login Screen (Netsca pe) .............. ............. ................ ............. ............. ............. 435 Figure 213 Replace Certificate .........[...]

ZyWALL 5/35/70 Series User’s Guide List of Fi gures 34 Figure 254 Firmware Upload In Process ...... ... .......... ............. ............. ............. ............ ....... 491 Figure 255 Network T emporarily Disconnect ed . .... ............. ............ ................. ............ ....... 492 Figure 256 Firmware Upload Error ..... ....[...]

ZyWALL 5/35/70 Series User’s Guide 35 List of Figures Figure 297 Menu 6.3: Route Failover .............. ... ............. ............. ............. ................ .......... 538 Figure 298 Menu 7.1: Wireless Setup ............. ............. ............. ............. ............. ............. ... 540 Figure 299 Menu 7.1.1: WLAN MAC Addre[...]

ZyWALL 5/35/70 Series User’s Guide List of Fi gures 36 Figure 339 Menu 21.2: Firewall Setup ............ ............. ............. ............. ............. ................ 579 Figure 340 Outgoing Packet F iltering Process ... ................. ................ ................ ................ 580 Figure 341 Filter Rule Proce ss ........ ..[...]

ZyWALL 5/35/70 Series User’s Guide 37 List of Figures Figure 382 Example Xmodem Up load ...... ............. ............. ............ ................. ............ ....... 621 Figure 383 Menu 24.7.2 As Seen Using the Cons ole Port ......................... ............. .......... 622 Figure 384 Example Xmodem Up load ...... ............. ....[...]

ZyWALL 5/35/70 Series User’s Guide List of Fi gures 38 Figure 425 Windows XP: Advanced TCP/ IP Prop erties .. ............. ............. ............. ............. 681 Figure 426 Windows XP: Internet P rotocol (TCP /IP) Properties .................. .................... ... 682 Figure 427 Macintosh OS 8/9: Apple Menu .... ... ................. [...]

ZyWALL 5/35/70 Series User’s Guide 39 List of Figures Figure 468 Headquarters Network Policy Edit .................... ................ ................ ................ 731 Figure 469 Branch Office Network Policy Edit ... ............. ............. ............. ............. ............. 732 Figure 470 VPN Rule Configured .... ............. .[...]

ZyWALL 5/35/70 Series User’s Guide List of Tables 40 List of T ables T able 1 Model S pecific Features .............. ................ ................ ............. ................ ............. 50 T able 2 Front Panel LED s . ............. ................ ............. ................ ................ ............. .......... 60 T able 3 Web[...]

ZyWALL 5/35/70 Series User’s Guide 41 List of Tables T able 39 WAN: Ethernet Encapsulation ............ ................. ................ ............. ................ ... 140 T able 40 WAN: PPPoE Encap s ulatio n ........... ................................ ................. ............ ....... 144 T able 41 WAN: PP TP Encapsulation .........[...]

ZyWALL 5/35/70 Series User’s Guide List of Tables 42 T able 82 Common Computer Virus T ypes ........ ................. ............ ................. ................ ... 254 T able 83 Anti-Virus: General .... ............ ................. ............. ................ ................ ............. ... 258 T able 84 Anti-Virus: Update ........[...]

ZyWALL 5/35/70 Series User’s Guide 43 List of Tables T able 125 N A T Mapping T ypes ................... ............. ................ ............. ................ ............. 374 T able 126 N A T Overview ...... ............. ............. ................ ............. ................ ............. .......... 375 T able 127 N A T Address [...]

ZyWALL 5/35/70 Series User’s Guide List of Tables 44 T able 168 Web Site Hits Report ........ ................ ............. ................ ............. ................ ....... 476 T able 169 P rotocol/ Port Report ........ ................ ............. ................ ............. ................ ....... 477 T able 170 H ost IP Address R[...]

ZyWALL 5/35/70 Series User’s Guide 45 List of Tables T able 21 1 Remote Node Network Layer Options Menu Fields ................... ............. .......... 552 T able 212 Menu 1 1.1.5: Traf fic Redirect Setup ..... ............. ............ ............. ................ ....... 555 T able 213 Menu 12. 1: E dit IP S tatic Route ........... .....[...]

ZyWALL 5/35/70 Series User’s Guide List of Tables 46 T able 254 Clas ses of IP Addresses ............... .......... ............. ................ ............. ............. ... 690 T able 255 A llowed IP Address Range By Class .... ................ ................ ................ ............. 691 T able 256 “Natural” Mas ks .............[...]

ZyWALL 5/35/70 Series User’s Guide 47 List of Tables T able 297 A S Logs ............ ................ ............. ................ ............. ............. ................ ......... .7 8 8 T able 298 S yslog Logs ............. ............ ................. ............. ................ ............. ................ ... 7 90 T able 299 R[...]

ZyWALL 5/35/70 Series User’s Guide Preface 48 Preface Congratulations on you r purchase of the ZyW ALL. Note: Register your product online to receive e-mail notices of firmware upgrade s and information at www .zyxel.com for global products, or a t www .us.zyxel.com for North American products. Y our ZyW ALL is easy to install and configure. Abou[...]

ZyWALL 5/35/70 Series User’s Guide 49 Pref ace Synt ax Conventions • “Enter” means for you to type one or more characters. “Select” or “Choose ” means for you to use one predefined choices. • The SMT menu titles and labels are in Bold Times New Roman font. Predefined field choices are in Bold Arial font. Command and arrow keys are[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 1 Getting to Know Your ZyW ALL 50 C HAPTER 1 Getting to Know Y our ZyW ALL This chapter introduces the main feat ures and applications of the ZyW ALL. 1.1 ZyW ALL Internet Security Appliance Overview The ZyW ALL is loaded with security features including VPN, firewall, content filtering, anti- spam, IDP [...]

ZyWALL 5/35/70 Series User’s Guide 51 Chapter 1 Getting to Know Your ZyWALL T able Key: An O in a mode’ s column shows that the device mode has the specified feature. The information in this table was correct at th e time of writing, although it may be subject to change. 1.2.1 Physical Features LAN Port The 10/100 Mbps auto-nego tiating Etherne[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 1 Getting to Know Your ZyW ALL 52 Time and Date The ZyW ALL allows you to get the current time and da te from an external server when you turn on your ZyW ALL. Y ou can also set the tim e manua lly . The Real T ime Chip (R TC) ke eps track of the time and date. Reset Button Use the reset button to re sto[...]

ZyWALL 5/35/70 Series User’s Guide 53 Chapter 1 Getting to Know Your ZyWALL Bandwid t h Management Bandwidth manage ment allows you to allo cate network resource s according to defin ed policies. This policy-based ba nd width allocation helps your netw ork to better handle real-time applications such as V oice-over-IP (V oIP). IPSec VPN Cap a bil[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 1 Getting to Know Your ZyW ALL 54 Content Filtering The ZyW ALL can block web features such as ActiveX controls, Java applets and cookies, as well as disable web proxies. The ZyW ALL can block or allow access to web sites that you specify . The ZyW ALL can also bloc k access to web sites containing keywo[...]

ZyWALL 5/35/70 Series User’s Guide 55 Chapter 1 Getting to Know Your ZyWALL IEEE 802.1x for Network Security The ZyW ALL supports the IEEE 802.1x standard th at works with the IEEE 802.1 1 to enhance user authentication. W ith the local user profile, the ZyW ALL allows you to configure up 32 user profiles without a networ k authentication server [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 1 Getting to Know Your ZyW ALL 56 Dynamic DNS Support W ith Dynamic DNS (Domain Name System) support, you can have a static hostname alia s for a dynamic IP address, allowing the host to be more easily accessible from various locations on the Internet. Y ou must register for this service with a Dynamic D[...]

ZyWALL 5/35/70 Series User’s Guide 57 Chapter 1 Getting to Know Your ZyWALL T raffic Redirect T raffic Redirect forwards W AN traffic to a backup gateway on the LAN when the ZyW ALL cannot connect to the Internet, thus acting as an auxiliary backup whe n your regular W AN connection fails. Port Forwarding Use this feature to forward incoming serv[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 1 Getting to Know Your ZyW ALL 58 1.3 Applications for the ZyW ALL Here are some examples of what you can do with y our ZyW ALL. 1.3.1 Secure Broadband Internet A ccess via Cable or DSL Modem Y ou can connect a cable modem, DSL or wi reless modem to the ZyW ALL for broadband Internet access via Ethernet [...]

ZyWALL 5/35/70 Series User’s Guide 59 Chapter 1 Getting to Know Your ZyWALL Figure 2 VPN Application 1.3.3 Front Panel LEDs Figure 3 ZyW ALL 70 Front Panel Figure 4 ZyW ALL 35 Front Panel Figure 5 ZyW ALL 5 Fro nt Panel[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 1 Getting to Know Your ZyW ALL 60 The following table describes the LEDs. Table 2 Front Panel LEDs LED COLOR ST ATUS DESCRIPTION PWR Off The ZyW ALL is turned off. Green On The ZyWALL is turned on. Red On The power to the ZyWALL is too low . SYS Green Off The ZyW ALL is not ready or has fail ed. On The Z[...]

ZyWALL 5/35/70 Series User’s Guide 61 Chapter 1 Getting to Know Your ZyWALL[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 2 Introdu cing the Web Configur ator 62 C HAPTER 2 Introducing the W eb Configurator This chapter describes how to access the Zy W ALL we b configurator and p rovides an overview of its screens. 2.1 W eb Configurator Overview The web configurator is an HTML-based mana gement interface that allows easy Zy[...]

ZyWALL 5/35/70 Series User’s Guide 63 Chapter 2 Introducing the Web Configurator Figure 6 Change Password Screen 6 Click Apply in the Replace Certificate scre en to create a certificate using your ZyW ALL ’ s MAC address that will be specific to this device. Note: If you do not replace th e default certificate here or in the CERT IFICA TES scre[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 2 Introdu cing the Web Conf igurator 64 2.3.1 Procedure T o Use The Reset Button Make sure the SYS LED is on (not blinking ) before you begin this proc edure. 1 Press the RESET button for ten seconds, and then release it. If the SYS LED begins to blink, the defaults have been restored and the ZyW ALL res[...]

ZyWALL 5/35/70 Series User’s Guide 65 Chapter 2 Introducing the Web Configurator Note: Follow the instruction s you see in the HOME screen or click the icon. The screen varies according to the device mode you select in the MAINTENANCE Devic e Mode screen. 2.4.1 Router Mode The following screen displays when the ZyW ALL is set to router mode. The [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 2 Introdu cing the Web Configur ator 66 The following table describes the labels in this screen. Table 3 Web Configurator HOME Scr een in Router Mode LABEL DESCRIPTION Wizards for W AN 1 (W AN) and VPN Quick Setup Internet Access Click Internet Ac cess to use the initial configurat ion wizard. This confi[...]

ZyWALL 5/35/70 Series User’s Guide 67 Chapter 2 Introducing the Web Configurator 2.4.2 Bridge Mode The following screen displays when the ZyW A LL is set to bridge mode. While in bridge mode, the ZyW ALL cannot get an IP address from a DHCP server . The LAN , W AN, DMZ and WLAN interfaces all have the same (static) IP a ddress and subnet mask. Y [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 2 Introdu cing the Web Conf igurator 68 Figure 10 Web Configurator HO ME Screen in Bridge Mode The following table describes the labels in this screen. Table 4 Web Configurator HOME Screen in Bridg e Mode LABEL DESCRIPTION Wizards for VPN Quick Setup VPN Click VPN to create VPN policies. Device Informati[...]

ZyWALL 5/35/70 Series User’s Guide 69 Chapter 2 Introducing the Web Configurator Firmware V ersion This is the ZyNOS Firmware ve rsion an d the date created. ZyNOS is ZyXEL's proprietary Network Operating System design. Device Mode This displays whether the ZyWALL is functioning as a router or a bridge. Firewall This displays wheth er or not[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 2 Introdu cing the Web Configur ator 70 2.4.3 Navigation Panel After you enter the password, use the sub-menus on the navigation p anel to configure ZyW ALL features. The following table lists the fe atures available for each device mode. Not all ZyW ALLs have all features listed in this table. RSTP Path[...]

ZyWALL 5/35/70 Series User’s Guide 71 Chapter 2 Introducing the Web Configurator T able Key: An O in a mode’ s column shows that the device mode has the specified feature. The information in this table was correct at th e time of writing, although it may be subject to change. The following table describes the sub-menus. DNS O Remote Management [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 2 Introdu cing the Web Configur ator 72 WA N General This screen al lows you to configure load balancing, route pr iority and traffic redirect properties. Route (ZyW ALL 5 only) This screen allows you to configure route priority . WA N ( Z yWA L L 5 only) Use this screen to configure the W AN port for in[...]

ZyWALL 5/35/70 Series User’s Guide 73 Chapter 2 Introducing the Web Configurator IDP General Use this screen to enable IDP on the ZyWALL and choose what interface(s) you want to protect from intrusions. Signature Use these screens to view signatures by attack type or search for signatures by signatu re name, ID, severity , target operating system[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 2 Introdu cing the Web Configur ator 74 NA T NA T Overview Use this screen to enable NA T . Address Mapping Use this screen to configure network address translation mapping rules. Port Forwarding Use this screen to configure servers behind the ZyWALL. Port T riggering Use this screen to change your ZyW A[...]

ZyWALL 5/35/70 Series User’s Guide 75 Chapter 2 Introducing the Web Configurator 2.4.4 System S t atistics Click Show St a t i s t i c s in the HOME screen. Read-only in formation here includes port status and packet specific statistics. Also provided is "Up T ime" and "poll interval(s)". The Poll Interval(s) field is configur[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 2 Introdu cing the Web Conf igurator 76 2.4.5 Show St atistics: Line Chart Click the icon in the Show S tatistics screen. This screen shows you the line chart of each port’ s throughput sta tistics. Figure 12 Home : Show Statistics: Line Chart S tatus For the LAN and DMZ ports, this displa ys the port [...]

ZyWALL 5/35/70 Series User’s Guide 77 Chapter 2 Introducing the Web Configurator The following table describes the labels in this screen. Table 8 Home: Show Statistics: Line Chart LABEL DESCRIPTION Click the icon to go back to the Show St atistics screen. Port Select the check box(es) to disp lay the through put statistics of the corresponding po[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 2 Introdu cing the Web Conf igurator 78 The following table describes the labels in this screen. Table 9 Home: DHCP Table LABEL DESCRIPTION Interface Select LAN , DMZ or WLAN to show the current DHCP client information fo r the specifi ed interfac e. # This is the index nu mber of the host computer . IP [...]

ZyWALL 5/35/70 Series User’s Guide 79 Chapter 2 Introducing the Web Configurator Figure 14 Home : VPN S tatus The following table describes the labels in this screen. Table 10 Home : VPN Status LABEL DESCRIPTION # This is the security association index number. Name This field displays the identification name for this VPN policy . Local Network Th[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 3 Wi zard Setup 80 C HAPTER 3 W izard Setup This chapter provides information on the Wizard Setup screens in the web configurator . The Internet access wizard is only applicable when the ZyW ALL is in router mode. 3.1 Wizard Setup Overview The web configurator's setup wizards help yo u configure W A[...]

ZyWALL 5/35/70 Series User’s Guide 81 Chapter 3 Wizard Setup Figure 15 ISP Parameters : Et hernet Encap sulation The following table describes the labels in this screen. Table 11 ISP Parameters : Ethe rnet Encaps ulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation Y ou must choose the Ethernet option when the W AN port is u[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 3 Wi zard Setup 82 3.2.1.2 PPPoE Encap sulation Point-to-Point Protocol ov er Ethernet (PPPoE) function s as a dial-up connection. PPPoE is an IETF (Internet Engineering T ask Force) standard specifying ho w a host personal compute r interacts with a broadba nd mode m (for example xDSL, cable, wire less,[...]

ZyWALL 5/35/70 Series User’s Guide 83 Chapter 3 Wizard Setup 3.2.1.3 PPTP Encap su lation Point-to-Point T unneling Protocol (PP TP) is a network pro tocol that enables transfe rs of data from a remote client to a private server , crea ting a V irtual Private Network (VPN) usin g TCP/ IP-based networks. PP TP supports on-demand, multi-protocol, a[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 3 Wi zard Setup 84 Figure 17 ISP Parameters: PPTP Encap sulation The following table describes the labels in this screen. Table 13 ISP Parameters : PPTP Encapsulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation Select PPTP from the drop-down li st box. T o configure a PPTP client, [...]

ZyWALL 5/35/70 Series User’s Guide 85 Chapter 3 Wizard Setup 3.2.2 Internet Access Wizard: Second Screen Click Next to go to the screen where you can regi ster your ZyW ALL and activate the free content filtering, anti-spam, anti-virus and IDP trial applications. Otherwise, click Skip to display the congratulations screen and click Clos e to comp[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 3 Wi zard Setup 86 Figure 19 Internet Access Setu p Complete 3.2.3 Internet Access Wizard: Registration If you clicked Next in the previous screen (see Figure 18 on page 85 ), the following screen displays. Note: If you want to activate a standard service with your iCard’ s PIN number (license key), us[...]

ZyWALL 5/35/70 Series User’s Guide 87 Chapter 3 Wizard Setup The following table describes the labels in this screen. T able 14 Internet Access W izard: Registration LABEL DESCRIPTION Device Registration If you select Existing myZyXEL.com acco unt , only the User Name and Password fields are availabl e. New myZyXEL.com account If you haven’t cr[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 3 Wi zard Setup 88 Figure 22 Internet Access Wizard: S tatus The following screen appears if the registration was not succes sful. Click Return to go back to the Device Registration screen and check your settings. Figure 23 Internet Access Wizard: Registration Failed If the ZyW ALL has been registered, t[...]

ZyWALL 5/35/70 Series User’s Guide 89 Chapter 3 Wizard Setup Figure 25 Internet Access Wizard: Activated Services 3.3 VPN Wizard Gateway Setting Use the VPN wizard screens to configure a VPN rule that uses a pre-shared key . If you want to set the rule to use a certificate, please go to the VPN screens for configuration. Click VPN W izard in the [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 3 Wi zard Setup 90 The following table describes the labels in this screen. Table 15 VPN Wizard: Gate way Setting LABEL DESCRIPTION Gateway Policy Property Name T ype up to 32 characters to identify this VPN gateway policy . Y ou may use any character , including spaces, but the ZyW ALL drops trailing sp[...]

ZyWALL 5/35/70 Series User’s Guide 91 Chapter 3 Wizard Setup Figure 27 VPN Wizard: Network Setting The following table describes the labels in this screen. Table 16 VPN Wizard : Netwo rk Setting LABEL DESCRIPTION Network Policy Property Active If the Active check box is selected, packets for the tunnel trigger the ZyWALL to build the tunnel. Clea[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 3 Wi zard Setup 92 3.5 VPN Wizard IKE T unnel Setting (IKE Phase 1) Figure 28 VPN Wizard: IKE Tunnel Setting Remote Network Remote IP addresses must be static and correspond to the remote IPSec router's configured local IP addresses. Select Single for a single IP addres s. Select Range IP for a spec[...]

ZyWALL 5/35/70 Series User’s Guide 93 Chapter 3 Wizard Setup The following table describes the labels in this screen. Table 17 VPN Wizard: IKE Tunnel Setting LABEL DESCRIPTION Negotia tion Mode Select Main Mode for identity protecti on. Select Aggress ive Mode to allow more incoming connections from dynamic IP addresses to use separate passwords.[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 3 Wi zard Setup 94 3.6 VPN Wizard IPSec Setting (IKE Phase 2) Figure 29 VPN Wizard: IPSec Setting The following table describes the labels in this screen. Table 18 VPN Wizard: IPSec Setting LABEL DESCRIPTION Encap sulation Mode Tu n n e l is compatible with NA T , Transport is not. T unnel mode encapsula[...]

ZyWALL 5/35/70 Series User’s Guide 95 Chapter 3 Wizard Setup 3.7 VPN Wizard S t atus Summary This read-only screen shows the status of the current VPN settin g. Use the summary table to check whether what you have configured is correct. SA Life T ime (Seconds) Define the l ength of time before an IKE SA aut omatically renegotia tes in thi s field[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 3 Wi zard Setup 96 Figure 30 VPN Wizard: VPN S tatus The following table describes the labels in this screen. Table 19 VPN Wizard: VPN Status LABEL DESCRIPTION Gateway Policy Property Name This is the name of this VPN gateway policy . Gateway Policy Setting My ZyW ALL This is the W AN IP address or the d[...]

ZyWALL 5/35/70 Series User’s Guide 97 Chapter 3 Wizard Setup Name This is the name of this VPN network policy . Network Policy Setting Local Network S tarting IP Address This is a (static) IP address on the LAN behind your ZyW ALL. Ending IP Address/ Subnet Mask When the local network is configured for a single IP ad dress, this field is N/A. Whe[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 3 Wi zard Setup 98 3.8 VPN Wizard Setup Complete Congratulations! Y ou have successfully set up th e VPN rule after any existing rule(s) for your ZyW ALL. Figure 31 VPN Wizard Setup Co mplete[...]

ZyWALL 5/35/70 Series User’s Guide 99 Chapter 3 Wizard Setup[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 4 Regist ration 100 C HAPTER 4 Registration 4.1 myZyXEL.com overview myZyXEL.com is ZyXEL ’ s online services center wh ere you can register your ZyW ALL and manage subscription services available for the ZyW ALL. Note: Y ou need to create an account before you can register your device and activate the[...]

ZyWALL 5/35/70 Series User’s Guide 101 Chapter 4 Registr ation Y ou will get automatic e-mail not ification of new signature releases from mySecurityZone after you activate the IDP/Anti-virus service. Y o u can also check for new signature or virus updates at http://mysecurity .zyxel.com . See the chapters about content filtering, anti-virus, ant[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 4 Regist ration 102 The following table describes the labels in this screen. T able 20 Registration LABEL DESCRIPTION Device Registration If you select Existing myZyXEL.com acco unt , only the User Name and Password fields are availabl e. New myZyXEL.com account If you haven’t created an account at myZ[...]

ZyWALL 5/35/70 Series User’s Guide 103 Chapter 4 Registr ation Figure 33 Registrat ion : Registered Device 4.3 Service After you activate a trial, you can also use the Service screen to register and enter your iCard’ s PIN number (license key). Click REGISTRA T ION , Service to open the screen as shown next. Note: If you restore the ZyW ALL to [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 4 Regist ration 104 The following table describes the labels in this screen. T able 21 Service LABEL DESCRIPTION Service Management Service This field displays the servi ce name available o n the ZyWALL. S tatus This field displays whether a service is activated ( Active ) or not ( Inactive ). Registrat [...]

ZyWALL 5/35/70 Series User’s Guide 105 Chapter 4 Registr ation[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 5 LAN Screen s 106 C HAPTER 5 LAN Screens This chapter describes how to configure LAN settin gs. This chapter is on ly applicable when the ZyW ALL is in router mode. The LAN Port Roles screen is available on the ZyW ALL 5 and ZyW ALL 35. 5.1 LAN Overview Local Area Network (LAN) is a shared communic atio[...]

ZyWALL 5/35/70 Series User’s Guide 107 Chapter 5 LAN Screens These parameters should work fo r the majority of installations . If your ISP gives yo u explicit DNS server address(es), read the embedde d web c onfigurator help regarding what fields need to be configured. 5.3.2 IP Address and Subnet Mask Similar to the way houses on a street share a[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 5 LAN Screen s 108 Both RIP-2B and RIP-2M send routing data in RIP -2 fo rmat; the dif ference being that RIP- 2B uses subnet broadcasting while RI P-2M uses multicasting. Multicasting can reduce the load on non-router machines since they gene rally do not listen to the RIP multicast address and so will [...]

ZyWALL 5/35/70 Series User’s Guide 109 Chapter 5 LAN Screens Figure 35 LAN The following table describes the labels in this screen. T able 22 LAN LABEL DESCRIPTION LAN TCP/IP IP Address T ype the IP address of your ZyWALL in do tted decimal notation. 192.168.1.1 is the factory default. Alternatively , click the ri ght mouse bu tton to copy and/or[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 5 LAN Screen s 110 Multicast Select IGMP V - 1 or IGMP V -2 or None . IGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish membership in a Multicast group - it is not used to carry user data. IGMP version 2 (RFC 2236) is an improvement over version 1 (RFC 1 1 12) but IGM[...]

ZyWALL 5/35/70 Series User’s Guide 111 Chapter 5 LAN Screens 5.6 LAN St atic DHCP This table allows you to assign IP addresses on the LAN to specific individual computers based on their MAC Addresses. Every Ethernet device has a unique MAC (Med ia Access Control) addre ss. The MAC address is assigned at the factory and consists of six pairs of he[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 5 LAN Screen s 112 5.7 LAN IP Alias IP alias allows you to partition a physical network into dif fer ent logical networks over the same Ethernet interface. The ZyW ALL supports th ree logical LAN interfaces via its single physical Ethernet interface with the ZyW ALL itself as the gateway for ea ch LAN ne[...]

ZyWALL 5/35/70 Series User’s Guide 113 Chapter 5 LAN Screens Figure 38 LAN IP Alias The following table describes the labels in this screen. T able 24 LAN IP Alias LABEL DESCRIPTION Enable IP Alias 1, 2 Select the check box to configure another LAN network for the ZyWALL. IP Address Enter the IP address of your ZyW ALL in dotted decimal notation.[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 5 LAN Screen s 114 5.8 LAN Port Roles Use the Port R oles screen to set ports as LAN , DMZ or WLAN interfaces. The LAN port role is not available on all models. Connect wireless LAN Access Points (APs) to WLAN interfaces to extend the ZyW ALL ’ s wireless LAN coverage. The WLAN port role allows the ZyW[...]

ZyWALL 5/35/70 Series User’s Guide 115 Chapter 5 LAN Screens T o change your ZyW ALL ’ s port role settings, click NETWORK , LAN and then the Port Roles tab. The screen appears as shown. The radio buttons on th e left correspond to Ethernet ports on the front pane l of the ZyW ALL. Ports 1 to 4 are all LAN ports by default. The radio buttons on[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 5 LAN Screen s 116 After you change the LAN/DMZ/WLAN port roles and click Apply , please wait for few seconds until the following screen appears. Click Return to go back to the Port Roles screen. Figure 41 Port Roles Change Complete Apply Click Apply to save your changes back to the ZyWALL. Reset Click R[...]

ZyWALL 5/35/70 Series User’s Guide 117 Chapter 5 LAN Screens[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 6 Bridge Sc reens 118 C HAPTER 6 Bridge Screens This chapter describes how to configure bridge settings. This chapter is only applicable when the ZyW ALL is in bridge mode. 6.1 Bridge Loop The ZyW ALL can act as a bridge between a switch and a wired LAN or between two routers. Be careful to avoid bri dge[...]

ZyWALL 5/35/70 Series User’s Guide 119 Chapter 6 Bridge Screens 6.2.1 Rapid STP The ZyW ALL uses IEEE 802.1w RSTP (Rapid Spanning T ree Protocol) that allow faster convergence of the spanning tree (while al so being backwards comp atible with STP-only aware bridges). Using RSTP topology change in formation does not have to propagate to the root b[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 6 Bridge Sc reens 120 Once a stable network topology has been esta blished, all bridges listen for Hello BPDUs (Bridge Protocol Data Units) tr ansmitted from the root bridge. If a bridge does no t get a Hello BPDU after a predefined interval (Max Age), th e bridge assume s that the link to the root bridg[...]

ZyWALL 5/35/70 Series User’s Guide 121 Chapter 6 Bridge Screens Figure 43 Bridge The following table describes the labels in this screen. T able 28 Bridge LABEL DESCRIPTION Bridge IP Address Setup IP Address T ype the IP address of your ZyWALL in dotted decimal notation. IP Subnet Mask The subnet mask specifi es the network number portion of an I[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 6 Bridge Sc reens 122 6.4 Bridge Port Roles Use the Port R oles screen to set ports as LAN, DMZ or WLAN interfaces. The LAN port role is not available on all models. Connect wireless LAN Access Points (APs) to WLAN interfaces to extend the ZyW ALL ’ s wireless LAN coverage. The WLAN port role allows th[...]

ZyWALL 5/35/70 Series User’s Guide 123 Chapter 6 Bridge Screens Figure 44 WLAN Port Role Example T o change your ZyW ALL ’ s port role settings, click NETWORK , BRIDGE and then the Port Roles tab. The screen appears as shown. The radio buttons on th e left correspond to Ethernet ports on the front pane l of the ZyW ALL. Ports 1 to 4 are all DMZ[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 6 Bridge Sc reens 124 After you change the LAN/DMZ/WLAN port roles and click Apply , please wait for few seconds until the following screen appears. Click Return to go back to the Port Roles screen. Figure 46 Port Roles Change Complete WLAN When you have the wireless card set to WLAN , you can sele ct a [...]

ZyWALL 5/35/70 Series User’s Guide 125 Chapter 6 Bridge Screens[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 7 WAN Screens 126 C HAPTER 7 W AN Screens This chapter describes how to configure W AN settings. Multiple W AN and load balancing are not available on the ZyW ALL 5. 7.1 W AN Overview • Use the W AN Ge neral screen to configure load balanc ing, route priority and traf fic redirect properties for the Zy[...]

ZyWALL 5/35/70 Series User’s Guide 127 Chapter 7 WAN Screens Y ou can select through which W AN port you wa nt to send out traffic from UPnP-enabled applications (see Chapter 28 on page 452 ). The ZyW ALL's DDNS lets you select whic h W AN interface you want to use for each individual domain name. The DDNS high ava ilability feature lets you[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 7 WAN Screens 128 7.4.1.1 Example 1 The following figure depicts an example where both the W AN ports on the ZyW ALL are connected to the Internet. The configu red available outbound band widths for W AN 1 and W AN 2 are 512K and 256K respectively . Figure 47 Least Load First Examp le If the outbound ban[...]

ZyWALL 5/35/70 Series User’s Guide 129 Chapter 7 WAN Screens 7.4.2 W e ighted Round Robin Similar to the Round Robin (RR) algorithm, the W eighted Round Robin (WRR) algorithm set s the ZyW ALL to send traf fic through each W AN interface in turn. In addition, the W AN interfaces are assigned weights. An interface with a larger weight gets more of[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 7 WAN Screens 130 Figure 49 S pillover Algorithm Example 7.5 TCP/IP Priority (Metric) The metric represents the "cost of transmissi on". A router determines the best route for transmission by choosing a path with the lowest "cost". RI P routing u ses hop count as the measurement of co[...]

ZyWALL 5/35/70 Series User’s Guide 131 Chapter 7 WAN Screens Figure 50 W AN General[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 7 WAN Screens 132 The following table describes the labels in this screen. Table 32 WAN Gene ral LABEL DESCRIPTION Active/Passive (Fail Over) Mode Select the Active/Passive (fai l over) o peration mode to have the ZyWALL use the second highest priority W AN port as a back up. This means that the ZyW ALL [...]

