ZyXEL Communications P-660HW-DX manual

www .zyxel.com P-660HW -Dx 802.1 1g Wireless ADSL 2+ 4-port Gateway User ’ s Guide V ersion 3.40 8/2007 Edition 2[...]

[...]

About This User's Guide P-660HW-Dx User’s Guide 3 About This User's Guide Intended Audience This manual is intended for people who want to configure the ZyXEL Device using the web configurator . Y ou should have at least a basic knowledge of TCP/IP network ing concepts and topology . Related Document ation • Quick Start Guide The Quic[...]

Document Conventions P-660HW-Dx User’s Guide 4 Document Conventions W arnings and Notes These are how warnings and notes are shown in this User ’ s Guide. 1 W arnings tell you about things that could harm you or your device. " Notes tell you other import ant information (for example, other things yo u may need to configure or help ful tip [...]

Document Conventions P-660HW-Dx User’s Guide 5 Icons Used in Figures Figures in this User ’ s Guide may use the followi ng generic icons. The ZyXEL Device icon is not an exact representation of your device. ZyXEL Device Computer Notebook computer Server DSLAM Firewall T elephon e Switch Router[...]

Safety Warnings P-660HW-Dx User’s Guide 6 Safety Warnings 1 For your safety , be sure to read and follow all warning notices and instructions. • Do NOT use this product near water , for example, in a wet basement or near a swimming pool. • Do NOT expose your device to dampness, dust or corrosive liquids. • Do NOT store thin gs on the device[...]

Safety Warnings P-660HW-Dx User’s Guide 7[...]

Safety Warnings P-660HW-Dx User’s Guide 8[...]

Contents Overview P-660HW-Dx User’s Guide 9 Contents Overview Introduction .......................................... ........................................................................ .......... 31 Introducing the ZyXEL Device ............... ................ ................ ................ ................. ................ .. .3 3 Intr[...]

Contents Overview P-660HW-Dx User’s Guide 10[...]

Table of Contents P-660HW-Dx User’s Guide 11 Table of Contents About This User's Guide ........................................................................... ............................... 3 Document Conventions.................................................................. ......................................... .4 Safety Warning[...]

Table of Contents P-660HW-Dx User’s Guide 12 2.4.7 Changing Login Password .......... .......... ... ................. ............ ................. ............ ....... 49 Part II: Wizards ....................... .................................... ............................ 51 Chapter 3 Wizard Setup for Interne t Access ....................[...]

Table of Contents P-660HW-Dx User’s Guide 13 5.6.2 Configuring More Connections Advanced Set up ............... ................ ................ ....... 88 5.7 T raffic Redirect ..................... ................ ................. ............. ................ ................ ...... .......... 89 5.8 Configuring WAN Backup ......... ......[...]

Table of Contents P-660HW-Dx User’s Guide 14 7.6.2 WMM QoS Priorities .. ................ ............. ................ ............. ................ ................ ..... 122 7.6.3 Services .............. ................ ................ ............. ................ ................ ................ ..... ... 123 7.7 QoS Screen ...........[...]

Table of Contents P-660HW-Dx User’s Guide 15 9.5.1 S tateful I nspection Process ....... ................ ............. ................ ................. ............ ..... 149 9.5.2 S tateful I nspection and the ZyXEL Devic e .................... ................ ................ ........... 150 9.5.3 TCP Security ................ .............[...]

Table of Contents P-660HW-Dx User’s Guide 16 Part V : Advanced . .................................... .............................. .............. 181 Chapter 12 St atic Route ..................................................... .............................................................. ........ 183 12.1 S tatic Route ............. ........[...]

Table of Contents P-660HW-Dx User’s Guide 17 15.4 Configuring T elnet ....... ............. ................ ............. ................ ............. ................ ......... ..... 205 15.5 T elnet Login ................ ................ ................ ................ ............. ................ ................ ........ 2 06 15.6 Con[...]

Table of Contents P-660HW-Dx User’s Guide 18 18.4 Log Descriptions ............ ................ ................ ................ ............. ................ ................ ..... 2 37 Chapter 19 T ools ............................................ .............................................................................. ............. 25[...]

Table of Contents P-660HW-Dx User’s Guide 19 Appendix L Legal Information ......................................................... ...................................... 34 7 Appendix M Customer Support ........................................... ................................................. 351 Index.........................................[...]

Table of Contents P-660HW-Dx User’s Guide 20[...]

List of Figures P-660HW-Dx User’s Guide 21 List of Figures Figure 1 Protected Internet Access Applications ...... ................. ................ ............. ................ ........... ..... 34 Figure 2 LAN-to-LAN Application Example ........... ............. ................ ................ ............. ................ .. ..... 34 Figu[...]

List of Figure s P-660HW-Dx User’s Guide 22 Figure 39 Example of T raffic Shaping ............. ............. ............. ................ ............. ................ ...... .......... 79 Figure 40 Internet Connection (PPP oE) ................ ................ ............. ................ ................. ........... ........ 81 Figure 41[...]

List of Figures P-660HW-Dx User’s Guide 23 Figure 82 Three-W ay Handshake .......... ................ ............. ................ ................ ............. ............. ........ 146 Figure 83 SYN Flood .......................... ................ ............. ................ ................ ................ .... ............ ..... 147 [...]

List of Figure s P-660HW-Dx User’s Guide 24 Figure 125 Network Connections .......... ................ ................ ................. ................ ................ ..... ......... 218 Figure 126 Internet Connection P roperties ........ ................ ................ ................ ................. ........... ...... 2 19 Figure 127 [...]

List of Figures P-660HW-Dx User’s Guide 25 Figure 168 Macintosh OS 8/9: Apple Menu .. ...... ... ................ ............. ................ ............. ................ .. ... 294 Figure 169 Macintosh OS 8/9: TCP/IP ......................... ................ ................ ................ ................ .. ...... 294 Figure 170 Macint[...]

List of Figure s P-660HW-Dx User’s Guide 26[...]

List of Tables P-660HW-Dx User’s Guide 27 List of Tables T able 1 ADSL St andards ................ ............. ................ ................ ................ ................ .......... ................ 34 T able 2 Front Panel LEDs .. ................ ............. ................ ................ ................ ................ ...... .[...]

List of Tables P-660HW-Dx User’s Guide 28 T able 39 MAC Address Filt er ... ................ ................ ................. ................ ................ .............. ........ ..... 121 T able 40 WMM QoS Priorities . ................ ................ ................. ................ ................ ................ .......... . 122 T[...]

List of Tables P-660HW-Dx User’s Guide 29 T able 82 Remote Management: WWW ............. ...... .......... ................ ............. ................ ................ .... .2 0 5 T able 83 Remote Management: T eln et . ................ ................ ............. ................ ............. ................ ..... 206 T able 84 Remote M[...]

List of Tables P-660HW-Dx User’s Guide 30 T able 125 IP Address Network Number and H ost ID Example ............. ................ ............. ................ . 302 T able 126 Subnet Mask s ... ................ ................ ................ ............. ................ ................ ....... .............. 303 T able 127 Maximum Host N[...]

31 P ART I Introduction Introducing the ZyXEL Device (33) Introducing the W eb Configurator (3 7)[...]

32[...]

