ZyXEL Communications ZYWALL10 manuale d’uso

ZyW ALL 10 Internet Secu rity G ateway User’s Guide Version 3.24 April 2001[...]

ZyW ALL 10 Internet Security G ateway ii Copyright Copyright Copyright © 2001 by ZyXEL Communications Corporation. The content s of this publ ication may not be reprodu ced in any part or as a wh ole, transcribed, s tored in a retrieval system, translated into any language, or transmitted in an y for m or by any means, electronic, mechanical, magn[...]

ZyW ALL 10 Internet Security G ateway FCC iii Federal Communications Commission (FCC) Interference Statement This device co mplies with Pa rt 1 5 of FCC rules. Operation is subj ect to the following two conditions: This device may not cause harmful in terference. This device must accept any interference received, including interference that may cau[...]

ZyW ALL 10 Internet Security G ateway iv Canadian Us ers Information for Canadian Users The Industry Canad a label iden tif ies certifi ed equi pme nt. T his cer tifi cat ion mea ns that the equipment meet s certain tele communicatio ns netw ork protectiv e, operation, and safety req uirements. T he Industry Canada does not guar antee that the equi[...]

ZyW ALL 10 Internet Security G ateway Declaratio n of Conf ormit y v Declaration of Confor mit y We, the Manufacturer/Importer, ZyXEL Communications Cor p . No. 6, Innovation Rd. II, Science-Based Industrial Park, Hsinchu, T aiwan, 300 R.O .C declare that t he produ ct ZyWA LL 10 is in co nform ity with (reference to the spec ific at i on under whi[...]

ZyW ALL 10 Internet Security G ateway vi CE[...]

ZyW ALL 10 Internet Security G ateway ZyXEL Lim ited W arrant y vii ZyXEL Limited W arranty ZyXE L warrants to the origi nal end us er (purchaser) that this pro duct is free fro m any defe cts in mat erials or workmans hip for a peri od of up to tw o years from t he date of p urchase. Duri ng the w arranty period, and upon proof of pur chase, sh ou[...]

ZyW ALL 10 Internet Security G ateway viii Custom er Support Customer Support When you contact your customer support representative please hav e the following informat ion read y: ♦ ZyWALL Model an d serial num ber. ♦ Information in Menu 24.2.1 — System Inform ation . ♦ Warranty Inf ormation. ♦ Date you received y our ZyWALL. ♦ Brief de[...]

ZyW ALL 10 Internet Security G ateway Table of Contents ix T able of Contents Copyright ...................................................................................................................... ............................... ii Federal Communications Commission (FCC) Interfer ence Statement.............................................[...]

ZyW ALL 10 Internet Security G ateway x Table of Contents 2.7 General Setup ............................................................................................................... ............... 2-9 2.7.1 Dynamic DNS ............................................................................................................... ....2-10 2.7[...]

ZyW ALL 10 Internet Security G ateway Table of Contents xi 5.1 IP Static Route Setup ....................................................................................................... ........... 5-2 Chapter 6 Network Addr ess T ranslation (NA T ) ................................................................................... 6 -1 6.1 Intr[...]

ZyW ALL 10 Internet Security G ateway xii Table of Cont ents 7.6.2 Remote Node Filters....................................................................................................... ...7-17 Chapter 8 SNMP Configuration................................................................................................... ...........8-1 8.1 About[...]

ZyW ALL 10 Internet Security G ateway Table of Contents xiii 11.2 Call Control S upport ....................................................................................................... ......... 11-2 11.2.1 Budget Management........................................................................................................ . 11-2 11.2.2 [...]

ZyW ALL 10 Internet Security G ateway xiv Table of Cont ents 14.1 SMT Menus.................................................................................................................. .............14-1 14.1.1 View Firewall L og ........................................................................................................ .... 14-2 1[...]

ZyW ALL 10 Internet Security G ateway Table of Contents xv 17.1 Introduction ............................................................................................................... ............... 17-1 17.2 Creating/Editing A Cu stom Port ............................................................................................. . 17-3 Ch[...]

ZyW ALL 10 Internet Security G ateway xvi Table of Cont ents Appendix E Fire wall CLI Co mmands ............................................................................................... ....... G Appendix F Power Adapter Specifications ....................................................................................... ....... L Glossary o[...]

ZyW ALL 10 Internet Security G ateway List of F igures xvii List of Figures Figure 1-1 Secu re Internet Access via Cable .................................................................................... ............. 1-4 Figure 1-2 Secu re Internet Access via DSL ...................................................................................[...]

ZyW ALL 10 Internet Security G ateway xviii List of Figures Figure 4-4 Men u 1 1.3 — Remote Node Network L ayer Options ................................................................... 4-6 Figure 4-5 Men u 1 1.3 — Remote Node Network L ayer Options ................................................................... 4-8 Figure 4-6 Men u 1 1.5[...]

ZyW ALL 10 Internet Security G ateway List of F igures xix Figure 6-21 NA T Example 4 ...................................................................................................... .................. 6-20 Figure 6-22 Ex ample 4: Menu 15.1.1.1 — Addres s Mapping Ru le ............................................................. 6-21 Figur[...]

ZyW ALL 10 Internet Security G ateway xx List of F igures Figure 9-8 Men u 24.3.2 — System Maintenance — UNIX Syslog................................................................ 9-6 Figure 9-9 C all-T riggering Packet Example ...................................................................................... ........... 9-10 Figure 9-10 M[...]

ZyW ALL 10 Internet Security G ateway List of F igures xxi Figure 12-1 T eln et Configuration on a TCP/IP Network ........................................................................... .. 12-1 Figure 13-1 Zy W ALL Firewall Application ........................................................................................ ........ 13-3 Figure [...]

ZyW ALL 10 Internet Security G ateway xxii List of Fig ures Figure 19-2 Ex ample 1: E-m ail Screen ........................................................................................... .............. 19-3 Figure 19-3 Ex ample 1: Config uring a Rule ...................................................................................... ........[...]

ZyW ALL 10 Internet Security G ateway List of T ables xxiii List of T ables T a ble 2-1 LED f unctions ........................................................................................................ ........................ 2-1 T a ble 2-2 Main Men u Commands .................................................................................[...]

ZyW ALL 10 Internet Securit y Gatewa y xxiv List of T ables T a ble 7-2 Ru le Abbreviations Used .............................................................................................. ..................7-6 T a ble 7-3 TCP/I P Filter Rule Menu Fields ....................................................................................... ....[...]

ZyW ALL 10 Internet Security G ateway List of T ables xxv T a ble 17-1 Cu stom Ports ........................................................................................................ ...................... 17-2 T a ble 17-2 Creatin g/Editing A Custom Port ...................................................................................... [...]

[...]

ZyW ALL 10 Internet Security G ateway Prefac e xxvi i Preface A bout Y our Router Congratu lations on y our purchase of the ZyWALL 10 Int ernet Security Gateway. Don’t forget to register your ZyWALL (fast, easy online registration at www .zyxel.com ) for free future product updates and information. The ZyWALL 10 is a dual Eth ernet Internet Secur[...]

ZyW ALL 10 Internet Securit y Gatewa y xxviii Preface Regardless of your particular application, it is i mportant that you follow the steps outli ned in Chapters 1 and 2 to connect y our ZyWALL to your LAN. You can then refer to th e appropriate chapters of th e manual, dep ending o n your app licat i o ns. Related Documentation " Support Disk[...]

Getting Starte d I Part I: Getti ng Starte d Chapters 1— 3 are str uctured as a step-b y-step gu ide to hel p you connec t, inst all and set up your Zy WA L L to operate on your network and acces s the Interne t.[...]

[...]

ZyWALL 10 Internet Sec urity G ateway Getting to Know Y our Z y WALL 1-1 Chapter 1 Getting to Know Your ZyWALL This chapt er introd uces the main feat ures and ap plicatio ns of the ZyW ALL. 1.1 The ZyW ALL 10 Internet Security Gate wa y The ZyWALL 10 is a du al Ethernet Internet Security Gateway inte grated wi th a robust firewall and network mana[...]

ZyWALL 10 Internet Sec urity Gate way 1-2 Getting to Know Y our Z y WALL PPTP En capsul ation Point- to-Point Tunneling Protocol ( PPTP) is a ne twork prot ocol that en ables secure transf er of data f rom a remote client to a private s erver, creating a Virtual Private Network (VPN) using a TCP/IP-based netw ork. PPTP su pports on- demand, m ulti-[...]

ZyWALL 10 Internet Sec urity G ateway Getting to Know Y our Z y WALL 1-3 Full Network Management This feature allows you to access the SMT (Sys tem Management Terminal) through the console port or teln et connection. RoadRunner Suppor t In addition to st andard cable modem services, the ZyWALL supports Tim e Warner’s RoadRunner Serv ice. Time and[...]

ZyWALL 10 Internet Sec urity Gate way 1-4 Getting to Know Y our Z y W ALL Figure 1-1 Secure In ternet Acc ess v ia Cable Figure 1-2 Secure In ternet Ac cess v ia DSL You can als o use your xDSL modem in the bridg e mode for always -on Internet access and h igh-speed data transfer.[...]

ZyWALL 10 Internet Sec urity G ateway Hard ware Inst a lla ti on & Initia l Se tup 2-1 Chapter 2 Hardware Installation & Initial Setup This chapt er explai ns the LEDs and ports as well as how to connec t the har dware and p erform the initia l set up. 2.1 Front Panel LEDs and Back Panel Ports 2.1.1 Front Panel LEDs The LEDs on the f ront p[...]

ZyWALL 10 Internet Sec urity Gate way 2-2 Hardware Insta lla ti on & Initia l Se tup LEDS FUNCTION INDICATOR STATUS ACTI VE DESCRIPTION Off The W AN Link is not ready, or ha s failed. On The W AN Link is OK. WAN W AN Green Flashing The 10M WAN link i s sending/r eceiving packets. 2.2 ZyW ALL 10 Rear Panel and Connections The following figure sh[...]

ZyWALL 10 Internet Sec urity G ateway Hard ware Inst a lla ti on & Initia l Se tup 2-3 console port of the Zy WALL and the other en d (choice of 9- pin or 25-pin , depending on your computer) end to a seri al port (COM1, COM2 or other COM port) of y our workstation. You can use an extension RS - 232 cable if th e enclosed one is too sh ort. Aft[...]

ZyWALL 10 Internet Sec urity Gate way 2-4 Hardware Insta lla ti on & Initia l Se tup 3. A cable/xDSL m odem and an ISP account. After the ZyWALL is properly set up, you can make future changes to t he configuration through telnet connections. 2.4 T urn On Y our ZyW ALL At this poi nt, you should have connect ed the console port, t he LA N port,[...]

ZyWALL 10 Internet Sec urity G ateway Hard ware Inst a lla ti on & Initia l Se tup 2-5 Several operations that you should be familiar with before you attempt to modify the configuration are listed in the table belo w. Table 2-2 Main Menu Commands OPERATION KEYSTROKES DESCRIPTION Move dow n to another menu [ENTER] To move forw ard to a submenu, [...]

ZyWALL 10 Internet Sec urity Gate way 2-6 Hardware Insta lla ti on & Initia l Se tup 2.5.1 Main Menu After you enter the password, the SMT displa ys the Z yWAL L 1 0 Mai n Me nu , as sho wn next. Figure 2-5 ZyWALL 10 Main Menu Copyright (c) 1994 - 2001 ZyXEL Communications Corp. ZyWALL Main Menu Getting Started Advanced Management 1. General Se[...]