ZyWALL 5/35/70 Series User’s Guide 133 Chapter 7 WAN Screens 7.7 Configuring Load Balancing T o configure load balanc ing on the ZyW ALL, click NETWORK , WA N in the navigation panel. The WA N G e n e r a l screen displays by default. Select Active/Active Mode under Operation Mode to enable load balancing on the ZyW ALL. The WA N G e n e r a l sc[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 7 WAN Screens 134 7.7.1 Least Load First T o configure Least Load First, select Least Load First in the Load Balancing Algorithm field. Figure 51 Load Balancing: Least Lo ad First The following table describes the re lated fields in this screen. Table 33 Load Balancing: Least Lo ad First LABEL DESCRIPTIO[...]

ZyWALL 5/35/70 Series User’s Guide 135 Chapter 7 WAN Screens 7.7.2 W eighted Round Robin T o load balance using the weight ed roun d robin method, s elect W eighted Round Robin in the Load Balancing Algorithm field. Figure 52 Load Balancing: W eighted Round Robin The following table describes the re lated fields in this screen. Table 34 Load Bala[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 7 WAN Screens 136 Figure 53 Load Balancing: S pillover The following table describes the re lated fields in this screen. Table 35 Load Balancing: S pillover LABEL DESCRIPTION Active/Active Mode Select Active/Active Mode and set the related fields to enable load balancing on th e ZyW ALL. Load Balancing A[...]

ZyWALL 5/35/70 Series User’s Guide 137 Chapter 7 WAN Screens Figure 54 W A N Route The following table describes the labels in this screen. Table 36 WAN Rout e LABEL DESCRIPTION Route Priority WA N T raffic Redirect Dial Backup The default WAN connection is "1' as your broadband connecti on via the WAN port should always be your p refer[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 7 WAN Screens 138 7.9 W AN IP Address Assignment Every computer on the Internet must have a unique IP address. If your networks are is olated from the Internet, for instance, only between your two branch of fices, you can assign any IP addresses to the hosts without problems. However , the Internet Assig[...]

ZyWALL 5/35/70 Series User’s Guide 139 Chapter 7 WAN Screens 1 The ISP tells you the DNS server addresses, usua lly in the form of an information sheet, when you sign up. If your ISP gives you DNS server addresses, manually enter them in the DNS server field s. 2 If your ISP dynamically assigns the DNS serve r IP addresses (along with the ZyW ALL[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 7 WAN Screens 140 Figure 55 W A N: Ethernet Encap sulation The following table describes the labels in this screen. Table 39 WAN: Ethernet Enca psulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation Y ou must choose the Etherne t option when the WAN port is used as a regular Etherne[...]

ZyWALL 5/35/70 Series User’s Guide 141 Chapter 7 WAN Screens Retype to Confirm T ype your password again to make sure that you have entered is correctly . Login Server IP Address T ype the a uthentication se rver IP a ddress here if your ISP gave you one. This field is not available for T elia Login. Login Server (T elia Login only) T ype the dom[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 7 WAN Screens 142 7.12.2 PPPoE Encap sulation The ZyW ALL supports PPPoE (Point-to-Point Pr otocol over Ethernet). PPPoE is an IETF standard (RFC 2516) specifying how a personal computer (PC) interacts with a broadband modem (DSL, cable, wireless, etc.) connection. The PP PoE option is for a dial-up conn[...]

ZyWALL 5/35/70 Series User’s Guide 143 Chapter 7 WAN Screens Operationally , PPPoE saves significant effort for bo th you and the ISP or carrier , as it requires no specific configuration of the broa dband modem at the customer site. By implementing PPPoE directly on the ZyW ALL (rather than individual computers), the computers on the LAN do not [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 7 WAN Screens 144 The following table describes the labels in this screen. Table 40 WAN: PPPoE Encapsulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation The PPPoE choice is for a dial-up connection using PPPoE. The router supports PPPoE (Point-to-Point Protocol over Ethernet). PPPo[...]

ZyWALL 5/35/70 Series User’s Guide 145 Chapter 7 WAN Screens RIP Direction RIP (Routing Information Protocol) allows a router to exchange routi ng information with other routers. The RIP Direction field control s the sending and receiving of RIP packet s. Choose Both , None , I n Only or Out On ly . When set to Both or Out Only , the ZyWALL will [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 7 WAN Screens 146 7.12.3 PPTP Encap sulation Point-to-Point T unneling Protocol (PP TP) is a ne twork protocol that enables secure transfer of data from a remote client to a private server , creating a V irtual Private Network (VPN) using TCP/IP-based networks. PP TP supp orts on-demand, multi-protoco l [...]

ZyWALL 5/35/70 Series User’s Guide 147 Chapter 7 WAN Screens The following table describes the labels in this screen. Table 41 WAN: PPTP Encapsulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation Point-to-Point T unn eling Protocol (PPT P) is a network protocol that enables secure transfer of data from a remote client to a p[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 7 WAN Screens 148 Enable NA T (Network Address T ranslation) Network Address T ranslation (NA T) allows the translation of an Internet protocol address used within one network (for exampl e a pr ivate IP address used in a local network) to a different IP address known within another network (for example [...]

ZyWALL 5/35/70 Series User’s Guide 149 Chapter 7 WAN Screens 7.13 T raffic Redirect T raffic redirect forwards W AN traffic to a backup gateway when the ZyW ALL canno t connect to the Internet through its norm al gateway . Conne ct the backup gateway on the W AN so that the ZyW ALL still provides firewall protection. Figure 58 T raffic Redirec t [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 7 WAN Screens 150 Figure 59 T raffic Redirect LAN Setup 7.14 Configuring T raffic Redirect T o change your ZyW ALL ’ s traffic redirect settings, click NETWORK , WA N and then the T raffic Redirect tab. The screen appears as shown. Not all fields are available on all models. Figure 60 T raffic Redirect[...]

ZyWALL 5/35/70 Series User’s Guide 151 Chapter 7 WAN Screens 7.15 Configuring Dial Backup Click NETWORK , WA N and then the Dial Backup tab to display the Dial Backup screen. Use this sc reen to config ure the back up W AN dial -up connec tion. Fail T olerance T ype how many W AN connection checks can fail (1 to 10) before the connection is consi[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 7 WAN Screens 152 Figure 61 Dial Backup[...]

ZyWALL 5/35/70 Series User’s Guide 153 Chapter 7 WAN Screens The following table describes the labels in this screen. Table 43 Dial Ba ckup LABEL DESCRIPTION Dial Backup Setu p Enable Dial Backup Select th is check box to turn on dial backup. Basic Settings Login Name T ype the login name a ssigned by your ISP . Password T ype the password assign[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 7 WAN Screens 154 Enable RIP Select this check box to turn on RIP (Rout in g Information Protocol), which allows a router to exchange routing in formatio n with other routers. RIP V ersion Th e RIP V ers ion field controls the format and the broadcasting method of the RIP packets that the ZyW ALL sends ([...]

ZyWALL 5/35/70 Series User’s Guide 155 Chapter 7 WAN Screens 7.16 Advanced Modem Setup 7.16.1 A T Command Strings For regular telephone lines, the default Dial st ring tells the modem that the line uses tone dialing. ATDT is the command for a switch that requ ires tone dialing. If your switch requires pulse dialing, change th e string to ATDP . F[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 7 WAN Screens 156 Figure 62 Advanced Setup The following table describes the labels in this screen. Table 44 Advanced Setu p LABEL DESCRIPTION A T Command St r i n g s Dial T ype the A T Command string to make a call. Drop T ype the A T Command string to drop a ca ll. "~" represents a one secon[...]

ZyWALL 5/35/70 Series User’s Guide 157 Chapter 7 WAN Screens Dial T imeout (sec) T ype a number of seconds for the ZyWALL to try to set up an outgoing call before timing out (sto pping). Retry Count T ype a number of times for the ZyW ALL to retry a busy or no-answer phone number before blacklisting th e number . Retry Interval (sec) T ype a numb[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 8 DMZ Scree ns 158 C HAPTER 8 DMZ Screens This chapter describes how to configure the ZyW ALL ’ s DMZ. 8.1 DMZ The DeMilitarized Zone (DMZ) pr ovides a way for public servers (W eb, e-mail, FTP , etc.) to be visible to the outside world (while still being protected from DoS (Denial of Service) attacks [...]

ZyWALL 5/35/70 Series User’s Guide 159 Chapter 8 DMZ Screens Figure 63 DMZ The following table describes the labels in this screen. Table 45 DMZ LABEL DESCRIPTION DMZ TCP/IP IP Address T ype the IP address of your ZyWALL ’s DMZ port in dotted decimal notation. Note: Make sure the IP addresses of the LAN, W AN, WLAN and DMZ are on separate subne[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 8 DMZ Scree ns 160 RIP V ersion The RIP V ersion fiel d controls the format an d the broadcasting me thod of the RIP packets that the ZyW ALL sends (it recognizes both formats when receiving). RIP- 1 is universally supported but RIP-2 carries more informa tion. RIP-1 is probably adequate for most network[...]

ZyWALL 5/35/70 Series User’s Guide 161 Chapter 8 DMZ Screens 8.3 DMZ S t atic DHCP This table allows you to assign IP addresses on the DMZ to specific individual computers based on their MAC Addresses. Every Ethernet device has a unique MAC (Med ia Access Control) addre ss. The MAC address is assigned at the factory and consists of six pairs of h[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 8 DMZ Scree ns 162 Figure 64 DMZ S tatic DHCP The following table describes the labels in this screen. T able 46 DMZ S tatic DHCP LABEL DESCRIPTION # This is the index number of th e St atic IP table entry (row). MAC Address T ype the MAC address of a computer on your DMZ. IP Address T ype the IP address[...]

ZyWALL 5/35/70 Series User’s Guide 163 Chapter 8 DMZ Screens 8.4 DMZ IP Alias IP alias allows you to partition a physical network into dif fer ent logical networks over the same Ethernet interface. The ZyW ALL supports three logical DMZ interfa ces via it s single physical Ethernet interface with the ZyW ALL itself as the gateway for each DMZ net[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 8 DMZ Scree ns 164 8.5 DMZ Public IP Address Example The following figure shows a simple network set up with public IP addresses on the W AN and DMZ and private IP addresses on the LAN. Lowe r case letters represent public IP addresses (like a.b.c.d for example). The LAN port and co nnected computers (A [...]

ZyWALL 5/35/70 Series User’s Guide 165 Chapter 8 DMZ Screens Figure 66 DMZ Public Addr ess Example 8.6 DMZ Private and Public IP Address Example The following figure shows a network setup with both private and public IP addresses on the DMZ. Lower case letters represent public IP addresses (like a.b.c.d for example). The LAN port and connected co[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 8 DMZ Scree ns 166 Figure 67 DMZ Private and Public Address Example 8.7 DMZ Port Roles Use the Port R oles screen to set ports as LAN , DMZ or WLAN interfaces. The LAN port role is not available on all models. Connect wireless LAN Access Points (APs) to WLAN interfaces to extend the ZyW ALL ’ s wireles[...]

ZyWALL 5/35/70 Series User’s Guide 167 Chapter 8 DMZ Screens Figure 68 WLAN Port Role Example Note: Do the following if you are configuring fro m a computer connected to a LAN, DMZ or WLAN port and changing the port's role: 1. A port's IP address varies as its role changes, make sure your computer's IP address is in the same subnet[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 8 DMZ Scree ns 168 Figure 69 DMZ: Port Roles The following table describes the labels in this screen. Table 48 DMZ: Port Roles LABEL DESCRIPTION LAN Select a port’s LAN radio button to use th e port as p art of the LAN. The port will use the LAN IP address and MAC address. DMZ Select a port’s DMZ rad[...]

ZyWALL 5/35/70 Series User’s Guide 169 Chapter 8 DMZ Screens[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 9 Wireles s LAN 170 C HAPTER 9 W ireless LAN This chapter discusses how to conf igure wireless LAN on the ZyW ALL. 9.1 Wireless LAN Introduction A wireless LAN can be as simple as two computers with wireless LAN adapters communicating in a peer-to-p eer network or as complex as a number of computers with[...]

ZyWALL 5/35/70 Series User’s Guide 171 Chapter 9 Wireless LAN Figure 70 WLAN The following table describes the labels in this screen. T able 49 WLAN LABEL DESCRIPTION WLAN TCP/I P IP Address T ype the IP address of your ZyWALL ’s WL AN interface in dotted decimal notation. Alternatively , click the right mouse button to copy and/or paste the IP[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 9 Wireles s LAN 172 RIP V ersion The RIP V ers ion field controls the format and t he broadcasting method of the RIP packets that the ZyW ALL sends (it reco gnizes both formats when receiv ing). RIP-1 is universally supported but RIP-2 carries more information. RIP-1 is probably adequate for most network[...]

ZyWALL 5/35/70 Series User’s Guide 173 Chapter 9 Wireless LAN 9.3 WLAN S t atic DHCP This table allows you to assign IP addresses on the WLAN to specific individual computers based on their MAC addresses. Every Ethernet device has a unique MAC (Med ia Access Control) addre ss. The MAC address is assigned at the factory and consists of six pairs o[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 9 Wireles s LAN 174 Figure 71 WLAN S tatic DHCP The following table describes the labels in this screen. T able 50 WLAN S tatic DHCP LABEL DESCRIPTION # This is the index number of th e St atic IP table entry (row). MAC Address T ype the MAC address of a computer on your WLAN. IP Address T ype the IP add[...]

ZyWALL 5/35/70 Series User’s Guide 175 Chapter 9 Wireless LAN When you use IP alias, you can also configur e firewall rules to control access between the WLAN's logical networks (subnets). Note: Make sure that the subnet s of the logical networks do not overlap . T o change your ZyW ALL ’ s IP alias settings, click NETWORK , WLAN and then [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 9 Wireles s LAN 176 9.5 WLAN Port Roles Use the Port R oles screen to set ports as LAN , DMZ or WLAN interfaces. The LAN port role is not available on all models. Connect wireless LAN Access Points (APs) to WLAN interfaces to extend the ZyW ALL ’ s wireless LAN coverage. The WLAN port role allows the Z[...]

ZyWALL 5/35/70 Series User’s Guide 177 Chapter 9 Wireless LAN Note: Do the following if you are configuring fro m a computer connected to a LAN, DMZ or WLAN port and changing the port's role: 1. A port's IP address varies as its role changes, make sure your computer's IP address is in the same subnet as t he ZyW ALL's LAN, DMZ[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 9 Wireles s LAN 178 After you change the LAN/DMZ/WLAN port roles and click Apply , please wait for few seconds until the following screen appears. Click Return to go back to the Port Roles screen. Figure 75 WLAN Port Roles Change Complete 9.6 Wireless Security W ireless security is vital to your network [...]

ZyWALL 5/35/70 Series User’s Guide 179 Chapter 9 Wireless LAN Figure 76 ZyW ALL Wireless Security Levels If you do not enable any wireless security on your ZyW ALL, your network is acc essible to any wireless networki ng device that is within range. Use the ZyW ALL web configurator to set up yo ur wireless LAN security settings. Refer to the chap[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 9 Wireles s LAN 180 9.6.3 Restricted Access The MAC Filter screen allows you to configure the AP to give exclusive access to devices ( Allow Association ) or exclude them from accessing the AP ( Deny Association ). 9.6.4 Hide ZyW ALL Identity If you hide the ESSID, then the ZyW ALL cannot be seen when a [...]

ZyWALL 5/35/70 Series User’s Guide 181 Chapter 9 Wireless LAN 9.9 802.1x Overview The IEEE 802.1x standard outlines enhanced security methods for both the authentication of wireless stations and encryption key manageme nt. Authentication can be done using the local user database inte rnal to the ZyW ALL (authenticat e up to 32 users) or an extern[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 9 Wireles s LAN 182 Sent by the RADIUS server to indicate th at it has started or stopped accounting. In order to ensure network security , the access point and the RADIUS server use a shared secret key, which is a password, they both know . The key is not sent ov er the network. In addition to the share[...]

ZyWALL 5/35/70 Series User’s Guide 183 Chapter 9 Wireless LAN If this feature is enabled, it is not necessary to configure a defau lt encryption key in the Wir eless Card screen (see Section 9.16.4 on page 192 ). Y ou may still configure and store keys here, but they will not be u sed while dynamic WEP is enabled. T o use dynamic WEP , enable and[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 9 Wireles s LAN 184 TKIP regularly changes and rotates the encryp tion keys so that the same encryption key is never used twice. The RADIUS server distribut es a Pairwise Master Key (PMK) key to the AP that then sets up a key hierarchy and mana gement system, using the pair-wise key to dynamically gene r[...]

ZyWALL 5/35/70 Series User’s Guide 185 Chapter 9 Wireless LAN Figure 78 WP A-PSK Authentication 9.13 Introduction to RADIUS The ZyW ALL can use an external RADIUS serv er to authenticate an unlimited number of users. RADIUS is based on a client-sever mo del that supports authe n tication and accounting, where access point is the client and the se[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 9 Wireles s LAN 186 Figure 79 WP A with R ADIUS Application Example 9.15 Wireless Client WP A Supplicant s A wireless client supplicant is the software that runs on an operating system instructing the wireless client how to use WP A. At the time of writing, the mo st widely availa ble supplicants are the[...]

ZyWALL 5/35/70 Series User’s Guide 187 Chapter 9 Wireless LAN Figure 80 Wirel ess Card: No Security The following table describes the labels in this screen. T able 54 Wireless Card: No Security LABEL DESCRIPTION Enable Wireless Card The wireless LAN is turned off by defaul t, before you enable the wireless LAN you should configure some security b[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 9 Wireles s LAN 188 9.16.1 S t atic WEP St atic WEP provides a mechanism for encrypting data using encryption keys. Both the AP and the wireless stations must use the same WEP key to encrypt and decrypt data. Y our ZyW ALL allows you to configure up to fou r 64-bit or 128-bit WEP keys, b ut only one key [...]

ZyWALL 5/35/70 Series User’s Guide 189 Chapter 9 Wireless LAN Figure 81 Wireless Card: S tatic WEP The following table describes the wireless LAN security labels in this screen. T able 55 Wireless Card: St atic WEP LABEL DESCRIPTION Security Select St atic WEP from the d rop-down list. WEP Encryption WEP (Wired Equivalent Priva cy) provides data [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 9 Wireles s LAN 190 Figure 82 Wireless Card: WP A-PSK The following wireless LAN security fiel ds become available when you select WP A-PSK in the Security drop down list-bo x. T able 56 Wireless Card: WP A-PSK LABEL DESCRIPTION Security Select WP A-PSK from the drop-down list. Pre-Shared Key The encryp [...]

ZyWALL 5/35/70 Series User’s Guide 191 Chapter 9 Wireless LAN 9.16.3 WP A Click the NETWORK and WIRELESS CAR D to display the Wire l es s Card screen. Select WP A from the Security list. Figure 83 Wireless Card: WP A The following wireless LAN security fiel ds become available when you select WP A in the Security drop down list-b ox. T able 57 Wi[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 9 Wireles s LAN 192 9.16.4 IEEE 802.1x + Dynamic WEP Click the NETWORK and WIRELESS CAR D to display the Wire l es s Card screen. Select 802.1x + Dy namic WEP from the Security list. Figure 84 Wireless Card: 802.1x + Dynamic WEP The following wireless LAN security fiel ds become available when you select[...]

ZyWALL 5/35/70 Series User’s Guide 193 Chapter 9 Wireless LAN 9.16.5 IEEE 802.1x + St atic WEP Click the NETWORK and WIRELESS CAR D to display the Wire l es s Card screen. Select 802.1x + S tatic WEP from the Security list. Figure 85 Wireless Card: 802.1x + S tatic WEP The following wireless LAN security fiel ds become available when you select 8[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 9 Wireles s LAN 194 9.16.6 IEEE 802.1x + No WEP Click the NETWORK and WIRELESS CAR D to display the Wire l es s Card screen. Select 802.1x + No WEP from the Security list. Figure 86 Wireless Card: 802.1x + No WEP ReAuthentication T imer (Seconds) S peci fy how often wireless stations have to resend user [...]

ZyWALL 5/35/70 Series User’s Guide 195 Chapter 9 Wireless LAN The following wireless LAN security fiel ds become available when you select 802.1x + No WEP in the Security drop down list-box. T able 60 Wireless Card: 802.1x + No WEP LABEL DESCRIPTION Security Select 802.1x + No WEP from the d rop-down list. ReAuthentication T imer (Seconds) S peci[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 9 Wireles s LAN 196 The following wireless LAN security fiel ds become available when you select No Acce ss 802.1x + S tatic WEP in the Security drop down list-box. T able 61 Wireless Card: No Access 802.1x + S tatic WEP LABEL DESCRIPTION Security Select No Access 802.1x + St atic WEP from the drop-down [...]

ZyWALL 5/35/70 Series User’s Guide 197 Chapter 9 Wireless LAN Figure 88 Wireless Card: MAC Address Filter The following table describes the labels in this menu. T able 62 Wireless Card: MAC Address Filter LABEL DESCRIPTION Active Select or clear the check box to e nable or disable MAC address filter ing. Enable MAC address filtering to have the r[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 10 Firewalls 198 C HAPTER 10 Firewalls This chapter gives some back ground information on firewa lls and introduces the ZyW ALL firewall. 10.1 Firewall Overview Originally , the term firewall referred to a construction techni que designed to prevent the spread of fire from one room to another . The ne tw[...]

ZyWALL 5/35/70 Series User’s Guide 199 Chapter 10 Firewalls 1 Information hiding prevents the names of internal systems from being made known via DNS to outside systems, since the applicatio n gateway is the only host whose name must be made known to outside systems. 2 Robust authentication and logging pre-authenticates application traffic before[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 10 Firewalls 200 Figure 89 ZyW ALL Firewall Application 10.4 Denial of Service Denials of Service (DoS) attacks are aimed at devices and networks w ith a connection to the Internet. Their goal is not to st eal information, but to disabl e a device or netwo rk so users no longer have access to network res[...]

ZyWALL 5/35/70 Series User’s Guide 201 Chapter 10 Firewalls 10.4.2 T ypes of DoS Attacks There are four types of DoS attacks: 1 Those that exploit bugs in a TCP/IP implementation. 2 Those that exploit weaknesses in the TCP/IP specification. 3 Brute-force attacks that flood a network with useless data. 4 IP Spoofing. •" Ping of Death "[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 10 Firewalls 202 response. While the targeted system waits for the ACK that follows the SYN-ACK, it queu es up all outstandin g SYN-ACK responses on what is known as a backlog queu e. SYN-ACKs are moved off the queue only when an ACK comes b ack or when an internal timer (which is set at relatively long [...]

ZyWALL 5/35/70 Series User’s Guide 203 Chapter 10 Firewalls Figure 92 Smurf Attack 10.4.2.1 ICMP V ulnerability ICMP is an error -reporting protocol that works in concert with IP . The following ICMP types trigger an alert: T able 64 ICMP Commands That T rigger Alert s 5 REDIRECT 13 TIMEST AMP_REQUEST 14 TIMEST AMP_REPL Y 17 ADDRESS_MASK_REQUEST [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 10 Firewalls 204 All SMTP commands are illegal except for tho se displayed in the following tables. T able 66 Legal SMTP Commands AUTH DA T A EHLO ETRN EXPN HELO HELP MAIL NOOP QUIT RCPT RSET SAML SEND SOML TURN VRFY 10.4.2.3 T raceroute T raceroute is a utility used to determine th e path a packet takes[...]

ZyWALL 5/35/70 Series User’s Guide 205 Chapter 10 Firewalls Figure 93 S tateful Inspection The previous figure shows the ZyW ALL ’ s de fault firewall rules in action as well as demonstrates how stateful inspection works. User A can initiate a T elnet session from within the LAN and responses to this request are allowe d. However other T elnet [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 10 Firewalls 206 temporary entries might be modified, in order to permit only packets that are valid for the current state o f the conn ection. 8 Any additional inbound or outb ound packets that belong to the connection are inspected to update the state table entry and to modify the temporary inbound acc[...]

ZyWALL 5/35/70 Series User’s Guide 207 Chapter 10 Firewalls If an initiation packet originates on the LAN, this means that someone is trying to make a connection from the LAN to the In ternet. Assuming that this is an acceptable part of the security policy (as is the case w ith the default policy), the connection will be allowed. A cache entry is[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 10 Firewalls 208 Any protocol that operates in this way must be supported on a case-by-case bas is. Y ou can use the web configurat or’ s Custom Services feature to do this. 10.6 Guidelines For Enhancing Security With Y our Firewall 1 Change the default password via SMT or web configurator. 2 Think abo[...]

ZyWALL 5/35/70 Series User’s Guide 209 Chapter 10 Firewalls 10.7.2 Firewall • The firewall inspects packet contents as well as their source and destination addresses. Firewalls of this type employ an inspection module, appl icable to all protocols, that understands data in the packet is intended for other laye rs, from the network layer (IP hea[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 11 Fi rewall Sc reens 210 C HAPTER 11 Firewall Screens This chapter shows you how to configure your ZyW ALL firewall. 1 1.1 Access Methods The web configurator is, by far , the most co mprehensive firewall configuration tool your ZyW ALL has to offer . For this reason, it is recommended that you con figu[...]

ZyWALL 5/35/70 Series User’s Guide 211 Chapter 11 Fi rewall Screens • WLAN to W AN By default, the ZyW ALL ’ s stateful pa cket insp ection drops packets travel ing in the following directions: •W A N t o L A N • W AN to W AN/ZyW ALL This prevents computers on the W AN from using the ZyW ALL as a gateway to communicate with other computer[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 11 Fi rewall Sc reens 212 1 1.3 Rule Logic Overview Note: S tudy these point s carefully before configuring rules. 1 1.3.1 Rule Checklist 1 Stat e the intent of the rule. For example, Th is restricts all IRC acce ss from the LAN to the Internet. Or , This allows a remote Lotus Note s server to synchroniz[...]

ZyWALL 5/35/70 Series User’s Guide 213 Chapter 11 Fi rewall Screens 1 1.3.3 .2 Service Select the service from the Service scrolling list box. If the service is not listed, it is necessary to first define it. See Section 1 1.1 1.2 on page 229 for more information on predefined services. 1 1.3.3.3 Source Address What is the connection’ s source [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 11 Fi rewall Sc reens 214 Figure 94 LAN to W AN Traf fic 1 1.4.2 W A N T o LAN Rules The default rule for W AN to LAN traffic bloc ks all incoming connections (W AN to LAN). If you wish to allow certain W AN users to have access to your LAN, you will need to create custom rules to allow it. See the follo[...]

ZyWALL 5/35/70 Series User’s Guide 215 Chapter 11 Fi rewall Screens 1 1.6 Firewall Default Rule (Router Mode) Click SECURITY , FIREW ALL to open the Default Rule screen. Enable (or activate) the firewall by selecting the Enable Fir e wall check box. Use this screen to configure general firewall sett ings when the ZyW ALL is set to router mode. Fi[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 11 Fi rewall Sc reens 216 1 1.7 Firewall Default Rule (Bridge Mode) Click SECURITY , FIREW ALL to open the Default Rule screen. Enable (or activate) the firewall by selecting the Enable Fir e wall check box. Use this screen to configure gene ral firewall settings when the ZyW ALL is set to bridge mode. P[...]

ZyWALL 5/35/70 Series User’s Guide 217 Chapter 11 Fi rewall Screens Figure 97 Default Rule (Bri dge Mode) The following table describes the labels in this screen. T able 68 Default Rule (Bridge Mode) LABEL DESCRIPTION Enable Firewall Select this check box to activate the fi rewall. The ZyW ALL performs access control and protects against Denial o[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 11 Fi rewall Sc reens 218 1 1.8 Firewall Rule Summary Click SECURITY , FIREW ALL , then the Rule Summary tab to open the screen. This screen displays a list of the co nfigured firewall rules. Note: The ordering of your rule s is very import ant as rules are applie d in turn. Figure 98 Rule Summary The fo[...]

ZyWALL 5/35/70 Series User’s Guide 219 Chapter 11 Fi rewall Screens 1 1.8.1 Firewall Edit Rule Follow these directions to create a new rule. 1 In the Rule Summary screen, type the index number for where you want to put the rule. For example, if you type 6, your ne w rule becomes nu mber 6 and the previous rule 6 (if there is one) becomes rule 7. [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 11 Fi rewall Sc reens 220 Figure 99 Firewall Edit Rule[...]

ZyWALL 5/35/70 Series User’s Guide 221 Chapter 11 Fi rewall Screens The following table describes the labels in this screen. T able 70 Firewall Edit Rule LABEL DESCRIPTION Rule Name Enter a descriptive name of up to 31 printable ASCII characters (except Extende d ASCII characters) for the firewall rule. S paces are allowed. Edit Source/ Destinati[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 11 Fi rewall Sc reens 222 1 1.9 Anti-Probing If an outside user attempts to probe an unsupp orted port on your ZyW ALL, an ICMP response packet is automatically return ed. This allows the outside user to know the ZyW ALL exists. The ZyW ALL supports anti-probing, which prev ents the ICMP response packet [...]

ZyWALL 5/35/70 Series User’s Guide 223 Chapter 11 Fi rewall Screens 1 1.10 Firewall Threshold In the Threshold screen, shown later , you m ay choose to generate an alert whenever an attack is detected. For DoS attacks, the ZyW ALL uses th resholds to determine when to drop sessions that do not become fully established. These thresholds apply glob[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 11 Fi rewall Sc reens 224 When the rate of new connection a ttempts rises above a threshold ( one-minute high ), the ZyW ALL starts deleting half-open se ssions as required to accommo date new connection requests. The ZyW ALL con tinues to delete half-open session s as necessary , until the rate of new c[...]

ZyWALL 5/35/70 Series User’s Guide 225 Chapter 11 Fi rewall Screens Figure 101 Firewall Threshold The following table describes the labels in this screen. T able 72 Firewall Threshold LABEL DESCRIPTION Disable DoS Attack Protection on Select the check box of an interface to which the ZyWALL does not apply the thresholds. This disables DoS pr otec[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 11 Fi rewall Sc reens 226 1 1.1 1 Service Click SECURITY , FIREW ALL , then the Service tab to open the screen as shown next. Use this screen to configure custom services for use in firewall rules or view the services that are predefined in the ZyW A LL. Maximum Incomplete High This is the number of exis[...]

ZyWALL 5/35/70 Series User’s Guide 227 Chapter 11 Fi rewall Screens Figure 102 Firewall Service The following table describes the labels in this screen. T able 73 Firewall Service LABEL DESCRIPTION Custom Service This table shows all configured custom services. # This is the index number of the custom service. Service Name This is the name of the[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 11 Fi rewall Sc reens 228 1 1.1 1.1 Firewall Edit Custom Service Configure customized ports for serv ices not predefined by the ZyW ALL (see Section 1 1.1 1.2 on page 229 for a list of predefined services) . For a comprehensive list of port numbers, ICMP type/code numbers and services, visit the IA NA (I[...]

ZyWALL 5/35/70 Series User’s Guide 229 Chapter 11 Fi rewall Screens 1 1.1 1.2 Predefined Services The Pr edefined Services table in the Service screen displays all predefined services that the ZyW ALL already supports. Next to the name of the service, two fields appear in bracke ts. The first field indicates the IP protocol type (TCP , UDP , or I[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 11 Fi rewall Sc reens 230 IMAP(TCP/UDP:143) Internet Message Access Protocol (IMAP) is us ed to access mail stored on a remo te mail serve r over a TCP/IP connection using port 143. IMAP has shorter response times than POP3. IMAPS(TCP/UDP:993) IMAP over TLS/SSL (IMAPS) is a secure protocol (that encrypts[...]