P-660HW-Dx User’s Guide 33 C HAPTER 1 Introducing the ZyXEL Device This chapter introduces the main applications and features of the ZyXEL Device. It also introduces the ways yo u can manage the ZyXEL Device. 1.1 Overview The ZyXEL Device is an IEEE 802.1 1b/g wirel ess ADSL2+ gateway that allows super -fast, secure Internet access over analog (P[...]

Chapter 1 Introducing the ZyXEL Device P-660HW-Dx User’s Guide 34 Figure 1 Protected Internet Access Applications Y ou can also use the ZyXEL Device to connec t two geographically dispersed networks over the ADSL line. A typical LAN-to-LAN ap plication example is shown as follows. Figure 2 LAN-to-LAN Applic ation Example The ZyXEL Device is compa[...]

Chapter 1 Introducing the ZyXEL Device P-660HW-Dx User’s Guide 35 1.2 W ays to Manage the ZyXEL Device Use any of the following method s to manage the ZyXEL Device. • W eb Configurator . This is recommended fo r everyday management of the ZyXEL Device using a (s upported) w eb browser . • Command Line Interface. Line commands are mostly used [...]

Chapter 1 Introducing the ZyXEL Device P-660HW-Dx User’s Guide 36 The following table describes the LEDs. 1.5 Hardware Connections Refer to the Quick S tart Guide for in formation on hard ware connections. T able 2 Fron t Panel LEDs LED COLOR STATUS DESCRIPTION POWER Green On The ZyXEL Device is receiving power and functioning properly . Blinking[...]

P-660HW-Dx User’s Guide 37 C HAPTER 2 Introducing the Web Configurator This chapter describes how to access and navigate the web configurator . 2.1 W eb Configurator Overview The web configurator is an HTML-based mana gement interface that allows easy ZyXEL Device setup and management via Internet browser . Use Internet Explorer 6.0 and later or [...]

Chapter 2 Introducing the Web Configur ator P-660HW-Dx User’s Guide 38 5 A window displays as shown. Figure 4 Password Screen 2.2.1 User Access 1 For user access enter the default user password user to view the status only . The following window will appear . Figure 5 User status scree n 2.2.2 Administrator Access 1 For administrator access enter[...]

Chapter 2 Introducing the Web Configurator P-660HW-Dx User’s Guide 39 confirm and click Apply . Alternatively click Ignore to proceed to the main menu if you do not want to change the password now . " If you do not change the p assword at least once, the following sc reen appears every time you log in with the admi n password. Figure 6 Chang[...]

Chapter 2 Introducing the Web Configur ator P-660HW-Dx User’s Guide 40 " The management session automatic ally times out when the time period set in the Administrator Inactivity T imer field expires (default five minutes). Simply log back into the ZyXEL Device if th is happens. 2.3 Resetting the ZyXEL Device If you forget your password or ca[...]

Chapter 2 Introducing the Web Configurator P-660HW-Dx User’s Guide 41 Figure 8 Web Configurator : Main Screen " Click the icon (located in the top right corner of most scree ns) to view embedded help. Use the submenus to configure ZyXEL Device features. Click the Logout icon at any ti to exit the web configurator . T able 3 Web Configurat or[...]

Chapter 2 Introducing the Web Configur ator P-660HW-Dx User’s Guide 42 LAN IP Use this screen to configure L AN TCP/IP settings, enable Any IP and other advanced properties. DHCP Setup Use this screen to configure LAN DHCP settings. Client List Use this screen to view curre nt DHCP client information and to always assign an IP address to a MAC ad[...]

Chapter 2 Introducing the Web Configurator P-660HW-Dx User’s Guide 43 2.4.2 St atu s Screen The following summarizes how to navigate the web configurator from the St a t u s screen. Some fields or links are not available if yo u entered the user password in the login password screen (see Figure 5 on page 38 ). Not all fields are avail able on all[...]

Chapter 2 Introducing the Web Configur ator P-660HW-Dx User’s Guide 44 Figure 9 S tatus Screen The following table describes the labels shown in the St a t u s screen. T able 4 Sta tus Screen LABEL DESCRIPTION Refresh Int erval Select a nu mber of seconds or None from the drop-down list box to refresh all screen statistics automatically at the en[...]

Chapter 2 Introducing the Web Configurator P-660HW-Dx User’s Guide 45 IP Subnet Mask This is the LAN port IP subnet mask. DHCP This is the W AN port DHCP role - Server , Relay or None . WLAN Information (Wireless devices only) SSID This is the descriptive name used to id entify the ZyXEL Device in the wireless LAN. Channel This is the channe l nu[...]

Chapter 2 Introducing the Web Configur ator P-660HW-Dx User’s Guide 46 2.4.3 St atus: Any IP T able Click the Any IP T able hyperlink in the St a t u s screen. The Any IP table shows current read- only information (including the IP address and the MAC address) of all network devices that use the Any IP feature to communicate with the ZyXEL Device[...]

Chapter 2 Introducing the Web Configurator P-660HW-Dx User’s Guide 47 The following table describes the labels in this screen. 2.4.5 St atus: Bandwidth S tatus Click the Bandwidth S tatus hyperlink in the St a t u s scree n. Select an interface from the drop- down list box to v iew the bandwidth usage of its bandwidth rules. The gray section of t[...]

Chapter 2 Introducing the Web Configur ator P-660HW-Dx User’s Guide 48 Figure 13 S tatus: Packet S tatistics The following table describes th e fields in this screen. T able 7 S tatus: Pa cket S tatistics LABEL DESCRIPTION System Monitor System up T ime Thi s is the elapsed time the system has been up. Current Date/T ime This field displays your [...]

Chapter 2 Introducing the Web Configurator P-660HW-Dx User’s Guide 49 2.4.7 Changing Login Password It is highly recommended that you periodic ally change the password for accessing the ZyXEL Device. If you didn’t change the default o ne after you logged in or you want to change to a new password again, then click Maintenance > System to dis[...]

Chapter 2 Introducing the Web Configur ator P-660HW-Dx User’s Guide 50[...]

51 P ART II W izards W izard Setup for Internet Access (53) Bandwidth Management W izard (67)[...]

52[...]

P-660HW-Dx User’s Guide 53 C HAPTER 3 Wizard Setup for Internet Access This chapter provides informatio n on the W izard Setup screens for Internet access in the web configurator . 3.1 Introduction Use the wizard setup sc reens to configure your system for Internet access with the information given to you by your ISP . " See the advanced men[...]

Chapter 3 Wizard Setup for Inte rnet Access P-660HW-Dx User’s Guide 54 Figure 16 Wizard: Welcome 3 The wizard attempts to detect whic h W AN connection type you are using. If the wizard detects your connection type and your ISP uses PPPo E or PPPoA, go to Section 3.2.1 on page 55 . The screen varies depending on the connecti on type you use. If t[...]

Chapter 3 Wizard Setup for Inter net Access P-660HW-Dx User’s Guide 55 Figure 18 Auto Detection: Failed 3.2.1 Automatic Detection 1 If you have a PPPoE or PPPoA co nnection, a screen displays prompting you to enter your Internet account information. Enter th e username , password and/or service name exactly as provided. 2 Click Next . Figure 19 A[...]