ZyWALL 10 Internet Sec urity G ateway Hard ware Inst a lla ti on & Initia l Se tup 2-7 2.5.2 Syst em Management T erminal Interf ace Summary Table 2- 3 Main M enu Summary NO. MENU TITLE FUNCTION 1 General Setup Use this menu to set up routing/br idg ing and general infor mati on. 2 WAN Setup Use this menu to clo ne a M AC address from a compute[...]

ZyWALL 10 Internet Sec urity Gate way 2-8 Hardware Insta lla ti on & Initia l Se tup 2.5.3 SMT Menus at a Glance Figure 2-6 SM T Menus at a Glance[...]

ZyWALL 10 Internet Sec urity G ateway Hard ware Inst a lla ti on & Initia l Se tup 2-9 2.6 Changing the System Pass word The firs t thing y ou should do i s chang e the default system passw ord by following the steps shown next . Step 1. Enter 23 in the main menu to ope n M enu 23 - Syst em Passw ord as shown belo w. Figure 2-7 Men u 23 — Sys[...]

ZyWALL 10 Internet Sec urity Gate way 2-10 Hardware Inst a lla ti on & Initia l Se tup The Domain Name entry is what is propagated to the DHCP client s on the LAN. If you leave this field blank, the d o main name o bta i ned b y DHCP fro m the ISP is used . Whi l e yo u must e nt e r t he host na me ( Syste m Name ) on each individual machine, [...]

ZyWALL 10 Internet Sec urity G ateway Hard ware Inst a lla ti on & Initia l Se tup 2-1 1 Table 2-4 General Setup Menu Field FIELD DESCRIPTION EXAMPLE System Na me Choose a des criptive na me for ident ification purpo ses. It is recommende d you enter y our comput er’s “Computer name” in th is field. T his name can b e up to 30 al phanumer[...]

ZyWALL 10 Internet Sec urity Gate way 2-12 Hardware Inst a lla ti on & Initia l Se tup Table 2-5 Configure Dynamic DNS Menu Fields FIELD DESCRIPTION EXAMPLE Service Provider Enter the na me of your Dy namic DN S client. www .dyndns.org Active Press [SPACE BAR] to cycle between Yes or No . Yes Host Enter the domai n name as signed to y our Zy W [...]

ZyWALL 10 Internet Sec urity G ateway Hard ware Inst a lla ti on & Initia l Se tup 2-1 3 Figure 2-10 Menu 2 — W A N Setup The MAC address field allows users to configu re the WAN port's MAC address by eith er using the factory default or clon ing the MAC address from a com puter on your LAN. Once it is successfully conf igured, the addre[...]

ZyWALL 10 Internet Sec urity Gate way 2-14 Hardware Inst a lla ti on & Initia l Se tup Figure 2-11 Menu 3 — L A N Setup 2.9.1 LAN Port Filter Setup This menu allows you to specif y the filter sets that you wish to apply to the LAN traffic. You seldo m need to filter the LAN traffic, however, the filter sets may be useful to block certain pack[...]

ZyWALL 10 Internet Sec urity G ateway Internet Acc ess 3-1 Chapter 3 Internet Access This chapt er shows y ou how to c onfigure t he LAN as well as the WAN of y our ZyW ALL for Intern et access. 3.1 TCP/I P and DHCP for LAN The ZyWALL has built-i n DHCP ser ver capability that assigns IP addresses and DNS ser vers to systems that support DHCP clien[...]

ZyWALL 10 Internet Sec urity Gate way 3-2 Internet Acc ess Example of netw ork properti es for L AN servers wit h fixed IP add resses: Choose an IP address: 192.168.1.2 - 192.168.1.32 ; 192.168 .1.65 - 192.16 8.1.254. Subnet mask: 255.255.255.0 Gateway (or default route): 192.168.1.1 (Zy W ALL LAN IP) 3.1.3 IP Address and Subnet M ask Similar to th[...]

ZyWALL 10 Internet Sec urity G ateway Internet Acc ess 3-3 Internet address es for your local netw orks. On the other hand, if y ou are part of a much larger org anization, you sh ould consult your network administrator f or the appropriate I P address es. Regardle ss of your partic ular sit uation, d o not cre ate an ar bit rar y IP ad dress; al w[...]

ZyWALL 10 Internet Sec urity Gate way 3-4 Internet Acc ess WAN int erfaces using menus 3.2 (LA N) and 11.3 (WA N). Select None to disable IP Multicasting on these interfaces. 3.1.7 IP A lias IP Alias allows you to partition a physical net work into different logical networks over the same Ethernet interface. The ZyWALL su pports three logical LAN i[...]

ZyWALL 10 Internet Sec urity G ateway Internet Acc ess 3-5 Figure 3-3 Menu 3 — LAN Setup From menu 3, select th e submenu option TCP/IP and DHCP Set up and press [ ENTER ]. T he screen n ow display s M enu 3.2 — TCP/IP a nd DHCP Ethernet Setup , as sh own. Figure 3-4 Menu 3.2 — TCP/IP and DHCP Ethernet Setup Follow the instr uction s in the n[...]

ZyWALL 10 Internet Sec urity Gate way 3-6 Internet Acc ess Table 3-1 DHCP Ethernet Setup Menu Fields FIELD DESCRIPTION EXAMPLE DHCP This field enables /disables the DHCP server. If set to Server , y our Zy W ALL w ill act as a DHCP server. If set to None , th e DHCP server will be disabled. If set to Relay , the ZyWA LL acts as a surrogate DHCP se [...]

ZyWALL 10 Internet Sec urity G ateway Internet Acc ess 3-7 FIELD DESCRIPTION EXAMPLE Multicast IGMP (Internet Gro up Multica st Protocol) is a sess ion-layer proto col used to esta blish me mbership in a Multica st group. T he Zy W ALL supports both IGM P version 1 ( IGMP-v1 ) a nd version 2 ( IG MP-v2 ). Press the [SPACE BAR] to e nable IP Multic [...]

ZyWALL 10 Internet Sec urity Gate way 3-8 Internet Acc ess Use the instructions in the following table to con figure IP Alias p arameters. Table 3-3 IP Alias Setup Menu Fields FIELD DESCRIPTION EXAMPLE IP Alias Choose Yes t o configure the LAN netw ork for the Zy W ALL. Yes IP Address Enter the IP a ddress of your Zy W ALL in dotted dec imal notati[...]

ZyWALL 10 Internet Sec urity G ateway Internet Acc ess 3-9 Figure 3-6 Men u 4 — Internet Access Setup (Eth ernet) The following table describes t his screen. Table 3- 4 Intern et Access Set up M enu Fields FIELD DESCRIPTION ISP’s Name Enter the name of your Intern et Service Provid er, e.g., my ISP. This information i s for identi fication p ur[...]

ZyWALL 10 Internet Sec urity Gate way 3-10 Internet Acc ess FIELD DESCRIPTION IP Address Enter the (fix ed) IP address assign ed to you by y our ISP (Static IP A ddress Assignment is select ed in the prev ious fie ld). IP Subnet M ask Enter the subne t mask asso ciated w ith your static IP. Gateway IP Address Enter the gatew ay IP address associate[...]

ZyWALL 10 Internet Sec urity G ateway Internet Acc ess 3-1 1 Figure 3- 7 Intern et Access Setup ( PPT P) The follow ing table contai ns instructions about the new fields when y ou choose PPTP in th e Encaps ulation field in M enu 4 . Table 3- 5 New Field s in Men u 4 (PPT P) screen FIELD DESCRIPTION EXAMPLE Encapsulati on Press the [SPACE BAR] and [...]

ZyWALL 10 Internet Sec urity Gate way 3-12 Internet Acc ess known as dynamic service selection. This en ables the service provider to easily create an d offer new IP services f or specific u sers. Opera tion ally , PPPoE s ave s signif icant ef fort for both the end u ser a nd ISP/ carri er, as it requ ires no speci fic configuration of the broadba[...]

ZyWALL 10 Internet Sec urity G ateway Internet Acc ess 3-13 3.4 Basic Setup Complete Well done! You h ave successfully connected, ins talled and set up your Zy W ALL to operate on your n etwork as well as access the Internet. Please n ote that w hen the fir ewal l is activ ated, the de fault po licy allo ws all commu nicati ons to the Inter net tha[...]

Advance d App licatio ns II Part II: Advanced Applications Chapters 4 — 6 des cribe adv anced appl ications i ncluding R em ote Node Setup, IP Static routes and NA T .[...]

ZyWALL 10 Internet Sec urity Gate way Remote Node Setup 4-1 Chapter 4 Remote Node Setup This chapt er shows y ou how to c onfigure a remote node. A remote node is required for placing calls to a remote gateway. A rem ote node represents both the remote gate way and the ne t work b ehind it ac r oss a W AN co n necti o n. No t e tha t when yo u use [...]

ZyWALL 10 Internet Sec urity Gate way 4-2 Rem ote Node Setup Table 4- 1 Fields in M enu 11.1 FIELD DESCRIPTION EXAMPLE Rem Node N ame Enter a descri ptive name for the remot e node. Thi s field can be up to eight characters . LAoffice Active Press [SPACE BAR] to select Yes (activate remote node) or No (deactivate r emote node). Yes Encapsulati on E[...]

ZyWALL 10 Internet Sec urity Gate way Remote Node Setup 4-3 Once you h ave configured the Remot e Node Profile M enu, press [ENTER] to retur n to menu 11. Press [ENTER] at the message “Pre ss ENTER to Conf irm...” to sav e your configurat ion, or pres s [ESC] at any time to cancel . 4.1.2 PPPoE Encapsulat ion The Zy WALL supports PPPoE (Poin t-[...]

ZyWALL 10 Internet Sec urity Gate way 4-4 Rem ote Node Setup Do not specify a nailed-u p connection unless your telephone company off ers flat-rate service or you need a constant conn ection and the cost is of no concern. The follow ing table descri bes the fields n ot already described in Table 4-1 . Tabl e 4-2 Fields in Menu 11.1 (PPPo E Encap su[...]

ZyWALL 10 Internet Sec urity Gate way Remote Node Setup 4-5 Figure 4-3 Menu 11.1 — Remote Node Profile for PPTP Encapsulation The next table shows how to configu re fields in m enu 11.1 not previou sly di scussed above. Table 4-3 Fields in Menu 11.1 (PPTP Encapsulation) FIELD DESCRIPTION EXAMPLE Encapsulati on Toggle the sp ace bar to choose PPTP[...]

ZyWALL 10 Internet Sec urity Gate way 4-6 Rem ote Node Setup 4.2 Editi ng TCP/IP Options (with Ethernet Encapsulati on) Move the cursor to the Edit IP field in menu 11.1, then press th e [SPACE BA R] to toggle and set the value to Yes . Press [ENTER] to open Menu 11. 3 - Network Layer Options . Figure 4-4 Menu 11.3 — Remote Node Network Layer Opt[...]

ZyWALL 10 Internet Sec urity Gate way Remote Node Setup 4-7 FIELD DESCRIPTION EXAMPLE Private This field i s valid only for PPTP/PPPoE encapsul ation. This parameter deter mines if t he ZyW ALL will in clude the ro ute to this remote no de in its RIP br oadcasts. If set t o Yes , this ro ute is kept private and n ot include d in RIP broadc ast. If [...]

ZyWALL 10 Internet Sec urity Gate way 4-8 Rem ote Node Setup Figure 4-5 Menu 11.3 — Remote Node Network Layer Options The next tab le gi ve s you i nstr uctio ns abo ut con figur i ng r e mote no de net wor k la yer o ptio ns. Table 4-5 Remote Node Network Layer Options Menu Fields FIELD DESCRIPTION EXAMPLE IP Address Assignment If y our ISP did [...]