ZyWALL 5/35/70 Series User’s Guide 231 Chapter 11 Fi rewall Screens 1 1.12 Example Firewall Rule The following Internet firewa ll rule example allows a hypot hetical My Service connection from the Internet. 1 In the Service screen, click Add to open th e Edit Custom Service screen. SIP-V2(UDP:5060) The Session Initiation Protocol (SIP) is an appl[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 11 Fi rewall Sc reens 232 Figure 104 Service 2 Configure it as follows and click Apply . Figure 105 Edit Custom Service Example 3 Click the Rule Summary tab. Select WA N t o L A N from the Packet Dir ection drop- down list bo x. 4 In the Rule Summary screen, type the index number for where you want to pu[...]

ZyWALL 5/35/70 Series User’s Guide 233 Chapter 11 Fi rewall Screens Figure 106 Rule Summary 6 Enter the name of the firewall rule. 7 Select Any in the Destination Address(es) box and then click Delete . 8 Configure the destination address screen as follows and click Add . Figure 107 Rule Edit Example 9 In the Edit Rule screen, use the arrows betw[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 11 Fi rewall Sc reens 234 Note: Custom services show up with an * before their names in the Services list box and the Rule Summary list box. Figure 108 My Service Rule Configuration[...]

ZyWALL 5/35/70 Series User’s Guide 235 Chapter 11 Fi rewall Screens Figure 109 My Service Example Rule Summary Rule 1: Allows a My Service conn ection from the W AN to IP addresses 10.0.0.10 through 10.0.0.1 5 on the LAN.[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 12 Intrusion Detectio n and Prevention (IDP) 236 C HAPTER 12 Intrusion Detection and Prevention (IDP) This chapter introduces some ba ckground information o n IDP . Sk ip to the next chapter to see how to configure IDP on your ZyW ALL. 12.1 Introduction to IDP An IDP system can detect malicious or suspic[...]

ZyWALL 5/35/70 Series User’s Guide 237 Chapter 12 Intrusion Detection and Pr evention (IDP) Firewalls are usually deployed at the n etwork edge. However , many attacks (inadvertently) are launched from within an or ganization. V irtua l private networks (VP N), removable storage devices and wireless networks ma y all provide access to the interna[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 12 Intrusion Detectio n and Prevention (IDP) 238 12.1.5 Example Intrusions The following are some examples of intrusions. 12.1.5.1 SQL Slammer Worm W32.SQLExp.W orm is a worm that targ ets the systems running Microsoft SQL Server 2000, as well as Microsoft Desktop Engine (MSDE) 2000. The worm sends 37 6 [...]

ZyWALL 5/35/70 Series User’s Guide 239 Chapter 12 Intrusion Detection and Pr evention (IDP) 12.1.5.4 MyDoom MyDoom W32.Mydoom.A @mm (also known as W32.Novar g.A) is a mass-mailing worm that arrives as an attachment with an bat, cmd, exe, pif, scr , or zip file extension. When a computer is infected, the worm sets up a bac k door into the sy stem [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 13 Configuring IDP 240 C HAPTER 13 Configuring IDP This chapter shows you how to configure IDP on the Zy W ALL. 13.1 Overview T o use IDP on the ZyW ALL, you need to insert the ZyW ALL T urbo Card into the rear panel slot of the ZyW ALL. See the ZyW ALL T urbo Card guide for details. Note: The ZyW ALL ha[...]

ZyWALL 5/35/70 Series User’s Guide 241 Chapter 13 Configuring IDP Figure 1 1 1 Applying IDP to Interf aces 13.2 General Setup Use this scr een to enab le IDP on the ZyW ALL and choose what inte rface(s) you wan t to protect from intrusions. Click IDP from the navigation panel. General is the first screen as shown in the following figure.[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 13 Configuring IDP 242 Figure 1 12 IDP: General The following table describes the labels in this screen. Table 76 IDP: General Se tup LABEL DESCRIPTION General Setup Enable Intrusion Detection and Protection Select this check box to enable IDP on the ZyWALL. When this check box is cleared the ZyW ALL is [...]

ZyWALL 5/35/70 Series User’s Guide 243 Chapter 13 Configuring IDP T o see signatures lis ted by intrusion type supp orted by the ZyW ALL, sele ct that type from the Attack T ype list box. Figure 1 13 Attack T ypes The following table descr ibes each attack type. Table 77 Attack Types T YPE DESCRIPTION DoS/DDoS The goal of Denial of Service (DoS) [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 13 Configuring IDP 244 13.3.2 Intrusion Severity Intrusions are assigned a severity level based on the following table. The intrusion severity level then determines the default signature action. Table 78 Intrusion Severity SEVERITY DESCRIPTION Severe These are intrusions that try to run ar bitrary code o[...]

ZyWALL 5/35/70 Series User’s Guide 245 Chapter 13 Configuring IDP Figure 1 14 Signature Actions The following table describes signature actions. Table 79 Signature Actio ns ACTION DESCRIPTION No Action The intrusion is detected but no action is taken. Drop Packet The packet is silently discarded. Drop Session When the firewall is enabled, subsequ[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 13 Configuring IDP 246 Figure 1 15 IDP: Signatures The following table describes the labels in this screen. T able 80 IDP Signatures: Group V iew LABEL DESCRIPTION Signature Groups Attack T ype Select the type of signatures you want to view from the list box. See Section 13.3.1 on page 242 for informatio[...]

ZyWALL 5/35/70 Series User’s Guide 247 Chapter 13 Configuring IDP 13.3.5 Query View Click IDP in th e navigation pane l and then click the Signatur es tab to see the ZyW ALL ’ s “group view” signature screen, then click the Switch to query view link to go to this ‘query view” screen. In this screen you can search for signatures based on[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 13 Configuring IDP 248 Note: A partial name may be searched but a complete ID number must be entered before a match can be found. For exa mple, a search by name for “w” (in the first example) finds all intrusions that cont ain this letter in the name field. However a search by ID for “1” would re[...]

ZyWALL 5/35/70 Series User’s Guide 249 Chapter 13 Configuring IDP Figure 1 17 Signature Query by Comple te ID 13.3.5.2 Query Example 2 1 From the “group view” signature screen, click the Switch to query view link. 1 Select Signature Sear ch By Attributes . 2 Select the Severity , Ty p e , Platform , Active , Log , Alert and/or Action items. I[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 13 Configuring IDP 250 Figure 1 18 Signature Query by Attribute. 13.4 Up date The ZyW ALL comes with built-in signatures cr eated by the ZyXEL Security Response T e am (ZSR T). These are regularly updated as new intrusions evolve. Use the Update screen to immediately download or schedule new signature do[...]

ZyWALL 5/35/70 Series User’s Guide 251 Chapter 13 Configuring IDP 13.4.2 Configuring IDP Up date When scheduling signatu re updates, you shou ld choose a day and time when your network is least busy so as to minimize disru ption to your network. Y our custom signature configurations are not over-written when you download new signatures. File-base[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 13 Configuring IDP 252 The following table describes the labels in this screen. Table 81 Signatures Update LABEL DESCRIPTION Signature Information Current Patt ern Ve r s i o n This field displays the signatures vers ion numb er currently used by the ZyWALL. This number is defined by the ZyXEL Security R[...]

ZyWALL 5/35/70 Series User’s Guide 253 Chapter 13 Configuring IDP 13.5 Backup and Restore Y ou can change the pre-defined Active , Log , Alert and/or Action settings of individual signatures. Figure 120 IDP: Backup & Restore Use the Backup & Restore screen to: • Back up IDP signatures with your custom configured settings. Click Backup a[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 14 Anti-Virus 254 C HAPTER 14 Anti-V irus This chapter introduces and shows you how to configure th e anti-virus scanner . 14.1 Anti-V irus Overview A computer virus is a small program designed to corrupt and/or alter the o peration of other legitimate programs. A worm is a self-replicating virus that re[...]

ZyWALL 5/35/70 Series User’s Guide 255 Chapter 14 Anti-Virus 2 The virus spreads to other files and programs on the computer . 3 The infected files are uninten tionally sent to another computer thus starting the spread of the virus. 4 Once the virus is spread through the network, the number of infected networked computers can grow exponentially .[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 14 Anti-Virus 256 14.2.1 How the ZyW ALL Anti-V irus Sc anner W orks The ZyW ALL checks traf fic going to the inte rface(s) you specify for signature matches. Figure 121 ZyW ALL Anti-virus Example The following describes the virus scanning process on the ZyW ALL. 1 The ZyW ALL first identifies SMTP , POP[...]

ZyWALL 5/35/70 Series User’s Guide 257 Chapter 14 Anti-Virus 1 The ZyW ALL anti-virus scanner canno t detect po lymorphic viruses. 2 The ZyW ALL does not scan th e following file/traffic types: • Simultaneou s downloads of a file using multiple connections. For example, w hen you use FlashGet to download sections of a file simultaneously . • [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 14 Anti-Virus 258 The following table describes the labels in this screen. Table 83 Anti-V irus: General LABEL DESCRIPTION General Setup Enable Anti-Virus Select Enable Anti-V irus to activate the anti-virus feature on the ZyW ALL. Cle ar this check box to disable it. Note: Before you use the anti-virus [...]

ZyWALL 5/35/70 Series User’s Guide 259 Chapter 14 Anti-Virus Note: Y ou should have already registered the ZyW ALL at myZyXEL.com (http:// www .myzyxel.com/myzyxel/) and also have ei ther activa ted the trial license or standard license (iCard). If your license has expired, you will have t o renew it before updates are allowed. 14.4.1 mySecurity [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 14 Anti-Virus 260 Figure 123 Anti-Virus: Up date The following table describes the labels in this screen. Table 84 Anti-V irus: Update LABEL DESCRIPTION Signature Information Current Patt ern Ve r s i o n This field displays the signatures vers ion numb er currently used by the ZyWALL. This number is def[...]

ZyWALL 5/35/70 Series User’s Guide 261 Chapter 14 Anti-Virus Update Now Cl ick this button to begin downloading signatures from the Update Server immediately . Auto Update Sel ect the check box to configure a sched ule for automati c signature updates. The Hourly , Daily and Weekly fields display when the check box is selected. The ZyW ALL then a[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 15 Anti-S pam 262 C HAPTER 15 Anti-S p am This chapter covers how to use the ZyW ALL ’ s anti-spam feature to deal with junk e-mail (spam). 15.1 Anti-S p am Overview The ZyW ALL ’ s anti-spam featur e identifies unsolicited commer cial or ju nk e-mail (spam). Y ou can set the ZyW ALL to mark or disca[...]

ZyWALL 5/35/70 Series User’s Guide 263 Chapter 15 Anti-Spa m 15.1.1.1 Sp amBulk Engine The e-mail fingerprint ID that the ZyW ALL gene rates and sends to the anti-spam external database only includes the parts of the e-mail that are the most difficult for spammers (senders of spam) to change or fake. The anti-spam exte rnal database maintain s a [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 15 Anti-S pam 264 15.1.1.4 Sp amT ricks Engine The SpamT ricks engine checks for the tactics th at spammers use to minimize the expens e of sending lots of e-mail and tactics that they use to bypass spam filters. Use of relays, image-only e-mails, manipulati on of mail formats and HTML obfuscation are co[...]

ZyWALL 5/35/70 Series User’s Guide 265 Chapter 15 Anti-Spa m The anti-spam external database checks for spoofing of e-mail attributes (like the IP address) and uses statistical analys is to dete ct phishing. 15.1.4 Whitelist Configure whitelist entries to identify legitim ate e-mail . The whitelist entries have the ZyW ALL classify any e-mail tha[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 15 Anti-S pam 266 15.1.7 MIME Headers MIME (Multipurpose Internet Ma il Extensions) allows varied me di a types to be used in e- mail. MIME headers describe an e-mail’ s cont ent encoding and type. F or example, i t may show which program ge nerated the e-mail and what type of text is used in the e-mai[...]

ZyWALL 5/35/70 Series User’s Guide 267 Chapter 15 Anti-Spa m The following table describes the labels in this screen. Table 85 Anti-Spam: General LABEL DESCRIPTION General Setup Enable Anti-spam Select this check box to en able the anti-spam feature. Note: The anti-spam featu re checks all SMTP and POP3 e- mail going through the ZyW ALL, regardle[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 15 Anti-S pam 268 Figure 126 Anti-S pam: Externa l DB The following table describes the labels in this screen. Table 86 Anti-Spam: External DB LABEL DESCRIPTION External Database Enable External Database Enable the anti -spam external databas e feature to have the ZyWALL calculate a digest of an e-mail a[...]

ZyWALL 5/35/70 Series User’s Guide 269 Chapter 15 Anti-Spa m 15.4 Anti-S p am List s Screen Click SECURITY , ANTI-SP A M , Lists to display the Anti-Spam Lists screen. Configure the whitelist to identify legitimate e- mail. Configure the blac klist to id entify spam e-mail. Y ou can cre ate whitelist or blacklist entr ies based on the sender ’ [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 15 Anti-S pam 270 Figure 127 Anti-S pam: Lists The following table describes the labels in this screen. Table 87 Anti-S pam: List s LABEL DESCRIPTION Resource Usage Whitelist & Blacklist S torage Sp ace in Use This bar displays the percentage of the ZyWALL ’s anti-spam whitelist and blacklist stora[...]

ZyWALL 5/35/70 Series User’s Guide 271 Chapter 15 Anti-Spa m 15.5 Anti-S p am Rule Edit Screen Click SECURITY , ANTI-SP A M , Lists to display the Anti-Spam Lists screen. T o create a new anti-spam whitelist or blacklist entry , type the i ndex number wh ere you want to put the entry . and click Insert to display the ANTI-SP AM Rule Edit screen. [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 15 Anti-S pam 272 The following table describes the labels in this screen. Table 88 Anti-Spam Rule Edit LABEL DESCRIPTION Rule Edit Active T u rn this entry on to have the ZyWA LL use it as part of the whitelist or blacklist. Y ou must also turn on the use of the corresponding list (in the Anti-Sp am Cus[...]

ZyWALL 5/35/70 Series User’s Guide 273 Chapter 15 Anti-Spa m Apply Click Apply to save your settings and exit this screen. Cancel Click Cancel to exit this screen without saving. Table 88 Anti-Spam Rule Edit LABEL DESCRIPTION[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 16 Content Filtering Screens 274 C HAPTER 16 Content Filtering Screens This chapter provides an over view of content filtering. 16.1 Content Filtering Overview Content filtering all ows you to block certain we b features, such as Cookies, and/or restrict specific websites. W ith content f iltering, you c[...]

ZyWALL 5/35/70 Series User’s Guide 275 Chapter 16 Content Filterin g Screens Figure 129 Content Filter : General The following table describes the labels in this screen. T able 89 Content Filter : General LABEL DESCRIPTION General Setup Enable Content Filter Select this check box to enable the conten t filter . Restrict Web Features Select th e c[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 16 Content Filtering Screens 276 16.3 Content Filtering with an External Dat abase When you register for and en able external database conten t filtering, your ZyW ALL accesses an external database that has millions of web sites categorized based on content. Y ou can have the ZyW ALL block, block and/or [...]

ZyWALL 5/35/70 Series User’s Guide 277 Chapter 16 Content Filterin g Screens Figure 130 Content Filtering Looku p Procedure 1 A computer behind the ZyW ALL tries to access a web site. 2 The ZyW ALL looks up the web site in its cach e. If an attempt to access the web site was made in the past, a record of that web site’ s category will be in the[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 16 Content Filtering Screens 278 Figure 131 Content Filter : Categories The following table describes the labels in this screen. Table 90 Content Filter: Categ ories LABEL DESCRIPTION Auto Category Setup Enable External Database Content Filtering Enable external database content filtering to have the ZyW[...]

ZyWALL 5/35/70 Series User’s Guide 279 Chapter 16 Content Filterin g Screens Unrated W eb Pages Select Block to prevent users from accessing web pages that the external databa se content filter ing has not catego rized. When the external data base content filtering blocks access to a web page, it displays the denied access message that you config[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 16 Content Filtering Screens 280 Alcohol/T obacco Selecting this category exclud es pages that promote or offer the sale alcohol/tobacco products, or provide th e means to create them. It also includes pages that gl orify , tout, or otherwise encourage the consumption of alcohol/tobacco. It does not incl[...]

ZyWALL 5/35/70 Series User’s Guide 281 Chapter 16 Content Filterin g Screens Education Selecting this category excl udes pages that offer educational information, distance learning and trade school in formation or programs. It also includes pages th at are sponsored b y schools, educatio nal facilities, faculty , or alumni groups. Cultural Instit[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 16 Content Filtering Screens 282 News/Media Selecting this category excludes pages that primarily report information or comments on current events or contemporary issues of the da y . It also includes radio stations and magazin es. It does not include pages that can be rated in othe r categories. Persona[...]

ZyWALL 5/35/70 Series User’s Guide 283 Chapter 16 Content Filterin g Screens Humor/Jokes Selecting this cate gory excludes p ages that primarily focus on comedy , jokes, fun, etc. This may include pages containing jokes of adult or mature nature. Pages containing hu morous Adult/Mature content also have an Adult/Matu re category ra ting. S treami[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 16 Content Filtering Screens 284 16.5 Content Filter Customization Click SECURITY , CONT ENT FIL TER , then the Customization tab to display t he CONTENT FIL TER Customization screen. Y ou can create a list of good (allowed) web site addresses and a list of bad (blocked) web site addresses. Y ou can also[...]

ZyWALL 5/35/70 Series User’s Guide 285 Chapter 16 Content Filterin g Screens The following table describes the labels in this screen. Table 91 Content Filter: Customization LABEL DESCRIPTION Web Site List Customization Enable Web site customization Select this check box to allow trusted web sites and block forbidden web sites. Content filter list[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 16 Content Filtering Screens 286 16.6 Customizing Keyword Blocking URL Checking Y ou can use commands to set ho w much of a website’ s URL the content filter is to check for keyword blocking. See the appendices for info rmation on how to access and use the command interpreter . 16.6.1 Domain Name or IP[...]

ZyWALL 5/35/70 Series User’s Guide 287 Chapter 16 Content Filterin g Screens Use the ip urlfilter customize actionFlags 8 [disable | enable] command to extend (or not extend) the k eyword bloc king search to include the URL's complete filename. 16.7 Content Filtering Cache Click SECURITY , CONT ENT FIL TER , then the Cache tab to display the[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 16 Content Filtering Screens 288 The following table describes the labels in this screen. Table 92 Content Filter: Cache LABEL DESCRIPTION URL Cache Setup Maximum TTL T ype the maximum time to live (TTL) (1 to 720 hours). This sets how long the ZyW ALL is to allow an entry to remain in the URL cache befo[...]

ZyWALL 5/35/70 Series User’s Guide 289 Chapter 16 Content Filterin g Screens[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 17 Content Filtering Reports 290 C HAPTER 17 Content Filtering Report s This chapter describes how to view content filtering reports after yo u have activated the category-based content filtering subscription service. See Chapter 4 on pa ge 100 on how to create a myZyXEL.com account, register your device[...]

ZyWALL 5/35/70 Series User’s Guide 291 Chapter 17 Content Filtering Reports Figure 134 myZyXEL.com: Login 3 A welcome screen displays. Click your ZyW ALL ’ s model name and/or MAC address under Registered ZyXEL Pr oducts . Y ou can change the descriptive name for your ZyW ALL using the Rename button in the Service Management screen (see Figure [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 17 Content Filtering Reports 292 Figure 136 myZyXEL.com: Service Manage ment 5 Enter your ZyXEL device's MAC address (in lowe r case) in the Name field. Y ou can find this MAC address in the Service Management screen ( Figure 136 on page 29 2 ). T ype your myZyXEL.co m account password in the Passwo[...]

ZyWALL 5/35/70 Series User’s Guide 293 Chapter 17 Content Filtering Reports Figure 138 Content Filtering Re ports M ain Screen 8 Select items under Global Reports or Single User Reports to view the corresponding reports. Figure 139 Blue Coat: Report Home 9 Select a time period in the Date Range field, either Allowed or Blocked in the Action Ta k [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 17 Content Filtering Reports 294 Figure 140 Global Report Screen Exam ple 11 Y ou can click a ca tegory in the Categories report or click URLs in the Re port Home screen to see the URLs that were requested.[...]

ZyWALL 5/35/70 Series User’s Guide 295 Chapter 17 Content Filtering Reports Figure 141 Requested URLs Example 17.3 W eb Site Submission Y ou may find that a web site has not been accura tely categorized or that a web site’ s contents have changed and the content filtering cate gory needs to be updat ed. Use the following procedure to submit the[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 17 Content Filtering Reports 296 Figure 142 Web Pag e Review Process Screen 3 T ype the web site’ s URL in the field and click Submit to have the web site reviewed.[...]

ZyWALL 5/35/70 Series User’s Guide 297 Chapter 17 Content Filtering Reports[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 18 Introd uction to IPSec 298 C HAPTER 18 Introduction to IPSec This chapter introduces the basics of IPSec VPNs. 18.1 VPN Overview A VPN (V irtual Private Network) provides sec ure communications between sites without the expense of leased site-to-site lines. A secure VP N is a combination of tunneling,[...]

ZyWALL 5/35/70 Series User’s Guide 299 Chapter 18 Introdu ction to IPSec Figure 143 Encryption and De cryption 18.1.3.2 Dat a Confidentiality The IPSec sender can encrypt packets befo re transmitting them across a network. 18.1.3.3 Dat a Integrity The IPSec receiver can validate packets sent by the IPSec sender to ensure that the data has not bee[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 18 Introd uction to IPSec 300 18.2 IPSec Architecture The overall IPSec architect ure is shown as follows. Figure 144 IPSec Architecture 18.2.1 IPSec Algorithms The ESP (Encapsulating Security Payload) Protocol (RFC 2406) an d AH (Authentication Header) protocol (RFC 24 02) describe the pac ket formats a[...]

ZyWALL 5/35/70 Series User’s Guide 301 Chapter 18 Introdu ction to IPSec Figure 145 T ransport and T unnel Mode IPSec Encapsulation 18.3.1 T ransport Mode Tr a n s p o r t mode is used to protect upper layer prot ocols and only affects the data in the IP packet. In Tr a n s p o r t mode, the IP packet contains the security protoc ol ( AH or ESP )[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 18 Introd uction to IPSec 302 NA T is incompatible with the AH protocol in both Tr a n s p o r t and T unnel mode. An IPSec VPN using the AH protocol digitall y signs the outbound packet, both data payload and headers, with a hash value appe nded to the pack et. When using AH protoc ol, packet contents ([...]

ZyWALL 5/35/70 Series User’s Guide 303 Chapter 18 Introdu ction to IPSec[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 19 VPN Screens 304 C HAPTER 19 VPN Screens This chapter introduces the VPN W eb Configurator . See Chapter 30 on page 468 for information on viewing logs and Appendix S on page 770 for IPSec log descriptions. 19.1 VPN/IPSec Overview Use the screens documented in this chapter to configure rules for VPN co[...]

T able 94 ESP and AH ESP AH Encryption DES (default) Data Encryption S tandard (DES) is a widely used method of data encryption using a secret key . DES applies a 56-bit key to each 64-bit block of data. 3DES T riple DES (3DES) is a variant of DES, which iterates three times with three separate keys (3 x 56 = 168 bits), effectively doubling the str[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 19 VPN Screens 306 If the remote secure gateway has a static W AN IP address, enter it in the Remote Gateway Address field. Y ou may alternatively enter the remo te secure gateway’ s domain name (if it has one). Y ou can also enter a remote secure gateway’ s domain name in the Remote Gateway Address [...]

ZyWALL 5/35/70 Series User’s Guide 307 Chapter 19 VPN Screen s Figure 146 NA T Router Between IPSec Routers Normally you cannot set up a VPN connecti on with a NA T router between the two IPSec routers because the NA T router c hanges the header of th e IPSec packet. In the previous figure, IPSec router A sends an IPSec packet in an attempt to in[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 19 VPN Screens 308 between three encryption algor ithms (DES, 3DES and AES ), tw o authentication algorithms (MD5 and SHA1) and two ke y groups (DH1 and DH2) when yo u configure a VPN rule (see Section 19.12 on page 32 0 ). The ID type and content act as an extra level of identification for incoming SAs.[...]

ZyWALL 5/35/70 Series User’s Guide 309 Chapter 19 VPN Screen s The two ZyW ALLs in this ex ample cannot complete their negotiation because ZyW ALL B’ s Local ID type is IP , but ZyW ALL A ’ s Peer ID type is set to E-mail . An ID mismatched message displays in the IPSec log. T able 98 Mismatching ID T ype and Co ntent Configuration Example ZY[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 19 VPN Screens 310 • Choose an authentication algorithm. • Choose a Dif fie-Hellman public-key cry ptography key grou p ( DH1 or DH2 ) . • Set the IKE SA lifetime. This field allows you to determin e how long an IKE SA should stay up before it times out. An IKE SA times out when the IKE SA lifetime[...]

ZyWALL 5/35/70 Series User’s Guide 311 Chapter 19 VPN Screens 19.8.3 Diffie-Hellm an (DH) Ke y Group s Diffie-Hellman (DH) is a publi c -key cryptography protocol tha t allows two parties to establish a shared secret over an unsecured communications channel. Diff ie-Hellman is used within IKE SA setup to establish session keys. 768-bit (Group 1 -[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 19 VPN Screens 312 19.10 VPN Rules (IKE) Click VPN to display the VPN Rules (IKE) screen. This i s a read-only menu of your IPSec rule (tunnel). T o add an IPSe c rule (or gateway policy), click the add gateway policy ( ) icon. Edit an IPSec rule by clicking the edit ( ) icon to configure the associated [...]

ZyWALL 5/35/70 Series User’s Guide 313 Chapter 19 VPN Screen s Figure 149 Gateway and Network Policies This figure helps explain the main fields in the VPN setup. Figure 150 IPSec Fields Summary Note: Local and remote network IP addresses must be static. The following table describes the ic ons used in the VPN screens. Table 100 VPN screen Icons [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 19 VPN Screens 314 Note: The Recycle Bin gateway policy is a virtu al placeholder for any netwo rk policy(ies) without an associated gateway policy . When there is a network policy in the Recycle Bin , the Recycle Bin gateway po licy automatically displays in this screen. See Section 19.13 on p age 324 f[...]

ZyWALL 5/35/70 Series User’s Guide 315 Chapter 19 VPN Screen s Figure 151 VPN Rules (IKE): Gate way Policy: Edit[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 19 VPN Screens 316 The following table describes the labels in this screen. Table 101 VPN Rules (IKE): Gate way Policy: Edit LABEL DESCRIPTION Property Name T ype up to 32 characters to identify this VPN gateway policy . Y ou may use any character , including spaces, but the ZyW ALL drops trailing spaces[...]

ZyWALL 5/35/70 Series User’s Guide 317 Chapter 19 VPN Screens Remote Gateway Address T ype the WAN IP address or the domain na me (up to 31 characters) of the IPSec router with which you're making the VPN connecti on. Set this field to 0.0.0.0 if the remote IPSec router has a dynamic WAN IP address. In order to have more than one active rule[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 19 VPN Screens 318 Peer ID T ype Select from the following when you set Authentication Key to Pre-shared Key . •S e l e c t IP to identi fy the remote IPSec router by its IP address. •S e l e c t DNS to identify the remote IPSe c router by a do main name. •S e l e c t E-mail to identi fy the remote[...]

ZyWALL 5/35/70 Series User’s Guide 319 Chapter 19 VPN Screens Server Mode Select Server Mode to have this ZyWALL authent icate extended authentication clients that request this VPN connection. Y ou must also configure the extende d authentication clients’ usernames and passwords in the authentication server ’s local user database or a RADIUS [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 19 VPN Screens 320 19.12 VPN Rules (IKE): Network Policy Edit Click VPN and the add network policy ( ) icon in the VPN Rules (IKE) screen to display the VPN-Network Policy -Edit screen. Use this screen to configure a network policy . Enable Multiple Proposals Select this check box to allow the ZyW A LL t[...]

ZyWALL 5/35/70 Series User’s Guide 321 Chapter 19 VPN Screen s Figure 152 VPN Rules (IKE): Network Policy Edit[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 19 VPN Screens 322 The following table describes the labels in this screen. Table 102 VPN Rules (IKE): Ne twork Policy Edit LABEL DESCRIPTION Active If the Active check box is selected, packets for the tunnel trigger the ZyWALL to build the tunnel. Clear the Active check box to turn the network policy of[...]

ZyWALL 5/35/70 Series User’s Guide 323 Chapter 19 VPN Screens S tarting IP Address When the Address T ype field i s configured to Single Address , enter a (st atic) IP address on the LAN behind your ZyW ALL. When the Address T ype fiel d is configured to Range Address , enter the beginning (static) IP address, in a range of computers on th e LAN [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 19 VPN Screens 324 19.13 VPN Rules (IKE): Network Policy Move Click the move ( ) icon in the VPN Rules (IKE) screen to display the VPN Rules (IKE): Network Policy Move screen. Use this screen to associa te a network policy to a gateway rule. Authentication Algorithm MD5 (Message Digest 5) an d SHA1 (Secu[...]

ZyWALL 5/35/70 Series User’s Guide 325 Chapter 19 VPN Screen s Figure 153 VPN Rules (IKE): Network Policy Move The following table describes the labels in this screen. Table 103 VPN Rules (IKE): Ne twork Policy Move LABEL DESCRIPTION Network Policy Informati on The following fields display the genera l network settings of this VPN policy . Name T[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 19 VPN Screens 326 Y ou may want to configure a VPN rule that u ses manual key management if you are havin g problems with IKE key management. Refer to T able 100 on page 313 for descriptions of the ic ons used in this screen. Figure 154 VPN Rules (Man ual) The following table describes the labels in thi[...]

ZyWALL 5/35/70 Series User’s Guide 327 Chapter 19 VPN Screens 19.15 VPN Rules (Manual): Edit Manual key managemen t is useful if you have pro blems with IKE key management . 19.15.1 Security Pa rameter Index (SPI) An SPI is used to distinguish dif ferent SAs te rminating at the same de stination and using the same IPSec protocol. This data allows[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 19 VPN Screens 328 Figure 155 VPN Rules (Manual): Edit The following table describes the labels in this screen. T able 105 VPN Rules (Manual) Edit LABEL DESCRIPTION Property Active Select this check box to activate this VPN policy . Name T ype up to 32 characters to identify this VPN policy . Y ou may us[...]

ZyWALL 5/35/70 Series User’s Guide 329 Chapter 19 VPN Screens Local Network Local IP add resses must be static and correspond to the remote IPSec router's configured remote IP addresses. T wo ac tive SAs cannot have the local and remo te IP address(es) both the same. T wo active SAs can have the same local or remo te IP address, but not both[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 19 VPN Screens 330 My ZyW ALL Wh en the ZyW ALL is in router mode, enter the WAN IP address or the domain name of your ZyWALL or leave the field set to 0.0.0.0 . For a ZyW ALL with multiple WAN port s, the following applies if the My ZyW ALL field is configured as 0.0.0.0 : • When the WAN port operatio[...]