Chapter 3 Wizard Setup for Inte rnet Access P-660HW-Dx User’s Guide 56 Figure 20 Internet Access Wizard Setup: ISP Parameters The following table describes the fields in this screen. 2 The next wizard screen varies depending on what mode and encapsulation type you use. All screens shown are with routing mo de. Configure the fields and click Next [...]

Chapter 3 Wizard Setup for Inter net Access P-660HW-Dx User’s Guide 57 Figure 21 Internet Connection with PPPoE The following table describes the fields in this screen. Figure 22 Internet Connection with RFC 1483 The following table describes the fields in this screen. T able 9 Internet Connec tion with PPPoE LABEL DESCRIPTION User Name Enter the[...]

Chapter 3 Wizard Setup for Inte rnet Access P-660HW-Dx User’s Guide 58 Figure 23 Internet Connection with ENET ENCAP The following table describes the fields in this screen. Next Click Next to continue to the next wizard screen. Exit Click Exit to close the wizard screen without saving your changes. Ta b l e 1 1 Internet Connection with ENET ENCA[...]

Chapter 3 Wizard Setup for Inter net Access P-660HW-Dx User’s Guide 59 Figure 24 Internet Connection with PPPoA The following table describes the fields in this screen. • If the user name and/or password you ente red for PPPoE or PPPoA connection are not correct, the screen disp lays as shown next. Click Back to Username and Password setup to g[...]

Chapter 3 Wizard Setup for Inte rnet Access P-660HW-Dx User’s Guide 60 Figure 26 Connection T est Failed-2. 3.3 Wireless Connection Wizard Setup After you configure the Internet access informatio n, use the following scr eens to set up your wireless LAN. 1 Select Ye s an d click Next to configure wireless settings. Otherwise, select No and skip t[...]

Chapter 3 Wizard Setup for Inter net Access P-660HW-Dx User’s Guide 61 Figure 28 Wireless LAN Setup Wizard 1 The following table describes the labels in this screen. 3 Configure your wireless settin gs in this screen. Click Next . T able 13 Wireless LAN Setup Wizard 1 LABEL DESCRIPTION Active Select the check box to turn o n the wirele ss LAN. En[...]

Chapter 3 Wizard Setup for Inte rnet Access P-660HW-Dx User’s Guide 62 Figure 29 Wireless LAN Setup Wizard 2 The following table describes the labels in this screen. T able 14 Wireless LAN Setup Wizard 2 LABEL DESCRIPTION Network Name(SSID) Enter a descriptive name (up to 32 printable 7-bit ASCII character s) for the wireless LAN. If you change t[...]

Chapter 3 Wizard Setup for Inter net Access P-660HW-Dx User’s Guide 63 " The wireless st ations and ZyXEL Device must use the same SSID, cha nnel ID and WEP encryption key (if WEP is enabled), WP A-PSK (if WP A-PSK is enabled) for wireless communication. 4 This screen varies depending on the security mode you selected in the previous screen.[...]

Chapter 3 Wizard Setup for Inte rnet Access P-660HW-Dx User’s Guide 64 Figure 31 Manually assign a WEP key The following table describes the labels in this screen. 5 Click Apply to save your wireless LAN settings. Figure 32 Wireless LAN Setup 3 T able 16 Manually assign a WEP ke y LABEL DESCRIPTION Key The WEP keys are used to encrypt da ta. Both[...]

Chapter 3 Wizard Setup for Inter net Access P-660HW-Dx User’s Guide 65 6 Use the read-only summary table to check whet her what you have confi gured is correct. Click Finish to complete and save the wizard setup. Figure 33 Internet Access and WLAN Wizard Se tup Complete 7 Launch your web browser and navigate to www .zyxel.com. Internet access is [...]

Chapter 3 Wizard Setup for Inte rnet Access P-660HW-Dx User’s Guide 66[...]

P-660HW-Dx User’s Guide 67 C HAPTER 4 Bandwidth Management Wizard This chapter shows you how to configure basic bandwidth management using the wizard screens. 4.1 Introduction Bandwidth management allows y o u to control the amount of bandwidth going out through the ZyXEL Device’ s W AN port and p rioritize the distribution of the bandwidt h ac[...]

Chapter 4 Bandwid th Management Wizard P-660HW-Dx User’s Guide 68 4.3 Bandwid th Management Wizard Setup 1 After you enter the admin password to access the web configura tor , sele ct Go to Wizard setup and click Apply . Otherwise, click the wizard icon ( ) in the top right corner of the web configurat or to display the wizard main screen. Figure[...]

Chapter 4 Bandwidth Manage ment Wizard P-660HW-Dx User’s Guide 69 2 Click BANDWIDTH MANAGEMENT SETUP to configure the system for Internet access. Figure 35 Wizard: Welcome 3 Activate bandwidth mana gement and select to allocate ba ndwidth to packets ba sed on the service requirements. Figure 36 Bandwidt h Management Wizard: General Information Th[...]

Chapter 4 Bandwid th Management Wizard P-660HW-Dx User’s Guide 70 4 Use the second wizard screen to select the se rvices that you want to apply bandwidth management and select the priorities that you want to apply to the services listed. Figure 37 Bandwidt h Management Wizard: Configuration The following table describes the labels in this screen.[...]

Chapter 4 Bandwidth Manage ment Wizard P-660HW-Dx User’s Guide 71 5 Follow the on-screen in structions and click Finish to complete the wizard setup and save your configuratio n. Figure 38 Bandwid th Management Wizard: Complete Apply Click Apply to save your changes to the ZyXEL Device. Exit Click Exit to close the wizard screen with out saving y[...]

Chapter 4 Bandwid th Management Wizard P-660HW-Dx User’s Guide 72[...]

73 P ART III Network WA N S e t u p ( 7 5 ) LAN Setup (93) W ireless LAN (105) Network Address T ranslation (NA T) Screens (129)[...]

74[...]

P-660HW-Dx User’s Guide 75 C HAPTER 5 WAN Setup This chapter describes how to configure W AN settings. 5.1 W AN Overview A W AN (Wide Area Network) is an outside conn ection to another network or the Internet. 5.1.1 Encap sulation Be sure to use the encapsulat ion method required by your ISP . The ZyXEL Device su pports the following methods. 5.1[...]

Chapter 5 WAN Setup P-660HW-Dx User’s Guide 76 5.1.1.3 PPPoA PPPoA stands for Point to Point Protocol over A TM Adaptation Layer 5 (AAL5). A PPPoA connection functions like a dial -up Internet connection. The ZyXEL Device encapsulates the PPP session based on RF C1483 and sends it through an A TM PVC (Permanent V irtual Circuit) to the Internet S[...]

Chapter 5 WAN Setup P-660HW-Dx User’s Guide 77 5.1.3.2 Scenario 2: One VC, One Protocol (IP) Selecting RFC-1483 encapsulation with VC-based multiplexing requires the least amount of overhead (0 octets). However , if there is a po tential need for multiple protocol support in the future, it may be safer to select PPPoA encapsula tion instead of RF[...]

Chapter 5 WAN Setup P-660HW-Dx User’s Guide 78 Do not specify a nailed-up connection unless your telephone company offers flat-rate service or you need a constant connection and the cost is of no concern 5.1.7 NA T NA T (Netw ork Address T ransl ation - NA T , RFC 1631) is the translation of the IP address of a host in a packet, for example, the [...]