ZyWALL 10 Internet Sec urity Gate way Remote Node Setup 4-9 FIELD DESCRIPTION EXAMPLE number. Private This paramet er determine s if the Zy W ALL will i nclude the r oute to this remote no de in its RIP br oadcasts. If set t o Yes , this ro ute is kept private and n ot include d in RIP broadc ast. If No , the route to this remote no de will be pro [...]

ZyWALL 10 Internet Sec urity Gate way 4-10 Rem ote Node Setup Figure 4-6 Menu 11.5 — Remote Node Filter (Ethernet Encapsulation) Figure 4-7 Menu 11.5 — Remote Node Filter (PPPoE or PPTP Encapsulation) Menu 11.5 - Remote Node Filter Input Filter Sets: protocol filters= 3 device filters= Output Filter Sets: protocol filters= 1 device filters= Ent[...]

ZyWALL 10 Internet Sec urity Gate way IP Static Route Setu p 5-1 Chapter 5 IP Static Route Setup This chapt er shows y ou how to c onfigure s tatic rou tes with yo ur ZyW ALL. Static routes tell the ZyWALL routing information that it cannot lear n automatically through other means. This can arise in cases where RIP is disabled on the LAN. Each remo[...]

ZyWALL 10 Internet Sec urity Gate way 5-2 IP Stat ic Route Setup 5.1 IP Static Route S etup You configure IP static routes in menu 12. 1, by selecting one of the IP static ro utes a s shown b elo w. Enter 12 from the main menu . Figure 5-2 Menu 12 — IP Static Route Setup Now, enter t he index num ber of one of the static rou tes you want to conf [...]

ZyWALL 10 Internet Sec urity Gate way IP Static Route Setu p 5-3 Table 5- 1 IP Stati c Route M enu Fields FIELD DESCRIPTION Route # This is the ind ex number of the static route that y ou chose in m enu 12. Route Name Enter a descri ptive name for this rout e. This is for identifi cation purpo ses only . Active This field allow s you to activ ate/d[...]

[...]

ZyWALL 10 Internet Sec urity Gate way NA T 6-1 Chapter 6 Network Address Translation (NAT) This chapt er disc usses how to c onfigure NAT on t he ZyW ALL. 6.1 Introducti on NAT (Netw ork Address Transl ation - NAT, RFC 1631) is t he transl ation of the IP addres s of a host in a packet, e.g., th e source address of an outgoing packet, used w i thin[...]

ZyWALL 10 Internet Sec urity Gate way 6-2 NA T The global IP addresses for the inside hos ts can be either static or dynamically assi gned by the ISP. In addition, you can designate servers, e.g., a web server and a telnet server, on your local network and make them accessi ble to the outside world. If y ou do not define any servers (for Many-to- O[...]

ZyWALL 10 Internet Sec urity Gate way NA T 6-3 6.1.4 NA T Mapping T ypes NAT su pports five types of IP/port mappi ng. They are: 1. One to One: In One-to-On e mode, the ZyWALL maps one local IP address to on e global IP addres s. 2. Many t o One: In Many-to-One m ode, the ZyWALL maps mu ltiple local IP addres ses to one g lobal IP address. T his is[...]

ZyWALL 10 Internet Sec urity Gate way 6-4 NA T TYPE IP MAPPING SMT ABBREVIATION Server Server 1 IP !" IGA1 Server 2 IP !" IGA1 Server 3 IP !" IGA1 Server 6.1.5 SUA (Single User A ccount) V ersus NA T SUA (Sing le User Account) i n previous ZyN OS versions i s a subset of NAT that support s two types of mapping , Many-to-One an d Serv[...]

ZyWALL 10 Internet Sec urity Gate way NA T 6-5 Figure 6-2 NAT Application 6.2 SM T Menus 6.2.1 A ppl ying NA T in the SMT Menus You apply NAT via menus 4 or 11 .3 as display ed next. The next f igure shows you how to apply NAT for Internet access in menu 4. Enter 4 from the main m enu to go to Menu 4 - Internet Access Setup .[...]

ZyWALL 10 Internet Sec urity Gate way 6-6 NA T Figure 6-3 Men u 4 — Applying NAT fo r Internet Access The follow ing figure sh ows how you apply NAT to the remote n ode in menu 11.1. Step 1. Enter 11 from the main menu. Step 2. Mo ve the cursor to the Edit IP field, press the [SPACE BAR] to select Yes and then press [EN T ER] to br i ng up Menu 1[...]

ZyWALL 10 Internet Sec urity Gate way NA T 6-7 Table 6-3 Applying NAT in Menus 4 & 11.3 FIELD OPTIONS DESCRIPTION Full Feature When you se lect this o ption the SMT will use Address M apping Set 1 (me nu 15.1 - see section 6.2.3 for further dis cu ssion). You can con f ig ure any of the mappin g types descr ibed in Table 6-2 . None NAT is dis a[...]

ZyWALL 10 Internet Sec urity Gate way 6-8 NA T Enter 1 to bring up Menu 15. 1 — Address Mapping Sets . Figure 6-6 Menu 15.1 — Address Mapping Sets 1. NAT _SET is a se t name tha t was cr e ate d as an exa mple . Info rm a tio n abo ut cre a ti ng your own addre s s map pin g se ts is provide d la te r in the cha pter . Let’s look first at Opt[...]

ZyWALL 10 Internet Sec urity Gate way NA T 6-9 Table 6- 4 SUA Add ress M apping Rules FIELD DESCRIPTION EXAMPLE Set Name This is the name of the set you sele cted in men u 15.1 or ent er the name of a new set y ou want to create. SUA Idx This is the index or rule number . 1 Local Start IP Loc al E n d IP Local Start IP i s the startin g local IP a [...]

ZyWALL 10 Internet Sec urity Gate way 6-10 NA T Figure 6-8 Men u 15.1.1 — Fir st Set The Ty pe, Local a nd Glob al Start/ End IPs are config ured i n menu 1 5.1.1.1 (de s cribed later) a nd the v alues are displa yed her e. Ordering Y our Rules Ordering y our rules is important because the Zy WALL applies the rules in the order that you specify. [...]

ZyWALL 10 Internet Sec urity Gate way NA T 6-1 1 Table 6- 5 Fields in M enu 15.1.1 FIELD DESCRIPTION EXAMPLE Set Name Enter a name for this set of rule s. This i s a required field. Please note that if this fi eld is left blank, the entire set will be del eted. NAT_SET Action There are fo ur actions. The default is Edi t . Edit means you w ant to e[...]

ZyWALL 10 Internet Sec urity Gate way 6-12 NA T The following table describes the fields in this screen. Table 6-6 Menu 15.1.1.1 — Configuring an Individual Rule FIELD DESCRIPTION EXAMPLE Type Press the [SPACE BAR] to toggl e through a total of five types. The se are the m apping types dis cussed above ( see Table 6-2 ). Type Serv er allows you t[...]

ZyWALL 10 Internet Sec urity Gate way NA T 6-13 6.3.1 Multiple Serv ers behind NA T If you w ish, you can make inside s ervers for different serv ices, e.g., web or FTP, visible to the ou tside users, even though NAT m akes your whole inside n etwork appear as a si ngle machine t o the outside world. A se rvice is identifi ed by the port num ber, e[...]

ZyWALL 10 Internet Sec urity Gate way 6-14 NA T Step 4. P ress [ENTER] at the “Press ENTER to confirm …” pro mpt to save your configuration after you define all the s ervers or press [ESC] at any time to cancel. If you’ re usin g Ether net Enca psulatio n the SMT does no t allow you to c hange the port 1026 e ntry. The most often used port [...]

ZyWALL 10 Internet Sec urity Gate way NA T 6-15 6.4 Examples 6.4.1 Internet A ccess Only In the following In ternet access example, you only need one ru le where all your ILAs (Inside L ocal addresses ) map to one dy namic IGA (In side Global A ddress) assi gned by y our ISP. Figure 6-1 2 N A T Ex ample 1 Figure 6-1 3 Menu 4 — Internet Access &am[...]

ZyWALL 10 Internet Sec urity Gate way 6-16 NA T the Network A ddress Trans lation field i n menus 4 and 11.3 is specifically pre-configured to handle th is case. 6.4.2 Example 2: Intern et A ccess with an In side Server Figure 6-1 4 N A T Ex ample 2 In this case, y ou do exactly as abov e (use the convenient pre-conf igured SU A Only set) and also [...]

ZyWALL 10 Internet Sec urity Gate way NA T 6-17 6.4.3 Example 3: G eneral Case In this example, th ere are 3 IGAs from ou r ISP. T here are many departm ents but two have their own FT P server. All departm ents share the same rout er. The example will reserve one IGA for each departm ent with an FTP server and the oth er IGA is used by all. Now you[...]

ZyWALL 10 Internet Sec urity Gate way 6-18 NA T Step 3. Enter 1 to co nfigure the Address Mapping Sets. Step 4. Enter 1 to b egin configu ring this new set. Enter a Set Na me, choose the Edit Ac t i o n and t hen enter 1 for the Select Rule field. Press [ENTER] to confirm . Step 5. Select Ty pe as One-to-One (direct m apping f or packets going both[...]

ZyWALL 10 Internet Sec urity Gate way NA T 6-19 When y ou have configu red all four rul es, Menu 15.1.1 shou ld look as follows. Figure 6-1 9 Exampl e 3: Final M enu 15.1.1 Now conf igure the IGA3 to m ap to our we b server and ma il server on the LA N. Step 8. Enter 15 from the main menu. Step 9. No w enter 2 from t his menu an d configure it as s[...]

ZyWALL 10 Internet Sec urity Gate way 6-20 NA T 6.4.4 Example 4: NA T Unfriendly Application Programs Some appli cations do n ot support NA T Mapping usi ng TCP or UDP port address tran slation. In this case it is better to use Many-to-M any No Overlo ad mapping as port numbers do not change for M any-to- Many No Overload (and One-to-One ) NAT mapp[...]

ZyWALL 10 Internet Sec urity Gate way NA T 6-21 Figure 6-2 2 Exampl e 4: Menu 15.1.1.1 — Address M apping Rule After you’ve con fi gure d your rule, you s ho uld b e able to che c k the se t ting s i n me nu 1 5.1 .1 a s sho wn ne xt. Figure 6-2 3 Exampl e 4: Menu 15.1.1 — Address M apping Rules Menu 15.1.1.1 Address Mapping Rule Type= Many-t[...]

Advance d Managem ent III Part III: Advanced Manage ment Chapters 7 — 12 prov ides inf orm ation on ZyWALL Filter ing, SNM P Configur ation, S ystem Inform ation and D iagnosis , Transferring Files , System Mainte nance and T elnet.[...]

[...]

ZyWALL 10 Internet Sec urity Gate way Filters 7-1 Chapter 7 Filter Configuration This chapt er shows y ou how to c reate a nd apply fi lters. 7.1 About Filtering Your Zy W ALL uses filters to decide whether to allow pass age of a data packet and/or to m ake a call. There are two types of filter applications: data filtering and call filtering. Filte[...]

ZyWALL 10 Internet Sec urity Gate way 7-2 Filters 7.1.1 The Filter Structur e of the Zy W ALL A filter set consists of one or more filter rules. Usually, you would group related rules, e.g., all the rules for NetBIOS, into a single set and give it a descripti ve name. The ZyWALL allows you to configure up to twelve filter sets with six rules in eac[...]