ZyWALL 5/35/70 Series User’s Guide 331 Chapter 19 VPN Screen s 19.16 VPN SA Monitor In the web configurator , click VPN and the SA Monitor tab. Use this screen to display and manage active VPN connections. A Security Association (SA) is the group of secu rity settings related to a specific VPN tunnel. This screen displays active VPN connections. [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 19 VPN Screens 332 19.17 VPN Global Setting Click VPN , then the Global Setting tab to open the VPN Global Setting screen. Use this screen to change your ZyW ALL ’ s global settings. Figure 157 VPN: Global Setting The following table describes the labels in this screen. IPSec Algorithm Thi s field disp[...]

ZyWALL 5/35/70 Series User’s Guide 333 Chapter 19 VPN Screens 19.18 T elecommuter VPN/IPSec Examples The following examples show how multiple telecommuters can make VPN connections to a single ZyW ALL at headquarters. The telecommut ers use IPSec routers with dynamic W AN IP addresses. The ZyW ALL at headquarters has a static public IP address. 1[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 19 VPN Screens 334 Figure 158 T elecommuters Sharing One VPN Rule Example T able 108 T elecommuters Sharing One VPN Rule Example FIELDS T ELECOMMUTERS HEADQUAR TERS My ZyW ALL: 0.0.0.0 (dynamic IP address assigned by the ISP) Public static IP address Remote Gateway Address: Public static IP address 0.0.0[...]

ZyWALL 5/35/70 Series User’s Guide 335 Chapter 19 VPN Screen s Figure 159 T elecommuters Using Uniq ue VPN Rules Example T able 109 T elecommuters Using Unique VPN Rules Example T ELECOMMUTERS HEADQUARTERS All T e lecommuter Rules: All Headquarters Rules: My ZyW ALL 0.0.0.0 My ZyW ALL: bigcompanyhq.com Remote Gateway Address: bigcompanyhq.com Loc[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 19 VPN Screens 336 19.19 VPN and Remote Management If a VPN tunnel uses T elnet, FTP , WWW , SNMP , DNS or ICMP , then you should configure remote management ( REMOTE MGMT ) to allow access for that service. Local IP Address: 192.168.4.1 5 Remote Gateway Address: telecommuterc .dydns.org Remote Address 1[...]

ZyWALL 5/35/70 Series User’s Guide 337 Chapter 19 VPN Screens[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 20 Certificates 338 C HAPTER 20 Certificates This chapter gives background in formation about public-key certificates and explains how to use them. 20.1 Certificates Overview The ZyW ALL can use certificates (also called digita l IDs) to authenticate users. Certificates are based on public-priva te key p[...]

ZyWALL 5/35/70 Series User’s Guide 339 Chapter 20 Certificates Certification authorities maintain directory ser vers with databases o f valid and revoked certificates. A directory of certificates that have been revoked before the scheduled expiration is called a CRL (Certificate Revocation List). The ZyW ALL can check a peer ’ s certifica te ag[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 20 Certificates 340 20.4 My Certificates Click SECURITY , C ER TIFICA TES , My Certificates to open the My Certificates sc reen. This is the ZyW ALL ’ s summary list of certific ates and certification requests. Certificates display in black and certification requests display in gray . Figure 161 My Cer[...]

ZyWALL 5/35/70 Series User’s Guide 341 Chapter 20 Certificates Ty p e This field displays what kind of certificate this is. REQ represents a certification request an d is not yet a valid certificate. Send a certification request to a certification authority , which then issues a certific ate. Use the My Certificate Import screen to import the cer[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 20 Certificates 342 20.5 My Certificate Import Click SECURITY , C ER TIFICA TES , My Certificates and then Import to open the My Certificate I mport screen. Follow the instructions in this screen to save an existing certificate to the ZyW ALL. Note: Y ou can only import a certificate that matches a corre[...]

ZyWALL 5/35/70 Series User’s Guide 343 Chapter 20 Certificates Figure 162 My Certificat e Import The following table describes the labels in this screen. Ta b l e 1 1 1 My Certificate Import LABEL DESCRIPTION File Path T ype in the location of the file you w ant to upload in thi s field or click Browse to find it. Browse Click Browse to find the [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 20 Certificates 344 Figure 163 My Certificate Crea te The following table describes the labels in this screen. T able 1 12 My Certificate Create LABEL DESCRIPTION Certificate Name T ype up to 31 ASCII characters (not incl uding sp aces) to identif y this certifi cate. Subject Information Use these fields[...]

ZyWALL 5/35/70 Series User’s Guide 345 Chapter 20 Certificates Country T ype up to 127 characte rs to identify the nation where the ce rtificate owner is located. Y ou may use any character , including spaces, but the ZyW ALL drops trailing sp aces. Key Length Select a number from the drop-down list box to determine how many bits the key should u[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 20 Certificates 346 After you click Apply in the My Certificate Create screen, you see a screen that tells you the ZyW ALL is generating the self-signed cert ificate or certification request. After the ZyW ALL successfully enrolls a certifi cate or generates a certifica tion request or a self-signed cert[...]

ZyWALL 5/35/70 Series User’s Guide 347 Chapter 20 Certificates Figure 164 My Certificate Details[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 20 Certificates 348 The following table describes the labels in this screen. Table 113 My Certificate Details LABEL DESCRIPTION Name This field displays the identifying name of this certificate. If you want to change the name, type up to 31 characters to identify this certifica te. Y ou may use any chara[...]

ZyWALL 5/35/70 Series User’s Guide 349 Chapter 20 Certificates 20.8 T rusted CAs Click SECURITY , C ER TIFICA TES , Tr u s t e d C A s to open the Tr u s t e d C A s screen. This screen displays a summary list of certificates of the certification authorities that you have set the ZyW ALL to accept as trusted. The ZyW ALL accepts any valid certifi[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 20 Certificates 350 Figure 165 T rusted CAs The following table describes the labels in this screen. Table 114 T rusted CAs LABEL DESCRIPTION PKI S torage S pace in Use This bar displays the percentage of the ZyW ALL ’s PKI storage space that is currently in use. The bar turns from green to red when th[...]

ZyWALL 5/35/70 Series User’s Guide 351 Chapter 20 Certificates 20.9 T rusted CA Import Click SECURITY , C ER TIFICA TES , Tr u s t e d C A s to open the Tr u s t e d C A s screen and then click Import to open the T rusted CA Import screen. Follow the instructions in this screen to save a trusted certification authority’ s certificate to the ZyW[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 20 Certificates 352 The following table describes the labels in this screen. T able 1 15 Trusted CA Import LABEL DESCRIPTION File Path T ype in the location of the file you wan t to upload in this field or click Browse to find it. Browse Click Browse to find the certificate file you want to upload. Apply[...]

ZyWALL 5/35/70 Series User’s Guide 353 Chapter 20 Certificates Figure 167 T rusted CA Details The following table describes the labels in this screen. Table 116 T rusted CA Details LABEL DESCRIPTION Name This field displays the iden tifying name of this certificate. If you w ant to change the name, type up to 31 characters to identify this key ce[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 20 Certificates 354 Certification Path Click the Refresh button to have this read-only text box displa y the end entity’s certificate and a list of cert ification authority certificat es that shows the hierarchy of certification authorities that validate th e end entity’s certificate. If the issuing [...]

ZyWALL 5/35/70 Series User’s Guide 355 Chapter 20 Certificates 20.1 1 T rusted Remote Host s Click SECURITY , C ER TIFICA TES , T rusted Remote Hosts to open the T r usted Remote Hosts screen. This screen displays a list of the cer tificates of peers that you trust but which are not signed by one of the certification authorities on the Tr u s t e[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 20 Certificates 356 Figure 168 T rusted Remote Hosts The following table describes the labels in this screen. Table 117 T rusted Remote Hosts LABEL DESCRIPTION PKI S torage S pace in Use This bar displays th e percentage of the ZyW ALL ’s PKI storage space that is currently in use. The bar turns from g[...]

ZyWALL 5/35/70 Series User’s Guide 357 Chapter 20 Certificates 20.12 V erifying a T rusted Remote Host’ s Certificate Certificates issued by certific ation authorities have the certificat ion authority’ s signature for you to check. Self-sig ned certificates only h ave th e signature of the host itself. This means that you must be very carefu[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 20 Certificates 358 Figure 170 Certificate Details V erify (over the phone for example) that the remote host has the sa me information in the Thumbprint Algorithm and Thumbprint fields. 20.13 T rusted Remote Host s Import Click SECURITY , C ER TIFICA TES , T rusted Remote Hosts to open the T r usted Remo[...]

ZyWALL 5/35/70 Series User’s Guide 359 Chapter 20 Certificates Figure 171 T rusted Remote Host Import The following table describes the labels in this screen. T able 1 18 Trusted Remote Host Import LABEL DESCRIPTION File Path T ype in the location of the file you w ant to upload in this field or cl ick Browse to find it. Browse Click Browse to fi[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 20 Certificates 360 Figure 172 T rusted Remote Host Details The following table describes the labels in this screen. Table 119 T rusted Remote Host Details LABEL DESCRIPTION Name This field displays the iden tifying name of this certificate. If you want to change the name, type up to 31 characters to id [...]

ZyWALL 5/35/70 Series User’s Guide 361 Chapter 20 Certificates Certificate Information These read-only field s display detail ed information abou t the certificate. Ty p e This field displ ays general information abo ut the certificate. With truste d remote host certificates, this field alw ays displays CA-signed. The ZyWALL is the Certification [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 20 Certificates 362 20.15 Directory Servers Click SECURITY , C ER TIFICA TES , Directory Servers to open the Directory Servers screen. This screen displays a summary list of di rectory servers (that contain lists of valid and revoked certificates) that have bee n saved into the ZyW ALL. If you decide to [...]

ZyWALL 5/35/70 Series User’s Guide 363 Chapter 20 Certificates The following table describes the labels in this screen. T able 120 Directory Servers LABEL DESCRIPTION PKI S tor age S pace in Use This bar displays the percentage of the ZyWALL ’s PKI storage space that is currently in use. The bar turns from green to red when the maximum is being[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 20 Certificates 364 The following table describes the labels in this screen. T able 121 Directory Server Add LABEL DESCRIPTION Directory Service Setting Name T ype up to 31 ASCII characters (spaces are not permitted) to identify this directory server . Access Protocol Use th e drop-down list box to selec[...]

ZyWALL 5/35/70 Series User’s Guide 365 Chapter 20 Certificates[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 21 Authenticat ion Server 366 C HAPTER 21 Authentication Server This chapter discusses how to configure th e ZyW ALL ’ s authentication server feature. 21.1 Authentication Server Overview A ZyW ALL set to be a VPN extended authenti cation server can use either the local user database internal to the Zy[...]

ZyWALL 5/35/70 Series User’s Guide 367 Chapter 21 Au thentication Server Figure 175 Local User Da tabase[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 21 Authenticat ion Server 368 The following table describes the labels in this screen. T able 122 Local User Database LABEL DESCRIPTION Active Select this check box to enable the user profile. User Name Enter the user name of the user profile. Password Enter a password up to 31 ch aracters long for this [...]

ZyWALL 5/35/70 Series User’s Guide 369 Chapter 21 Au thentication Server The following table describes the labels in this screen. T able 123 RADIUS LABEL DESCRIPTION Authentication Server Active Select the check box to enable user authentication through an external authentication serve r . Clear the check b ox to enable u ser authentication using[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 22 Network Address Translation (NAT) 370 C HAPTER 22 Network Address T ranslation (NA T) This chapter discusses how to configure NA T on the ZyW ALL. 22.1 NA T Overview NA T (Network Address Translation - NA T , RFC 1631) is the transla tion of the IP address of a host in a packet. For example, the sourc[...]

ZyWALL 5/35/70 Series User’s Guide 371 Chapter 22 Network Addr ess Translation (NAT) 22.1.2 What NA T Does In the simplest form, NA T changes the sour ce IP address in a packet received from a subscriber (the inside local address) to anothe r (the inside global address) before forwarding the packet to the W AN side. When the response comes back, [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 22 Network Address Translation (NAT) 372 Figure 177 How NA T Works 22.1.4 NA T Application The following figure illustrates a possible NA T application, wher e three inside LANs (logical LANs using IP Alias) behind the ZyW ALL can communicate with three distinct W AN networks. More examples follow at the[...]

ZyWALL 5/35/70 Series User’s Guide 373 Chapter 22 Network Addr ess Translation (NAT) 22.1.5 Port Restricted Cone NA T At the time of writing ZyW ALL ZyNOS version 4. 00 uses port restricted cone NA T . Port restricted cone NA T maps all outgoing packets fro m an internal IP address and port to a single IP address and port on the external network.[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 22 Network Address Translation (NAT) 374 • Server : This type allows you to specify insi de servers of different services behind the NA T to be accessible to the outside world a lthough, it is highly recommended that you use the DMZ port for these servers instead. Note: Port numbers do not change for O[...]

ZyWALL 5/35/70 Series User’s Guide 375 Chapter 22 Network Addr ess Translation (NAT) 22.3 NA T Overview Click ADV ANCED , NA T to open the NA T Over view screen. Not all fields are available on all models. Figure 180 NA T Overview The following table describes the labels in this screen. T able 126 NA T Overview LABEL DESCRIPTION Global Settings M[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 22 Network Address Translation (NAT) 376 22.4 NA T Address Mapping Ordering your rules is important because the Zy W ALL applies the rules in the order that you specify . When a rule matche s the current pack et, the ZyW ALL takes the corresponding action and the remaining rules are ignored. If there are[...]

ZyWALL 5/35/70 Series User’s Guide 377 Chapter 22 Network Addr ess Translation (NAT) Figure 181 NA T Address Mapping The following table describes the labels in this screen. T able 127 NA T Addres s Mapping LABEL DESCRIPTION SUA Address Mapping Rules This read-only table displays the de fault address mapping rules. Full Feature Address Mapping Ru[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 22 Network Address Translation (NAT) 378 22.4.1 NA T Address Mapping Edit Click the Edit button to display the NA T Addr ess Mapping Edit screen. Use this screen to edit an address mapping rule. Figure 182 NA T Address Mapping Edit Global S tart IP This refers to the Inside Global IP Address (IGA), that [...]

ZyWALL 5/35/70 Series User’s Guide 379 Chapter 22 Network Addr ess Translation (NAT) The following table describes the labels in this screen. Table 128 NA T Address Mapping Edit LABEL DESCRIPTION Ty p e Choose the port mapping type from one of the following. 1. One-to-One : One-to-One mode maps one local IP address to one global IP address. Note [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 22 Network Address Translation (NAT) 380 22.5.1 Default Server IP Address In addition to the servers for specified services, NA T supports a default server IP address. A default server receives packets from ports that are not specifie d in this screen. Note: If you do not assign a Default Serve r IP addr[...]

ZyWALL 5/35/70 Series User’s Guide 381 Chapter 22 Network Addr ess Translation (NAT) Figure 183 Multiple Servers Behind NA T Example 22.5.4 NA T and Multiple W AN The ZyW ALL has two W AN ports. Y ou can configure port forward ing and trigger po rt rule sets for the first W AN port and separate sets of rules for the second W AN port. 22.5.5 Port [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 22 Network Address Translation (NAT) 382 Figure 184 Port T ranslation Example 22.6 Port Forwarding Note: If you do not assign a Default Serve r IP address, the ZyW ALL discards all packet s received for port s that are not specified here or in th e remote management setup. Click ADV ANCED , NA T and Port[...]

ZyWALL 5/35/70 Series User’s Guide 383 Chapter 22 Network Addr ess Translation (NAT) Figure 185 Port Forwarding The following table describes the labels in this screen. T able 130 Port Fo rwarding LABEL DESCRIPTION W AN Interface Select the WAN port for which you want to view or con figure address mapping ru les. Default Server In addition to the[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 22 Network Address Translation (NAT) 384 22.7 Port T riggering Some services use a dedicated range of ports on the client side and a dedica ted range of ports on the server side. W ith regular port forwarding you set a forwarding port in NA T to forward a service (coming in from the server on the W AN) t[...]

ZyWALL 5/35/70 Series User’s Guide 385 Chapter 22 Network Addr ess Translation (NAT) 4 The ZyW ALL forwards the traffic to Jane’ s computer IP address. 5 Only Jane can connect to the Real Audio server until th e connection is closed or times out. The ZyW ALL times out in three minutes with UDP (User Datagram Protocol) or two hours with TCP/IP ([...]

ZyWALL 5/35/70 Series User’s Guide Chapter 22 Network Address Translation (NAT) 386 Tr i g g e r The trigger port is a port (or a range of ports ) that causes (or triggers) the ZyW ALL to record the IP address of the LAN computer th at sent the traffic to a server on the W AN. St a r t P o r t T ype a port numbe r or the starting port number in a[...]

ZyWALL 5/35/70 Series User’s Guide 387 Chapter 22 Network Addr ess Translation (NAT)[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 23 Static Route 388 C HAPTER 23 S t atic Route This chapter shows you how to config ure static routes for your ZyW ALL. 23.1 IP S t atic Route Each remote node specifies only the network to which the gateway is di rectly connected, and the ZyW ALL has no knowled ge of the networks beyond. Fo r instance, [...]

ZyWALL 5/35/70 Series User’s Guide 389 Chapter 23 Static Route Note: The default route is disabled af ter you change the st atic W AN IP address to a dynamic W AN IP address. Figure 189 IP S tatic Route The following table describes the labels in this screen. T able 132 IP S tatic Route LABEL DESCRIPTION # This is the number of an individual stat[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 23 Static Route 390 23.2.1 IP St atic Route Edit Select a static route index numb er and click Edit . The screen shown next appears. Use this screen to configure the required information for a static route. Figure 190 IP S tatic Route Edit The following table describes the labels in this screen. Active T[...]

ZyWALL 5/35/70 Series User’s Guide 391 Chapter 23 Static Route Gateway IP Address Enter the IP addre ss of the gateway . The gateway i s a router or switch on the same network segment as the device's LAN or WAN port. The gateway h elps forward packet s to their destinations. Metric Metric represents the “cost” of transmi ssion for routin[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 24 Policy Route 392 C HAPTER 24 Policy Route This chapter covers setting and ap plying policies used for IP routing. This chapter applies to the ZyW ALL 35 and ZyW ALL 70. 24.1 Policy Route T raditionally , routing is based on the destination address only and the ZyW ALL takes the shortest path to forwar[...]

ZyWALL 5/35/70 Series User’s Guide 393 Chapter 24 Policy Route IPPR follows the existing packet filtering fac ility of RAS in style and in implementation. 24.4 IP Routing Policy Setup Click ADV ANCED , POLICY ROUTE to open the Policy Route Summary screen (some of the screen’ s blank rows are not shown). Figure 191 Policy Route Summary[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 24 Policy Route 394 The following table describes the labels in this screen. T able 134 Policy Route Summary LABEL DESCRIPTION # This is the number of an individual policy route. Active This field shows whether the policy is active or inactive. Source Address / Port This is the source IP address range an[...]

ZyWALL 5/35/70 Series User’s Guide 395 Chapter 24 Policy Route Figure 192 Edit IP Policy Route The following table describes the labels in this screen. Table 135 Edit IP Policy Route LABEL DESCRIPTION Criteria Active Select the check box to activate the policy . Rule Index This is the index number of the policy route. IP Protocol Select Predef in[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 24 Policy Route 396 Packet Length T ype a length of packet (in bytes). The operators in the Len Compare field apply to incoming packets of this length. Length Comparison Choose from Equal , Not Equal , Less , Greater , Les s or Equal or Greater or Equal . Source Interface Use the check box to select LAN [...]

ZyWALL 5/35/70 Series User’s Guide 397 Chapter 24 Policy Route[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 25 Bandwidth Management 398 C HAPTER 25 Bandwid th Management This chapter describes the functions and conf iguration of bandwidth management with multiple levels of sub-classes. 25.1 Bandwid th Management Overview Bandwidth management allo ws you to allocate an interface’ s outgoing capacity to specif[...]

ZyWALL 5/35/70 Series User’s Guide 399 Chapter 25 Bandwidth Manag ement 25.3 Proportional Bandwid th Allocation Bandwidth management allo ws you to define ho w much bandwidth each class gets; however , the actual bandwidth a llotted to each clas s de creases or increases in proportion to actual available bandwidth . 25.4 Application-based Bandwid[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 25 Bandwidth Managemen t 400 25.6 Application and Subnet-based Bandwid th Management Y ou could also create bandwidth clas ses based on a combination of a subnet and an application. The following exam ple table shows bandwidth alloca tions for application specific traffic from separate LAN subnets. Table[...]

ZyWALL 5/35/70 Series User’s Guide 401 Chapter 25 Bandwidth Manag ement When you enable maximi ze bandwidth usag e, the ZyW ALL first makes sure that each bandwidth class gets up to its bandwidth allotment. Next, the ZyW ALL divides up an interface’ s available bandwidth (bandwidth that is unbudgeted or unused by the classes) depending on how m[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 25 Bandwidth Managemen t 402 25.7.5.1 Priority-based Allotment of Unused and Unbudgeted Bandwid th The following table shows the priorities of the bandwidth classes and the amount of bandwidth that each class gets. Table 138 Priority-based Allotment of Unused an d Unbudgeted Bandwidth Exa mple BANDWID TH[...]

ZyWALL 5/35/70 Series User’s Guide 403 Chapter 25 Bandwidth Manag ement 25.8 Bandwid th Borrowing Bandwidth borrowing allows a sub-class to borrow u nused bandwidth from its paren t class, whereas maximize bandwidth usage allows bandwidth classes to bo rrow any unused or unbudgeted bandwidth on the whole interface. Enable bandwidth borrowing on a[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 25 Bandwidth Management 404 • The Bill class cannot bo rrow unused bandwi dth from the Root class because the Sales class has bandwidth borrowing disabl ed. • The Amy class cannot borrow unused bandwi dth from the Sales USA class because the Amy class has bandwid th borrowing di sabled. • The Resea[...]

ZyWALL 5/35/70 Series User’s Guide 405 Chapter 25 Bandwidth Manag ement Figure 194 Bandwidth Management: Summary The following table describes the labels in this screen. T able 141 Bandwidth Managemen t: Summary LABEL DESCRIPTION Class These read-only labe ls represent the physica l interfaces. Select an interface’s check box to enable ba ndwid[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 25 Bandwidth Managemen t 406 25.1 1 Configuring Class Setup The Class Setup screen displays the configured band wi dth classes by individual interface. Select an interface and click the buttons to pe rform the actions described n ext. Click “+” to expand the class tree or click “-“ to collapse th[...]

ZyWALL 5/35/70 Series User’s Guide 407 Chapter 25 Bandwidth Ma nagement 25.1 1.1 Bandwidth Manager Class Configuration Configure a bandwidth management class in the Class Setup scree n. Y ou must use the Summary screen to en able bandwidth manage ment on an interface before you can confi gure classes for that interface. T o add a child class, cli[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 25 Bandwidth Managemen t 408 Figure 196 Bandwidth Management: Edit Class The following table describes the labels in this screen. Table 143 Bandwidth Management: Edit Class LABEL DESCRIPTION Class Configuration Class Name Use the auto-generated name or en ter a descriptive name of up to 20 alphanumeric c[...]

ZyWALL 5/35/70 Series User’s Guide 409 Chapter 25 Bandwidth Ma nagement Enable Bandwidth Filter Select Enable Bandwid th Filter to have the ZyW ALL use this bandwidth filter when it performs bandwidth management. Y ou must enter a value in at least one of the following fields (other than the Subnet Mask fields which are only avai lable when you e[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 25 Bandwidth Managemen t 410 25.1 1.2 Bandwid th Management St atistics Use the Bandwidth Management S tatistics screen to view network performance information. Click the S tatistics button in the Class Setup screen to open the St a t i s t i c s screen. Apply Click Apply to save your change s back to th[...]

ZyWALL 5/35/70 Series User’s Guide 411 Chapter 25 Bandwidth Manag ement Figure 197 Bandwidth Ma nagement: S tatistics The following table describes the labels in this screen. Table 145 Bandwidth Ma nagement: S tatistics LABEL DESCRIPTION Class Name This field displays the name of the class the statistics page is showing. Budget (kbps) This field [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 25 Bandwidth Managemen t 412 Figure 198 Bandwidth Ma nagement: Monitor The following table describes the labels in this screen. T able 146 Bandwidth Managemen t: Monitor LABEL DESCRIPTION Interface Select an interface from the drop-down list box to view the bandwidth usage of its bandwidth classes. Class[...]

ZyWALL 5/35/70 Series User’s Guide 413 Chapter 25 Bandwidth Ma nagement[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 26 DNS 41 4 C HAPTER 26 DNS This chapter shows you how to configure the DNS screens. 26.1 DNS Overview DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa. The DNS server is extremely impo rtant because without it, you must know the IP address of a machine[...]

ZyWALL 5/35/70 Series User’s Guide 415 Chapter 26 DNS 26.4 Address Record An address record contains the mapping of a fu lly qualified domain na me (FQDN) to an IP address. An FQDN consists of a hos t and doma in name and includes the top-level domain. For example, www .zyxel.com.tw is a fully qualif ie d domain name, where “www” is the host,[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 26 DNS 41 6 Figure 199 Private DNS Server Example Note: If you do not specify an Intranet DNS server on the remote network, then the VPN host must use IP addresses to access the computers on the remote private network. 26.6 System Screen T o configure your ZyW ALL ’ s DNS address and name server record[...]

ZyWALL 5/35/70 Series User’s Guide 417 Chapter 26 DNS Figure 200 System DNS The following table describes the labels in this screen. Table 147 System DNS LABEL DESCRIPTION Address Record An address record specifie s the mapping of a fully qualifie d domain name (FQDN) to an IP address. An FQDN consists of a host and domain name and includes the t[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 26 DNS 41 8 26.6.1 Adding an Address Record Click Add in the System screen to add an address record. Figure 201 System DNS: Add Ad dress Record Name Server Record A name server record contains a DNS server ’s IP address. The Z yW ALL can query the DNS server to resolve domain names for features like VP[...]

ZyWALL 5/35/70 Series User’s Guide 419 Chapter 26 DNS The following table describes the labels in this screen. Table 148 System DNS: Add Address Record LABEL DESCRIPTION FQDN T ype a fully qualified domai n name (FQDN) of a server . An FQDN starts with a host name and continues all the way up to the top-level domain name. For example, www .zyxel.[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 26 DNS 42 0 The following table describes the labels in this screen. Table 149 System DNS: Insert Name Server Reco rd LABEL DESCRIPTION Domain Zone This field is optional. A domain zone is a ful ly qualified dom ain name without the host. For example, zyxel.com.tw is the domain zone for the www .zyxel.co[...]

ZyWALL 5/35/70 Series User’s Guide 421 Chapter 26 DNS 26.8 Configure DNS Cache T o configure your ZyW ALL ’ s DNS caching, click ADV ANCED , DNS , then the Cache tab. The screen appears as shown. Figure 203 DNS Cache The following table describes the labels in this screen. Table 150 DNS Cache LABEL DESCRIPTION DNS Cache Setup Cache Positive DNS[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 26 DNS 42 2 26.9 Configuring DNS DHCP Click ADV ANCED , DNS and then the DHCP tab to open the DNS DHC P screen shown next. Use this screen to configure the DNS serv er information that th e ZyW ALL sends to its LAN, DMZ or WLAN DHCP clients. DNS Cache Entry Flush Click this button to clear the cache manu[...]

ZyWALL 5/35/70 Series User’s Guide 423 Chapter 26 DNS Figure 204 DNS DHCP The following table describes the labels in this screen. Table 151 DNS DHCP LABEL DESCRIPTION DNS Servers Assigned by DHCP Server The ZyW ALL passes a DNS (Domain Name System) server IP address to the DHCP clients. Selected Interface Select an in terface from the drop-down [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 26 DNS 42 4 26.10 Dynamic DNS Dynamic DNS allows you to update your curre nt dynamic IP address with one or many dynamic DNS services so that anyone can c ont act you (in NetMeeting, CU-SeeMe, etc.). Y ou can also access your FTP server or W eb site on your own computer using a domain name (for instance [...]

ZyWALL 5/35/70 Series User’s Guide 425 Chapter 26 DNS Figure 205 DDNS The following table describes the labels in this screen. Table 152 DDNS LABEL DESCRIPTION Account Setup Active Select this check bo x to use dynamic DNS. Service Provider This is the name of your Dynamic DNS service provider . Username Enter your user name. Y ou can use up to 3[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 26 DNS 42 6 W AN Interface Select the W AN port to use for updati ng the IP address of the domain name. IP Address Update Policy Select Use W AN IP Address to have the ZyWALL update the doma in name with the WAN port's IP address. Select Use User-Defined and enter the IP address if you have a static[...]

ZyWALL 5/35/70 Series User’s Guide 427 Chapter 26 DNS[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 27 Remo te Management 428 C HAPTER 27 Remote Management This chapter provides information on the Remote Management screens. 27.1 Remote Management Overview Remote management allows you to determ ine which services/protocols can access which ZyW ALL interface (if any) from which computers. Note: When you [...]

ZyWALL 5/35/70 Series User’s Guide 429 Chapter 27 Remote Manag ement 1 A filter in SMT menu 3.1 (LAN) or in menu 1 1.5 (W AN) is applied to block a T elnet, FTP or W eb service. 2 Y ou have disabled that service in one of the remote management screens. 3 The IP address in the Secure Client IP Addr ess field does not match the client IP address. I[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 27 Remo te Management 430 Figure 206 HTTPS Implement ation Note: If you disable HTTP Server Access ( Disable ) in the REMOTE MGMT WWW screen, then the ZyW ALL blocks all HTTP connection attempts. 27.3 WWW Click ADV ANCED , REMOTE MGMT to open the WWW screen. Use this screen to change your ZyW ALL ’ s w[...]

ZyWALL 5/35/70 Series User’s Guide 431 Chapter 27 Remote Manageme nt Figure 207 WWW The following table describes the labels in this screen. T able 153 WWW LABEL DESCRIPTION HTTPS Server Certificate Select the Server Certificate that the ZyWALL will use to identify itself. The ZyW ALL is the SSL server and must always au thenticate itself to the [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 27 Remo te Management 432 27.4 HTTPS Example If you haven’t changed the default HTTPS port on the ZyW ALL, then in your browser enter “https://ZyW ALL IP Address/” as the web site address where “Z yW ALL IP Address” is the IP address or domain name of the ZyW ALL you wish to access. 27.4.1 Inte[...]

ZyWALL 5/35/70 Series User’s Guide 433 Chapter 27 Remote Manageme nt 27.4.2 Net scape Navigator W arning Messages When you attempt to access the ZyW ALL HTTPS server , a W ebsite Certified by an Unknown Authority screen pops up asking if you trust the server certificate. Click Examine Certificate if you want to verify that th e certificate is fro[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 27 Remo te Management 434 27.4.3 A voiding the Browser W arn ing Messages The following describes the main reasons that your browser displays warnings about the ZyW ALL ’ s HTTPS server certificate and what you can do to avoid seeing the warni ngs. • The issuing certificate authority of the ZyW ALL ?[...]

ZyWALL 5/35/70 Series User’s Guide 435 Chapter 27 Remote Manageme nt Figure 21 1 Login Screen (I nternet Explorer) Figure 212 Login Screen (Netsca pe) Click Login and you then see the next screen. The factory default certificate is a common default certificate for all ZyW ALL models.[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 27 Remo te Management 436 Figure 213 Replace Certificate Click Apply in the Replace Certificate scre en to create a certificate using your ZyW ALL ’ s MAC address that will be spec ific to this device. Click CER TIFICA TES to open the My Certificates screen. Y ou will see information similar to that sh[...]