Chapter 5 WAN Setup P-660HW-Dx User’s Guide 79 Sustained Cell Rate (SCR) is the mean cell rate of each bursty traf fic source. It specifies the maximum average rate at which c ells can be sent over the virtual connection. SCR may not be greater than the PCR. Maximum Burst Size (MBS) is the maximum numb er of cells that can be sent at the PCR. Aft[...]

Chapter 5 WAN Setup P-660HW-Dx User’s Guide 80 The VBR-nR T (non real-time V a riable Bit Rate) ty pe is used with bursty connections that do not require closely controlled delay and delay variation. It is commonly used for "bursty" traffic typical on LANs. PCR and MBS define the burst levels, SCR defines the minimum level. An example o[...]

Chapter 5 WAN Setup P-660HW-Dx User’s Guide 81 Figure 40 Internet Conne ction (PPPoE) The following table describes the labels in this screen. T able 20 Internet Connection LABEL DESCRIPTION General Name Enter the name of your Internet Servic e Provider , e.g., MyISP . This information is for identification purposes only . Mode Select Routing (de[...]

Chapter 5 WAN Setup P-660HW-Dx User’s Guide 82 5.5.1 Configuring Advanced Internet Connection Setup T o edit your ZyXEL Device's ad vanced W AN settings, click the Advanced Setup button in the Internet Connection screen. The screen appears as shown. VPI The valid range for the VPI is 0 to 2 55. Enter the VPI assig ned to you. VCI The valid r[...]

Chapter 5 WAN Setup P-660HW-Dx User’s Guide 83 Figure 41 Advanced Intern et Connection Setup The following table describes the labels in this screen. T able 21 Advanced Internet Connection Setup LABEL DESCRIPTION RIP & Multicast Setup RIP Direction Sel ect the RIP direction from None , Both , In Only and Out Only . RIP V ersion Select the RIP[...]

Chapter 5 WAN Setup P-660HW-Dx User’s Guide 84 5.6 Configuring More Connections This section describes the protocol-independent parameters for a remote network. They are required for placing calls to a remote gate way and the network behind it across a W AN connection. When you use the W AN > Internet Connection scree n to set up Internet acce[...]

Chapter 5 WAN Setup P-660HW-Dx User’s Guide 85 The following table describes the labels in this screen. 5.6.1 More Connections Edit Click the edit icon ( ) in the More Connections screen to configure a connection. T able 22 More Connections LABEL DESCRIPTION # This is the index number of a connection. Active This display whether this conne ction [...]

Chapter 5 WAN Setup P-660HW-Dx User’s Guide 86 Figure 43 More Connections Edit The following table describes the labels in this screen. T able 23 More Connections Edit LABEL DESCRIPTION Active Select the check box to activate or clear the check box to deactivate this connection. Name Enter a unique, descri ptive name of up to 13 ASCII characters [...]

Chapter 5 WAN Setup P-660HW-Dx User’s Guide 87 Multiplexing Select the method of multip lexing used by your ISP from the drop-down list. Choices ar e VC or LL C . By prior agreement, a protocol is assigned a specifi c virtual circuit, for example, VC1 will carry IP . If you select VC, spec ify separate VPI and VCI numbers for each protocol. For L[...]

Chapter 5 WAN Setup P-660HW-Dx User’s Guide 88 5.6.2 Configuring More Co nnections Advanced Setup T o edit your ZyXEL Device's ad vanced W AN settings, click the Advanced Setup button in the Mor e Connections Edit screen. The scree n appears as shown. Figure 44 More Connections Advanced Setup The following table describes the labels in this [...]

Chapter 5 WAN Setup P-660HW-Dx User’s Guide 89 5.7 T raffic Redirect T raffic redirect forwards traf fic to a backup gate way when the ZyXEL Device cannot connect to the Internet. An example is shown in the figure below . Figure 45 T raffic Redirect Example The following network topology allows you to avoid triangle route security issues when the[...]

Chapter 5 WAN Setup P-660HW-Dx User’s Guide 90 Figure 47 W AN Backup Setup The following table describes the labels in this screen. T able 25 W AN Backup Setup LABEL DESCRIPTION W AN Backup Setup Backup T ype Select the method that the ZyXEL Device uses to check the DSL connection. Select DSL Link to have the ZyXEL Device check if the connection [...]

Chapter 5 WAN Setup P-660HW-Dx User’s Guide 91 T imeout T ype the number of seconds (3 recomm ended) for your ZyXEL Device to wait for a ping response from one of the IP addresses in the Check W AN IP Address field before timing out the request. The WAN connection is considered "down " after the ZyXEL Device times out the numbe r of tim[...]

Chapter 5 WAN Setup P-660HW-Dx User’s Guide 92[...]

P-660HW-Dx User’s Guide 93 C HAPTER 6 LAN Setup This chapter describes how to configure LAN settings. 6.1 LAN Overview A Local Area Network (LAN) is a shared comm unication system to which many computers are attached. A LAN is a computer network lim ited to the immediate area, usually the same building or floor of a building. The LAN screens ca n[...]

Chapter 6 LAN Setup P-660HW-Dx User’s Guide 94 6.1.2 DHCP Setup DHCP (Dynamic Host Configuration Protocol , RFC 2131 and RFC 2132) allows individual clients to obtain TCP/IP configuration at start-up from a server . Y ou ca n configure the ZyXEL Device as a DHCP server or disable it. When configured as a server , the ZyXEL Device provides the TCP[...]

Chapter 6 LAN Setup P-660HW-Dx User’s Guide 95 6.3.1 IP Address and Subnet Mask Similar to the way houses on a street share a common street name, so too do computers on a LAN share one common network number . Where you obtain your netwo rk number depends on your particular situation. If the ISP or your network administrator assigns yo u a bloc k [...]

Chapter 6 LAN Setup P-660HW-Dx User’s Guide 96 6.3.2 RIP Setup RIP (Routing Information Protocol) allows a ro uter to e xchange rou ting information with other routers. The RIP Direction field controls the sending an d receiving of RIP pa ckets. When set to: • Both - the ZyXEL Device will broadcast its routin g table periodically and incorporat[...]

Chapter 6 LAN Setup P-660HW-Dx User’s Guide 97 6.3.4 Any IP T raditionally , you must set the IP addresses an d the subnet masks of a computer and the ZyXEL Device to be in the same subnet to allo w the computer to access the Internet (through the ZyXEL Device). In cases where your computer is required to use a static IP address in another networ[...]

Chapter 6 LAN Setup P-660HW-Dx User’s Guide 98 The following lists out the steps taken, when a co mputer tries to access the Internet for the first time through the ZyXEL Device. 1 When a computer (which is in a different su bnet) first attempts to access the Internet, it sends packets to its defa ult gateway (which is not the ZyXEL Device) by lo[...]

Chapter 6 LAN Setup P-660HW-Dx User’s Guide 99 6.4.1 Configuring Advanced LAN Setup T o edit your ZyXEL Device's advanced LAN settings, click the Advanced Setup button in the LAN IP screen. The screen appears as shown. Figure 51 Advanced LAN Setup The following table describes the labels in this screen. T able 27 Advanced LAN Setup LABEL DES[...]