ZyWALL 10 Internet Sec urity Gate way Filters 7-3 Start Fetch First Filter Set Fetch First Filter Rule Active? Execute Filter Rule Fetch Next Filter Rule Next filter Rule Available? Fetch Next Filter Set Next Filter Set Available? Accept Packet Drop Packet Yes No Yes No Yes Packet into filter Filter Set Forward Drop No Check Next Rule Figure 7-2 Fi[...]

ZyWALL 10 Internet Sec urity Gate way 7-4 Filters 7.2 Configur i ng a Fil ter Set To configu re a filter set, follow the procedure below. For m ore information on menus 21.2 and 21.3, please see Part 4. Step 1. Select option 21. Filter Set Configuration from th e main menu to open m enu 21. Figure 7-4 Menu 21 — Filter and Firewall Setup Step 2. E[...]

ZyWALL 10 Internet Sec urity Gate way Filters 7-5 Figure 7-6 NetBIOS_W AN Filter Rul es Summa ry Figure 7-7 NetBIOS _L AN Filter Rules Summ ary Figure 7-8 TEL_FTP_WEB_WAN Filter Rules Summary Menu 21.1.1 - Filter Rules Summary # A Type Filter Rules M m n - - ---- -------------------------------------------- --------- - - - 1 Y IP Pr=6, SA=0.0.0.0, [...]

ZyWALL 10 Internet Sec urity Gate way 7-6 Filters 7.2.1 Filter Rules Summary Menu This screen shows the summary of the existing rules in the filter set. The following tables con tain a brief description of the abbrev iations used i n the previous menus. Table 7- 1 Abbreviatio ns Used in the Filte r Rules Sum mary M enu FIELD DESCRIPTION # The filte[...]

ZyWALL 10 Internet Sec urity Gate way Filters 7-7 ABB RE VI ATI ON DESCRIPTION GEN Off Offset Len Length Refer to the next section for information on configuring the filter rules. 7.2.2 Configuring a Filter Rule To configure a f ilter rule, type its number in Menu 21.1 - Fil ter Rules Summ ary and press [ENTER] to open menu 21.1.1 for th e rule. To[...]

ZyWALL 10 Internet Sec urity Gate way 7-8 Filters The following table describes ho w to configure your TCP/IP filter rule. Table 7-3 TCP/IP Filter Rule M enu Fields FIELD DESCRIPTION OPTIONS Active Yes activate s the filter r ule and No deactiv at es it. Yes / No IP Protocol Protocol refers to the upper layer protocol, e.g., TC P is 6, UDP is 17 an[...]

ZyWALL 10 Internet Sec urity Gate way Filters 7-9 FIELD DESCRIPTION OPTIONS according to the action fields. If More is Yes , then A ction Matc hed and Action Not Matched w ill be N/A . Log Select the loggin g option fro m the follow ing: None – No pac kets will b e logged. Action Matche d - Only pack ets that ma tch the rule parameters w ill be l[...]

ZyWALL 10 Internet Sec urity Gate way 7-10 Filters The following figure illustrates the logic flo w of an IP filter. Packet into IP Filter Matched Matched Yes Action Matched Action Not Matched More? No Filter Active? Check IP Protocol Drop Drop Packet Accept Packet Drop Forward Check Next Rule Check Next Rule Check Next Rule Forward Not Matched Yes[...]

ZyWALL 10 Internet Sec urity Gate way Filters 7-1 1 7.2.4 Generic Filter Ru le This section shows you ho w to configure a generic filter rule. The purpose of generic rules is to allow you to filter non-IP packets. For IP, it is generally easier to use the IP rules directly. For generi c rules, the ZyWALL treats a pack et as a byte st ream as oppose[...]

ZyWALL 10 Internet Sec urity Gate way 7-12 Filters Table 7- 4 Generic Filt er Rule M enu F ields FIELD DESCRIPTION OPTIONS Filter # This is the filter set, f ilter rule co-o rdinates, i.e., 2,3 refer s to the se cond filter set and the thir d rule of that set. Filter Type Us e the [SPACE BAR] to select a rule ty pe. Parameters displayed bel ow each[...]

ZyWALL 10 Internet Sec urity Gate way Filters 7-13 7.3 Example Filter Let’s look at an example to block outside users fro m telnetting into the ZyWALL. Please see our included disk for m ore example filters. Figure 7-1 2 Telnet Filter Ex ample Step 1. Enter 21 from th e main menu to open Menu 21.1 - Filter Set Co nfiguration . Step 2. Enter the i[...]

ZyWALL 10 Internet Sec urity Gate way 7-14 Filters Figure 7-1 3 Example F ilter — M enu 21.1.1.1 When y ou press [ENTE R] to conf ir m, you will see the following screen. Note that there is only one filter rule in this set. Menu 21.1.1 - TCP/IP Filter Rule Filter #: 3,1 Filter Type= TCP/IP Filter Rule Active= Yes IP Protocol= 6 IP Source Route= N[...]

ZyWALL 10 Internet Sec urity Gate way Filters 7-15 Figure 7-1 4 Example F ilter Rules Summary — M enu 21.1.3 After you’ve created the filter set, you must apply it. Step 1. Enter 11 from the main menu to g o to menu 11. Step 2. Go to the Edit Filter Sets fi eld, press the [SPA CE BAR ] to select Yes and pres s [ENT ER] . Step 3. T his brings yo[...]

ZyWALL 10 Internet Sec urity Gate way 7-16 Filters the raw packets that appear on the wire. They are applied at th e point when the Zy WALL is receiving and sending the pack ets; i.e. the interface. The interface can be an Ethernet port or any other hardware port. The following diagram illustrates this. Figure 7-15 Protocol and Device Filter Sets 7[...]

ZyWALL 10 Internet Sec urity Gate way Filters 7-17 Figure 7-16 Filtering LAN Traffic 7.6.2 Remote Node Filter s Go to menu 11.5 (sho w n below – note that call filter sets are onl y present for PPPoE encapsulation) and enter the number(s) of the filter set(s) as appropriate. You can cascade up to four filter sets by entering their numbers s epara[...]

[...]

ZyWALL 10 Internet Sec urity Gate way SNMP 8-1 Chapter 8 SNMP Configuration This chapt er disc usses SNMP (Simple Network Managemen t Protoco l) for networ k managem ent and monitor ing. 8.1 About SNMP Your Zy WALL supports SNMP ag ent function ality, which allows a manager stat ion to manage and m onitor the ZyWALL through the netw or k. Keep in m[...]

ZyWALL 10 Internet Sec urity Gate way 8-2 SNMP The following table describes the SNMP co nfiguration parameters. Table 8-1 SNMP Configuration Menu Fields FIELD DESCRIPTION DEFAULT Get Community Enter th e get comm unity, w hich is the pa ssword for the incoming G et- and GetN ext- request s from the mana gement station. public Set Community Enter t[...]

ZyWALL 10 Internet Sec urity Gate way System Inform ation & Diagn osis 9-1 Chapter 9 System Information & Diagnosis This chapt er cover s SMT me nus 24.1 t o 24.4. This chapter covers the diagnostic to ols that help you to maintain your Zy W ALL. These tools include updates on system status, po rt status, log and trace capabilities and upgr[...]

ZyWALL 10 Internet Sec urity Gate way 9-2 System Inform ation & Diagn osis Figure 9-2 Men u 24.1 — Syst em Maint enance — Stat us The following table describes the fields present in Menu 24 . 1 - System Ma int enance - Stat us . These fields are READ-ONLY and are m eant to be used for diagn ostic purposes. The upper rig ht corner of the scr[...]

ZyWALL 10 Internet Sec urity Gate way System Inform ation & Diagn osis 9-3 FIELD DESCRIPTION IP Address The LAN port IP address. IP Mask The LAN port IP mask. DHCP The LAN p ort DHCP role. WA N Ethernet Address The W AN port Eth ernet addres s. IP Address The W AN port IP addre ss. IP Mask The W AN port IP mask. DHCP The W AN port DHCP role. Sy[...]

ZyWALL 10 Internet Sec urity Gate way 9-4 System Inform ation & Diagn osis 9.2.1 Syst em Information Syste m Info r mati o n gi ves yo u i nfor matio n abo ut your system as sho wn b elo w. More sp ecif icall y, it gi ves you inf ormation on you r routing protocol , Ethernet addres s, IP address, et c. Figure 9-4 Menu 24.2.1 — System M ainten[...]

ZyWALL 10 Internet Sec urity Gate way System Inform ation & Diagn osis 9-5 9.2.2 Console Port Speed You can change th e speed of the console port throu gh Menu 24.2.2 – Con sole Port Speed . You r ZyWALL supports 9600 (defau lt), 19200, 38 400, 57600, and 115200 bps for th e console port. U se the [SPAC E BAR] to select th e desired speed in [...]

ZyWALL 10 Internet Sec urity Gate way 9-6 System Inform ation & Diagn osis Figure 9-6 Menu 24.3 — System Maintenance — Log and Trace Examples of ty pical error and information messages are pres ented in the figure below. Figure 9-7 Example s of Erro r and Info rmation Messages 9.3.2 UNIX Sy slog The ZyWALL uses the UNIX syslog facility to l[...]

ZyWALL 10 Internet Sec urity Gate way System Inform ation & Diagn osis 9-7 You need to conf igure the UNIX syslog parameters described in th e following table to activate syslog then choose w hat you w ant to log . Table 9- 3 System M aintenance M enu S yslog Param eters PARAMETER DESCRIPTION UNIX Syslog: Active Press [SPACE BAR] to turn syslog[...]

ZyWALL 10 Internet Sec urity Gate way 9-8 System Inform ation & Diagn osis 1. CDR CDR Message Format Sdcm dSyslogS end( SYSLOG_CDR, SYSLOG_INFO, String ); String = board xx line xx channel xx, call xx, s t r board = the hardware board ID line = the WAN ID in a board Channel = channel ID within the WAN call = the call reference number which star[...]

ZyWALL 10 Internet Sec urity Gate way System Inform ation & Diagn osis 9-9 Mar 03 10:39:43 202.132.155.97 ZyXEL: GEN[fffffffffffnordff0080] }S05>R01mF Mar 03 10:41:29 202.132.155.97 ZyXEL: GEN[00a0c5f502fnord010080] }S05>R01mF Mar 03 10:41:34 202.132.155.97 ZyXEL: IP[Src=192.168.2.33 Dst=202.132.155.93 ICMP]}S04>R01mF Mar 03 11:59:20 2[...]

ZyWALL 10 Internet Sec urity Gate way 9-10 System Inform ation & Diagn osis 9.3.3 Call-T riggering Packet Call-Triggering Packet display s information about the packet that triggered a dial-out call in an easy readable form at. Equivalent information is available in menu 24.1 in hex format. An example is s ho wn next. Figure 9-9 Call-T riggerin[...]

ZyWALL 10 Internet Sec urity Gate way System Inform ation & Diagn osis 9-1 1 Figure 9-10 Menu 24.4 — System Maintenance — Diagnostic Follow the proced ure b e lo w to get to M enu 24.4 - S ystem Maintenance – Diagnostic. Step 1. Fro m the main menu, s elect option 24 t o open Menu 24 - System Maint enance . Step 2. Fro m this menu, select[...]

ZyWALL 10 Internet Sec urity Gate way 9-12 System Inform ation & Diagn osis Figure 9-11 W AN & LAN DHCP The follo wing table describes t he diagnostic tests a vailable in menu 24.4 for your Zy W ALL and associated connections. Table 9-4 System Maintenance Menu Diagnostic FIELD DESCRIPTION Ping Host Enter 1 to ping any machi ne (with an IP a[...]