ZyWALL 5/35/70 Series User’s Guide 437 Chapter 27 Remote Manageme nt Figure 215 Common ZyW ALL Certificate 27.5 SSH Unlike T elnet or FTP , which transmit data in clear text, SSH (Secure Shell) is a secure communication prot ocol that combines authenticatio n and data encryption to provide secure encrypted communication bet ween two hosts over an[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 27 Remo te Management 438 Figure 217 How SSH Works 1 Host Identification The SSH client s ends a conn ection request to the SSH server . The server identifies itself with a host key . The client encrypts a rand omly generated session key with the host key and server key and sends the result back to the s[...]

ZyWALL 5/35/70 Series User’s Guide 439 Chapter 27 Remote Manageme nt 27.7.1 Requirement s for Using SSH Y ou must install an SSH client pr ogram on a client computer (W indows or Linux operating system) that is used to conn ect to the ZyW A LL over SSH. 27.8 Configuring SSH Click ADV ANCED , REMOTE MGMT and then the SSH tab to chang e your ZyW AL[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 27 Remo te Management 440 27.9 Secure T elnet Using SSH Exampl es This section shows two examples using a comm and interface and a graphical interface SSH client program to remotely access the ZyW ALL. The configuration and connection steps are similar for most SSH client pr ograms. Refer to your SSH cli[...]

ZyWALL 5/35/70 Series User’s Guide 441 Chapter 27 Remote Manageme nt Figure 220 SSH Example 2: T est $ telnet 192.168.1.1 22 Trying 192.168.1.1... Connected to 192.168.1.1. Escape character is '^]'. SSH-1.5 -1.0.0 2 Enter “ ssh –1 192.168.1.1 ”. This command forces your computer to connect to the ZyW ALL using SSH version 1. If th[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 27 Remo te Management 442 Figure 222 Secure FTP: Firmware Upload Example $ sftp -1 192.168.1.1 Connecting to 192.168.1.1... The authenticity of host '19 2.168.1.1 (192.168.1.1)' can't be established. RSA1 key fingerprint is 21:6c:07:25:7e:f4:75:80:ec:a f:bd:d4:3d:80:53:d1. Are you sure you[...]

ZyWALL 5/35/70 Series User’s Guide 443 Chapter 27 Remote Manageme nt Figure 224 Te l n e t The following table describes the labels in this screen. Table 155 Te l n e t LABEL DESCRIPTION Server Port Y ou may change the server port number for a se rvice if needed, however you must use the same port numb er in order to use that service for remote m[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 27 Remo te Management 444 Figure 225 FTP The following table describes the labels in this screen. Table 156 FTP LABEL DESCRIPTION Server Port Y ou may change the server port number fo r a service if needed, howe ver you must use the same port number in order to use that service fo r remote management. Se[...]

ZyWALL 5/35/70 Series User’s Guide 445 Chapter 27 Remote Manageme nt Figure 226 SNMP Managemen t Model An SNMP managed network consis ts of two main types of comp onent: agen ts and a m anager . An agent is a management software module th at resi des in a managed device (the ZyW ALL). An agent translates the local management info rmation from the[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 27 Remo te Management 446 27.14.1 Supported MIBs The ZyW ALL support s MIB II that is defined in RFC-1213 and RFC-1 215. The focus of th e MIBs is to let administrators collect statistical data and monitor status and performance. 27.14.2 SNMP T rap s The ZyW ALL will send traps to the SNMP mana ger when [...]

ZyWALL 5/35/70 Series User’s Guide 447 Chapter 27 Remote Manageme nt Figure 227 SNMP The following table describes the labels in this screen. T able 158 SNMP LABEL DESCRIPTION SNMP Configuration Get Community Enter the Get Community , which is the password for the incoming Get and GetNext requests from the management station. The default is publi[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 27 Remo te Management 448 27.15 DNS Use DNS (Domain Name System) to map a domain name to its corresponding IP address and vice versa. Refer to Chapter 7 on page 126 for more information. Click ADV ANCED , REMOTE MGMT and then the DNS tab to change your Zy W ALL ’ s DNS settings. Use this screen to set [...]

ZyWALL 5/35/70 Series User’s Guide 449 Chapter 27 Remote Manageme nt If you allow your ZyW ALL to be managed b y the V antage CNM server , then you shou ld not do any configurat ions directly to the ZyW ALL (using either the web co nfigurator , SMT menus or commands) with out notifyi ng the V antage CNM administrator . 27.17 Configuring CNM V ant[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 27 Remo te Management 450 Last Registration T ime This fi eld displays the last date (year-mo nth-date) and time (hours-minutes- seconds) that the ZyW ALL registered with the V antage CNM server . It displays all zeroes if it has not yet r egistered with the V antage CNM server . Refresh Click Refresh to[...]

ZyWALL 5/35/70 Series User’s Guide 451 Chapter 27 Remote Manag ement[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 28 UPnP 452 C HAPTER 28 UPnP This chapter introduces the Universal Plug and Pl ay feature. This chapter is only applicable when the ZyW ALL is in router mode. 28.1 Universal Plug and Play Overview Universal Plug and Play (UPnP) is a distributed, open networking standard that uses TCP/IP for simple peer-t[...]

ZyWALL 5/35/70 Series User’s Guide 453 Chapter 28 UPnP All UPnP-enabled devices may communicate freely with eac h other without additional configuration. Disable UPnP if this is not your intention. 28.1.4 UPnP and ZyXEL ZyXEL has achieved UPnP certification from th e Universal Plug and Play Forum Creates UPnP™ Implementers Corp. (UIC). ZyXEL&ap[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 28 UPnP 454 28.3 Displaying UPnP Port Mapping Click UPnP and then Ports to display the UPnP Ports screen. Use this s creen to view the NA T port mapping rules that UPnP creates on the ZyW ALL. Not all fields are available on all models. Figure 231 UPnP Ports Allow users to make configuration changes thro[...]

ZyWALL 5/35/70 Series User’s Guide 455 Chapter 28 UPnP The following table describes the labels in this screen. T able 162 UPnP Ports LABEL DESCRIPTION Reserve UPnP NA T rules in flash after system bootup Select this check box to have the ZyW ALL retain UPnP created NA T rules even after rest arting. If you use UPnP and you set a port on your com[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 28 UPnP 456 28.4.1 Inst alling UPnP in Windows Me Follow the steps below to in stall UPnP in W indows Me. 1 Click St a r t , Settings and Contr ol Panel . Double-click Add/Remove Programs . 2 Click on the Win d o ws S et u p tab and select Communication in the Components selection box. Click Details . 3 [...]

ZyWALL 5/35/70 Series User’s Guide 457 Chapter 28 UPnP 28.4.2 Inst alling UPnP in Windows XP Follow the steps below to install UPnP in W indows XP . 1 Click St a r t , Settings and Contr ol Panel . 2 Double-click Network Connections . 3 In the Network Connections window , click Advanced in the main menu and select Optional Networking Components ?[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 28 UPnP 458 28.5.1 Auto-discover Y our UPnP-enabled Network Device 1 Click St a r t and Contr ol Panel . Double- click Network Connections . An icon displays under Internet Gateway . 2 Right-click the icon and select Properties . 3 In the Internet Connection Properties window , click Settings to see the [...]

ZyWALL 5/35/70 Series User’s Guide 459 Chapter 28 UPnP Note: When the UPnP-enabled device is disconnect ed from your computer , all port mappings will be deleted automatically . 4 Select the Show icon in notification area when connected check box and click OK . An icon displays in the system tray . 5 Double-click the icon to display your current [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 28 UPnP 460 Follow the steps below to access the web configurator . 1 Click St a r t and then Contr ol Panel . 2 Double-click Network Connections . 3 Select My Network Places under Other Places . 4 An icon with the d escription for each UPnP-enabled device display s under Local Network . 5 Right-click th[...]

6 Right-click the icon for your ZyXEL device and select Properties . A properties window displays with basic information about the ZyXEL device. ZyWALL 5/35/70 Series User’s Guide 461 Chapter 28 UPnP[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 29 AL G Screen 462 C HAPTER 29 ALG Screen This chapter covers how to use the ZyW ALL ’ s ALG featu re to allow ce rtain applications to pass through the ZyW ALL. 29.1 ALG Introduction The ZyW ALL can function as an Application Laye r Gateway (ALG) to allow certain NA T un- friendly applications (such a[...]

ZyWALL 5/35/70 Series User’s Guide 463 Chapter 29 ALG Screen If the primary W AN connection fa ils, t he client needs to re-i nitialize the conn ection through the secondary W AN port to have th e connection go thro ugh the secondary W AN port. When the ZyW ALL uses both of the W AN ports at the same time, you can configure routing policies to sp[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 29 AL G Screen 464 Figure 232 H.323 ALG Examp le Signaling session over TCP port 1720 Audio session using RTP • W ith multiple W AN IP addresses on the Zy W ALL, you can configure different firewall and port forwarding rules to allow incoming calls from each W AN IP address to go to a specific IP addre[...]

ZyWALL 5/35/70 Series User’s Guide 465 Chapter 29 ALG Scr een Figure 234 H.323 Calls from the WA N with Multiple Outgoing Calls • The H.323 ALG operat es on TCP packets with a port 172 0 destination. • The ZyW ALL allows H.323 audio connections. • The ZyW ALL can also apply bandwidth management to traffic that goes through the H.323 ALG . 2[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 29 AL G Screen 466 The following example shows SIP s ignaling and audio sessions between SIP clients A and B and the SIP server (1). Figure 235 SIP ALG Example Signaling session over UDP port 5060 Audio session using RTP 29.5.3 SIP Signaling Session Ti meout Most SIP clients have an “expire” mechanis[...]

ZyWALL 5/35/70 Series User’s Guide 467 Chapter 29 ALG Scr een Figure 236 ALG The following table describes the labels in this screen. Table 163 ALG LABEL DESCRIPTION Enable FTP ALG Select this check box to allow FTP sessions to pass through the ZyW ALL. FTP (File T ransfer Program) is a program that enable s fa st transfer of files, including lar[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 30 Logs Scre ens 468 C HAPTER 30 Logs Screens This chapter contains inform ation about configuring genera l log settings and viewing the ZyW ALL ’ s logs. Refer to Appendix S on page 770 for example log messa ge explanations. 30.1 Configuring V iew Log The web confi gurator allows you to look at all of[...]

ZyWALL 5/35/70 Series User’s Guide 469 Chapter 3 0 Logs Scre ens The following table describes the labels in this screen. Table 164 V iew Log LABEL DESCRIPTION Display The categories that you select in the Log Settings pa ge (see Section 30.3 on page 471 ) display in the dro p-down list box. Select a category of logs to view; select All Logs to v[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 30 Logs Scre ens 470 30.2.1 Certificate Not T rusted Log Note myZyXEL.com and the update server use certif icate signed by V eriSign to identif y themselves. If the ZyW ALL does not have a CA certificate signed by V eriSign as a trusted CA, the ZyW ALL will not trust the certificate from myZyXEL.com and [...]

ZyWALL 5/35/70 Series User’s Guide 471 Chapter 3 0 Logs Scre ens Figure 239 myZyXEL.com: Certificate Download 30.3 Configuring Log Settings T o change your ZyW ALL ’ s log settings, click LOGS , then the Log Settings tab. The screen appears as shown. Use the Log Settings screen to configure to where the Zy W ALL is to send logs; the schedule fo[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 30 Logs Scre ens 472 Figure 240 Log Settings[...]

ZyWALL 5/35/70 Series User’s Guide 473 Chapter 3 0 Logs Scr eens The following table describes the labels in this screen. T able 166 Log Settings LABEL DESCRIPTION E-mail Log Settings Mail Server Enter the server name or the IP addre ss of the mail server for the e-mail addresses specified below . If this field is left blank, logs and alert messa[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 30 Logs Scre ens 474 30.4 Configuring Report s The Reports p age displays which co mputers on the LAN send and receive the most traffic, what kinds of traffic are used the most and whic h web sites are visited the most often. Use the Reports screen to have the ZyW ALL record and di splay the following ne[...]

ZyWALL 5/35/70 Series User’s Guide 475 Chapter 3 0 Logs Scre ens Figure 241 Report s Note: Enabling the ZyW ALL ’s reporting functio n decreases the overall throughput by about 1 Mbps. The following table describes the labels in this screen. T able 167 Reports LABEL DESCRIPTION Collect S tatistics Select the check box and click Apply to have th[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 30 Logs Scre ens 476 30.4.1 V iewing W eb Site Hit s In the Reports screen, select W eb Site Hits from the Report T ype drop-dow n list box to have the ZyW ALL record and display which web sites have been vis ited the most often and how many times they have been visited. Figure 242 Web Site Hit s Report [...]

ZyWALL 5/35/70 Series User’s Guide 477 Chapter 3 0 Logs Scre ens Figure 243 Protocol/Port Report Example The following table describes the labels in this screen. T able 169 Protocol/ Port Report LABEL DESCRIPTION Protocol/Port This column lists the protocols or servic e ports for which the most traffic has gone through the ZyWALL. The protocols o[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 30 Logs Scre ens 478 30.4.3 V iewing Host IP Address In the Reports screen, select Host IP Address from the Report T ype drop-down list box to have the ZyW ALL record and display the LA N, DMZ or WLAN IP addre sses that the most traffic has been sent to and/or from and how much traffic has been sent to a[...]

ZyWALL 5/35/70 Series User’s Guide 479 Chapter 3 0 Logs Scre ens 30.4.4 Report s Specifications The following table lists detailed specifications on the reports feature. T able 171 Report S pecifications LABEL DESCRIPTION Number of web sites/protocols or ports/IP addresses listed: 20 Hit count limit: Up to 2 32 hits can be counted per web site. T[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 31 Maintenance 480 C HAPTER 31 Maintenance This chapter displays informat ion on the maintenance screens. 31.1 Maintenance Overview The maintenanc e screens can help you view system informa tion, upload new firmware, manage configuratio n and restart your ZyW ALL. 31.2 General Setup 31.2.1 General Setup [...]

ZyWALL 5/35/70 Series User’s Guide 481 Chapter 31 Maintenance Figure 245 General Setup The following table describes the labels in this screen. T able 172 General Setup LABEL DESCRIPTION General Setup System Name Choose a descriptive name for identification pu rposes. It is recommended you enter your computer’s “Compu ter name” in this fiel[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 31 Maintenance 482 Figure 246 Password Setup The following table describes the labels in this screen. T able 173 Password Setup LABEL DESCRIPTION Old Password T ype the default password or the existi ng password you use to access the system in this field. New Password T ype your new system password (up t[...]

ZyWALL 5/35/70 Series User’s Guide 483 Chapter 31 Maintenance Figure 247 T ime and Date The following table describes the labels in this screen. Table 174 T ime and Date LABEL DESCRIPTION Current T ime and Date Current T ime This field displays the ZyWALL ’s present time . Current Date This field displays the ZyW ALL ’s present date. T ime an[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 31 Maintenance 484 Get from Time Server Select this radio button to have the Zy WALL get the time and date from the time server you specified below . T ime Protocol Select the time service protocol that your time server uses. Not all time servers support all protocols, so you may have to check with your [...]

ZyWALL 5/35/70 Series User’s Guide 485 Chapter 31 Maintenance 31.5 Pre-defined NTP T ime Servers List When you turn on the ZyW ALL for the first time, the date an d time start at 20 00-01-01 00:00:00. The ZyW ALL then attempts to synchr onize with one of the following pre-defined list of NTP time servers. The ZyW ALL continues to use the followin[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 31 Maintenance 486 When the System Time and Date Synchr onization in Process screen appears, wait up to one minute. Figure 248 Synchronization in Process Click the Return button to go back to the T ime and Date screen after the time and date is updated successfully . Figure 249 Synchronization is Success[...]

ZyWALL 5/35/70 Series User’s Guide 487 Chapter 31 Maintenance 31.6 Introduction T o T ransp arent Bridging A transparent bridge is invisibl e to the operatio n of a network in that it does not modify the frames it forwards. The bridge checks the source address of incoming frames on the port and learns MAC addresses to associate with that po rt. A[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 31 Maintenance 488 3 As a transparent bridge does not modify the frames it forwards, it is ef fectively “stealth” as it is invisible to attackers. Bridging devices are most useful in complex envi ronments that require a rapid or new firewall deployment. A transparent, bridging firewall can also be go[...]

ZyWALL 5/35/70 Series User’s Guide 489 Chapter 31 Maintenance 31.9 Configuring Device Mode (Bridge) T o configure and have your ZyW ALL work as a router or a bridge, click MAINTENANCE , then the Device Mo de tab. The following applies when the ZyW ALL is in bridge mode. Figure 252 Device Mode (Bridge Mode ) The following table describes the label[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 31 Maintenance 490 31.10 F/W Upload Screen Find firmware at www .zyxel.com in a file that (usually) uses the system model name with a .bin extension, for example, "z ywall.bin". The upload proces s uses HTTP (Hypertext T ransfer Protocol) and may take up to two minutes. Afte r a successful uplo[...]

ZyWALL 5/35/70 Series User’s Guide 491 Chapter 31 Maintenance Figure 253 Firmware Uplo ad The following table describes the labels in this screen. T able 179 Firmware Upload LABEL DESCRIPTION File Path T ype in the loca tion of the file you wa nt to upload i n this field or click Browse ... to find it. Browse... Click Browse... to find th e .bin [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 31 Maintenance 492 Figure 255 Network T emporarily Disconnected After two minutes, log in again and check your new fi rmware version in t he HOME screen. If the upload was not successful, the fo llowing screen will appear . Click Return to go back to the F/W Upload screen. Figure 256 Firmware Uplo ad Err[...]

ZyWALL 5/35/70 Series User’s Guide 493 Chapter 31 Maintenance Figure 257 Backup and Restore 31.1 1.1 Backup Configuration Backup Configurat ion allows you to b ack up (save) the ZyW ALL ’ s current configuration to a file on your computer . Once your ZyW ALL is configured and functioning p roperly , it is highly recommended th at you back up yo[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 31 Maintenance 494 Note: Do not turn of f the ZyW ALL while configuration file upload is in progress. After you see a “restore configuration successf ul” scree n, you must then wait one minute before logging into the ZyW ALL again. Figure 258 Configuration Upload Successful The ZyW ALL automatically [...]

ZyWALL 5/35/70 Series User’s Guide 495 Chapter 31 Maintenance 31.1 1.3 Back to Factory Default s Pressing the Reset button in this section clears al l user-e ntered configuration information and returns the ZyW ALL to its factory defaults as shown on the screen. The following warning screen will appear . Figure 261 Reset W arning Message Y ou can[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 32 Intro ducing the SMT 496 C HAPTER 32 Introducing the SMT This chapter explains how to access the System Management T erminal and gives an overview of its menus. 32.1 Introduction to the SMT T he ZyW ALL ’ s SMT (System Management T ermin al) is a menu-driven interface that you can access from a term[...]

ZyWALL 5/35/70 Series User’s Guide 497 Chapter 32 Intr oducing the S MT Figure 263 Initial Screen Copyright (c) 1994 - 2004 Zy XEL Communications Corp. initialize ch =0, ethernet a ddress: 00:A0:C5:01:23:45 initialize ch =1, ethernet a ddress: 00:A0:C5:01:23:46 initialize ch =2, ethernet a ddress: 00:A0:C5:01:23:47 initialize ch =3, ethernet a dd[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 32 Intro ducing the SMT 498 32.3.1 Main Menu After you enter the passwor d, the SMT displays the ZyW ALL Main Menu , as shown next. This guide uses the ZyW ALL 70 menus as an example. The menus ma y vary slightly for different ZyW ALL models. Not all fields or menus are available on all models. Move to a[...]

ZyWALL 5/35/70 Series User’s Guide 499 Chapter 32 Intr oducing the S MT Figure 265 Main Menu (Router Mo de) Copyright (c) 1994 - 2005 ZyXEL Communications Corp. ZyWALL 70 Main Menu Getting Started Advanced Management 1. General Se tup 21. Filter and Firewall Setup 2. WAN Setup 22. SNMP Configuration 3. LAN Setup 23. System Password 4. Internet Ac[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 32 Intro ducing the SMT 500 32.3.2 SMT Menus Overview The following table gi ves you an overview o f your ZyW ALL ’ s various SMT menus. 3 LAN Setup Use this menu to apply L AN filters, configure LAN DHCP and TC P/IP settings. 4 Internet Access Setu p Configure your Internet access setu p (Internet add[...]

ZyWALL 5/35/70 Series User’s Guide 501 Chapter 32 I ntroducing the S MT 6 Route Setup (for the ZyW ALL 35 and the ZyW ALL 70) 6.1 Route Assessment 6.2 T raffic Redirect 6.3 Route Failover 7 Wireless Setup 7.1 Wireless Setu p 7.1.1 WLAN MAC Address Filter 7.2 TCP/IP and DHCP Ethernet Setup 7.2.1 IP Alias Setup 1 1 Remote Node Setup 1 1.1 Re mote N[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 32 Intro ducing the SMT 502 32.4 Changing the System Password Change the system password by following the steps shown next. 1 Enter 23 in the main menu to open Menu 23 - System Password as shown next. 24 System Maintenance 24.1 System S tatus 24.2 System Information and Console Port S peed 24.2.1 System [...]

ZyWALL 5/35/70 Series User’s Guide 503 Chapter 32 Intr oducing the S MT Figure 267 Menu 23: System Password Menu 23 - System Password Old Password= ? New Password= ? Retype to confirm = ? Enter here to CO NFIRM or ESC to CANCEL: 2 T ype your existing password and p ress [ENTER] . 3 T ype your new system password an d press [ENTER] . 4 Re-type you[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 33 SMT Menu 1 - General Setup 504 C HAPTER 33 SMT Menu 1 - General Setup Menu 1 - General Setup contains administra tive an d system-related information. 33.1 Introduction to General Setup Menu 1 - General Setup contains administra tive an d system-related information. 33.2 Configuring General Setup 1 En[...]

ZyWALL 5/35/70 Series User’s Guide 505 Chapter 33 SMT Menu 1 - Gene ral Setup Figure 269 Menu 1: General Setup (Bridge Mode) Menu 1 - Gener al Setup System Name= Domain Name= Device Mode= Bridge Mode IP Address= 192.168.1.1 Network Mask= 255.255.255.0 Gateway= 0.0.0.0 First System DNS Server IP Address= 0.0.0.0 Second System DNS Server IP Address[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 33 SMT Menu 1 - General Setup 506 33.2.1 Configuring Dynamic DNS T o configure Dynamic DNS, set the ZyW ALL to router mode in menu 1 or in the MAINTENANCE Device Mode screen and go to Menu 1 - General Setup and pres s [SP ACE BAR] to select Ye s in the Edit Dynamic DNS field. Press [ENTER] to display Men[...]

ZyWALL 5/35/70 Series User’s Guide 507 Chapter 33 SMT Menu 1 - Gene ral Setup Figure 271 Menu 1.1.1: Menu 1.1.1 DDN S Host Summary # S ummary --- - --------------------- ---------------------------------- 01 Hostname=ZyWALL, Type=Dynamic,WC=Yes ,Offline=No,Policy=DDNS Server Detect, WAN1, HA=Yes 02 _____________________ __________________________[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 33 SMT Menu 1 - General Setup 508 Figure 272 Menu 1.1.1: Menu 1.1.1 - DD NS Edit Host Hostname= ZyWALL DDNS Type= DynamicDNS Enable Wildcard Option= Yes Enable Off Line Option= N/A Bind WAN= 1 HA= Yes IP Address Update Policy: Let DDNS Server Auto Dete ct= Yes Use User-Defined= N/A Use WAN IP Address= N/[...]

ZyWALL 5/35/70 Series User’s Guide 509 Chapter 33 SMT Menu 1 - Gene ral Setup The IP address updates when you reconfigure menu 1 or perform DHCP client renewal. IP Address Update Policy: Y ou can select Ye s in either the Let D DNS Server Auto Detect field (recommende d) or the Use User-Defined field, but not both. With the Let DDNS Server Auto D[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 34 WAN and Di al Backup Setu p 510 C HAPTER 34 W AN and Dial Backup Setup This chapter describes how to configure the W AN using men u 2 and dial-backup u sing menus 2.1 and 1 1.1. 34.1 Introduction to W AN and Dial Backup Setup This chapter explains how to configure settings for your W AN port and how t[...]

ZyWALL 5/35/70 Series User’s Guide 511 Chap ter 34 WAN and Dial Backup Setup The following table describes the fields in this screen. Table 189 MAC Address Cloning in W AN Setup FIELD DESCRIPTION (W AN 1/2) MAC Address Assigned By Press [SP ACE BAR] and then [ENTER] to choose one of two methods to assign a MAC Address. Choose Fa ctory Default to [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 34 WAN and Di al Backup Setu p 512 Figure 274 Menu 2: Dial Backup Setup Menu 2 - WAN Setup WAN 1 MAC Address: Assigned By= Factory defa ult IP Address= N/A WAN 2 MAC Address: Assigned By= Factory defa ult IP Address= N/A Dial-Backup: Active= No Port Speed= 115200 AT Command String: Init= at&fs0=0 Edi[...]

ZyWALL 5/35/70 Series User’s Guide 513 Chap ter 34 WAN and Dial Backup Setup T o edit the advanced setup for the Dial Backup port, move the cursor to the Edit Advanced Setup field in Menu 2 - W AN Setup , press the [SP ACE BAR] to se lect Ye s and then press [ENTER]. Figure 275 Menu 2.1: Adva nced WAN Setup Menu 2.1 - Advanced WAN Setu p AT Comma[...]

T able 192 Advanced W AN Port Setup: Call Contro l Parameters FIELD DESCRIPTION Call Con trol Dial T imeout (sec ) Enter a number of seconds fo r the ZyW ALL to keep trying to set up an outgoing call before timing out (stopp ing). The ZyWALL times out and stops if it cannot set up an outgoing call within the timeout value. Retry Count Enter a numbe[...]

ZyWALL 5/35/70 Series User’s Guide 515 Chap ter 34 WAN and Dial Backup Setup Figure 276 Menu 1 1.3: Remote N ode Profile (Backup ISP) Menu 11.3 - Remote Node Profile (Backup ISP) Rem Node Name= Edit PPP Options= No Active= No Edit IP= No Outgoing: Edit Script Options= No My Login= ChangeMe My Password= ******** Telco Option: Retype to Confirm= **[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 34 WA N and Dial B ackup Setu p 516 34.7 Editing PPP Options The ZyW ALL ’ s dial back-up feature uses PPP . T o edit the remote node PPP Options, move the cursor to the Edit PPP Options field in Menu 1 1.3 - Remote No de Profile (Backup ISP) , and use the space bar to select Ye s . Press [Enter] to op[...]

ZyWALL 5/35/70 Series User’s Guide 517 Chap ter 34 WAN and Dial Backup Setup Figure 277 Menu 1 1.3.1: Remote Node PPP Options Menu 11.3.1 - Remote Node PPP Options Encapsulation= Standard PPP Compression= No Enter here to CONF IRM or ESC to CANCEL: This table describes the Remote Node PPP Options Menu, and contains instructions on how to configur[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 34 WAN and Di al Backup Setu p 518 Figure 278 Menu 1 1.3.2: Remote Node Network Layer Op tions Menu 11.3.2 - Remote Node Network Layer Options IP Address Assignm ent= Static Rem IP Addr= 0.0.0 .0 Rem Subnet Mask= 0 .0.0.0 My WAN Addr= 0.0.0 .0 Network Address Tr anslation= SUA Only NAT Lookup Set= 25 5 M[...]

ZyWALL 5/35/70 Series User’s Guide 519 Chap ter 34 WAN and Dial Backup Setup 34.9 Editing Login Script For some remote gateways, text login is required before PPP negotiation is started. The ZyW ALL provides a script facility for this purpose. The script has six programmable sets; each set is composed of an ‘Expe ct’ string an d a ‘Send’ [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 34 WAN and Di al Backup Setu p 520 Y ou can use two varia bles, $USERNAME and $PASSWORD (all UPPER case), to re present the actual user name and password in the script, so they will not show in the clear . They are replaced with the outgoing login name and pa ssword in the remote node when the ZyW ALL se[...]

ZyWALL 5/35/70 Series User’s Guide 521 Chap ter 34 WAN and Dial Backup Setup The following table describes the fields in this menu. Table 196 Menu 11.3.3: Remote Node Script FIELD DESCRIPTION Active Press [SP ACE BAR] and then [ENTER] to select either Ye s to enable the A T strings or No to disable them. Set 1-6: Expect Enter an Expect string to [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 35 LAN Set up 522 C HAPTER 35 LAN Setup This chapter describes how to configure the LAN using Menu 3 - LAN Setup . 35.1 Introduction to LAN Setup This chapter describes how to configure the ZyW ALL for LAN and wireless LAN connections. 35.2 Accessing the LAN Menus From the main menu, enter 3 to open Menu[...]

ZyWALL 5/35/70 Series User’s Guide 523 Chapter 35 LAN Setu p Figure 282 Menu 3.1: LAN Port Filter Setu p Menu 3.1 - LAN Port Filter S etup Input Filter Sets: protocol filters= device filters= Output Filter Sets: protocol filters= device filters= Press ENTER to Confirm or ES C to Cancel: 35.4 TCP/IP and DHCP Ethernet Setup Menu From the main menu,[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 35 LAN Set up 524 Figure 284 Menu 3.2: TCP/IP and DHCP Ethernet Setu p Menu 3.2 - TCP/IP and DHCP Ethernet Setup DHCP= Server TCP/IP Setup: Client IP Pool: Starting Address= 192.168. 1.33 IP Address= 192.168.1.1 Size of Client IP Pool= 12 8 IP Subnet Mask= 255.255.255.0 RIP Direction= Both Version= RIP-1[...]

ZyWALL 5/35/70 Series User’s Guide 525 Chapter 35 LAN Setu p Use the instructions in the following table to configure TCP/IP parameters for the LAN port. Note: LAN and DMZ IP addresses must be on sep arate subnets. T able 198 Menu 3.2: LAN TC P/IP Setup Field s FIELD DESCRIPTION TCP/IP Setup: IP Address Enter the IP a ddress of your Zy WA LL in d[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 35 LAN Set up 526 35.4.1 IP Alias Setup IP alias allows you to partition a physical network into dif fer ent logical networks over the same Ethernet interface. The ZyW ALL supports th ree logical LAN interfaces via its single physical Ethernet interface with the ZyW ALL itself as the gateway for ea ch LA[...]

ZyWALL 5/35/70 Series User’s Guide 527 Chapter 35 LAN Setup Outgoing Protocol Filters Enter the filter set(s) you wis h to apply to the outgoin g traffic between this node and the ZyWALL. When you have completed this menu, press [ENTER] at the p rompt [Press ENTER to C onfirm…] to save your configuration, or press [ESC] at any time to cancel. T[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 36 In ternet Access 528 C HAPTER 36 Internet Access This chapter shows you how to config ure your ZyW ALL for Internet access. 36.1 Introduction to Internet Access Setup Use information from your ISP along with the in st ructions in this chapter to set up your ZyW ALL to access the Internet. There are th[...]