Chapter 6 LAN Setup P-660HW-Dx User’s Guide 100 6.5 DHCP Setup Use this screen to configure th e DNS server information that the ZyXEL Device sends to the DHCP client devices on the LAN. Figure 52 DHCP Setup The following table describes the labels in this screen. Apply Cli ck Apply to save the changes. Cancel Click Cancel to begin configuring th[...]

Chapter 6 LAN Setup P-660HW-Dx User’s Guide 101 6.6 LAN Client List This table allows you to assign IP addresses on the LAN to specific individual computers based on their MAC Addresses. Every Ethernet device has a unique MAC (Med ia Access Control) addre ss. The MAC address is assigned at the factory and consists of six pairs of hexadec imal cha[...]

Chapter 6 LAN Setup P-660HW-Dx User’s Guide 102 6.7 LAN IP Alias IP alias allows you to partition a physical network into dif fer ent logical networks over the same Ethernet interface. The ZyXEL Device s upports three logical LA N interfaces via its single physical Ethernet interface with th e ZyXEL Device itself as the gateway for each LAN netwo[...]

Chapter 6 LAN Setup P-660HW-Dx User’s Guide 103 T o change your ZyXEL Device ’ s IP alias settings, click Network > LAN > IP Alias . The screen appears as shown. Figure 55 LAN IP Alias The following table describes the labels in this screen. T able 30 LAN IP Alias LABEL DESCRIPTION IP Alias 1, 2 S elect the check box to confi gure another[...]

Chapter 6 LAN Setup P-660HW-Dx User’s Guide 104 Apply Click Apply to save your change s to the ZyXEL Device. Cancel Click Cancel to begin confi guring this screen afresh. T able 30 LAN IP Alias LABEL DESCRIPTION[...]

P-660HW-Dx User’s Guide 105 C HAPTER 7 Wireless LAN This chapter discusses how to configure the wireless network settings on your ZyXEL Device. See the appendices for more detailed information ab out wireless networks. 7.1 Wireless Network Overview The following figure provides an exampl e of a wireless network. Figure 56 Example of a Wireless Ne[...]

Chapter 7 Wireless LAN P-660HW-Dx User’s Guide 106 • Every wireless client in the same wireless network must use security c ompatible with the AP . Security stops unauthorized devices from using the wireless network. It ca n also protect the information that is sent in the wireless network. 7.2 Wireless Security Overview The following sections [...]

Chapter 7 Wireless LAN P-660HW-Dx User’s Guide 107 • In a RADIUS server: this is a server u sed in businesses mo re than in homes. If your AP does not provide a local user database and if you do not have a RADIUS server , you cannot set up user names and passwords for your users. Unauthorized devices can still see th e information that is sent [...]

Chapter 7 Wireless LAN P-660HW-Dx User’s Guide 108 When you select WP A2 or WP A2-PSK in your ZyXEL Device, you can also select an option ( WP A compatible ) to support WP A as well. In this cas e, if some wireless clients support WP A and some support WP A2, you should set up WP A2-PSK or WP A2 (depending on the type of wireless network login) a[...]

Chapter 7 Wireless LAN P-660HW-Dx User’s Guide 109 The following table describes the general wireless LAN labels in this screen. See the rest of this chapter for informa tion on the other labels in this screen. 7.3.1 No Security Select No Security to allow wireless clients to commun icate with the access points without any data encryption. "[...]

Chapter 7 Wireless LAN P-660HW-Dx User’s Guide 11 0 Figure 58 Wireless: No Security The following table describes the labels in this screen. 7.3.2 WEP Encryption WEP encryption scrambles the da ta transmitted between the wire less clients and the access points to keep network communications pr ivate. It encrypts unicast and multicast communicatio[...]

Chapter 7 Wireless LAN P-660HW-Dx User’s Guide 111 Figure 59 Wireless: S tatic WEP Encryption The following table describes the wireless LAN security labels in this screen. 7.3.3 WP A-PSK/WP A2-PSK In order to configure and enable WP A(2)-PSK authentication; click Network > Wir eless LAN to display the Ge neral screen. Select WP A-PSK or WP A2[...]

Chapter 7 Wireless LAN P-660HW-Dx User’s Guide 11 2 Figure 60 Wireless: WP A-PSK/WP A2-PSK The following table describes the wireless LAN security labels in this screen. T able 35 Wireless: WP A-PSK/W P A2-PSK LABEL DESCRIPTION Security Mode Choose WP A-PSK or WP A2-PSK from the drop-down list box. WP A Compatible This check box is available onl [...]

Chapter 7 Wireless LAN P-660HW-Dx User’s Guide 11 3 7.3.4 WP A/WP A2 In order to configure and enable WP A/WP A2; click the W ireless LAN link under Network to display the General screen. Select WP A or WP A2 from the Security Mo de list. Idle T imeout (In Seconds) The ZyXEL Device automatically disconnec ts a wireless station from the wireless n[...]

Chapter 7 Wireless LAN P-660HW-Dx User’s Guide 11 4 Figure 61 Wireless: WP A/WP A2 The following table describes the wireless LAN security labels in this screen. T able 36 Wireless: WPA/WPA2 LABEL DESCRIPTION WP A Compatible This check box is available onl y when you select WP A2-PSK or WP A2 in the Security Mode field. Select the check box to ha[...]

Chapter 7 Wireless LAN P-660HW-Dx User’s Guide 11 5 7.3.5 Wireless LAN Advanced Setup T o configure advanced wi reless settings, click the Advanced Setup button in the General screen. The screen appears as shown. Group Key Update T imer (In Seconds) The Group Key Up date Timer is the rate at which the AP (if using WP A-PSK/ WP A2-PSK key manageme[...]

Chapter 7 Wireless LAN P-660HW-Dx User’s Guide 11 6 Figure 62 Advanced The following table describes the labels in this screen. T able 37 Wireless LAN: Advanced LABEL DESCRIPTION Wireless Advanced Setup RTS/CTS Threshold Enter a value between 0 and 2432. Fragmentation Threshold This is the maximum data fragment size that can be sent. Enter a valu[...]

Chapter 7 Wireless LAN P-660HW-Dx User’s Guide 11 7 7.4 OTIST In a wireless network, the wireless clients mu st have the same SSID and security settings as the access point (AP) or wireless router (we wi ll refer to both as “AP” here) in order to associate with it. T raditionally th is meant that you ha d to configure the settings on the AP a[...]

Chapter 7 Wireless LAN P-660HW-Dx User’s Guide 11 8 7.4.1.1.2 W eb Configurator Click the Network > Wireless LAN > OTIST . The following screen displays. Figure 63 OTIST The following table describes the labels in this screen. 7.4.1.2 Wireless Client Start the ZyXEL utility and click the Adapter tab. Select the OTIST check box, enter the sa[...]

Chapter 7 Wireless LAN P-660HW-Dx User’s Guide 11 9 Figure 64 Example Wireless Client OTIST Screen 7.4.2 St arting OTIST " Y ou must click S tart in the AP OTIST we b configurator screen and in the wireless client(s) Adapter screen all within three minutes (at the time of writing). Y ou can st art OTIST in the wireless client s and AP in any[...]