ZyWALL 10 Internet Sec urity Gate way Firm ware and Config uration F ile Mai ntenance 10-1 Chapter 10 Firmware and Configuration File Maintenance This chapt er tells you how to back up and res tore your co nfigurat ion file as well as uploa d new firmware an d a new co nfigurat ion file. 10.1 Fil ename conventions The configuration file (often call[...]

ZyWALL 10 Internet Sec urity Gate way 10-2 Firm ware and Conf iguration F ile Ma intenance Table 10-1 Filename Conventions FILE TYPE INTERNA L NAME EXTERNAL NAME DESCRIPTION AT COMMAND Configurati on File Rom-0 *.rom This is the r outer configurat ion filename on the Zy W AL L. Uploading the rom-0 file r eplaces the entire ROM file sy stem, inc lud[...]

ZyWALL 10 Internet Sec urity Gate way Firm ware and Config uration F ile Mai ntenance 10-3 10.2.1 Example: Backup Configurat ion Using Hy perT erminal Thi s se ctio n c onta ins exa mpl e s of ba c kup c onfi gurati o n, r estor e co nfi gur a tion a nd upl oad fi rmwar e usi ng the Hy perTerminal program . Other serial communications program s sho[...]

ZyWALL 10 Internet Sec urity Gate way 10-4 Firm ware and Conf iguration F ile Ma intenance 10.3 Restore Configuration Menu 2 4.6 -- System Maint e na nce - Restore Configuration allows you to restore the configuratio n via the console port. FTP and TFTP are the preferre d methods f or restoring your curren t workstation configuration to your ZyWALL[...]

ZyWALL 10 Internet Sec urity Gate way Firm ware and Config uration F ile Mai ntenance 10-5 Figure 10- 8 Telnet int o Men u 24.6 Restore Con figuratio n 10.4 Upload Firmware Menu 2 4.7 -- System Maint e na nce - Upload Firmware allows y ou to upgrade the firmware and the configuration file via th e console port. There are tw o components in the syst[...]

ZyWALL 10 Internet Sec urity Gate way 10-6 Firm ware and Conf iguration F ile Ma intenance Step 4. After successful firmware u pload, enter atgo to restart the ZyWALL. Figure 10- 10 Menu 24.7.1 — S ystem Main tenance — Uplo ad Route r Firmware 10.4.2 Example: Xmodem Upload Using Hy perT erminal Click Tra nsfer , t hen Send F ile to display the [...]

ZyWALL 10 Internet Sec urity Gate way Firm ware and Config uration F ile Mai ntenance 10-7 Menu 2 4.6 replac es the curre nt confi guratio n with your cu stomized confi guratio n you backed up pre vio us ly. Me nu 24. 7.2 sh ow s you the instr uction s for uplo adi ng the Router C onfigur ation file that repl aces the curren t config uration f ile [...]

ZyWALL 10 Internet Sec urity Gate way 10-8 Firm ware and Conf iguration F ile Ma intenance Step 1. Use telnet from your workst ation to connect to the Zy W ALL and log in. Because TFTP does not have any security checks, the ZyWALL records the IP address of the telnet client and accepts TFTP requests only from this addres s. Step 2. Put the SMT in c[...]

ZyWALL 10 Internet Sec urity Gate way Firm ware and Config uration F ile Mai ntenance 10-9 COMMAND DESCRIPTION Remote File This is the filena me on the Zy W AL L. The file name for the firmware is “ ras ” an d for the con figuration f ile, is “ rom-0 ”. Binary Transfer th e file in binary mode. Abort Stop transf er of the file . TFTP over W[...]

ZyWALL 10 Internet Sec urity Gate way 10-10 Firm ware and Config uration F ile Mai ntenance Figure 10- 13 Telnet in to M enu 24.7.1 You see the following screen when you telnet into menu 24.7.2. Figure 10- 14 Telnet in to M enu 24.7.2 — S ystem M aintenance To transfer the f irmware and the configuration file, follow the se examples: Menu 24.7.1 [...]

ZyWALL 10 Internet Sec urity Gate way Firm ware and Config uration F ile Mai ntenance 10-1 1 10.6.1 Using the FTP command from the DOS Prompt Step 1. La unc h t he FT P cl i ent on your wor kstat i o n. Step 2. Type open and t he IP address of your ZyWALL. Step 3. P ress [ENTER ] when prompted f or a username. Step 4. Type root and y our SMT passw [...]

ZyWALL 10 Internet Sec urity Gate way 10-12 Firm ware and Config uration F ile Mai ntenance Table 10- 3 Third Party FT P Client s — Genera l Fields COMMAND DESCRIPTION Host Addres s Enter the ad dress of the host server. Login T ype Anonymous. This is w hen a user I.D. and passw ord is automatic ally supplie d to the server f or anonymo us acces [...]

ZyWALL 10 Internet Sec urity Gate way System Maintenance & Inf ormation 11 - 1 Chapter 11 System Maintenance & Information This chapt er leads y ou through SMT me nus 24.8 t o 24.11. 11.1 Command Interpreter Mo de The Command Interpreter (C I) is a part of the m ain router fi rmware. The CI provides mu ch of the same functionality as the SM[...]

ZyWALL 10 Internet Sec urity Gate way 1 1-2 System Maintenance & Inf ormation 11.2 Call Control Suppor t The ZyWALL provides two call control fun ctions: budget management an d call history. Please note that this menu is only applicable when Encaps ulation is set to PP PoE or PPTP i n m enu 4 or menu 11.1. The budget management function allo ws[...]

ZyWALL 10 Internet Sec urity Gate way System Maintenance & Inf ormation 11 - 3 The total budget is the time limit on the accu mulated ti me for outgoing calls to a remote node. When this limit is reached, th e call will be dropped and fu rther outgoing calls to that rem ote node will be blocked. After each period, th e total budget is reset. Th[...]

ZyWALL 10 Internet Sec urity Gate way 1 1-4 System Maintenance & Inf ormation Figure 11-5 Call History Table 11- 2 Call Histo ry Fields FIELD DESCRIPTION Phone Number The PPPoE service name s are show n here. Dir This sh ows w hether the call w as inco ming or outgo ing. Rate T his is the transfer r ate of the ca ll. #call This is the num ber o[...]

ZyWALL 10 Internet Sec urity Gate way System Maintenance & Inf ormation 11 - 5 Select m enu 24 in the main menu to open Menu 24 - Sy stem Maintenance , as sho wn next. Figure 11-6 Menu 24 — System Maintenance Then enter 10 to go to Menu 24.10 - Syst em Maintena nce - Time and Da t e Setting to update the time and date settings of your ZyWALL [...]

ZyWALL 10 Internet Sec urity Gate way 1 1-6 System Maintenance & Inf ormation Table 11-3 Time and Date Setting Fields FIELD DESCRIPTION Enter the time service pro tocol that your time server sends w hen you turn on the Zy W ALL. Not a ll time serv ers support a ll protocol s, so you may have t o check w ith your ISP/netw ork administrat or or u[...]

ZyWALL 10 Internet Sec urity Gate way System Maintenance & Inf ormation 11 - 7 11.4 Remote Management Setup Telnet and F TP do not s upport encry ption, so f or very strong security both servi ces should be s hut down. This is done in Menu 24.11 - Rem ote Managem ent Control . Ente r 11 from menu 24 to brin g up this menu. A ll Telnet and FTP a[...]

ZyWALL 10 Internet Sec urity Gate way 1 1-8 System Maintenance & Inf ormation 11.5 Boot Commands The BootModul e AT comman ds execute from within t he router’s boot up software, wh en debug mode i s selected before the m ain router firmware (ZyNOS) is started. When you start up your ZyWALL, y ou are given a ch oice to go into debug m ode b y [...]

ZyWALL 10 Internet Sec urity Gate way System Maintenance & Inf ormation 11 - 9 Figure 11-10 Boot Module Commands ======= Debug Command Listing ======= AT just answer OK ATHE print help ATBAx change baudrate. 1:38.4k, 2:19.2k, 3:9.6k 4:57.6k 5:115.2k ATENx,(y) set BootExtension Debug Flag (y=password) ATSE show the seed of password generator ATT[...]

[...]

ZyWALL 10 Internet Sec urity Gate way T elnet 12-1 Chapter 12 Telnet Configuration and Capabilities This chapt er cover s the Teln et Conf iguration a nd Capab ilities of the ZyW ALL. 12.1 About T elnet Configurati on Before th e ZyWALL is properly setup for TCP/IP, the only option for con figuri ng it is throug h the console port. Once y our ZyWAL[...]

ZyWALL 10 Internet Sec urity Gate way 12-2 T elnet 12.3.2 Syst em Timeout There is a sy stem timeout of 5 minutes (300 secon ds) for eith er the console port or t elnet. Your Zy W ALL will automatically log you out if you do nothin g in this ti meout period, except when it is continuously updating the status in m enu 24.1 or w hen sys stdio has bee[...]

Firewall and Cont ent Filters IV Part IV: Firewall and Co ntent Filters Chapters 13 — 20 def ine the ter m “ Firewall”, introduce t he Z y W ALL Firewa ll and ZyWALL Web Configura tor , des cribe ho w to create Cus tom Rules and c onfigure c ustom ized ports, ex plain Logs and prov ide Exam ple Fire wall Rules . Chapt er 20 expla ins Cont ent[...]

[...]

ZyWALL 10 Internet Sec urity G ateway W hat Is a Firewall? 13-1 Chapter 13 What is a Firewall? This chapt er giv es some bac kground informat ion on F irewalls. Ori gin ally , the t erm fire wall referred to a constru ction technique designed to prev ent the spread of fi re from one room to another. The n etwork term firewall is typically def ined [...]

ZyWALL 10 Internet Securit y Gatewa y 13-2 W hat Is a Firewall? ii. Robust authen tication and logging pre-authenticates application traff ic before it reaches internal hosts and causes it to b e logged more effectively than if it were logged with standard host logging. Filtering rules at the packet filtering router can be less complex than they wo[...]

ZyWALL 10 Internet Sec urity G ateway W hat Is a Firewall? 13-3 Figure 13-1 ZyWALL Firewall A pplication 13.3 Denial of Serv ice Denials of Service (DoS) attack s are aimed at devices and netw orks with a connection to th e Internet. Their goal is not to st eal infor m ation, but to disable a device or netw ork so users no longer h ave access to ne[...]

ZyWALL 10 Internet Securit y Gatewa y 13-4 W hat Is a Firewall? Some of the m ost co mm on IP ports are: Table 13- 1 Common IP Ports 21 FTP 53 DNS 23 Telnet 80 H TTP 25 S MT P 110 POP3 13.3.2 T y pes of DoS attacks There are four types of DoS attacks: 1. Those that exploit bugs in a T CP/IP implementation. 2. Those that exploit weakn esses in the T[...]

ZyWALL 10 Internet Sec urity G ateway W hat Is a Firewall? 13-5 Figure 13-2 Three-Way Handshake Under normal circumstances , the application that initiates a session sends a SYN (synchronize) pack et to the receiving s erver. T he receiver sends back an AC K (acknowledgment) packet and its own SYN, and then the initiator responds with an ACK (ackno[...]

ZyWALL 10 Internet Securit y Gatewa y 13-6 W hat Is a Firewall? 3. A br ute-force attack, such as a "Smurf" attack, targ ets a feature in the IP specification know n as directed or s ubnet broadcas ting, to qu ickly flood th e target n et work with usel ess data. A Sm urf hacker floods a rou ter with Internet Control Mes sage Protocol ( I[...]