ZyWALL 5/35/70 Series User’s Guide 529 Chapter 36 Internet Access The following table describes the fields in this menu. T able 200 Menu 4: Internet Acce ss Setup (Ethernet) FIELD DESCRIPTION ISP’s Name This is the descriptive name of your ISP for identificati on purposes. Encapsulation Press [SP ACE BAR] and then press [ENT ER] to choose Ether[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 36 In ternet Access 530 36.3 Configuring the PPTP Client Note: The ZyW ALL supports only one PP TP server connection at any given time. T o configure a PP TP client, you must configure the My Login and Password fields for a PPP connection and the PP TP parame ters for a PP TP connection. After configurin[...]

ZyWALL 5/35/70 Series User’s Guide 531 Chapter 36 Internet Access Figure 288 Internet Access Setup (PPPoE) Menu 4 - Intern et Access Setup ISP's Name= WAN_1 Encapsulation= PPPoE Service Type= N/A My Login= My Password= ***** *** Retype to Confirm= ******** Idle Timeout= 100 IP Address Assignmen t= Dynamic IP Address= N/A IP Subnet Mask= N/ A[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 37 DMZ Setup 532 C HAPTER 37 DMZ Setup This chapter describes how to co nfigure the ZyW ALL ’ s DMZ using Menu 5 - DMZ Setup . 37.1 Configuring DMZ Setup From the main menu, enter 5 to open Menu 5 – DMZ Setup . Figure 289 Menu 5: DMZ Setup Menu 5 - DMZ Setup 1. DMZ Port Filter Setup 2. TCP/IP and DHC[...]

ZyWALL 5/35/70 Series User’s Guide 533 Chap ter 37 DMZ Setup 37.3.1 IP Address From the main menu, enter 5 to ope n Menu 5 - DMZ Setup to configure TCP/IP (RFC 1 155). Figure 291 Menu 5: DMZ Setup Menu 5 - DMZ Setup 1. DMZ Port Filter Setup 2. TCP/IP and DHCP Setup Enter Menu Selection Number: From menu 5, select th e submenu option 2. TCP/IP and[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 37 DMZ Setup 534 37.3.2 IP Alias Setup Y ou must use menu 5.2 to con figure the first network. Move the cursor to the Edit IP Alias field, press [SP ACE BAR] to choose Ye s and press [ENTER] to configure the second and third network. Pressing [ENTER] opens Menu 5.2.1 - IP Alias Setup , as shown ne xt. Fi[...]

ZyWALL 5/35/70 Series User’s Guide 535 Chap ter 37 DMZ Setup[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 38 Route Setup 536 C HAPTER 38 Route Setup This chapter describes how to configure the ZyW A LL's traffic redirect. This chapter applies to the ZyW ALL 35 and ZyW ALL 70. 38.1 Configuring Route Setup From the main menu, enter 6 to open Menu 6 - Route Setup . Figure 294 Menu 6: Route Setup Menu 6 - R[...]

ZyWALL 5/35/70 Series User’s Guide 537 Chapter 38 Route Setup The following table describes the fields in this menu. Table 203 Menu 6.1: Route Assessment FIELD DESCRIPTION Probing W AN 1/2 Check Point Press [SP ACE BAR] and then press [ENTER] to choose Ye s to test your ZyW ALL's W AN accessibility . If you do not select No in the Use Defaul[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 38 Route Setup 538 38.4 Route Failover This menu allows you to configure how the ZyW ALL uses the rout e assessment ping check function. Figure 297 Menu 6.3: Route Failover Menu 6.3 - Route Failover Period= 5 Timeout=: 3 Fail Tolerance= 3 Press ENTER to Confirm or ES C to Cancel: The following table desc[...]

ZyWALL 5/35/70 Series User’s Guide 539 Chapter 38 Route Setup[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 39 Wi reless Setup 540 C HAPTER 39 Wireless Setup Use menu 7 to set up your ZyW ALL as the wireless access point. 39.1 Wireless LAN Setup Note: If you are configuring the ZyW ALL from a computer connected to the wireless LAN and you change the ZyW ALL ’s ESSID or WEP settings, you will lose your wirele[...]

ZyWALL 5/35/70 Series User’s Guide 541 Chapter 39 Wireless Setup Follow the instructions in the next table on how to configure the wireless LAN parameters. T able 206 Menu 7. 1: Wireless Setup FIELD DESCRIPTION Enable Wireless LAN Press [SP A CE BAR] to select Ye s to turn on the wireless LAN. The wireless LAN is off by default. Configure wireles[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 39 Wi reless Setup 542 39.1.1 MAC Address Filter Setup Y our ZyW ALL checks the MAC address of the wirele ss station device against a list of allowed or denied MAC addresses. However , intruders could fake allowed MAC addresses so MAC- based authentication is less secu re than EAP authentication. Follow [...]

ZyWALL 5/35/70 Series User’s Guide 543 Chapter 39 Wireless Setup 39.2 TCP/IP Setup For more detailed information about RIP setup, IP Multicast and IP alias, please refer to Chapter 5 on page 10 6 . 39.2.1 IP Address From the main menu, enter 7 to open Menu 7 - WLAN Setup to configure TCP/IP (RFC 11 5 5 ) . Figure 300 Menu 7: WLAN Setup Menu 7 - W[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 39 Wi reless Setup 544 Figure 301 Menu 7.2: TCP/IP and DHCP Ethernet Setu p Menu 7.2 - TCP /IP and DHCP Ethernet Setup DHCP= None TCP/IP Setup: Client IP Pool: Starting Address= N/A IP Address= 0.0.0.0 Size of Client IP Poo l= N/A IP Subnet Mask= 0.0.0.0 RIP Direction= None Version= N/A Multicast= IGMP-v[...]

ZyWALL 5/35/70 Series User’s Guide 545 Chapter 39 Wireless Setup Figure 302 Menu 7.2.1: IP Alias Setup Menu 7.2.1 - IP Alias Setup IP Alias 1= No IP Add ress= N/A IP Sub net Mask= N/A RIP Di rection= N/A Vers ion= N/A IP Alias 2= No IP Add ress= N/A IP Sub net Mask= N/A RIP Di rection= N/A Vers ion= N/A Enter here to CO NFIRM or ESC to CANCEL: Re[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 40 Remot e Node Setup 546 C HAPTER 40 Remote Node Setup This chapter shows you how to configure a remote node. 40.1 Introduction to Remote Node Setup A remote node is required for placing calls to a remote gatewa y . A remote node represents both the remote gateway an d the network behind it across a W A[...]

ZyWALL 5/35/70 Series User’s Guide 547 Chapter 40 Remote No de Setup Figure 303 Menu 1 1: Remote Node Setup Menu 11 - Remote Node Setup 1. WAN_1 (ISP, SUA) 2. WAN_2 (ISP, NAT) 3. -Dial (BACKUP_ISP, SUA) Enter Node # to Edit: 40.3 Remote Node Profile Setup The following explains how to configure the re mote node profile menu. Not all fields are av[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 40 Remot e Node Setup 548 The following table describes the fields in this menu. T able 208 Menu 1 1.1: Remote Node Profile for Ethernet Encap sulation FIELD DESCRIPTION Rem Node Name Enter a descriptiv e name for the remote node. This field can be up to eight characters. Active Press [SP ACE BAR] and th[...]

ZyWALL 5/35/70 Series User’s Guide 549 Chapter 40 Remote No de Setup 40.3.2 PPPoE Encap sulation The ZyW ALL supports PPPoE (Point-to-Poi nt Pr otocol over Ethernet). Y ou can only use PPPoE encapsulation when you’re using th e ZyW ALL with a DSL modem as the W AN device. If you change the Encapsulation to PPPoE, then you will see the next scre[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 40 Remot e Node Setup 550 40.3.2.3 Metric See Section 7.5 on page 1 30 for details on the Metric field. T able 209 Fields in Menu 1 1.1 (PPPo E Encapsulation S pecific) FIELD DESCRIPTION Service Name If you are using PPPoE encapsulation, then type the name of your PPPoE service here. Only valid with PPPo[...]

ZyWALL 5/35/70 Series User’s Guide 551 Chapter 40 Remote No de Setup Figure 306 Menu 1 1.1: Remote Node Prof ile for P PTP Encaps ulation Menu 11.1 - Remo te Node Profile Rem Node Name= ChangeMe Route= IP Active= Yes Encapsulation= PPTP Edit IP= No Service Type= Standard Telco Option: Allocated Budget(min)= 0 Outgoing: Period(hr)= 0 My Login= Sch[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 40 Remot e Node Setup 552 Figure 307 Menu 1 1.1.2: Remote Node Network Layer O ptions for Ethernet Encapsulation Menu 11.1.2 - Remote Node Network Layer Options IP Address Assignm ent= Dynamic Rem IP Addr= N/A Rem Subnet Mask= N /A My WAN Addr= N/A Network Address Tr anslation= SUA Only NAT Lookup Set= 2[...]

ZyWALL 5/35/70 Series User’s Guide 553 Chapter 40 Remote No de Setup 40.5 Remote Node Filter Move the cu rsor to the field Edit Filter Sets in menu 1 1.1, and then press [SP ACE BAR] to set the value to Ye s . Press [ENTER] to open Menu 1 1.1.4 - Remote Node Filter . Use menu 1 1.1.4 to specify the filter set(s) to apply to the incoming and outgo[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 40 Remot e Node Setup 554 Figure 308 Menu 1 1.1.4: Remote Node Filter (Ethernet Encap sulation) Menu 11.1.4 - Remote Node Fi lter Input Filter Sets: protocol filters= device filters= Output Filter Sets: protocol filters= device filters= Enter here to CONFIRM or ESC to CANCEL: Figure 309 Menu 1 1.1.4: Rem[...]

ZyWALL 5/35/70 Series User’s Guide 555 Chapter 40 Remote No de Setup Figure 310 Menu 1 1.1.5: T raf fic Redirect Menu 11.1.5 - Traffic Redire ct Setup Active= Yes Configuration: Backup Gateway IP Address= 0 .0.0.0 Metric= 14 Check WAN IP Address= 0.0.0. 0 Fail Tolerance= 10 Period(sec)= 300 Timeout(sec)= 8 Press ENTER to Confirm or ESC to Cancel:[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 41 IP Static Ro ute Setup 556 C HAPTER 41 IP S t atic Route Setup This chapter shows you how to config ure static routes with your ZyW ALL. 41.1 IP S t atic Route Setup Enter 12 from the main menu. Select one of the IP static routes as shown next to configure IP static routes in menu 12.1. Note: The firs[...]

ZyWALL 5/35/70 Series User’s Guide 557 Chapter 41 IP Static Route Setup Figure 312 Menu 12. 1: Edit IP S tatic Route Menu 12.1 - Edit IP Static R oute Route #: 3 Route Name= ? Active= No Destination IP Address= ? IP Subnet Mask= ? Gateway IP Address= ? Metric= 2 Private= No Press ENTER to CONFIRM or ES C to CANCEL: `The following table describes [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 42 Network Address Translation (NAT) 558 C HAPTER 42 Network Address T ranslation (NA T) This chapter discusses how to configure NA T on the ZyW ALL. 42.1 Using NA T Note: Y ou must create a firewall rule in ad dition to setting up SUA/NA T , to allow traffic from the W AN to be forwarded through the Z y[...]

ZyWALL 5/35/70 Series User’s Guide 559 Chapter 42 Network Addr ess Translation (NAT) Figure 313 Menu 4: Applying NA T for Internet Access Menu 4 - Internet Access Set up ISP's Name= ChangeMe Encapsulation= Ethernet Service Type= Standard My Login= N/A My Password= N/A Retype to Confirm= N/A Login Server= N/A Relogin Every (min)= N/A IP Addre[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 42 Network Address Translation (NAT) 560 The following table describes the fields in this menu. T able 214 Applying NA T in Menus 4 & 1 1.1.2 FIELD DESCRIPTION OPTIONS Network Address T ranslation When you select this option the SMT will use Address Mapping Set 1 (menu 15.1 - see Section 42.2.1 on pa[...]

ZyWALL 5/35/70 Series User’s Guide 561 Chapter 42 Network Addr ess Translation (NAT) 42.2.1 Address Mapping Set s Enter 1 to bring up Menu 15.1 - Addr ess Mapping Sets . Figure 316 Menu 15.1: Address Ma pping Sets Menu 15.1 - Address Mapping Sets 1. NAT_SET 2. example 255. SUA (read only) Enter Menu Selection Number: 42.2.1.1 SUA Address Mapping [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 42 Network Address Translation (NAT) 562 Note: Menu 15.1.255 is read-only . T able 215 SUA Address Mapping Rules FIELD DESCRIPTION Set Name This is the name of the set you selected in menu 15.1 or enter the name of a new set you want to create. Idx This is the index or rule number . Local S tart IP Local[...]

ZyWALL 5/35/70 Series User’s Guide 563 Chapter 42 Network Addr ess Translation (NAT) Figure 318 Menu 15.1.1: First Set Menu 15 .1.1 - Address Mapping Rules Set Name= NAT_SET Idx Local St art IP Local End IP Global S tart IP Global End IP Type --- --------------- -------------- - --------------- --------------- -- 1. 0.0.0.0 255.255.255.255 0.0.0.[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 42 Network Address Translation (NAT) 564 Note: Y ou must press [ENTER] at the bottom of the screen to save the whole set. Y ou must do this again if you make any changes to the set – including deleting a rule. No changes to the set t ake place until t his action is taken. Selecting Edit in the Action f[...]

ZyWALL 5/35/70 Series User’s Guide 565 Chapter 42 Network Addr ess Translation (NAT) 42.3 Configuring a Server behind NA T Note: If you do not assign a Default Serve r IP address, the ZyW ALL discards all packet s received for port s that are not specified here or in th e remote management setup. Follow these steps to config ure a server behind N[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 42 Network Address Translation (NAT) 566 Figure 321 Menu 15.2.1: NA T Server Se ts Menu 15 .2.1 - NAT Server Setup Default S erver: 0.0.0.0 Rule Act. Star t Port End Port IP Address ------------------ ------------------------------------ 001 No 0 0 0.0.0.0 002 No 0 0 0.0.0.0 003 No 0 0 0.0.0.0 004 No 0 0[...]

ZyWALL 5/35/70 Series User’s Guide 567 Chapter 42 Network Addr ess Translation (NAT) Figure 322 15.2.1.2: NA T Server Confi guration 15.2.1.2 - NAT Server Config uration Wan= 1 Index= 2 --------------------------- --------------------- Name= 1 Active= Yes Start port= 21 End port= 25 IP Address= 192.168.1.3 3 Press ENTER to Confirm or ES C to Canc[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 42 Network Address Translation (NAT) 568 Figure 323 Menu 15.2.1: NA T Server Se tup Menu 15.2.1 - NAT Server Setup Default Server: 0.0.0.0 Rule Act. St art Port End Port IP Address ---------------- -------------------------------------- 001 No 0 0 0.0.0.0 002 Yes 21 25 192.168.1.33 003 No 0 0 0.0.0.0 004[...]

ZyWALL 5/35/70 Series User’s Guide 569 Chapter 42 Network Addr ess Translation (NAT) Figure 325 NA T Exam ple 1 Figure 326 Menu 4: Internet Access & NA T Example Menu 4 - Internet Access Set up ISP's Name= ChangeMe Encapsulation= Ethernet Service Type= Standard My Login= N/A My Password= N/A Retype to Confirm= N/A Login Server= N/A Relog[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 42 Network Address Translation (NAT) 570 42.4.2 Example 2: Interne t Access with an Default Server Figure 327 NA T Exam ple 2 In this case, you do exactly as above (use the convenient pre-configured SUA Only set) and also go to menu 15.2.1 to specify the Default Server behind the NA T as sh own in the ne[...]

ZyWALL 5/35/70 Series User’s Guide 571 Chapter 42 Network Addr ess Translation (NAT) 1 Map the first IGA to the first inside FTP server for FTP t raf fic in both directions ( 1 : 1 mapping, giving bo th local and global IP addresses). 2 Map the second IGA to our second inside FTP server for FTP traffic in both directions ( 1 : 1 mapping, giving b[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 42 Network Address Translation (NAT) 572 Figure 330 Example 3: Menu 1 1.1.2 Menu 11.1.2 - Remote Node Ne twork Layer Options IP Address Assignme nt= Dynamic IP Address= N/A IP Subnet Mask= N/A Gateway IP Addr= N/ A Network Address Translation = SUA Only Metric= 2 Private= RIP Direction= None Version= N/A[...]

ZyWALL 5/35/70 Series User’s Guide 573 Chapter 42 Network Addr ess Translation (NAT) Figure 332 Example 3: Final Menu 15.1.1 Menu 15.1 .1 - Address Mapping Rules Set Name= Example3 Idx Local Start IP Local End IP Global Start IP Global End IP Type --- --------------- ---- ----------- --------------- ---------- ----- --- 1. 192.168.1.10 10.132.50.[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 42 Network Address Translation (NAT) 574 42.4.4 Example 4: NA T Unfr iendly Application Programs Some applications do not support NA T Mapping using TCP or UDP port address translation. In this case it is better to use Many-One-to-One mapping as port numbers do not chan ge for Many-One-to-One (and One-to[...]

ZyWALL 5/35/70 Series User’s Guide 575 Chapter 42 Network Addr ess Translation (NAT) Figure 336 Example 4: Menu 15.1.1: Address Mapping Rules Menu 15.1.1 - Address Mapping Rules Set Name= Example4 Idx Local Start IP Local End IP Global Start IP Global End IP Type --- --------------- ---- ----------- --------------- ---------- ----- --- 1. 192.168[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 42 Network Address Translation (NAT) 576 Note: Only one LAN computer can use a trigge r port (range) at a time. Enter 3 in menu 15 to display Menu 15.3 - T rigger Ports . For a ZyW ALL with multiple W AN ports, enter 1 or 2 from me nu 15.3 to go to Menu 15.3.1 or Menu 15.3.2 - T rigger Port Setup and con[...]

ZyWALL 5/35/70 Series User’s Guide 577 Chapter 42 Network Addr ess Translation (NAT)[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 43 Introducin g the ZyWALL Firewall 578 C HAPTER 43 Introducing the ZyW ALL Firewall This chapter shows you how to ge t started with the ZyW ALL firewall. 43.1 Using ZyW ALL SMT Menus From the main menu enter 21 to go to Menu 21 - Filter Set and Firewall Configuration to display the screen shown next. Fi[...]

ZyWALL 5/35/70 Series User’s Guide 579 Chapter 43 Introduc ing the ZyWALL Firewall Figure 339 Menu 21.2: Fi rewall Setup Menu 21.2 - Fir ewall Setup The firewall protects agains t Denial of Service (DoS) attacks when it is active. Your network is vulnerable t o attacks when the firewall is turned off. Refer to the User's Guide fo r details a[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 44 Filter Configuration 580 C HAPTER 44 Filter Configuration This chapter shows you how to create and apply filters. 44.1 Introduction to Filters Y our ZyW ALL uses filte rs to decide whether to a llow passage of a data packet a nd/or to make a call. There are two types of filter applications : data filt[...]

ZyWALL 5/35/70 Series User’s Guide 581 Chapter 44 Filter Configuration 44.1.1 The Filter Structure of the ZyW AL L A filter set consists of one or more filter rules. Usually , you would group related rules, e.g., all the rules for NetBIOS, into a single set and give it a descriptive name. The ZyW ALL allows you to configure up to twelve filte r s[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 44 Filter Configuration 582 Figure 341 Filter Rule Process Y ou can apply up to four filter sets to a particular port to block multiple types of packets. W ith each filter set having up to six rules, you can have a maximum of 24 rules active for a single port.[...]

ZyWALL 5/35/70 Series User’s Guide 583 Chapter 44 Filter Configuratio n 44.2 Configuring a Filter Set The ZyW ALL includes filtering for NetBIOS over TCP/IP packets by default. T o configure another filter set, follow the procedure below . 1 Enter 21 in the main me nu to open menu 2 1. Figure 342 Menu 21: Filter and Firewa ll Setup Menu 21 - Filt[...]

T able 220 Abbreviations Used in the Filter Rules Summary Menu FIELD DESCRIPTION A Active: “Y” means the rule is active . “N” means the rule is inactive. Ty p e The type of filter rule: “GEN” for Generic, “IP” for TCP/IP . Filter Rules These parameters are displayed here. M More. “Y” means there are more rules to check wh ich fo[...]

ZyWALL 5/35/70 Series User’s Guide 585 Chapter 44 Filter Configuratio n T o speed up filtering, all rules in a filter set must be of the same class, i.e., protocol filters or generic filters. The class of a filter set is determined by the firs t rule that you create. When applying the filter sets to a port , separate menu fields are prov ided for[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 44 Filter Configuration 586 The following figure illustrates th e logic flow of an IP filter . Destination IP Addr Enter the destinati on IP Address of the packet you wish to filter. This field is ignored if it is 0.0.0. 0. IP Mask Enter the IP mask to apply to the Destination: IP Addr . Port # Enter the[...]

ZyWALL 5/35/70 Series User’s Guide 587 Chapter 44 Filter Configuratio n Figure 345 Executing an IP Filter 44.2.3 Configuring a Generic Filter Rule This section shows y ou how to config ure a generi c filter rule. The purpose of generic rules is[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 44 Filter Configuration 588 to allow you to filter non-IP packets. For IP , it is generally easier to us e the IP rules directly . For generic rules, the ZyW ALL treats a packet as a byte stream as opposed to an IP or IPX packet. Y o u specify the portion of the packet to check with the Offset (from 0) a[...]

ZyWALL 5/35/70 Series User’s Guide 589 Chapter 44 Filter Configuratio n 44.3 Example Filter Let’ s look at an example to block outside us ers from accessing the ZyW ALL via telnet. Please see our included disk for more example filters. Figure 347 T elnet Filter Example 1 Enter 21 from the main menu to open Menu 21 - Filter and Firewall Setup . [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 44 Filter Configuration 590 Figure 348 Example Filter: Menu 21 .1.3.1 Menu 21.1. 3.1 - TCP/IP Filter Rule Filter #: 3,1 Filter Type= TCP/IP Filter R ule Active= Yes IP Protocol= 6 IP Source Route= No Destination: IP Addr= 0.0.0. 0 IP Mask= 0.0.0. 0 Port #= 23 Port # Comp= Equal Source: IP Addr= 0.0.0. 0 [...]

ZyWALL 5/35/70 Series User’s Guide 591 Chapter 44 Filter Configuratio n M = N means an action can be taken immediately . The action is to drop the packet ( m = D ) if the action is matched and to fo rward the packet immediately ( n = F ) if the action is not matched no matter whe ther there are more rules to be checked (there aren’ t in this ex[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 44 Filter Configuration 592 44.6 Applying a Filter This section shows you where to apply the filter(s) after you design it (them). The ZyW ALL already has filters to prevent NetBIOS traffic fro m triggering calls, and block incoming telnet, FTP and HTTP connections. Note: If you do not activate the firew[...]

ZyWALL 5/35/70 Series User’s Guide 593 Chapter 44 Filter Configuratio n Figure 352 Filtering DMZ T raffic Menu 5.1 - DMZ Port Fil ter Setup Input Filter Sets: protocol filters= device filters= Output Filter Sets: protocol filters= device filters= Press ENTER to Confirm or ES C to Cancel: 44.6.3 Applying Re mote Node Filters Go to menu 1 1.1.4 (sh[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 45 SNMP Configuration 594 C HAPTER 45 SNMP Configuration This chapter explains SNMP configuratio n menu 22. 45.1 SNMP Configuration T o configure SNMP , enter 22 from the main menu to display Menu 22 - SNMP Configuration as shown next. The “community” for Get , Set and Tr a p fields is SNMP terminolo[...]

ZyWALL 5/35/70 Series User’s Guide 595 Chapter 45 SNMP Configu ration 45.2 SNMP T rap s The ZyW ALL will send traps to the SNMP mana ger when any one of the following events occurs: T able 225 SNMP Trap s T RAP # T RAP NAME DESCRIPTION 0 coldS tart (defined in RFC-1215 ) A trap is sent after booting (power on). 1 warmS tart (defined in RFC-1215 )[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 46 System Info rmation & Diagnosis 596 C HAPTER 46 System Information & Diagnosis This chapter covers SMT menus 24.1 to 24.4. 46.1 Introduction to System St atus This chapter covers the diagnostic tools that he lp you to maintain your ZyW ALL. These tools include updates on system status, port st[...]

ZyWALL 5/35/70 Series User’s Guide 597 Chapter 46 System Information & Diagnosis 3 There are three commands in Menu 24.1 - System Maintenance - S tatus . Entering 1 drops the W AN co nnection, 9 resets the co unters and [ESC] takes you back to the previous screen. Figure 356 Menu 24.1: System Maintenance: S tatus Menu 24.1 - System Maintenanc[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 46 System Info rmation & Diagnosis 598 46.3 System Information and Console Port S peed This section describes your system and allows you to choose different console port speeds. T o get to the System Informa tion and Console Port Speed: 1 Enter 24 to go to Menu 24 - System Maintenance . 2 Enter 2 to [...]

ZyWALL 5/35/70 Series User’s Guide 599 Chapter 46 System Information & Diagnosis Figure 358 Menu 24.2.1: System Ma intenance: Informatio n Menu 24.2.1 - System Mai ntenance - Information Name: Routing: IP ZyNOS F/W Version: V4.00 (WM.0)b2 | 07/25/2005 Country Code: 255 LAN Ethernet Address: 00:A 0:C5:01:23:45 IP Address: 192.168.1. 1 IP Mask:[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 46 System Info rmation & Diagnosis 600 Figure 359 Menu 24.2.2: System Maintenance: Change Cons ole Port S peed Menu 24.2.2 - System Mainten ance - Change Console Port Speed Console Por t Speed: 9600 Press ENTER t o Confirm or ESC to Cancel:Press Space Bar to Toggle. 46.4 Log and T race There are two [...]

ZyWALL 5/35/70 Series User’s Guide 601 Chapter 46 System Information & Diagnosis Figure 361 Examples of Error and Information Messages 52 Thu Jul 1 05:54:53 2004 PP05 ERROR Wireless LAN init fail, code= 15 53 Thu Jul 1 05:54:53 2004 PINI INFO Channel 0 ok 54 Thu Jul 1 05:54:56 2004 PP05 -WARN SNMP TRAP 3: interface 3: link up 55 Thu Jul 1 05:[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 46 System Info rmation & Diagnosis 602 Y our ZyW ALL sends five types of syslog messages . Some examples (not all ZyW ALL specific) of these syslog messages with their message formats are shown next: 1 CDR CDR Message Format SdcmdSyslogSend( SYSLOG_CDR, SYSLOG_INFO, String ); String = board xx line x[...]

Filter log Message Format SdcmdSyslogSend(SYSLOG_FILLOG, SYSLOG_NOTICE, String ); String = IP[Src=xx.xx.xx.xx Dst=xx.xx.xx.xx prot spo=xxxx dpo=xxxx] S04>R01mD IP[…] is the packet header and S04>R01mD means filter set 4 (S) and rule 1 (R), match (m) drop (D). Src: Source Address Dst: Destination Address prot: Protocol ("TCP","[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 46 System Info rmation & Diagnosis 604 46.4.3 Call-T riggering Packet Call-T riggering Packet displays information about the packet that triggered a dial-out call in an easy readable format. Equiva lent information is available in menu 24.1 in hex format. An example is shown next. Figure 363 Call-T r[...]

ZyWALL 5/35/70 Series User’s Guide 605 Chapter 46 System Information & Diagnosis 1 From the main menu, select option 24 to open Menu 24 - System Maintenance . 2 From this menu, select option 4. Diagnostic. This will open Menu 24.4 - System Maintenance - Diagnostic . Figure 364 Menu 24.4: System Maintenance: Diagnostic Menu 24.4 - System Maint[...]

T able 229 System Maintenance Menu D iagnostic FIELD DESCRIPTION Ping Host Enter 1 to ping any machine (with an IP address) on your LAN o r W AN. Enter its IP address in the Host IP Address field below . W AN DHCP Release Ente r 2 to release your W AN DHCP settings. W AN DHCP Renewal Enter 3 to renew your WAN DHCP settings. Internet Setu p T est En[...]

ZyWALL 5/35/70 Series User’s Guide 607 Chapter 46 System Information & Diagnosis[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 47 Firm ware and Configuration File Maintenance 608 C HAPTER 47 Firmware and Configuration File Maintenance This chapter tells you how t o back up and rest ore your configuration file as well as upload new firmware and a new configura tion file. 47.1 Introduction Use the instructions in this chapter to c[...]

ZyWALL 5/35/70 Series User’s Guide 609 Chapter 47 Firmw are and Configu ration File Maint enance The following table is a summary . Please note that the internal filename refe rs to the filename on the ZyW ALL and the external filename refers to the filename not on the ZyW ALL, that is, on your computer , local network or FTP site and so the name[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 47 Firmwa re and Configuration File Maintenance 610 Figure 366 T elnet into M enu 24.5 Menu 2 4.5 - Backup Configuration To transfer the configuration fi le to your workstation, follow the procedure below: 1. Launch the FTP client on your workstation. 2. Type "open" and the IP address of your r[...]

ZyWALL 5/35/70 Series User’s Guide 611 Chapter 47 Firmw are and Configu ration File Maint enance 47.3.3 Example of FTP Comm ands from the Command Line Figure 367 FTP Session Example 331 Enter PASS command Password: 230 Logged in ftp> bin 200 Type I OK ftp> get rom-0 zyxel.rom 200 Port command okay 150 Opening data connection for STOR ras 22[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 47 Firm ware and Configuration File Maintenance 612 4 The IP you entered in the Secured Client IP field in menu 24.1 1 does not match th e client IP . If it does not match, the Zy W ALL will disconnect the T elnet session immediately . 5 Y ou have an SMT console session running. 47.3.6 Backup Configurati[...]

ZyWALL 5/35/70 Series User’s Guide 613 Chapter 47 Firmw are and Configu ration File Maint enance 47.3.8 GUI-based TFTP Client s The following table describes some of the fiel ds that you may see in GUI-based TFTP clients. T able 232 General Commands for GUI-based TFTP Clients COMMAND DESCRIPTION Host Enter the IP address of the ZyW ALL. 1 92.168.[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 47 Firmwa re and Configuration File Maintenance 614 Figure 370 Backup Configuration Example T ype a location for storing the configuration file or click Br owse to look for one. Choose the Xmodem prot ocol. Then click Receive . 4 After a successful backup you will see the following screen. Pr ess any key[...]

ZyWALL 5/35/70 Series User’s Guide 615 Chapter 47 Firmw are and Configu ration File Maint enance Figure 372 T elnet into M enu 24.6 Menu 24.6 -- System Maintenance - Restore Configuration To transfer the firmware and configuration file to your workstation, follow the procedure below: 1. Launch the FTP client on your workstation. 2. Type "ope[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 47 Firmwa re and Configuration File Maintenance 616 47.4.2 Restore Usin g FTP Session Ex ample Figure 373 Restore Using FTP Session Example ftp> put config.rom rom-0 200 Port command okay 150 Opening data connection for STOR rom-0 226 File received OK 221 Goodbye for writing flash ftp: 16384 bytes sen[...]