Chapter 7 Wireless LAN P-660HW-Dx User’s Guide 120 Figure 67 OTIST in progress (Client) In the wireless client, you see th is screen if i t can’t find an OTIST -enabled AP (with the same Setup key ). Click OK to go back to the ZyXEL utility mai n screen. Figure 68 No AP with OTIST Found • If there is more than one OTIST -enabled AP within ran[...]

Chapter 7 Wireless LAN P-660HW-Dx User’s Guide 121 7.5 MAC Filter The MAC filter screen allows you to configure t h e ZyXEL Device to give exclusive access to up to 32 devices ( Allow ) or exclude up to 32 de vices from accessing the ZyXEL Device ( Deny ). Every Ethernet device has a unique MAC (Media Access Control) address. The MAC address is a[...]

Chapter 7 Wireless LAN P-660HW-Dx User’s Guide 122 7.6 WMM QoS WMM (W i-Fi MultiMedia) QoS (Quality of Service) allows you to prioritize wireless traf fic according to the delivery requirements of individual services. WMM is a part of the IEEE 802.1 1e QoS enhanc ement to certified W i-Fi wireless networks. 7.6.1 WMM QoS Example When WMM QoS is n[...]

Chapter 7 Wireless LAN P-660HW-Dx User’s Guide 123 7.6.3 Services The commonly used services and port numbers ar e shown in the following table . Please refer to RFC 1700 for further information about port numbers. Next to the name of the service, two fields appear in brackets. The first field indicat es the IP protocol type (TCP , UDP , or ICMP)[...]

Chapter 7 Wireless LAN P-660HW-Dx User’s Guide 124 T able 41 Commonly Used Services SERVICE DESCRIPTION AIM/New-ICQ(TCP:5190) AOL ’s Internet Messenger service, used as a listening port by ICQ. AUTH(TCP:1 13) Auth entication protocol used by some servers. BGP(TCP:179) Border Gateway Protocol. BOOTP_CLIENT(UDP:68) DHCP Client. BOOTP_SERVER(UDP :[...]

Chapter 7 Wireless LAN P-660HW-Dx User’s Guide 125 7.7 QoS Screen The QoS screen by default allows you to au tomatically give a service a priority level according to the T oS value in the IP header of the packets it sends. 7.7.1 T oS (T ype of Service) and WMM QoS T oS defines the DS (Differentiated Service) fiel d in the IP packet header . The T[...]

Chapter 7 Wireless LAN P-660HW-Dx User’s Guide 126 Click Network > Wi reless LAN > QoS . The following screen displays. Figure 71 Wireless LAN: QoS The following table describes the fields in this screen. T able 42 Wireless Lan: QoS LABEL DESCRIPTION QoS Enable WMM QoS Select the check box to enable WMM QoS on the ZyXEL Device. WMM QoS Poli[...]

Chapter 7 Wireless LAN P-660HW-Dx User’s Guide 127 7.7.2 Application Pr iority Configuration T o edit a WMM QoS application entr y , click the edit icon ( ) under Modify . The following screen displays. Figure 72 Application Priority Configuration The following table describes the fields in this screen. T able 43 Application Priori ty Configurati[...]

Chapter 7 Wireless LAN P-660HW-Dx User’s Guide 128 Apply Click Apply to save your changes back to the ZyXEL Device. Cancel Click Cance l to return to the previous sc reen without savin g your changes. T able 43 Application Priority Co nfigu ration (contin ued) LABEL DESCRIPTION[...]

P-660HW-Dx User’s Guide 129 C HAPTER 8 Network Address Translation (NAT) Screens This chapter discusses how to configure NA T on the ZyXEL Device. 8.1 NA T Overview NA T (Netw ork Address T ransl ation - NA T , RFC 1631) is the translation of the IP address of a host in a packet, for example, the source address of an outgoing packet, used within [...]

Chapter 8 Network Add ress Translat ion (NAT) Screens P-660HW-Dx User’s Guide 130 8.1.2 What NA T Do es In the simplest form, NA T changes the sour ce IP address in a packet received from a subscriber (the inside local address) to anothe r (the inside global address) before forwarding the packet to the W AN side. When the respon se comes back, NA[...]

Chapter 8 Network Address Translation (NAT ) Screens P-660HW-Dx User’s Guide 131 Figure 74 NA T Application With IP Alias 8.1.5 NA T Mapping T ypes NA T suppo rts five types of IP/port mapping. They are: • One to One : In One-to-One mode, the ZyXEL Devi ce maps one local IP address to one global IP address. • Many to One : In Many-to-One mode[...]

Chapter 8 Network Add ress Translat ion (NAT) Screens P-660HW-Dx User’s Guide 132 The following table summarizes these types. 8.2 SUA (Single User Account) V ersus NA T SUA (Single User Account) is a ZyNOS implemen tation of a subset of NA T that supports two types of mapping, Many-to-One and Server . The ZyXEL Device also supports Full Feature N[...]

Chapter 8 Network Address Translation (NAT ) Screens P-660HW-Dx User’s Guide 133 8.4 NA T General Setup Y ou must create a firewall rule in addition to setting up SUA/NA T , to allow traffic from the W AN to be forwarded through the ZyXEL Device. Click Network > NA T to open th e following screen. Figure 75 NA T General The following table des[...]

Chapter 8 Network Add ress Translat ion (NAT) Screens P-660HW-Dx User’s Guide 134 Y ou may enter a single port number or a range of port numbers to be forwarded, and the local IP address of the desired server . The port number identifies a service; for example, web service is on port 80 and FTP on port 21. In some cases, such as for unknown servi[...]

Chapter 8 Network Address Translation (NAT ) Screens P-660HW-Dx User’s Guide 135 8.5.3 Configuring Servers Behi nd Port Forwarding (Example) Let's say you want to assign po rts 21-2 5 to one FTP , T elnet and SMTP se rver ( A in the example), port 80 to another ( B in the example) and assign a default server IP address of 192.168.1.35 to a t[...]

Chapter 8 Network Add ress Translat ion (NAT) Screens P-660HW-Dx User’s Guide 136 Figure 77 NA T Port Forwarding The following table describes th e fields in this screen. 8.6.1 Port Forwarding Rule Edit T o edit a port forwarding rule, clic k the rule’ s edit icon ( ) in the Port Forwarding screen to display the screen shown next. T able 48 NAT[...]

Chapter 8 Network Address Translation (NAT ) Screens P-660HW-Dx User’s Guide 137 Figure 78 Port Forwarding Rule Setup The following table describes th e fields in this screen. 8.7 Address Mapping " The Address Mapping screen is available only when you select Full Feature in the NA T > General screen. Ordering your rules is important becau[...]

Chapter 8 Network Add ress Translat ion (NAT) Screens P-660HW-Dx User’s Guide 138 rules. For example, if you have already configur ed rules 1 to 6 in your current set and now you configure rule number 9. In the set summary scr een, the new rule will be rule 7, not 9. Now if you delete rule 4, rules 5 to 7 will be pushed up by 1 rule, so old rules[...]

Chapter 8 Network Address Translation (NAT ) Screens P-660HW-Dx User’s Guide 139 8.7.1 Address Mapping Rule Edit T o edit an address mapping rule, click the rule’ s edit icon in the Address Mapping screen to display the screen shown next. Figure 80 Edit Address Mapping Rule Ty p e 1-1 : One-to-one mode maps one local IP address to one global IP[...]