ZyWALL 10 Internet Sec urity G ateway W hat Is a Firewall? 13-7 ! Denies all sessions originating fro m the WAN (Intern et) to the LAN (local network). Figure 1 3-5 Stat eful Inspec tion The previous f igure shows the ZyWALL’s default firewall ru les in action as well as demonstrates how stateful inspection works. U ser A can initiate a T elnet s[...]

ZyWALL 10 Internet Securit y Gatewa y 13-8 W hat Is a Firewall? 6. Later, an inbou nd packet reaches the interf ace. This packet is part of the connection previously established w ith the outbound packet. The in bound packet is ev aluated against the inbound access list, and is permitted because of the te mporary access list entry previou sl y crea[...]

ZyWALL 10 Internet Sec urity G ateway W hat Is a Firewall? 13-9 If an initiation packet originates on the LAN, this means that so meone i s tr ying to make a connection from the LAN to the Intern et. Assuming that this is an acceptable part of the security policy (as is the case with the default policy ), the connection will be allowed. A cache ent[...]

ZyWALL 10 Internet Securit y Gatewa y 13-10 W hat Is a Firewall? 2. Think about access con trol before you connect a console port t o the netw or k in any way , including attaching a modem to th e port. Be aware that a break on the console port might g ive unauthorized individuals total control of th e firewall, even with access control conf igured[...]

ZyWALL 10 Internet Sec urity G ateway W hat Is a Firewall? 13-1 1 8. Change y our passw ords regularly . Also, use passw ords that are n ot easy to figu re out. The m ost difficult passw ords to crack are those with upper and low er case letters, numbers an d a symbol such as % or #. 9. Upgrade y our software regu larly. Many older ve rsions of s o[...]

[...]

ZyWALL 10 Internet Sec urity Gate way Introduc ing the Z y W ALL Fire wall 14-1 Chapter 14 Introducing the ZyWALL Firewall This chapt er shows y ou how to get started w ith the Z yWALL Fir ewall. Ple ase see Chap ter 13 for some bac kground i nformatio n on firewa lls. 14.1 SMT Me nus From the main menu (see below) enter 21 to go to Menu 21 - Filte[...]

ZyWALL 10 Internet Sec urity G ateway 14-2 Introduc ing the ZyWALL Firewall Figure 14-3 Menu 21.2 — Firewall Setup Configure the fir ewal l rules u sing the Z yWAL L Web Conf igur ator or CL I comma nds. 14.1.1 View Firewall Log Enter option 3 from menu 21 to view the firewall log. Firewall logs may also be viewed from the ZyWALL Web Confi gur at[...]

ZyWALL 10 Internet Sec urity Gate way Introduc ing the Z y W ALL Fire wall 14-3 ICMP Echo A brute-force attack, su ch as a "Smurf" attack, targets a feature in the IP specification known as directed or subn et broadcasting, to quickly fl ood the target network with us eless data. A Sm urf hacker floods a rou ter with Intern et Control Mes[...]

ZyWALL 10 Internet Sec urity G ateway 14-4 Introduc ing the ZyWALL Firewall T racerou te Traceroute is a utility used to determ ine the path a packet takes between two en dpoints. Sometimes when a packet filter f irewall is configured incorrectly an attacker can traceroute the firewall gaining kn owledge of the n et work topology inside th e firewa[...]

ZyWALL 10 Internet Sec urity Gate way Introduc ing the Z y W ALL Fire wall 14-5 Table 14- 4 View Firewall Lo g FIELD DESCRIPTION EXAMPLES # This is the index number of the firewall log. 128 entries are availabl e numbered fr om 0 to 127. Once they are all used, th e log w ill wrap around a nd the old l ogs will be lost. 23 mm:dd:yy e.g., Jan 1 00 T[...]

ZyWALL 10 Internet Sec urity G ateway 14-6 Introduc ing the ZyWALL Firewall Figure 14-5 Big Picture — Filtering, Firewall and N AT 14.3 Packet F iltering Vs Fire w all Below are some comparisons bet ween the ZyWALL’s filtering and fire wall functions. 14.3.1 Packet Filtering: ! The router filters packets as they pass through the router’s inte[...]

ZyWALL 10 Internet Sec urity Gate way Introduc ing the Z y W ALL Fire wall 14-7 When T o Use Filtering 1. To block/allow LAN pack ets by their MAC address. 2. To block/allow special IP packets which are neither TCP, UDP, nor ICMP packets. 3. To block/al low both in bound (WAN to LA N) a nd out bound (LAN to WA N) tra ffic between the s pecific insi[...]

[...]

ZyWALL 10 Internet Sec urity Gate way Introduc ing the Z y W ALL Web Configura tor 15-1 Chapter 15 Introducing the ZyWALL Web Configurator This chapt er shows y ou how to c onfigure y our fire wall with the W eb C onfigurator . 15.1 Web Configurator Login and Welcome Screens Launch y our web browse r and enter 192.168. 1.1 as the UR L. This i s the[...]

ZyWALL 10 Internet Sec urity G ateway 15-2 Introduc ing the Z y W ALL Web Configura tor Figure 15-2 ZyWALL We b Configurator Welcome Screen[...]

ZyWALL 10 Internet Sec urity Gate way Introduc ing the Z y W ALL Web Configura tor 15-3 15.2 Enabling the Firewall Click Firewall , then Configura tion , then the Rule Config tab to enable the firewall as seen in the follo wing screen. Figure 15-3 Enabling the Firewall 15.3 E-mail This screen allows y o u to specify your mail server, where e-m ail [...]

ZyWALL 10 Internet Sec urity G ateway 15-4 Introduc ing the Z y W ALL Web Configura tor mail account. Enter the complete e-mail addr ess to which alert messages will b e sent in the E-m ai l Alert s To field and s chedule times for sending alerts in the Alert Timer fie lds in th e E-mail screen (following screen). 15.3.2 W hat are Logs? A log is a [...]

ZyWALL 10 Internet Sec urity Gate way Introduc ing the Z y W ALL Web Configura tor 15-5 Table 15- 1 E-mail FIELD DESCRIPTION OPTIONS Address Inform ation Mail Serv er Enter the IP address of y our mail serv er in dotted decimal for mat. Your Intern et Service Provid er (ISP) should be ab le to provi de this info rmation. If t his field is left blan[...]

ZyWALL 10 Internet Sec urity G ateway 15-6 Introduc ing the Z y W ALL Web Configura tor 15.3.3 SMTP Error Messages If there are diff iculties in sending e-mail the following error messages appear. Please see th e Support Notes on th e included disk f o r information on ot her types of error messag es. E-mail error m e ssages appear in m enu 24.3.1 [...]

ZyWALL 10 Internet Sec urity Gate way Introduc ing the Z y W ALL Web Configura tor 15-7 Figure 15-5 E-mail Log 15.4 A ttack Alert The first defens e against DOS attacks. In this screen you may choose to generate an alert whenever an attack is detected. F or DoS attacks, t he ZyWALL uses th resholds to dete rmine when to drop s essions that do not b[...]

ZyWALL 10 Internet Sec urity G ateway 15-8 Introduc ing the Z y W ALL Web Configura tor 5. Type of traff ic for certain servers . If your network is slower than average for any of these factors (especially if you have servers that are slow or handle many tasks an d are often busy), then th e default values should be reduced. You sho uld make an y c[...]

ZyWALL 10 Internet Sec urity Gate way Introduc ing the Z y W ALL Web Configura tor 15-9 Figure 1 5-6 A ttack A lert The following table describes the fields in this screen.[...]

ZyWALL 10 Internet Sec urity G ateway 15-10 Introduc ing the Z y W ALL Web Configura tor Table 15-3 Attack Alert FIELD DESCRIPTION DEFAULT VALUES Generate alert w hen attack dete cted A detected atta ck automa tically g enerates a log entry. Che ck this box to generate an alert (as w ell as a log) whenever an attack is detected. See the Lo gs Cha p[...]

ZyWALL 10 Internet Sec urity Gate way Introduc ing the Z y W ALL Web Configura tor 15-1 1 FIELD DESCRIPTION DEFAULT VALUES rises abov e this numb er, the Zy W ALL deletes half-open se ssions as re quired to accommoda te new conne ction reque sts. Do not set Maximum Incomplet e High to lower than t he current Maximu m I ncomplete Low number. half-op[...]

[...]

ZyWALL 10 Internet Sec urity Gate way Creating C ustom Rules 16-1 Chapter 16 Creating Custom Rules This chapt er cont ains inst ructions for defin ing bot h Local N etwork and I nternet r ules. 16.1 Rules Overvie w Firewall rules are subdiv ided into “Local Network” and “ Internet”. By default, the Zy W ALL’s stateful packet inspection al[...]

ZyWALL 10 Internet Sec urity G ateway 16-2 Creating C ustom Rules 5. What computers o n the LAN are to be affected (if any )? 6. What computers on the Internet w ill be affected? The more specific, the better. For exam ple, if traffic is being allowed from the Internet to the LAN, it is better to allo w only certain m achines o n the Internet to ac[...]

ZyWALL 10 Internet Sec urity Gate way Creating C ustom Rules 16-3 16.3 Connection Direction This section talks about con fi gur in g firewall rules for connections going fro m L AN to W AN and WAN to LA N in your fi rewa ll. 16.3.1 L A N to W AN Rules The default rule for LA N to WAN traffic is that all users on the LAN are allow ed non-restricted [...]

ZyWALL 10 Internet Sec urity G ateway 16-4 Creating C ustom Rules Figure 16-2 WAN to LAN Traffic 16.4 Rule Summary The fiel ds in the Rule Su mma ry screens ar e th e same for Loca l Networ k and Int ern et , so the discuss ion below refers to both. Click on Firewall , then Local Ne t work to bring up the followin g scree n. This screen is a summar[...]

ZyWALL 10 Internet Sec urity Gate way Creating C ustom Rules 16-5 Figure 16-3 Firewall Rules Summary — First Screen The following table describes the fields in this screen.[...]

ZyWALL 10 Internet Sec urity G ateway 16-6 Creating C ustom Rules Table 16- 1 Firew all Rules Summ ary — Fi rst Screen FIELD DESCRIPTION OPTIONS General Name This is the name of the firewall rule set. Type a name to distinguis h the LAN-to- W AN filt er set from the W AN-to- LAN filter se t. Name The default a ction for packets not match ing foll[...]

ZyWALL 10 Internet Sec urity Gate way Creating C ustom Rules 16-7 FIELD DESCRIPTION OPTIONS Click A pply to creat e a new firew all rule. New firewall rul es are added at the end a fter existing firewa ll rules. C lick Edit to edit an ex isting filter rule. See s ection 16 .5 for more detai ls. Click Del ete to delete an ex isting firewall rul e. N[...]

ZyWALL 10 Internet Sec urity G ateway 16-8 Creating C ustom Rules Table 16- 2 Pred efined Serv ices SERVICE DESCRIPTION BGP(TCP:179) Border G ateway Protocol. BOOTP_CLIENT(UDP:68) DHCP Cl i ent. BOOTP_SERVER(UDP:67) DHCP Se rve r. CU-SEEME(TC P/UDP:7648, 24032) A popular vide oconferenc ing soluti on from W hite Pines Softw are. DNS(UDP /TCP:53) Do[...]

ZyWALL 10 Internet Sec urity Gate way Creating C ustom Rules 16-9 SERVICE DESCRIPTION SFTP(TCP:115) Simple File Trans fer Protocol. SMT P(TCP:25) Simple M ail Transfer Pr otocol is the messa ge-exchange s tandard for the Inter net. SMTP enables you to mov e messa ges from one e- mail server to another. SNMP(TCP/U DP:161) Simple Netw ork Management [...]