ZyWALL 5/35/70 Series User’s Guide 617 Chapter 47 Firmw are and Configu ration File Maint enance 4 After a successful restoration you will see the following screen. Press any key to restart the ZyW ALL and return to the SMT menu. Figure 377 Successful Restoration Confirmation Screen Save to ROM Hit any key to start system reboot. 47.5 Uploading F[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 47 Firmwa re and Configuration File Maintenance 618 Figure 378 T elnet Into Menu 24.7.1: Upload System Firmware Menu 24.7.1 - System Ma intenance - Upload System Firmware To upload the system firmwar e, follow the procedure below: 1. Launch the FTP client o n your workstation. 2. Type "open" an[...]

ZyWALL 5/35/70 Series User’s Guide 619 Chapter 47 Firmw are and Configu ration File Maint enance 47.5.3 FTP File Upload Comman d from the DOS Prompt Example 1 Launch the FTP client on your computer . 2 Enter “open”, followed by a space and the IP address of your ZyW ALL. 3 Press [ENTER] when prompted for a username. 4 Enter your password as r[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 47 Firm ware and Configuration File Maintenance 620 1 Use telnet from your computer to connect to the ZyW ALL and log in. Because TFTP does not have any security checks, the ZyW A LL records the IP address of the telnet client and accepts TFTP request s only from this address. 2 Put the SMT in command in[...]

ZyWALL 5/35/70 Series User’s Guide 621 Chapter 47 Firmw are and Configu ration File Maint enance Figure 381 Menu 24.7.1 As Seen Using th e Console Port Menu 24.7.1 - System Maintenance - Upload System Firmware To upload system firmware: 1. Enter "y" at the prompt b elow to go into debug mode. 2. Enter "atur" after "Enter [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 47 Firmwa re and Configuration File Maintenance 622 Figure 383 Menu 24.7.2 As Seen Using th e Console Port Menu 24.7.2 - System Mainten ance - Upload System Configuration File To upload system configurati on file: 1. Enter "y" at the prompt b elow to go into debug mode. 2. Enter "atlc"[...]

ZyWALL 5/35/70 Series User’s Guide 623 Chapter 47 Firmw are and Configu ration File Maint enance[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 48 System Maintenance Menu s 8 to 10 624 C HAPTER 48 System Maintenance Menus 8 to 10 This chapter leads you through SM T menus 24.8 to 24. 10. 48.1 Command Interpreter Mode The Command Interpre ter (CI) is a part of the main router firmware. The CI provides much of the same functionality as the SMT , wh[...]

ZyWALL 5/35/70 Series User’s Guide 625 Chapter 48 System Maintenance Menus 8 to 10 The required fields in a co mmand ar e enclosed in angle brac kets <> . The optional fields in a c ommand are enclosed in square brackets [] . The | symbol means “or”. For example, sys filter netbios config <type> <on|off> means that you must [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 48 System Maintenance Menu s 8 to 10 626 48.2 Call Control Support The ZyW ALL provides two call control fu nctions: budget management and call hi story . Please note that this menu is only applicable when Encapsulation is set to PPPoE or PPTP in menu 4 or menu 1 1.1. The budget management func tion allo[...]

ZyWALL 5/35/70 Series User’s Guide 627 Chapter 48 System Maintenance Menus 8 to 10 Figure 388 Budget Management Menu 24.9.1 - Bu dget Management Remote Node Connection T ime/Total Budget Elapsed Time/Total Per iod 1.WAN_1 No Budget No Budget 2.WAN_2 No Budget No Budget 3.Dial No Budget No Budget Reset Node (0 to update screen): The total budget i[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 48 System Maintenance Menu s 8 to 10 628 Figure 389 Call History Menu 24.9.2 - Call History Phone Number Dir Rate #call Max Min Total 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. Enter Entry to Delete(0 to e xit): The following table describes the fields in this screen. T able 235 Call History FIELD DESCRIPTION Phone [...]

ZyWALL 5/35/70 Series User’s Guide 629 Chapter 48 System Maintenance Menus 8 to 10 Figure 390 Menu 24: System Maintenan ce Menu 24 - System Maint enance 1. System Status 2. System Information and Console Port Speed 3. Log and Trace 4. Diagnostic 5. Backup Configuration 6. Restore Configuration 7. Upload Firmware 8. Command Interpreter Mod e 9. Ca[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 48 System Maintenance Menus 8 to 10 63 0 T able 236 Menu 24 .10 System Maint enan ce: Time and Date Setting FIELD DESCRIPTION T ime Protocol Enter the time service proto col that your timeserver uses. Not all time servers support all protocols, so you may ha ve to check with your ISP/network administrato[...]

ZyWALL 5/35/70 Series User’s Guide 631 Chapter 48 System Maintenance Menus 8 to 10 End Date (mm- nth-week-hr) Configure the day and time when Dayli ght Saving Time ends if you selected Ye s in the Daylight Saving fi eld. The hr field uses the 24 hour format. Here are a couple of examples: Daylight Saving T ime ends in the United St ates on the la[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 49 Remo te Management 632 C HAPTER 49 Remote Management This chapter covers remote management found in SMT menu 24.1 1. 49.1 Remote Management Remote management allows you to determ ine which services/protocols can access which ZyW ALL interface (if any) from which computers. Y ou may manage your ZyW ALL[...]

ZyWALL 5/35/70 Series User’s Guide 633 Chapter 49 Remote Manageme nt Figure 392 Menu 24.1 1 – Remote Manage ment Contro l Menu 24.11 - Remote Management Control TELNET Server: Port = 23 Access = ALL Secure Cl ient IP = 0.0.0.0 FTP Server: Port = 21 Access = ALL Secure Cl ient IP = 0.0.0.0 SSH Server: Certifica te = auto_generated_self_signed_ce[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 49 Remo te Management 634 49.1.1 Remote Management Limit ations Remote management over LAN or W AN will not work when: 1 A filter in menu 3.1 (LAN) or in menu 1 1.5 (W AN) is applied to block a T elnet, FTP or W eb service. 2 Y ou have disabled that service in menu 24.1 1. 3 The IP address in the Secure [...]

ZyWALL 5/35/70 Series User’s Guide 635 Chapter 49 Remote Manag ement[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 50 IP Policy Routing 636 C HAPTER 50 IP Policy Routing This chapter covers setting and ap plying policies used for IP routing. This chapter applies to the ZyW ALL 35 and ZyW ALL 70. 50.1 IP Routing Policy Summary Menu 25 shows the summary of a policy rule, including the criteria and the action of a si ng[...]

ZyWALL 5/35/70 Series User’s Guide 637 Chapter 50 IP Policy Routing 50.2 IP Routing Policy Setup T o setup a routing policy , perform the following procedures: Criteria/Action This displays the details about to which packets the policy applies and how the policy has the Zy W ALL handle those packets. Refer to T able 239 on page 637 for detailed i[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 50 IP Policy Routing 638 1 T ype 25 in the main menu to open Menu 25 - IP Routing Policy Summary . 2 Select Edit in the Select Command field; type the index number of the rule you want to configure in th e Select Rule field and press [ENTER] to open Menu 25.1 - IP Routing Policy Setup (see the next figur[...]

ZyWALL 5/35/70 Series User’s Guide 639 Chapter 50 IP Policy Routing 50.2.1 Applying Policy to Packet s T o apply the policy to packets received on the selected interface (s), go to Menu 25.1: IP Routing Policy Setup and press [SP ACE BAR] to select Ye s in the Edit policy to packets received fr om field. Press [ENTER] to display Menu 25.1.1 - IP [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 50 IP Policy Routing 640 Figure 395 Menu 25.1.1: IP Routing Policy Setup Menu 25.1.1 - IP Routing Po licy Setup Apply policy to packets received from: LAN= No DMZ= No WLAN= No ALL WAN= Yes Selected Rem ote Node index= N/A Press ENTER to Confirm or ES C to Cancel: The following table describes the fields [...]

ZyWALL 5/35/70 Series User’s Guide 641 Chapter 50 IP Policy Routing Figure 396 Example of IP Policy Routing T o force W eb packets coming from clients with IP addresses of 192.168.1.33 to 192.168.1.64 to be routed to the Internet via the W AN port of the ZyW ALL, follow the steps as shown next. 1 Create a rule in Menu 25.1 - IP Routing Policy Set[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 50 IP Policy Routing 642 4 Create another rule in menu 25 .1 for this rule to route pa ckets from any host (IP= 0.0.0.0 means any host) with protocol TCP and port FTP access through another gateway (192.168.1.100). Figure 398 IP Routing Policy Example 2 Menu 25.1 - IP Routing Poli cy Setup Rule Index= 2 [...]

ZyWALL 5/35/70 Series User’s Guide 643 Chapter 50 IP Policy Routing[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 51 Call Scheduling 644 C HAPTER 51 Call Scheduling Call scheduling allows you to dictate when a re mote node sho uld be called and for how l ong. 51.1 Introduction to Call Scheduling The call scheduling feature allows the ZyW ALL to manage a remote node and dictate when a remote node should be called and[...]

ZyWALL 5/35/70 Series User’s Guide 645 Chapter 51 Call Scheduling Figure 400 Schedule Set Setup Menu 26.1 - Schedule Set Set up Active= Yes How Often= Once Start Date(yyyy-mm-dd) = N/A Once: Date(yyyy-mm-dd)= 2000 - 0 1 - 01 Weekdays: Sunday= N/A Monday= N/A Tuesday= N/A Wednesday= N/A Thursday= N/A Friday= N/A Saturday= N/A Start Time (hh:mm)= 0[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 51 Call Scheduling 646 Once your schedule sets are conf igured, yo u must then apply them to the desired remote node(s). Enter 1 1 from the Main Menu and then enter the tar get remo te node index. Press [SP ACE BAR] and then [ENTER] to select PPPoE in the Encapsulation field to make the schedule sets fie[...]

ZyWALL 5/35/70 Series User’s Guide 647 Chapter 51 Call Scheduling Figure 402 Applying Schedule Set(s ) to a Remote Node (PPTP) Menu 11.1 - Rem ote Node Profile Rem Node Name= ChangeMe Route= IP Active= Yes Encapsulation= PPTP Edit IP= No Service Type= Standard Telco Option: Allocated Budget(min)= 0 Outgoing= Period(hr)= 0 My Login= Schedules= 1,2[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 52 Trou bleshooting 648 C HAPTER 52 T roubleshooting This chapter covers potential pr oblems and possible remedies. After each problem descri ption, some instructions are provided to help you to diagnose and to solve the problem. Please see our included disk for further information. 52.1 Problems St arti[...]

ZyWALL 5/35/70 Series User’s Guide 649 Chapter 52 Trou bleshooting 52.3 Problems with the DMZ Interface Table 245 Troubleshooting th e DMZ Interface PROBLEM CORRECTIVE ACTION Cannot access servers on the DMZ from the LAN. Check your Ethernet cable type and connections. Refer to the Qu ick S tart Guide for DMZ connection instructions. Make sure th[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 52 Trou bleshooting 650 52.5 Problems Accessing the ZyW ALL Table 247 Troubleshooting Accessing the ZyWALL PROBLEM CORRECTIVE ACTION Cannot access the ZyW ALL. The default password is “1234”. The passwor d field is case sensitive. Make sure that you enter the correct pa ssword using the proper casing[...]

ZyWALL 5/35/70 Series User’s Guide 651 Chapter 52 Trou bleshooting • W eb browser pop-up win dows from your device. • JavaScripts (enabled by default). • Java permissions (enabled by default). Note: Internet Explorer 6 screens are used here. Screens for o ther Internet Explorer versions may vary . 52.5.1.1 Internet Explorer Pop-up Blockers [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 52 Trou bleshooting 652 Figure 404 Internet Options : Privacy 3 Click Apply to save this setting. 52.5.1.1.2 Enable pop-up Blockers with Exceptions Alternatively , if you only want to allow pop-up windows from your device, see the follo wing steps. 1 In Internet Explorer , select To o l s , Internet Opti[...]

ZyWALL 5/35/70 Series User’s Guide 653 Chapter 52 Trou bleshooting Figure 405 Internet Options : Privacy 3 T ype the IP address of your device (the web page that you do not want to have blocked) with the prefix “http://”. For example, http://192.168.1.1. 4 Click Add to move the IP address to the list of Allowed sites .[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 52 Trou bleshooting 654 Figure 406 Pop-up Blocker Settings 5 Click Close to return to the Privacy screen. 6 Click Apply to save this setting. 52.5.1.2 JavaScript s If pages of the web configurat or do not display properly in Inte rnet Explorer , check that JavaScripts are allowed. 1 In Internet Explorer [...]

ZyWALL 5/35/70 Series User’s Guide 655 Chapter 52 Trou bleshooting Figure 407 Internet Options : Security 2 Click the Custom Level... button. 3 Scroll down to Scripting . 4 Under Active scripting make sure that Enable is selected (the default). 5 Under Scripting of Java applets make sure that Enable is sele cted (the default). 6 Click OK to clos [...]

ZyWALL 5/35/70 Series User’s Guide Chapter 52 Trou bleshooting 656 Figure 408 Security Settings - Java Scripting 52.5.1.3 Java Permissions 1 From Internet Explorer , click To o l s , In ternet Options and then the Security tab. 2 Click the Custom Level... button. 3 Scroll down to Microsoft VM . 4 Under Java permissions make sure that a safety lev[...]

ZyWALL 5/35/70 Series User’s Guide 657 Chapter 52 Trou bleshooting Figure 409 Security Settings - Java 52.5.1.3.1 JA V A (Sun) 1 From Internet Explorer , click To o l s , In ternet Options and then the Adva nced tab. 2 Make sure that Use Java 2 for <applet> under Java (Sun) is selected. 3 Click OK to clos e the window .[...]

ZyWALL 5/35/70 Series User’s Guide Chapter 52 Trou bleshooting 658 Figure 410 Java (Sun) 52.6 Packet Flow The following is the packet check flow on t he ZyW ALL. LAN/DMZ/WLAN to W AN: LAN/DMZ Data and Call Filtering (in SMT menu 21) -> Firewall -> IDP -> Anti-V irus -> Anti-Spam -> Remote Node Data Filtering (in SMT menu 21) -> [...]

ZyWALL 5/35/70 Series User’s Guide 659 Chapter 52 Trou bleshooting[...]

ZyWALL 5/35/70 Series User’s Guide Appendix A Prod uct Specificatio ns 660 A PPENDIX A Product S pecifications See also the Introduction ch apter for a general overv iew of the key features. S pecification T ables Table 248 Device Specifications Default IP Address 192.168.1 .1 Default Subnet Mask 255.255 .255.0 (24 bits) Default Password 1234 DHC[...]

ZyWALL 5/35/70 Series User’s Guide 661 Appendix A Product Specifications Operatio n Humidit y 20% ~ 95% RH (non -condensing) S torag e Humidity 20% ~ 95% RH (non-condensing) Certific ations EMC: FCC Class B, CE-EMC Class B, C-T ick Class B, VCCI Class B Safety: CSA International, CE EN60950-1 MTBF (Mean T ime Between Failure s) (Bellcore model) Z[...]

ZyWALL 5/35/70 Series User’s Guide Appendix A Prod uct Specificatio ns 662 Anti-S pam S pam, Phishing d etection Configurable white and black lists SMTP , POP3 support External S pam dat abase Content Filtering W eb page blocking by URL keyword IKE + PKI support External database content filtering Java/ActiveX /Cookie/News blocking T raffic Manag[...]

ZyWALL 5/35/70 Series User’s Guide 663 Appendix A Product Specifications Table 251 Feature Specifica tions FEATURE SPECIFICATION ZYW ALL 70 ZYW ALL 35 ZYW ALL 5 Number of S tatic DHCP T able Entries 128 128 128 Number of S tatic Routes 50 50 30 Number of Policy Routes 48 48 N/A Number of Port Forwarding Rules 100 50 30 Number of NA T Sessions 10,[...]

ZyWALL 5/35/70 Series User’s Guide Appendix A Prod uct Specification s 664 Comp atible ZyXEL WLAN Cards The following table lists the ZyXEL WLAN cards that you can use in the ZyW ALL at the time of writing. It also shows the secu rity features that each card supports. Note: Check the product p age on the www .zyxel.com website for updates on ZyXE[...]

ZyWALL 5/35/70 Series User’s Guide 665 Appendix A Product Specifications Figure 41 1 WLAN Card Installation Cable Pin Assignment s In a serial communications connection, gene rally a computer is DTE (Data T erminal Equipment) and a modem is DCE (Data Circ uit-terminating Equipment). The Z yW ALL is DCE when you connect a computer to the co nsole [...]

ZyWALL 5/35/70 Series User’s Guide Appendix A Prod uct Specification s 666 Table 253 Console/Dial Backup Port Pin Assignments CONSOLE Port RS – 232 (Female) DB-9F DIAL BACKUP RS – 232 (Male) DB-9M (Not on all models) Pin 1 = NON Pin 2 = DCE-TXD Pin 3 = DCE –RXD Pin 4 = DCE –DSR Pin 5 = GND Pin 6 = DCE –DTR Pin 7 = DCE –CTS Pin 8 = DCE[...]

ZyWALL 5/35/70 Series User’s Guide 667 Appendix A Product Specifications[...]

ZyWALL 5/35/70 Series User’s Guide Appendix B Hardware Installation 668 A PPENDIX B Hardware Inst allation The ZyW ALL can be placed on a desktop or ra ck-mounted on a stan da rd EIA rack. Use the brackets in a rack-m ounted installation. General Inst allation Instructions Read all the safety warnings in the beginning of this User's Guide be[...]

ZyWALL 5/35/70 Series User’s Guide 669 Appendix B Hardware Installation Figure 414 Attaching Rubber Feet Note: Do not block the ventilation holes . Leave space betwee n ZyW ALLs when stacking. Rack-mounted Inst allation Requirement s The ZyW ALL can be mounted on an EIA standard size, 19-inch rack or in a wiring closet with other equipment. Follo[...]

ZyWALL 5/35/70 Series User’s Guide Appendix B Hardware Installation 670 Figure 415 Attaching Mounting Bracket s and Screws 3 After attaching both mounting brackets, pos ition the ZyW ALL in the rack by lining up the holes in the bracket s with the appropri ate holes on the rack. Secure the ZyW ALL to the rack with the rack-mounting screws. Figure[...]

ZyWALL 5/35/70 Series User’s Guide 671 Appendix B Hardware Installation[...]

ZyWALL 5/35/70 Series User’s Guide Appendix C Removing and Installing a Fuse 672 A PPENDIX C Removing and Inst alling a Fuse This appendix shows you how to remo ve and install fuses for the ZyW ALL. If you need to install a new fuse, follow the procedure below . Note: If you use a fuse other than th e included fuses, make sure it matches the fuse[...]

ZyWALL 5/35/70 Series User’s Guide 673 Appendix C Removing and In stalling a Fuse[...]

ZyWALL 5/35/70 Series User’s Guide Appendix D Setting up Your Computer’s IP Addr ess 674 A PPENDIX D Setting up Y our Computer ’ s IP Address All computers must have a 10M or 100M Et hernet adapter card and TCP/IP installed. W indows 95/98/Me/NT/2000/XP , Macintosh OS 7 and later operating systems and all versions of UNIX/LINUX include the so[...]

ZyWALL 5/35/70 Series User’s Guide 675 Appendix D Setting up Your Computer’s IP Address Figure 417 WIndows 95/98 /Me: Networ k: Configu ration Inst alling Components The Network window Configuration tab displays a list of installed components. Y ou need a network adapter , the TCP/IP protocol and Client for Microsof t Networks. If you need the [...]

ZyWALL 5/35/70 Series User’s Guide Appendix D Setting up Your Computer’s IP Address 676 3 Select Microsoft from the list of manufacturers. 4 Select Client for Microsoft Networks from the list of network clients and then click OK . 5 Restart your computer so the changes you made take ef fect. Configuring 1 In the Network window Configuration tab[...]

ZyWALL 5/35/70 Series User’s Guide 677 Appendix D Setting up Your Computer’s IP Address Figure 419 Windows 95/98/Me : TCP/IP Pr operties: DNS Configuration 4 Click the Gateway tab. • If you do not know your g ateway’ s IP address, remove previously installed gateways. • If you have a gateway IP address, type it in the New gateway field an[...]

ZyWALL 5/35/70 Series User’s Guide Appendix D Setting up Your Computer’s IP Address 678 Figure 420 Windows XP: S tart Menu 2 In the Control Panel , double-click Network Connections ( Network and Dial-up Connections in W i ndows 2000/NT). Figure 421 Windows XP: Control Panel 3 Right-click Local Area Connection and then click Pr oper ties .[...]

ZyWALL 5/35/70 Series User’s Guide 679 Appendix D Setting up Your Computer’s IP Address Figure 422 Windows XP: Control Panel: Network Connections: Proper ties 4 Select Internet Protocol (TCP/IP) (under the Genera l tab in W in XP) and then click Properties . Figure 423 Windows XP: Local Area Conne ction Properties 5 The Internet Pr otocol TCP/I[...]

ZyWALL 5/35/70 Series User’s Guide Appendix D Setting up Your Computer’s IP Address 680 • If you have a static IP address click Use the following IP Address and fill in the IP addr ess , Subnet mask , and Default gateway fields. • Click Advanced . Figure 424 Windows XP: Internet Protocol (TCP/IP) P roperties 6 If you do not know your gatewa[...]

ZyWALL 5/35/70 Series User’s Guide 681 Appendix D Setting up Your Computer’s IP Address Figure 425 Windows XP: Advanced TCP/IP Properties 7 In the Internet Protocol TCP/IP Properties window (the General tab in Windows XP): • Click Obtain DNS se rver address automatically if you do not know your DNS server IP address(es ). • If you know your[...]

ZyWALL 5/35/70 Series User’s Guide Appendix D Setting up Your Computer’s IP Address 682 Figure 426 Windows XP: Internet Protocol (TCP/IP) P roperties 8 Click OK to close the Internet Protocol (TCP/IP) Pr operties window . 9 Click Close ( OK in W indows 2000/NT) to close the Local Area Connection Pr operties window . 10 Close the Network Connect[...]

ZyWALL 5/35/70 Series User’s Guide 683 Appendix D Setting up Your Computer’s IP Address Figure 427 Macintosh OS 8/9: Apple Menu 2 Select Ethernet built-in from the Connect via list. Figure 428 Macintosh O S 8/9: TC P/IP 3 For dynamically assigned settings, select Using DHCP Server from the Configur e: list.[...]

ZyWALL 5/35/70 Series User’s Guide Appendix D Setting up Your Computer’s IP Address 684 4 For statically assigned settings, do the following: •F r o m t h e Configure box, select Manually . • T ype your IP address in the IP Address box. • T ype your subne t mask in the Subnet mask box. • T ype the IP a ddress of your Prestige in the Rou[...]

ZyWALL 5/35/70 Series User’s Guide 685 Appendix D Setting up Your Computer’s IP Address Figure 430 Macintosh O S X: Netw ork 4 For statically assigned settings, do the following: •F r o m t h e Configure box, select Manually . • T ype your IP address in the IP Address box. • T ype your subne t mask in the Subnet mask box. • T ype the IP[...]

ZyWALL 5/35/70 Series User’s Guide Appendix D Setting up Your Computer’s IP Address 686 Note: Make sure you are logged in as the ro ot administrator . Using the K Desktop Environment (KDE) Follow the steps below to configure your computer IP address using the KDE. 1 Click the Red Hat button (located on the bottom left corner), select System Set[...]

ZyWALL 5/35/70 Series User’s Guide 687 Appendix D Setting up Your Computer’s IP Address • If you hav e a dynamic IP address, cl ick Automatically obtain IP address settings with and select dhcp from the drop down list. • If you have a static IP address, click S tatically set IP Addresses and fill in the Address , Subnet mask , and Default G[...]

ZyWALL 5/35/70 Series User’s Guide Appendix D Setting up Your Computer’s IP Address 688 1 Assuming that you have only one network card on th e computer , locate the ifconfig- eth0 configuration file (where eth0 is the name of the Ethernet card). Open the configuration file with any plain text editor . • If you hav e a dynamic IP address, ente[...]

ZyWALL 5/35/70 Series User’s Guide 689 Appendix D Setting up Your Computer’s IP Address Figure 438 Red Hat 9.0: Resta rt Ethernet Card [root@localhost init.d]# net work restart Shutting down interface eth0 : [OK] Shutting down loopback inter face: [OK] Setting network parameters: [OK] Bringing up loopback interfa ce: [OK] Bringing up interface [...]

ZyWALL 5/35/70 Series User’s Guide Appendix E IP Subnetting 690 A PPENDIX E IP Subnetting IP Addressing Routers “route” based on the network number . The router that delivers the data packe t to the correct destination host uses the host ID. IP Classes An IP address is made up of four octets (ei ght bits), wri tten in dotted decimal notation,[...]

ZyWALL 5/35/70 Series User’s Guide 691 Appendix E IP Subnettin g Since the first octet of a class “A” IP address must contain a “0”, the first octet of a class “A” address can have a value of 0 to 127. Similarly the first octet of a clas s “B” must begi n with “10”, therefore the first octet of a class “B” address has a va[...]

ZyWALL 5/35/70 Series User’s Guide Appendix E IP Subnetting 692 Since the mask is always a continuous number of ones begin ning from the left, fo llowed by a continuous number of zeros for the remainder of the 32 bit mask, you can simply specify the number of ones instead of writing the value of each octet. This is usually specified by writing a [...]

ZyWALL 5/35/70 Series User’s Guide 693 Appendix E IP Subnettin g Note: In the following chart s, shaded/bolded last o ctet bit values indicate host ID bit s “borrowed” to form network ID bit s. The number of “borrowed” host ID bits determines the number of sub nets y ou can have. Th e remaining number of host ID bits (af ter “borrowing?[...]

ZyWALL 5/35/70 Series User’s Guide Appendix E IP Subnetting 694 Example: Four Subnet s The above exampl e illustrated using a 25-bit subne t mask to divide a class “C” address space into two subnets. Similarly to divide a class “C” address into four subnets, you need to “borrow” two host ID bits to give four possible combinations of 0[...]

Table 264 Subnet 4 NETWORK NUMBER LAST OCTET BIT V ALUE IP Address 192.168.1. 192 IP Address (Binary) 1 1000000.10101000.00 000001. 11 000000 Subnet Mask (Binary) 11111111 . 11111111 . 11111111 . 11 000000 Subnet Address: 192.168.1.192 Lowest Host ID: 192.168.1.19 3 Broadcast Address: 192.168.1.255 Highest Host ID: 192.16 8.1.254 ZyWALL 5/35/70 Ser[...]

ZyWALL 5/35/70 Series User’s Guide Appendix E IP Subnetting 696 Subnetting With Class A and Class B Networks. For class “A” and class “B” addresses the subnet ma sk also determines which bits are part of the network number and which are part of the h ost ID. A class “B” address has two host ID octets ava ilable for subnetting and a cl[...]

ZyWALL 5/35/70 Series User’s Guide 697 Appendix E IP Subnettin g[...]

ZyWALL 5/35/70 Series User’s Guide Appendix F PPPoE 698 A PPENDIX F PPPoE PPPoE in Action An ADSL modem bridges a PPP session over Ethernet (PPP ov er Ethernet, RFC 2516) from your computer to an A TM PVC (Permanent V irt ual Circuit) which connects to a DSL Access Concentrator where the PPP session terminates (see F igure 440 o n page 699 ). One[...]

ZyWALL 5/35/70 Series User’s Guide 699 Appendix F PPPoE Figure 440 Single-Compute r per Router Hard ware Configuration How PPPoE W orks The PPPoE driver makes the Ethernet appea r as a serial link to the computer and the computer runs PPP over it, while the modem bridges the Ethernet frames to the Access Concentrator (AC). Between the AC and an I[...]

ZyWALL 5/35/70 Series User’s Guide Appendix G PPT P 700 A PPENDIX G PPTP What is PPTP? PP TP (Point-to-Point T unneling Protocol) is a Microsoft proprietary protocol (RFC 26 37 for PP TP is informational only) to tunnel PPP frames. How can we transport PP P frames from a computer to a broadband modem over Ethernet? A solution is to build PP TP in[...]

ZyWALL 5/35/70 Series User’s Guide 701 Appendix G PPTP PPTP Protocol Overview PP TP is very simila r to L2TP , since L2TP is based on both PP TP and L2F (Cisco’ s Layer 2 Forwarding). Conceptually , the re are three pa rties in PP TP , namely the PNS (PP TP Network Server), the P AC (PP TP Access Concentrator) a nd the PP TP user . The PNS is t[...]

ZyWALL 5/35/70 Series User’s Guide Appendix G PPT P 702 Figure 444 Example Message Exchange between Computer and an ANT PPP Dat a Connection The PPP frames are tunneled between the PN S and P AC over GRE (General Routing Encapsulation, RFC 1701, 1702 ). The individual calls within a tunnel are distingu ished using the Call ID field in the GRE hea[...]

ZyWALL 5/35/70 Series User’s Guide 703 Appendix G PPTP[...]

ZyWALL 5/35/70 Series User’s Guide Appendix H Wireless LANs 704 A PPENDIX H Wireless LANs Wireless LAN T opologies This section discusses ad-hoc and in frastructure w ireless LAN topologies. Ad-hoc Wireless LAN Configuration The simplest WLAN configuration is an inde pendent (Ad-hoc) WLAN that connects a set of computers with wireless stations (A[...]

ZyWALL 5/35/70 Series User’s Guide 705 Appendix H Wire less LANs Figure 446 Basic Service Set ESS An Extended Service Set (ESS) consists of a series of overlappi ng BSSs, each containing an access point, with each access point connected together by a wired network. This wired connection between APs is called a Distribution System (DS). This type [...]

ZyWALL 5/35/70 Series User’s Guide Appendix H Wireless LANs 706 Figure 447 Infrastructure WLAN Channel A channel is the radio frequency(ies) used by IEEE 802.1 1a/b/g wireless devices. Channels available depend on your g eographical area. Y ou may have a choice of channels (for your region) so you should use a di fferent ch annel th an an adjacen[...]

ZyWALL 5/35/70 Series User’s Guide 707 Appendix H Wire less LANs Figure 448 RTS / CT S When station A sends data to the AP , it migh t no t know that the station B is already using the channel. If these two stations se nd data at the same time, collis ions may occur when both sets of data arrive at the AP at the same time, r esulting in a loss of[...]

ZyWALL 5/35/70 Series User’s Guide Appendix H Wireless LANs 708 A large Fragmentation Thr eshold is recommended for networks not prone to interference while you should set a smaller threshold for busy networks or networks tha t are prone to interference. If the Fragmentation Threshold value is smaller than the RTS / C T S value (see previously) y[...]

ZyWALL 5/35/70 Series User’s Guide 709 Appendix H Wire less LANs IEEE 802.1x In June 2001, the IEEE 802.1x st andard was designed to extend th e features of IEEE 802.1 1 to support extended authentication as well as providing additional accounting and control features. It is supported by W indows XP and a number of network devices. Some advantage[...]

ZyWALL 5/35/70 Series User’s Guide Appendix H Wireless LANs 710 • Access-Challenge Sent by a RADIUS server requesting more information in order to allow access. The access point sends a proper response from the user and then sends another Access- Request message. The following types of RADIUS messages are exchanged between the a ccess point and[...]