Chapter 8 Network Add ress Translat ion (NAT) Screens P-660HW-Dx User’s Guide 140 The following table describes th e fields in this screen. T able 51 Edit Address Mapping Rule LABEL DESCRIPTION Ty p e Choose the port mapping type from one of the following. • One-to-One : One-to-One mode maps one local IP address to one global IP address. Note t[...]

141 P ART IV Security Firewalls (143) Firewall Configuration (155) Content Filtering (177)[...]

142[...]

P-660HW-Dx User’s Guide 143 C HAPTER 9 Firewalls This chapter gives some back ground information on firewa lls and introduces the ZyXEL Device firewall. 9.1 Firewall Overview Originally , the term fir ewall referred to a construction techni que designe d to prevent the spread of fire from one room to another . The ne tworking term “firewall” [...]

Chapter 9 Firewalls P-660HW-Dx User’s Guide 144 9.2.2 Applicatio n-level Firewalls Application-level firewalls restrict access by serv ing as proxies for e xternal servers. Since they use programs written for specific Internet servic es, such as HTTP, FTP and tel net, they can evaluate network packets for valid applicatio n-sp ecific data. Applic[...]

Chapter 9 Firewalls P-660HW-Dx User’s Guide 145 9.3.1 Denial of Service Att acks Figure 81 Firewall Application 9.4 Denial of Service Denials of Service (DoS) attacks are aimed at devices and networks w ith a connection to the Internet. Their goal is not to st eal in formation, but to disable a device or ne twork so users no longer have access to[...]

Chapter 9 Firewalls P-660HW-Dx User’s Guide 146 9.4.2 T ypes of DoS Attacks There are four types of DoS attacks: 1 Those that exploit bugs in a TCP/IP implementation. 2 Those that exploit weaknesses in the TCP/IP specification. 3 Brute-force attacks that flood a network with useless data. 4 IP Spoofing. 5 " Ping of Death " and " T [...]

Chapter 9 Firewalls P-660HW-Dx User’s Guide 147 Figure 83 SYN Flood •I n a LAND Attack , hackers flood SYN packets into the network with a spoofed source IP address of the targeted system . This makes it appear as if the host computer sent the packets to itself, making the sy stem unavailable while the target system tries to respond to itself. [...]

Chapter 9 Firewalls P-660HW-Dx User’s Guide 148 9.4.2.1 ICMP V ulnerability ICMP is an error -reporting protocol that works in concert with IP . The following ICMP types trigger an alert: 9.4.2.2 Illegal Commands (NetBIOS and SMTP) The only legal NetBIOS commands are the following - all others are illegal. All SMTP commands are illegal except for[...]

Chapter 9 Firewalls P-660HW-Dx User’s Guide 149 are allowed in. The ZyXEL Device uses stateful packet inspection to protect the private LAN from hackers and vandals on the Internet. By de fault, the ZyXEL Device’ s stateful inspection allows all communications to the Internet that or iginate from the LAN, and blocks all traffic to the LAN that [...]

Chapter 9 Firewalls P-660HW-Dx User’s Guide 150 6 Later , an inbound packet reac hes the interface . This packet is part of the connection previously established with the outbound packet. The inbound packet is ev aluated against the inbound access list, and is permitted because of the temporary access list entry previously crea ted. 7 The packe t[...]

Chapter 9 Firewalls P-660HW-Dx User’s Guide 151 If an initiation packet originates on the LAN, this means that someone is trying to make a connection from the LAN to the In ternet. Assuming that this is an acceptable part of the security policy (as is the case w ith the default policy), the connection will be allowed. A cache entry is added which[...]

Chapter 9 Firewalls P-660HW-Dx User’s Guide 152 9.6 Guidelines for Enhancing Security with Y our Firewall • Change the default password via CLI (Co mmand Line Interpreter) or web configurator. • Limit who can telnet into your router . • Don't enable any local service (such as SN MP or NTP) that you don't use. An y enabled service [...]

Chapter 9 Firewalls P-660HW-Dx User’s Guide 153 • Always shred confidential inform ation, particularly about your computer , before throwing it away . Some hackers dig through the trash of companies or indivi duals for information that might help them in an attack. 9.7 Packet Filtering Vs Firewall Below are some comparisons be tween the ZyXEL D[...]

Chapter 9 Firewalls P-660HW-Dx User’s Guide 154 • T o selectively bloc k/allow inbound or outbound traffic between inside host/networks and outside host/networks. Remember that filters can not distinguish traf fic originating from an inside host or an ou tside host by IP address. • The firewall performs better than filtering if you need to ch[...]

P-660HW-Dx User’s Guide 155 C HAPTER 10 Firewall Configuration This chapter shows you how to enable and configure t he ZyXEL Device firewall. 10.1 Access Methods The web configurator is, by far , the most co mprehensive firewall configuration tool your ZyXEL Device has to offer . For this rea son, it is recommended that you config ure your firewa[...]

Chapter 10 Firewa ll Configuration P-660HW-Dx User’s Guide 156 " If you configure firewall rules without a good understanding of how they work, you might inadvertently introduce security risk s to the firewall and to the protected network. Make sure you test your rules a fter you configure them. For example, you may create rules to: • Bloc[...]

Chapter 10 Firewall Configu ration P-660HW-Dx User’s Guide 157 3 Is it possible to modify the rule to be more specific? For ex ample, if IRC is blocked for all users, will a rule that blocks just certain users be more effective? 4 Does a rule that allows Internet users acces s to resources on the LAN create a security vulnerability? For example, [...]

Chapter 10 Firewa ll Configuration P-660HW-Dx User’s Guide 158 10.4.1 LAN to W AN Rules The default rule for LAN to W AN traf fic is that all users on the LAN are allowed non- restricted access to the W AN. When you config ure a LAN to W AN rule, you in essence want to limit some or all users from accessing cer tain services on the W A N. W AN to[...]

Chapter 10 Firewall Configu ration P-660HW-Dx User’s Guide 159 The following table describes the labels in this screen. 10.6 Firewall Rules Summary " The ordering of your rules is very import ant as rules are applied in turn. Refer to Section 9.1 on page 143 for more information. Click Security > Firewall > Rules to bring up the follow[...]

Chapter 10 Firewa ll Configuration P-660HW-Dx User’s Guide 160 Figure 87 Firewall Rules The following table describes the labels in this screen. T able 57 Firewall Rules LABEL DESCRIPTION Firewall Rules S torage S pace in Use This read-only bar shows how much of the ZyXEL Device's memory for recording firewall rules it is currently using. Wh[...]

Chapter 10 Firewall Configu ration P-660HW-Dx User’s Guide 161 10.6.1 Configuring Firewall Rules Refer to Section 9.1 on page 143 for more information. In the Rules screen, select an index number and cl ick Add or click a rule’ s Edit icon to display this screen and refer to the following table for information on the labels. Log This field show[...]

Chapter 10 Firewa ll Configuration P-660HW-Dx User’s Guide 162 Figure 88 Firewall: Edit Rule[...]

Chapter 10 Firewall Configu ration P-660HW-Dx User’s Guide 163 The following table describes the labels in this screen. T able 58 Firewall: Edit Rule LABEL DESCRIPTION Activ e Select this option to enable this firewall rule. Action for Matched Packet Use the drop-down list box to select what the firewall is to do with p ackets that match this rul[...]