ZyWALL 10 Internet Sec urity G ateway 16-10 Creating C ustom Rules 16.5.1 Creating/Editing Firewall Rules To create a new rule, click a n umber ( No. ) then click Edit in the last screen sho wn to display the follo win g screen. Figure 16-4 Creating/Editing A Firewall Rule[...]

ZyWALL 10 Internet Sec urity Gate way Creating C ustom Rules 16-1 1 Table 16- 3 Creating/ Editing A Firew all Rule FIELD DESCRIPTION OPTIONS Source Address Pr ess SrcA dd to add a new address, SrcEdit to edit an ex isting one or SrcDelete to delete one. Please see the nex t section for more i nformation on ad ding and ed iting source a ddresses. Sr[...]

ZyWALL 10 Internet Sec urity G ateway 16-12 Creating C ustom Rules 16.5.2 Source and Destination A ddresses To add a new source or desti nation addres s, click SrcAdd or DestAdd from the screen abov e. To edit an existing source or destin ation address, select it from the box and click SrcEdit or DestEdit from the screen above . Either action displ[...]

ZyWALL 10 Internet Sec urity Gate way Creating C ustom Rules 16-13 Table 16-4 Adding/Editing Source and Destination Addresses FIELD DESCRIPTION OPTIONS Address Ty pe Do you want your rule to apply to packets w ith a particu lar (single) IP address, a r ange of IP ad dresses (e. g., 192.168.1.1 0 to 192.169.1.5 0), a subnet or any IP addr ess? Selec[...]

ZyWALL 10 Internet Sec urity G ateway 16-14 Creating C ustom Rules 16.6 T imeout The fiel ds in the Timeout screens are the same for Local and Int ernet netwo rks , so the discussion below refers t o both. 16.6.1 Factors Influencing Choices for T imeout V alues The factors influ encing choices for timeout values are the sam e as the factors influen[...]

ZyWALL 10 Internet Sec urity Gate way Creating C ustom Rules 16-15 Table 16- 5 Timeout Menu FIELD DESCRIPTION DEFAULT VALUE TCP T imeout Valu es Connectio n Timeout This is the len gth of time t he ZyWALL waits for a TCP session to r each the e stablished st ate before drop ping the sessio n. 30 seconds FIN- W ait Tim eout This is the length of ti [...]

[...]

ZyWALL 10 Internet Sec urity Gate way Custom Ports 17-1 Chapter 17 Custom Ports This chapt er cover s creating , viewing and editi ng custom ports. 17.1 Introducti on Configu re customized ports for services not predefined by the Zy WALL (see Figure 16-4) . For a comprehens ive list of port num bers and servi ces, visit the IA NA (Internet As signe[...]

ZyWALL 10 Internet Sec urity G ateway 17-2 Custom Ports Table 17- 1 Custom Ports FIELD DESCRIPTION Customi zed Services No. This is the number of your customiz ed port. Status Indicates whether ports have al ready been co nfigured or are still empty. Name This is the nam e of your c ustomized port. Protocol This show s the IP protocol (T CP, UDP or[...]

ZyWALL 10 Internet Sec urity Gate way Custom Ports 17-3 17.2 Creating/Editing A Custom Port Click Edit to create a new custom port or edit an existing on e. This displays the following screen. Figure 17-2 Creating/Editing A Custom Port The next table describes the fields in this screen.[...]

ZyWALL 10 Internet Sec urity G ateway 17-4 Custom Ports Table 17- 2 Creating /Editing A Custo m Port FIELD DESCRIPTION OPTIONS Service Na me Enter a unique nam e for your cu stom port. Service Ty pe Choose the IP port ( TCP , UDP or Bot h ) that defines your customiz ed port from the drop down list box. TCP UDP Both Port Configura tion Type Click t[...]

ZyWALL 10 Internet Sec urity Gate way Exam ple Firewa ll Rules 18-1 Chapter 18 Logs This chapt er cont ains inf ormatio n about usin g the log s creen to v iew the res ults of th e rules y ou have conf igured. 18.1 Log Screen When y ou configure a new rule you also have th e option to log ev ents that match , don’t match (or bot h) this rule (see[...]

ZyWALL 10 Internet Sec urity G ateway 18-2 Example F irewall R ules Table 18-1 Log Sc reen FIELD DESCRIPTION EXAMPLES No. This is the index number of the firewall log. 128 entries are av ailable nu mbered from 0 to 127. Once they are all used, th e log w ill wrap arou nd and the old l ogs w ill be lost. dd:mm:yy e.g., Jan 1 0 Time This is the time [...]

ZyWALL 10 Internet Sec urity Gate way Exam ple Firewa ll Rules 19-1 Chapter 19 Example Firewall Rules This chapt er gives examples f or conf iguring v arious r ules for W AN to LAN and LAN to W AN. 19.1 Examples Whenever you open a hole in the firewall to forward a s ervice from the Internet to the local netw ork, and NAT i s a lso ena b led, you m[...]

ZyWALL 10 Internet Sec urity G ateway 19-2 Example F irewall R ules Step 1. Activate the firewall. You may activate the firewall through the Zy W ALL Web Configurator as shown ne xt (cli ck Co nfiguration , the Config tab, then ch eck the Firewa ll Ena bled box) or through SMT menu 21.2. You can only conf igure the fi rewall using the Zy WALL Web C[...]

ZyWALL 10 Internet Sec urity Gate way Exam ple Firewa ll Rules 19-3 Step 2. Co n fi gure yo ur E- mail screen as follo ws. Click the E-mail tab to bring up the next screen. Figure 19-2 Examp l e 1: E-mail Sc re en Enter 10.10 0.1.2, the IP a ddress of the mail server here. This is where w e send the alerts. We want to send an alert at this time. En[...]

ZyWALL 10 Internet Sec urity G ateway 19-4 Example F irewall R ules Step 3. Co n figure your firewall rule as shown in the following screen. The default firewall blocks all Internet traffic entering our local network, but y ou want to create a hole for web service f rom the Internet. Click Internet an d go to the Rule Summ ary. C onfigure this sc r[...]

ZyWALL 10 Internet Sec urity Gate way Exam ple Firewa ll Rules 19-5 Step 4. Clic k DestAdd to configure the destination address as the IP of your s erver on the LAN. Figure 1 9-4 Exampl e 1: Destin ation Address for T raffic Origin ating f rom the Inte rnet 10.100.1. 2 is the IP of our server on the LAN (support ing FTP, HTTP, T elnet and mail serv[...]

ZyWALL 10 Internet Sec urity G ateway 19-6 Example F irewall R ules Step 5. W hen yo u have finis hed c onfigur in g your r ules, t he Rul e Sum mary sc ree n sho ul d loo k like t hi s. Click Apply i n this screen to save your configuration back to the ZyWALL. Figure 1 9-5 Exampl e 1: Rule Summary Scr een 19.1.2 Example 2: Small Off ice With M ail[...]

ZyWALL 10 Internet Sec urity Gate way Exam ple Firewa ll Rules 19-7 Step 1. First you want to send alerts when there is an attack. Go to the Attack Alert screen (click Configurat ion , then the Attack Alert tab) shown n ext. Figure 1 9-6 Send Alerts Wh en Atta cked Step 2. Configure the E-mail screen as shown in example 1: your mail serv er’s IP [...]

ZyWALL 10 Internet Sec urity G ateway 19-8 Example F irewall R ules Figure 19-7 Configuring A POP Custom Port Step 4. No w, y o u will create rules to block all outgoing traffic (from the local network to the Internet) except for traff ic originating from the HTTP proxy server and our mail serv er. Click Internet to see the Rule Summary screen. Now[...]

ZyWALL 10 Internet Sec urity Gate way Exam ple Firewa ll Rules 19-9 Step 5. Clic k SrcAdd under the Source Address box and en ter the IP address of th e mail server (192.168.10. 2) in the sam e fashion as in Figur e 19-4 . Figure 19-8 Example 2: Local Network Rule 1 Configuration Step 6. Si milarly configure anoth er local network to Internet rule [...]

ZyWALL 10 Internet Sec urity G ateway 19-10 Exam ple Firewa ll Rules Step 7. The Rule Summary screen sho uld look like Figure 19-9 . Don’ t forget to click Apply wh e n yo u have fi nis he d co n figuri ng yo ur rule ( s) to sa ve your set ting s b ack to the Z yWAL L. Figure 19- 9 Example 2: Local N etwork Ru le Summary Step 8. No w y ou want an[...]

ZyWALL 10 Internet Sec urity Gate way Exam ple Firewa ll Rules 19-1 1 Step 9. On co m pleting the procedure the Rule Summary for this Internet firewall r ules should look like the following screen. Don’t forget to click Apply wh en you ha ve fini shed c o nfi gur in g your rule(s) to save your settings back to the ZyWALL. Figure 19- 10 Example: I[...]

ZyWALL 10 Internet Sec urity G ateway 19-12 Exam ple Firewa ll Rules 19.1.3 Exa mple 3: DHCP Negotiation and Syslog Connection from the Internet The following are some Internet firewall rule examples that allow DHCP negotiatio n bet ween the ISP and the ZyWALL 10 and allow a syslog connection from the In ternet. Step 1. Follo w the procedu re shown[...]

ZyWALL 10 Internet Sec urity Gate way Exam ple Firewa ll Rules 19-13 Step 2. Fo llo w the procedures outlined in the previous exa mples to co nfigure all your rules. When finished, your rule summary screen should look like the following. Figure 19-12 Syslog Rule Configuration Click Apply whe n fi nish e d. This is your Sy slog custom port. This is [...]

ZyWALL 10 Internet Sec urity G ateway 19-14 Exam ple Firewa ll Rules Step 3. On co m pleting the procedure the Rule Summary for this I nternet firewall rules should look like the following screen. Don’t forget to click Apply wh en you ha ve fini shed c o nfi gur in g your rule(s) to save your settings back to the ZyWALL. Figure 19-13 Ex ample 3: [...]

ZyWALL 10 Internet Sec urity Gate way Content Fi ltering 20-1 Chapter 20 Content Filtering This chapter provides a brief overview of content filtering us ing the Web C onfigurator. For more detailed information , consult the HTML help sectio n of the included disk. Internet content filtering allows schools and bu sinesses to create and enforce Inte[...]

ZyWALL 10 Internet Sec urity G ateway 20-2 Content Fi ltering Figure 20-1 Categor ies Sc reen[...]

ZyWALL 10 Internet Sec urity Gate way Content Fi ltering 20-3 20.2 Update List Content on the Internet is consta ntly changing, so the content filter list should b e upd a ted o n a weekly basis. Figure 20-2 List Update Scree n[...]

ZyWALL 10 Internet Sec urity G ateway 20-4 Content Fi ltering 20.3 Exempting Computers This screen allows the adm inistrator to include or exclude a rang e of users on the LAN from cont ent filtering. Figure 20-3 Exempt Zone Screen[...]

ZyWALL 10 Internet Sec urity Gate way Content Fi ltering 20-5 20.4 Customizing Customize the content filter list b y adding or removing specific sites fro m the f ilter list . Figure 20-4 Customize Screen[...]

ZyWALL 10 Internet Sec urity G ateway 20-6 Content Fi ltering 20.5 Ke y w ords The ZyWALL can also be configu red to block certain web sites by using URL keywords . Figure 20-5 Keyword Scre en[...]

ZyWALL 10 Internet Sec urity Gate way Content Fi ltering 20-7 20.6 Log Records This screen records the results of your conte nt filter policies. Figure 20-6 Logs Screen[...]