ZyWALL 5/35/70 Series User’s Guide 711 Appendix H Wire less LANs 3 The wireless station replies with identity info rmation, including username and password. 4 The RADIUS server checks the user informa tion against its user profile database and determines whether or not to au thenticate the wireless station. T ypes of Authentication This section d[...]

ZyWALL 5/35/70 Series User’s Guide Appendix H Wireless LANs 712 PEAP (Protected EAP) Like EAP-TTLS, server-side certific ate authentication is used to establish a secure connection, then use simple username and p assword methods through the secured connection to authenticate the clients, thus hiding client identity . However , PEAP only supports [...]

ZyWALL 5/35/70 Series User’s Guide 713 Appendix H Wire less LANs Figure 450 WEP Authentication S teps Open system authentication in volves an unencrypted two-message procedure. A wireless station sends an open system authentication request to the AP , which will then automatically accept and connect the wireless station to the network. In effect,[...]

ZyWALL 5/35/70 Series User’s Guide Appendix H Wireless LANs 714 Note: EAP-MD5 cannot be used with Dynamic WEP Key Exchange For added security , certificate-based authen tications (EAP-TLS, EAP-TTLS and PEAP) use dynamic keys for data encryption. They are ofte n deployed in corp orate environments, but for public deployment, a simp le user name an[...]

ZyWALL 5/35/70 Series User’s Guide 715 Appendix H Wire less LANs The Message Integrity Check (MIC ) is designed to prevent an attacker from capturing data packets, altering them and resending them. The MIC provides a strong mathematical function in which the receiver and the transmitter each compute and then compare the MIC. If they do not match,[...]

ZyWALL 5/35/70 Series User’s Guide Appendix H Wireless LANs 716 In a network environment with multiple access points, wireless st ations are able to switch from one access point to another as they move between the coverage areas. This is roaming. As the wireless station moves from place to place, it is responsible for choosing the most appropriat[...]

ZyWALL 5/35/70 Series User’s Guide 717 Appendix H Wire less LANs Requirement s for Roaming The following requirements must be met in order for wirele ss stations to roam between the coverage areas . 1 All the access points must be on the same subnet and configured wi th the same ESSID. 2 If IEEE 802.1x user auth entication is enabled and to be do[...]

ZyWALL 5/35/70 Series User’s Guide Appendix I Triangle Route 718 A PPENDIX I T riangle Route The Ideal Setup When the firewall is on, your ZyW ALL acts as a secure gateway between your LAN and the Internet. In an ideal network topology , all incoming and outgoing network traf fic passes through the ZyW ALL to protect your LAN against attacks. Fig[...]

ZyWALL 5/35/70 Series User’s Guide 719 Appendix I Triangle Route Figure 453 “T riangle Route” Problem The “T riangle Route” Solutions This section presents you two solutions to the “triangle route” problem. IP Aliasing IP alias allows you to partition your network into logical sections over the same Ethernet interface. Y our ZyW ALL s[...]

ZyWALL 5/35/70 Series User’s Guide Appendix I Triangle Route 720 Figure 454 IP Alias Gateways on the W AN Side A second solution to the “triangle route” problem is to put all of your network gateways on the W AN side as the following figure shows. This en sures that all incoming netw ork traffic passes through your ZyW ALL to your LAN. Ther e[...]

ZyWALL 5/35/70 Series User’s Guide 721 Appendix I Triangle Route[...]

ZyWALL 5/35/70 Series User’s Guide Appendix J Windows 98 SE/Me Requirements for Anti-V irus Message Display 722 A PPENDIX J Windows 98 SE/Me Requirement s for Anti-V irus Message Display W ith the anti-virus packet scan, w hen a virus is detected, an alert message is displayed on Miscrosoft W indows-based computers. For W indows 98 SE/Me, you mus[...]

ZyWALL 5/35/70 Series User’s Guide 723 Appendix J Windows 98 SE/Me Requirements for Anti-Virus Messag e Display Figure 457 WIndows 98 SE: Program T ask Bar 2 Click the S tart Menu Programs tab and click Advanced .. . Figure 458 Windows 98 SE: T ask Bar Properties 3 Double-click Programs and click St a r t U p . 4 Right-click in the St a r t U p p[...]

ZyWALL 5/35/70 Series User’s Guide Appendix J Windows 98 SE/Me Requirements for Anti-V irus Message Display 724 Figure 459 Windows 98 SE: S tartUp 5 A Create Shortcut window disp lays. Enter “winpo pup” in the Command line field and click Next . Figure 460 Windows 98 SE: S tartup: Create Shortcut 6 Specify a name for the shortcut or accept th[...]

ZyWALL 5/35/70 Series User’s Guide 725 Appendix J Windows 98 SE/Me Requirements for Anti-Virus Messag e Display Figure 461 Windows 98 SE: S tartup: Select a T itle for the Program 7 A shortcut is created in the St a r t U p pane. Restart the computer when prompted. Figure 462 Windows 98 SE: S tartup: Shortcut Note: The WinPopup window displa ys a[...]

ZyWALL 5/35/70 Series User’s Guide Appendix K VPN Setup 726 A PPENDIX K VPN Setup This appendix will help you to quickly crea te a IPSec/VPN connection between two ZyXEL IPSec routers. It should be considered a quick reference for experienced users. General Notes • The private netw orks behind the IPSec rou ters must be on different subnets. Fo[...]

ZyWALL 5/35/70 Series User’s Guide 727 Appendix K VPN Setup The following pages show a ty pical configuration that build s a tunnel between two private networks. One network is the head quarters (HQ) and the other is a branch of fice. Both sites have static (fixed) public addresses. Replace the Remote Gateway Address and Local/ Remote S tarting I[...]

ZyWALL 5/35/70 Series User’s Guide Appendix K VPN Setup 728 Figure 464 The IP address of the branch office IPSec router . Headquarters Gateway Policy Edit[...]

ZyWALL 5/35/70 Series User’s Guide 729 Appendix K VPN Setup Figure 465 Branch Office Gateway Policy Edit The IP address of the headquarters IPSec router . 3 Click the add network policy ( ) icon next to the BRANCH gateway policy to configure a VPN p olicy .[...]

ZyWALL 5/35/70 Series User’s Guide Appendix K VPN Setup 730 Figure 466 Headquarte rs VPN Rule Figure 467 Branch Office VPN Rule 4 Configure the screens in the headquarters and the branch office as follows and click Apply .[...]

ZyWALL 5/35/70 Series User’s Guide 731 Appendix K VPN Setup Figure 468 Headquarte rs Network Policy Edit IP addresses on different subnets. Activate t he network policy .[...]

ZyWALL 5/35/70 Series User’s Guide Appendix K VPN Setup 732 Figure 469 IP addresses on different subnets. Activate t he network policy . Branch Office Network Policy Edit Dialing the VPN T unnel via Web Configurator T o test w hether the IPSec routers can build the VPN tunnel, click the dial ( ) icon in the VPN Rules (IKE) screen to ha ve the IPS[...]

ZyWALL 5/35/70 Series User’s Guide 733 Appendix K VPN Setup Figure 470 VPN Rule Configured The following screen displays. Figure 471 VPN Dial This screen displays later if the I PSec routers can build the VPN tunnel. Figure 472 VPN T unnel Established[...]

ZyWALL 5/35/70 Series User’s Guide Appendix K VPN Setup 734 VPN T roubleshooting If the IPSec tunnel does not build properly , the pr oblem is likely a configuration error at one of the IPSec routers. Log into the web conf igurators of both ZyXEL IPSec routers. Check the settings in each field methodically and slowly . VPN Log The system log can [...]

ZyWALL 5/35/70 Series User’s Guide 735 Appendix K VPN Setup Figure 473 VPN Log Example ras> sys log disp ike ipsec # .time sou rce destination notes message 0|01/11/2001 18:47:22 |5.6 .7.8 |5.1.2.3 |IKE Rule [ex-1] Tunnel built successfully 1|01/11/2001 18:47:22 |5.6 .7.8 |5.1.2.3 |IKE The cookie pair is : 0xD AC0B43FBDE154F5 / 0xC5156C099C3F7[...]

ZyWALL 5/35/70 Series User’s Guide Appendix K VPN Setup 736 IPSec Debug If you are having difficulty building an IPSec tunnel to a non-ZyX EL IPSec router , ad vanced users may wish to examine the IPSec debug feature ( Menu 24.8 ). Note: If any of your VPN rules have an active networ k policy set to nailed-up, using the IPSec debug feature may ca[...]

ZyWALL 5/35/70 Series User’s Guide 737 Appendix K VPN Setup Use a VPN T unnel A VPN tunnel gives you a se cure connection to ano ther computer or ne twork. The VPN St a t u s screen displays whethe r or not your VPN tunnel is connected. Example VPN tunnel uses are securely sending and retrieving files, and accessing corporate network drives, we b[...]

ZyWALL 5/35/70 Series User’s Guide Appendix L Importing Certificates 738 A PPENDIX L Importing Certificates This appendix shows importing certificat es examples using In ternet Ex plorer 5. Import ZyW ALL Certificates into Net scape Navigator In Netscape Navigator , you can permanently trust the ZyW ALL ’ s server certificate by importing it in[...]

ZyWALL 5/35/70 Series User’s Guide 739 Appendix L Importing Certificates Figure 476 Login Screen 2 Click Install Certificate to open the Install Certificate wizard. Figure 477 Certificate General Information befor e Import 3 Click Next to begin the Install Certificate wizard.[...]

ZyWALL 5/35/70 Series User’s Guide Appendix L Importing Certificates 740 Figure 478 Certificate Import Wizard 1 4 Select where you would like to store the certificate and then click Next . Figure 479 Certificate Import Wizard 2 5 Click Finish to complete the Import Certificate wizard.[...]

ZyWALL 5/35/70 Series User’s Guide 741 Appendix L Importing Certificates Figure 480 Certificate Import Wizard 3 6 Click Ye s to add the ZyW ALL certifi cate to the root store. Figure 481 Root Certificate S tore[...]

ZyWALL 5/35/70 Series User’s Guide Appendix L Importing Certificates 742 Figure 482 Certificate General Information af ter Import Enrolling and Importing SSL Client Certificates The SSL client needs a certificate if Authenticate Client Certificates is selected on the ZyW ALL. Y ou m ust have importe d at least one trusted CA to the ZyW ALL in ord[...]

ZyWALL 5/35/70 Series User’s Guide 743 Appendix L Importing Certificates Figure 483 ZyW ALL Trusted CA Screen The CA sends you a package containing the CA ’ s trusted certificate(s), your personal certificate(s) and a password to inst all the personal certificate(s). Inst alling the CA ’ s Certificate 1 Double click the CA ’ s trusted certi[...]

ZyWALL 5/35/70 Series User’s Guide Appendix L Importing Certificates 744 Figure 484 CA Certificate Example 2 Click Install Certificate and follow the wizard as show n earlier in this appendix. Inst alling Y our Personal Certificate(s) Y ou need a password in a dvance. The CA may is sue the password or yo u may have to specify it during the enroll[...]

ZyWALL 5/35/70 Series User’s Guide 745 Appendix L Importing Certificates Figure 485 Personal Certificate Import Wizard 1 2 The file name and path of the certificate y ou double-clicked should automatically appear in the File name text box. Click Br owse if you wish to import a different certificate. Figure 486 Personal Certificate Import Wizard 2[...]

ZyWALL 5/35/70 Series User’s Guide Appendix L Importing Certificates 746 Figure 487 Personal Certificate Import Wizard 3 4 Have the wizard determine where the certificat e should be saved on your computer or select Place all certificates in the following stor e and choose a different location. Figure 488 Personal Certificate Import Wizard 4 5 Cli[...]

ZyWALL 5/35/70 Series User’s Guide 747 Appendix L Importing Certificates Figure 489 Personal Certificate Import Wizard 5 6 Y ou should see the following screen when the ce rtificate is correctly installed on your computer . Figure 490 Personal Certificate Import Wizard 6 Using a Certificate When Accessing the ZyW ALL Example Use the following pro[...]

ZyWALL 5/35/70 Series User’s Guide Appendix L Importing Certificates 748 Figure 492 SSL Client Authentication 3 Y ou next see the ZyW ALL login screen. Figure 493 ZyW ALL Secure Login Screen[...]

ZyWALL 5/35/70 Series User’s Guide 749 Appendix L Importing Certificates[...]

ZyWALL 5/35/70 Series User’s Guide Appendix M Comma nd Interpret er 750 A PPENDIX M Command Interpreter The following describes how to use the comman d interpreter . Enter 24 in the main menu to bring up the system maintena nce menu. Enter 8 to go to Menu 24.8 - Command Interpr eter Mode . See the included disk or zyxel.com for more detailed info[...]

ZyWALL 5/35/70 Series User’s Guide 751 Appendix M Command Interpreter[...]

ZyWALL 5/35/70 Series User’s Guide Appendix N Firewall Commands 752 A PPENDIX N Firewall Commands The following des cribes th e firewall commands. See Appendix M on page 750 for information on the command structure. Table 271 Firewall Commands FUNCTION COMMAND DESCRIPTION Firewall Se t-Up config edit firewall active <yes | no> This command [...]

ZyWALL 5/35/70 Series User’s Guide 753 Appendix N Firewall Commands E-mail config edit firewall e-mail mail-server <ip address of mail server> This command sets the IP address to which the e-mail messages are sent. config edit firewall e-mail return-addr <e-mail address> This command sets the source e-mail add ress of the firewall e-m[...]

ZyWALL 5/35/70 Series User’s Guide Appendix N Firewall Commands 754 config edit firewall attack minute-high <0-255> This command sets the threshold rate of new half-open sessions per minute where the ZyW ALL starts deleting old half-opene d sessions until it gets t hem down to the minute- low threshold. config edit firewall attack minute-lo[...]

ZyWALL 5/35/70 Series User’s Guide 755 Appendix N Firewall Commands Config edit firewall set <set #> tcp-idle-timeout <seconds> This command sets how long ZyWALL lets an inactive TCP connection remain open before considering it closed. Config edit firewall set <set #> log <yes | no> This command sets whether or not the ZyW[...]

ZyWALL 5/35/70 Series User’s Guide Appendix N Firewall Commands 756 config edit firewall set <set #> rule <rule #> destaddr- subnet <ip address> <subnet mask> This command sets a rule to have the ZyW ALL check for traffic with a p articular subnet destination (def ined by IP address and subnet mask). config edit firewall s[...]

ZyWALL 5/35/70 Series User’s Guide 757 Appendix N Firewall Commands[...]

ZyWALL 5/35/70 Series User’s Guide Appendix O Net BIOS Filter Comma nds 758 A PPENDIX O NetBIOS Filter Commands The following describes the NetB IOS packet filter commands. See Appendix M on page 750 for information on th e command structure. Introduction NetBIOS (Network Basic Input/Output System ) are TCP or UDP broadcast packets that enable a [...]

ZyWALL 5/35/70 Series User’s Guide 759 Appendix O NetBIOS Filter Commands The filter types and their defa ult settings are as follows. Table 272 NetBIOS Filter Default Settings NAME DESCRIPTION EXAMPLE Between LAN and WAN This field displays whether NetBIOS packets are blocked or forwarded between the LAN and the WAN. Block Between LAN and DMZ Th[...]

ZyWALL 5/35/70 Series User’s Guide Appendix O Net BIOS Filter Command s 760 sys filter netbios config 3 on This command blocks IPSec NetBIOS packets. sys filter netbios config 4 off This command stops NetBIOS commands from initiating calls.[...]

ZyWALL 5/35/70 Series User’s Guide 761 Appendix O NetBIOS Filter Commands[...]

ZyWALL 5/35/70 Series User’s Guide Appendix P Certificates Commands 762 A PPENDIX P Certificates Commands The following describes the certificate commands. See Appendix M on page 750 for information on the command structure. All of these commands start with certificates. Table 273 Certificates Commands COMMAND DESCRIPTION my_cert create create se[...]

ZyWALL 5/35/70 Series User’s Guide 763 Appendix P Certificates Commands create cmp_enroll <name> <CA addr> <CA cert> <auth key> <subject> [key size] Create a certificate request and enroll for a certificate immediately online using CMP protocol. <name> specifies a descriptive name for the enrolled certificate. [...]

ZyWALL 5/35/70 Series User’s Guide Appendix P Certificates Commands 764 replace_fact ory Create a certificate using your device MAC address that will be specific to this device. The factory default certificate is a common default certificate for al l ZyWALL models. ca_trusted import <name> Import the PEM-encoded certi ficate from stdin. <[...]

ZyWALL 5/35/70 Series User’s Guide 765 Appendix P Certificates Commands delete <name> Delete the specified trusted remote host certificate. <name> sp ecifies the name of the certificate to be dele ted. list List all trusted remote host certificate names and basic info rmation. rename <old name> <new name> Rename the specif[...]

ZyWALL 5/35/70 Series User’s Guide Appendix Q Brute-Forc e Passwo rd Guessing Pr otection 766 A PPENDIX Q Brute-Force Password Guessing Protection Brute-force password guessing protection allows you to specify a wait-ti me that must ex pire before entering a fourth password after th ree incorrect passwords have been entered. The following describ[...]

ZyWALL 5/35/70 Series User’s Guide 767 Appendix Q Brute-Force Passwor d Guessing Protection[...]

ZyWALL 5/35/70 Series User’s Guide Appendix R Boot Commands 768 A PPENDIX R Boot Commands The BootModule A T comman ds execute fro m wi thin the router ’ s bootup software, when debug mode is selected before the main router firmware is start ed. When you start up your ZyW ALL, you are given a cho ice to go into debug mod e by pressing a key at [...]

ZyWALL 5/35/70 Series User’s Guide 769 Appendix R Boot Co mmands Figure 495 Boot Module Commands AT just answer OK ATHE print help ATBAx chan ge baudrate. 1:38.4k, 2:19.2k, 3:9.6k 4:57.6k 5:115.2k ATENx,(y) set BootExtens ion Debug Flag (y=password) ATSE show the seed of password generator ATTI(h,m,s) change system time to hour:min:sec or show cu[...]

ZyWALL 5/35/70 Series User’s Guide Appendix S Log Descriptions 770 A PPENDIX S Log Descriptions This appendix provides descrip tions of example log messages. Table 275 System Maintenance Logs LOG MESSAGE DESCRIPTION Time calibration is successful The router has adjusted its time based on informati on from the time server . Time calibration failed[...]

ZyWALL 5/35/70 Series User’s Guide 771 Appendix S Log Descriptions Configuration Change: PC = 0x%x, Task ID = 0x%x The router is saving configuration changes. Successful SSH login Someone has logged on to the router ’s SSH server . SSH login failed Someone has failed to log on to the router ’s SSH server . Successful HTTPS login Someone has l[...]

ZyWALL 5/35/70 Series User’s Guide Appendix S Log Descriptions 772 Table 277 Access Control Log s LOG MESSAGE DESCRIPTION Firewall default policy: [ TC P | UDP | IGMP | ESP | GRE | OSP F ] <Packet Direction> Attempted TCP/UDP/IGMP/ ESP/GRE/OSPF access matched the default po licy and was blocked or forwarded according to the default policy?[...]

ZyWALL 5/35/70 Series User’s Guide 773 Appendix S Log Descriptions Table 278 TCP Reset Lo gs LOG MESSAGE DESCRIPTION Under SYN flood attack, sent TCP RST The router sent a TCP reset packet when a host was unde r a SYN flood attack (the TCP incompl ete count is per d estination host.) Exceed TCP MAX incomplete, sent TCP RST The router sent a TCP r[...]

ZyWALL 5/35/70 Series User’s Guide Appendix S Log Descriptions 774 Table 280 ICMP Logs LOG MESSAGE DESCRIPTION Firewall default policy: ICM P <Packet Direction>, <type:%d >, <code:%d> ICMP access matched the default policy and was blocked or forwarded according to the user's setting . Firewall rule [NOT] match: I CMP <Pa[...]

ZyWALL 5/35/70 Series User’s Guide 775 Appendix S Log Descriptions Table 283 UPnP Logs LOG MESSAGE DESCRIPTION UPnP pass through Firewall UPnP packet s can pass through the firewall. ppp:LCP Closing The PPP con nection’s Link Control Protocol stage is closing. ppp:IPCP Closing The PPP connection’s Internet Protocol Control Proto col stage is [...]

ZyWALL 5/35/70 Series User’s Guide Appendix S Log Descriptions 776 For type and code details, see T abl e 294 on page 785 . Connecting to content filter server fail The connection to the external content fi ltering server failed. License key is invalid The external content filter ing licen se key is invalid. Table 285 Attack Logs LOG MESSAGE DESC[...]

ZyWALL 5/35/70 Series User’s Guide 777 Appendix S Log Descriptions Firewall sent TCP packet in response to DoS attack TCP The firewall sent TCP packet in response to a DoS attack ICMP Source Quench ICMP Th e firewall detecte d an ICMP Source Quench attack. ICMP Time Exceed ICMP The firewall detected an ICMP Time Exceed att ack. ICMP Destination U[...]

Table 287 Wireless Logs LOG MESSAGE DESCRIPTION WLAN MAC Filter Fail The MAC filter blocked a wireless station from connecting to the device. WLAN MAC Filter Success The MAC filter all owed a wireless station to connect to the device. WLAN STA Association A wireless station associ ated with the device. WLAN STA Association List Full The maximum num[...]

ZyWALL 5/35/70 Series User’s Guide 779 Appendix S Log Descriptions Table 289 IKE Logs LOG MESSAGE DESCRIPTION Active connection allowed exceeded The IKE process for a ne w conn ection fa iled because the limit of simultaneous phase 2 SAs has been reached. Start Phase 2: Quick Mode Phase 2 Quick Mode has started. Verifying Remote ID failed: Th e c[...]

ZyWALL 5/35/70 Series User’s Guide Appendix S Log Descriptions 780 Remote IP <Remote IP> / <Remote IP> conflicts The security gateway is set to “0.0.0.0” and the router used the peer ’s “Local Address” as the router ’s “Remote Address”. This information conflicted with static rule #d; thus the connection is not allowed[...]

ZyWALL 5/35/70 Series User’s Guide 781 Appendix S Log Descriptions Rule [%d] Phase 2 authentication algorithm mismatch The listed rule’s IKE phase 2 authentication algorithm did not match between the router an d the peer . Rule [%d] Phase 2 encapsulation mismatch The listed rule’s IKE phase 2 encapsulation did not match between the router and[...]

ZyWALL 5/35/70 Series User’s Guide Appendix S Log Descriptions 782 Table 290 PKI Logs LOG MESSAGE DESCRIPTION Enrollment successful Th e SCEP online certificate enrollment was successful. The Destination field records the certi fication auth ority server IP add ress and port. Enrollment failed Th e SCEP online certificate enrollmen t failed. The [...]

ZyWALL 5/35/70 Series User’s Guide 783 Appendix S Log Descriptions Table 291 Certificate Path Verificati on Failure Reason Codes CODE DESCRIPTION 1 Algorithm mismatch between the cert ificate and the search co nstraints. 2 Key usage mismatch between the cert ificate and the search constraints. 3 Certificate was not valid in the time interval. 4 ([...]

ZyWALL 5/35/70 Series User’s Guide Appendix S Log Descriptions 784 Local User Database does not find user`s credential. A user was not authenticated by the local user database because the user is not listed in th e local user database. RADIUS accepts user. A user was authenticated by the RADIUS Server . RADIUS rejects user. Pls check RADIUS Serve[...]

ZyWALL 5/35/70 Series User’s Guide 785 Appendix S Log Descriptions (L to L/ZW) LAN to LAN/ ZyW ALL ACL set for packet s traveling from the LAN to the LAN or the ZyW ALL. (W to W/ZW) WA N t o WA N / ZyW ALL ACL set for packet s traveling from the W AN to the W AN or the ZyW ALL. (D to D/ZW) DMZ to DMZ/ ZyW ALL ACL set for packet s traveling from t[...]

ZyWALL 5/35/70 Series User’s Guide Appendix S Log Descriptions 786 11 T ime Exceeded 0 T ime to live exceeded in transit 1 Fragment reassembly time exceeded 12 Parameter Problem 0 Pointer indicates the error 13 T imestamp 0 T imestamp request message 14 T imestamp Reply 0 T imestamp reply message 15 Information Request 0 Information request messa[...]

ZyWALL 5/35/70 Series User’s Guide 787 Appendix S Log Descriptions Signature update OK - New signature version: <Signature version> Release Date: <Release date>! The device updated the signa ture file successfully . The sign ature file’s version and re lease date a re included. The turbo card is not ready , please insert the card an[...]

ZyWALL 5/35/70 Series User’s Guide Appendix S Log Descriptions 788 The turbo card is not ready , please insert the card and reboot! The turbo card i s not in stalled. The system is doing signature update now , please wait! The device is updating the signatu re file. Table 297 AS Logs LOG MESSAGE DESCRIPTION Mail is in the Black List - Mail From:%[...]

ZyWALL 5/35/70 Series User’s Guide 789 Appendix S Log Descriptions Remove rating server [%Rating Server IP Address%] from server list! The listed server IP address has been removed from the list of anti- spam external database servers. "This is a phishing mail - Spam Score:%d Mail From:%EMAIL_ADDRESS% Subject:%MAIL_SUBJECT%!" The spam s[...]

ZyWALL 5/35/70 Series User’s Guide Appendix S Log Descriptions 790 Syslog Logs There are two types of syslog: event logs and traffic logs. The device generates an event log when a system event occurs, for example, when a user logs in or the device is under attack. The device generates a traffic log when a "session " is terminated. A tra[...]

ZyWALL 5/35/70 Series User’s Guide 791 Appendix S Log Descriptions The following table shows RFC-2408 ISAKMP payload types that the log displays. Please refer to the RFC for detailed information on each type. Table 299 RFC-2408 ISAKMP Payload Types LOG DISPLA Y P A YLOAD TYPE SA Security Association PROP Proposal TRANS T ransform KE Key Exchange [...]

ZyWALL 5/35/70 Series User’s Guide Appendix S Log Descriptions 792 Log Commands Go to the command interpreter interface. Appendix M on page 750 explains how to access and use the commands. Configuring What Y ou W a nt the ZyW ALL to Log 1 Use the sys logs load command to load the log setting buffer that allows you to configure which logs th e ZyW[...]

ZyWALL 5/35/70 Series User’s Guide 793 Appendix S Log Descriptions • Use the sys logs clear command to erase all of the ZyW ALL ’ s logs. Log Command Example This example shows how to set the ZyW ALL to record the access logs and alerts and then view the results. ras> sys logs load ras> sys logs category acces s 3 ras> sys logs save [...]

ZyWALL 5/35/70 Series User’s Guide Index 794 Index Numerics 10/100 Mbps Ethernet WAN 51 11 0 V A C 5 230V AC 5 A Abnormal Working Conditions 6 AC 5 Access control 243 Access Point 541 Accessories 5 Action for Matched Packe ts 221 Action for No Sp am Score 269 Action for S pam Mails 267 Active 515 , 517 , 548 Acts of God 6 Address Assignment 138 ,[...]

ZyWALL 5/35/70 Series User’s Guide 795 Index C CA 71 1 Cable Modem 199 Cables, Connecting 5 Call Back Delay 514 Call Control 626 Call History 62 7 , 628 Call Scheduling 55 , 644 Max Number of Schedule Sets 644 PPPoE 646 Precedence 644 Call-Triggering Packet 604 CardBus slot 52 Central Network Man agement 56 certificate 317 Certificate Authority 7[...]

ZyWALL 5/35/70 Series User’s Guide Index 796 DNS 448 DNS Server For VPN Host 415 Domain Name 138 , 272 , 38 0 , 480 , 599 DoS Basics 200 Ty p e s 201 DoS (Denial of Service) 53 Drop T imeout 514 DSL Modem 58 , 549 DTR 155 , 513 Dust 5 Dynamic DNS 424 Dynamic DNS Support 56 Dynamic WEP Key Exchange 713 DYNDNS Wildcard 415 , 424 E EAP 178 , 179 , 1[...]

ZyWALL 5/35/70 Series User’s Guide 797 Index Firmware File Maintenance 608 Fitness 6 Flow Control 496 Fragmentation Threshold 707 Fragmentation threshold 707 France, Contact Information 7 Fraudsters 264 FTP 380 , 424 , 428 , 443 , 610 , 634 File Upload 619 GUI-based Clie nts 61 1 Restoring Files 614 FTP File T ransfer 617 FTP Restrictio ns 428 , [...]

ZyWALL 5/35/70 Series User’s Guide Index 798 IP Addressing 690 IP Alias 56 , 526 IP Alias Setup 526 IP Classes 690 IP Multicast 56 Internet Group Manage ment Protocol (IGMP) 56 IP Policy Routing 56 IP Pool 11 0 , 160 , 172 , 524 IP Pool Setup 106 IP Ports 200 IP Routing Policy (IPPR) 392 Benefits 392 Cost Savings 392 Criteria 392 Load Sharing 392[...]

ZyWALL 5/35/70 Series User’s Guide 799 Index MIME 269 MIME Header 272 MIME Headers 266 MIME V alue 27 2 Modifications 3 MSDU 541 Multicast 108 , 11 0 , 172 , 519 , 525 , 553 Multimedia 231 , 465 Multipurpose Internet Mail Extensions 26 6 Mutation virus 254 My IP Addr 551 My Login 515 , 548 My Login Name 529 My Password 515 , 529 , 548 My Server I[...]

ZyWALL 5/35/70 Series User’s Guide Index 800 Levels 244 Policy-based Routing 392 Polyphormic virus 254 Pool 5 POP2 265 POP3 200 , 265 , 26 7 , 269 , 380 Port Forwarding 57 Port Restricted Cone NA T 373 port scans 236 Post Office Protocol 265 Postage Prepaid. 6 Power Cord 5 PPP 516 PPPoE 55 , 80 , 82 , 698 PPPoE Encapsulation 528 , 531 , 547 , 549[...]

ZyWALL 5/35/70 Series User’s Guide 801 Index Return Material Auth orization (RMA) Number 6 Returned Products 6 Returns 6 RFC 1889 463 RFC 3489 465 Rights 2 Rights, Legal 6 RIP 107 , 108 , 51 9 , 525 , 526 , 553 Direction 526 Ve r s i o n 52 6 , 553 Risk 5 Risks 5 RMA 6 RoadRunner Support 57 Roaming 715 Example 716 Requirements 717 Root bridge 11 [...]

ZyWALL 5/35/70 Series User’s Guide Index 802 SSH 53 , 437 SSH Implement ation 438 startup 724 S tateful Inspection 53 , 198 , 199 , 204 , 205 Process 205 ZyW ALL 206 S tatic Route 388 S torage Sp ace 270 STP (S panning Tree Protocol) 52 STP Port S tates 120 STP See S panning Tree Protocol 11 8 STP T erminology 11 9 SUA (Single User Account) 374 ,[...]

ZyWALL 5/35/70 Series User’s Guide 803 Index Unsolicited Commercial E-mail 262 Upload Firmware 617 UPnP 54 , 452 UPnP Examples 455 UPnP Port Mapping 454 Upper Layer Prot ocols 206 , 207 Use Server Detected IP 509 User Authentication 183 , 714 User Name 506 User Profiles 366 V Va l u e 6 V endor 5 V entilation Slots 5 Viewing Certifications 3 Virt[...]