Troubleshooting, A ppendic es, Glossar y and In dex V Part V: Troubleshooting, Append ices, Glossary and Index Chapter 21 provides inform ation abou t solving c omm on problem s, follo wed by som e Appen dices, a Glossar y of T erms and an Ind ex.[...]

[...]

ZyWALL 10 Internet Sec urity Gate way Troubleshooting 21-1 Chapter 21 Troubleshooting This chapt er cov ers potent ial prob lems an d possible remedies . After e ach proble m desc ription, some ins tructions are prov ided to he lp you to diagnos e and to s olve the problem. Please s ee our included disk for further inf ormat ion. 21.1 Problems Star[...]

ZyWALL 10 Internet Sec urity Gate way 21-2 Troubleshootin g 21.2 Problems w ith the LA N Interface Table 21-2 Troubleshooting the LAN Interface Problem Corrective A ction Check the 10M/100M LEDs on the front pa nel. One of these LEDs should be on . If they are both off, ch eck the ca bles betw een your Zy W ALL and hub or the stati on. Can’t ping[...]

ZyWALL 10 Internet Sec urity Gate way Troubleshooting 21-3 21.4 Problems with Internet Access Table 21-4 Troubleshooting Interne t A ccess Problem Corrective A ction Connect your C able/x DSL modem with th e Zy W ALL usi ng appropriat e cable. Check w ith the manufa cturer of your Ca ble/x DSL device about y our cable require ment becau se for some[...]

[...]

ZyWALL 10 Internet Sec urity Gate way PPPo E A Appendix A PPPoE PPPoE in Action An AD SL modem bri dges a PPP s ession over Eth ernet (PPP ov er Ethern et, RFC 2516) f rom your PC to an ATM PVC (Permanent Virtual Circuit) which conn ects to a xDSL Access Concentrator where the PPP sess ion term inates (s ee the ne xt figure). O ne PVC c an support [...]

ZyWALL 10 Internet Sec urity Gate way PPPo E B How PPPoE Works The P PPoE dr ive r mak es th e Ethe rnet appear a s a s erial link to the PC and t he PC runs PPP over i t, w hil e the modem bridg es the Ethernet frames to the Access Concentrator (AC ). Between the AC and an ISP, the AC is acting as a L2T P (Layer 2 T unneli ng Pro t o col) LAC (L2T[...]

ZyWALL 10 Internet Sec urity Gate way PPTP C Appendix B PPTP What is PPT P? PPTP (Poin t-to- Point Tunn eling Prot ocol) is a Micros oft propri etary prot ocol (RFC 2637 f or PPTP i s inf orma tion al only ) to tunn el PPP fra mes . How can we transport PPP frame s from a PC to a broadband modem over Ethernet? A solution is to build PPT P into the [...]

ZyWALL 10 Internet Sec urity Gate way PPTP D Ac cess C oncentra tor) an d the PPTP us er. Th e PNS i s th e box th at hosts bot h th e PPP and t he PPT P stac ks and forms on e end of the PPTP tunnel. The PAC is the box that dials/answers the phone calls and relays the PPP f ram es to t he PN S. The PPTP u ser is n ot neces sari ly a PPP c lien t ([...]

ZyWALL 10 Internet Sec urity Gate way Hardware Sp ec if ic ati ons E Appendix C Hardware Specifications Power Specifi cation I/P AC 120V / 60Hz ; O/P DC 12V 1200 mA MTBF 100000 hr s Operation T emperature 0º C ~ 40º C Ethernet Specifi cation for WA N 10Mbit Half Duplex Ethernet Specifi cation for LAN 10/100 M bit Half / Full Auto- negotiation Con[...]

ZyWALL 10 Internet Sec urity Gate way F Sa fety Ins truc tion s Appendix D Important Safety Instructions The following safety instructions apply to the ZyWALL. 1. Be sure to read and follow all warning notices and instruction s. 2. The maximum recomm ended a mbient temperature for the Zy W ALL is 40º Celsius (104º Fahrenheit).Care must be tak en [...]

ZyWALL 10 Internet Sec urity Gate way CLI Comm ands G Appendix E Firewall CLI Commands The follo wing tab le de sc ribe s the s yntax used t o conf igure your fi rewa l l usi ng Co mmand L ine I nterfa c e (CLI) commands. Se lect Men u 24.8 - Command Interpreter Mode from the main menu to go into CLI mode. F or details on other CLI comm ands to con[...]

ZyWALL 10 Internet Sec urity Gate way H CLI Comm ands Function CLI Syntax Description config edit firewall e-mail email-to <e-mail address> Edits the mail address which you want to send t he alert to. config edit firewall e-mail policy <full | hourly | daily | weekly> Edits whether the current firewall traf fic log cont ents are sent th[...]

ZyWALL 10 Internet Sec urity Gate way CLI Comm ands I Function CLI Syntax Description Config edit firewall set <set #> default-permit <forward | block> E di ts whether a packet is dropped or allowed through, when it does not meet a rule within the set. Config edit firewall set <set #> icmp-timeout <seconds> Edits the time li[...]

ZyWALL 10 Internet Sec urity Gate way J CLI Comm ands Function CLI Syntax Description config edit firewall set <set #> rule <rule #> srcaddr-subnet <ip address> <subnet mask> Selects and edits a sourc e address and subnet mask of traffi c which co mply to this ru le. config edit firewall set <set #> rule <rule #>[...]

ZyWALL 10 Internet Sec urity Gate way CLI Comm ands K Function CLI Syntax Description D D e e l l e e t t e e config delete firewall e-mail Rem oves all the settings for e-mai l alert. config delete firewall attack Res ets all the settin gs for attack t o default setting. config delete firewall set <set #> Removes t he specifi ed set from t h[...]

ZyWALL 10 Internet Sec urity Gate way L Power Adapt er Specif ic ati ons Appendix F Power Adapter Specifications AC Power Adapter Spec ifications North America AC Power Adapter model M W 48-1201200 Input power: AC120Volts/ 60H z Output pow er: DC12Volts/1.2A Power consu mption: 9 W Plug: North Am erican standard s Safety standar ds: UL, CUL (U L 13[...]

ZyWALL 10 Internet Sec urity Gate way Power Ad apt er Specif ications M Japan AC Power Adapter model JOD-48-1 124 Input pow er: AC100Volts/ 50/ 60Hz/ 27VA Output pow er: DC12Volts/1.2A Power consu mption: 9 W Plug: Japan standard s Safety standar ds: T-M ark Australia and N ew Zealand AC Power Adapter model AD-120120 0DS Input power: AC240Volts/ 50[...]

ZyWALL 10 Internet Sec urity Gate way N Glossa ry of T erms Glossary of T erms 10BaseT The 10-M bps baseband Ethernet specificatio n that uses two pair s of tw isted-pair cabl ing (Category 3 or 5): one pair for transmit ting data an d the other for receiving dat a. ARP Address Re solution Protoco l is a proto col for map ping an Inter net Protocol[...]

ZyWALL 10 Internet Sec urity Gate way Glossa ry of T erms O Cookie A strin g of charac ters saved by a web brow ser on the us er's hard d isk. Many web pages send cooki es to track specific user infor mation. Cooki es can be used to r etain information a s the user b rowses a web site. For example, cookies ar e used to 'remember' the[...]

ZyWALL 10 Internet Sec urity Gate way P Glossa ry of T erms Digital Sig nature Digital code that authenticat es whomever signed the document or software. Softw are, messages, E mail, and other electro nic docum ents can b e signed elec tronically so that they cannot be altered by anyone e lse. If som eone alters a signed docu ment, the signature is[...]

ZyWALL 10 Internet Sec urity Gate way Glossa ry of T erms Q Events These are network a ctivities. Som e activities are direct at tacks on your system, while others might be dependi ng on the cir c umstances. T herefore, any a ctivity, regard less of severity i s called an ev ent. An event may or may not be a d irect attac k on your syst em. FAQ (Fr[...]

ZyWALL 10 Internet Sec urity Gate way R Glossa ry of T erms Integrity Proof th at the data is th e same as originally in tended. Un authorized softw are or people have not alter ed the original information . internet (Low er case i) Any t ime you conne ct 2 or more networks together, y ou have an i nternet. Internet (Upper c ase I) The vast collect[...]

ZyWALL 10 Internet Sec urity Gate way Glossa ry of T erms S same as your Eth ernet addr ess.) The M AC layer frame s data for trans mission over t he network, the n passes the fr ame to the physi cal layer interf ace where it is trans mitted as a stream of b its. Name Resolution The allocation o f an IP address to a host name. See D NS NAT Network [...]

ZyWALL 10 Internet Sec urity Gate way T Glossa ry of T erms This cat egory of co mputer crim inal incl udes several d ifferent ty pes of il legal activit ies Making cop ies of softw are for others to use. D istributing pirated softw are over the Internet or a Bul letin Board Sy stem. Receiv ing or dow nloading ill egal copie s of softw are in any f[...]

ZyWALL 10 Internet Sec urity Gate way Glossa ry of T erms U Proxy Server A server that perfor ms netw ork operations in lieu of other syste ms on the network. Proxy Serv ers are most often u sed as part of a firew all to mask the identity of users inside a cor porate network y et still prov ide acce ss to the Int ernet. W he n a user co nnects to a[...]

ZyWALL 10 Internet Sec urity Gate way V Glossa ry of T erms security fl aws in th eir netw ork system s. Server A computer , or a softw are package, that prov ides a spe cific kin d of servi ce to client software run ning on other computers . Shoulder Surfing Looking ov er someone' s should er to see the numbers th ey dial on a phone, or t he [...]

ZyWALL 10 Internet Sec urity Gate way Glossa ry of T erms W TFTP Trivial File Tr ansfer Proto col is an I nternet file tr ansfer proto col similar to FTP (File Transfer Prot ocol), but it is scaled b ack in fun ctionality so that it requir es few er resource s to run. TFT P uses the UD P (User Datagra m Protocol) rather than TC P (Transmissi on Con[...]

[...]

ZyWALL 10 Internet Sec urity Gate way Index Y Index A Action for M atched Packe ts .......................... 16-11 Activate The F irewall ...................................... 19-3 Alert Schedule ................................................ 15-5 Application-l evel Firewalls .............................. 13-1 AT command ......................[...]

ZyWALL 10 Internet Sec urity Gate way Z Index E-mail tab ........................................................15-4 Encapsulati on PPP over Ethernet....................................................A Ethernet Encaps ulation3-8, 4-1, 4-5 , 4-6, 4-10, 6- 12, 6-14 Example E-mai l Log ........................................15-6 Examples ..........[...]

ZyWALL 10 Internet Sec urity Gate way Index AA Rule Sum mary ................................................... 16-4 log..................................................................... 9-5 Log Facility ....................................................... 9-7 Log Screen ..................................................... 18-1 Login scree [...]

ZyWALL 10 Internet Sec urity Gate way BB Index Security Ramif ications .....................................16-2 Send Alerts W hen Attacked ............................19-7 Server .................................................................... 3-1, 3-9, 4-2 , 6-3, 6-4, 6-7, 6-9, 6-12, 6-13 , 6- 14, 6-16, 6-17, 11-6, N, U, V Service ...........[...]

ZyWALL 10 Internet Sec urity Gate way Index CC X xDSL modem ..... 1-3, 1-4, 2-3, 2-4, 4-3, 21-2, 21-3 XMODEM protocol.......................................... 10-2 Z ZyNOS ............. 2-13, 6-4, 6-7, 9- 3, 9-4, 10-1, 10-2 ZyNOS F/ W Version ......................... 9-3, 9-4, 10-1 Zy W ALL Firew all Applica tion........................... 13-3 Z[...]