Chapter 10 Firewa ll Configuration P-660HW-Dx User’s Guide 164 10.6.2 Customized Services Configure customized services and port number s not predefined by the ZyXEL Device. For a comprehensive list of port numbers and services, visit the IANA (Internet Assigned Number Authority) website. For further informa tion on these se rvices, please read S[...]

Chapter 10 Firewall Configu ration P-660HW-Dx User’s Guide 165 Refer to Section 9.1 on page 143 for more information. Figure 90 Firewall: Configure Customized Services The following table describes the labels in this screen. 10.7 Example Firewall Rule The following Internet firewa ll rule example allows a hypot hetical “MyService” connection [...]

Chapter 10 Firewa ll Configuration P-660HW-Dx User’s Guide 166 Figure 91 Firewall Example: Rules 3 In the Rules screen, select the index number after that you want to add the rule. For example, if you select “6”, your new rule b ecomes number 7 and the previous rule 7 (if there is one) becomes rule 8. 4 Click Add to display the firewall rule [...]

Chapter 10 Firewall Configu ration P-660HW-Dx User’s Guide 167 Figure 93 Firewall Example: Edit Ru le: Des tination Addres s 9 Use the Add >> and Remove buttons between A vailable Services and Selected Services list boxes to configure it as follows. Click Apply when you are done. " Custom services show up with an “*” before th eir [...]

Chapter 10 Firewa ll Configuration P-660HW-Dx User’s Guide 168 Figure 94 Firewall Example: Edit Rule: Select Customized Services On completing the configuration procedure for this Internet firewall rule, the Rules screen should look like the following. Rule 1 allows a “MyService” connection from the W AN to IP addresses 10.0.0.10 through 10.0[...]

Chapter 10 Firewall Configu ration P-660HW-Dx User’s Guide 169 Figure 95 Firewall Example: Rules: MyService 10.8 Predefined Services The A vailable Services list box in the Edit Ru le s creen (see Section 10.6.1 on page 161 ) displays all predefined services that the ZyXEL Device already supports. Next to the name of the service, two fields appea[...]

Chapter 10 Firewa ll Configuration P-660HW-Dx User’s Guide 170 HTTP(TCP:80) Hyper T ext Tr a nsfer Protocol - a c lient/server protocol for the world wide web. HTTPS HTTPS is a secured http session often used in e-commerce. ICQ(UDP:4000) This is a popu lar Internet cha t program. IPSEC_TRANSPORT/ TUNNEL(AH:0) The IPSEC AH (Authentic ation Header)[...]

Chapter 10 Firewall Configu ration P-660HW-Dx User’s Guide 171 10.9 Anti-Probing If an outside user attempts to probe an unsupp orted port on your ZyXEL Device , an ICMP response packet is automatically returned. This allows the ou tside user to know the ZyXEL Device exists. The ZyXEL Device supports anti- probing, which prevents the ICMP respons[...]

Chapter 10 Firewa ll Configuration P-660HW-Dx User’s Guide 172 The following table describes the labels in this screen. 10.10 DoS Thresholds For DoS attacks, the ZyXEL Device uses threshol ds to determine when to drop sessions that do not become fully established. These thresholds ap ply globally to all sessions. Y ou can use the default threshol[...]

Chapter 10 Firewall Configu ration P-660HW-Dx User’s Guide 173 10.10.2 Half-Open Sessions An unusually high number of half-open sessions (either an absolute number or measured as the arrival rate) could indicate that a Denial of Service a ttack is occurring. For TCP , "half- open" means that the session has not reached the establis hed [...]

Chapter 10 Firewa ll Configuration P-660HW-Dx User’s Guide 174 Figure 97 Firewall: Threshold The following table describes the labels in this screen. T able 63 Firewall: Threshold LABEL DESCRIPTION DEF AUL T V ALUES Denial of Service Thresholds One Minute Low This is the rate of new half-open sessions that causes the firewall to stop deleting hal[...]

Chapter 10 Firewall Configu ration P-660HW-Dx User’s Guide 175 Maximum Incomplete High This is the number of e xisting half-op en sessions that causes the firewall to st art deleting half-open sessi ons. When the number of existing half-open sessions rises above this number , the ZyXEL Device deletes half-open sessions as required to accommodate [...]

Chapter 10 Firewa ll Configuration P-660HW-Dx User’s Guide 176[...]

P-660HW-Dx User’s Guide 177 C HAPTER 11 Content Filtering This chapter covers how to configure content filtering. 1 1 .1 Content Filtering Overview Internet content filtering allows you to create and enforce Internet access policies tailored to your needs. Content filtering gives you the ab ility to block web sites that contain key words (that yo[...]

Chapter 11 Content Filtering P-660HW-Dx User’s Guide 178 The following table describes the labels in this screen. 1 1 .3 Configuring the Schedule T o set the days and times for the ZyXEL De vice to perform content filtering, click Security > Content Filter > Schedule . The screen appears as shown. Figure 99 Content Filter: Schedule T able 6[...]

Chapter 11 Con tent Filtering P-660HW-Dx User’s Guide 179 The following table describes the labels in this screen. 1 1 .4 Configuring T rusted Computers T o exclude a range of users on the LAN from content filtering on your Zy XEL Device, click Security > Content Filter > Tr u s t e d . The screen appears as shown. Figure 100 Content Filter[...]

Chapter 11 Content Filtering P-660HW-Dx User’s Guide 180[...]

181 P ART V Advanced S tatic Route (183) Bandwidth Management (1 87) Dynamic DNS Setup (199) Remote Management Configurat ion (203) Universal Plug-and-P lay (UPnP) (213)[...]

182[...]

P-660HW-Dx User’s Guide 183 C HAPTER 12 Static Route This chapter shows you how to configure static routes for your ZyXEL Device. 12.1 S t atic Route Each remote node specifies only the network to which the gateway is di rectly connected, and the ZyXEL Device has no know ledge of the network s beyond. For instance , the ZyXEL Device knows about n[...]

Chapter 12 Static Rou te P-660HW-Dx User’s Guide 184 Figure 102 S tatic Route The following table describes the labels in this screen. 12.2.1 S tatic Route Edit Select a static route index numb er and click Edit ( ). The screen shown next appears. Use this screen to configure the requir ed information for a static route. T able 67 Static Route LA[...]

Chapter 12 Static Route P-660HW-Dx User’s Guide 185 Figure 103 S tatic Route Edit The following table describes the labels in this screen. T able 68 Static Rou te Edit LABEL DESCRIPTION Activ e This field allows you to activa te/deactivate this static route. Route Name Enter the name of the IP static ro ute. Leav e this field blank to delete this[...]

Chapter 12 Static Rou te P-660HW-Dx User’s Guide 186[...]

P-660HW-Dx User’s Guide 187 C HAPTER 13 Bandwidth Management This chapter contains information about configuri ng bandwidth management, editing rules and viewing the ZyXEL Device’ s bandwidth managem ent logs. 13.1 Bandwid th Management Overview ZyXEL ’ s Bandwidth Management allows you to specify bandwidth management rules based on an applic[...]

Chapter 13 Bandwid th Manageme nt P-660HW-Dx User’s Guide 188 Figure 104 Subnet-based Ba ndwidt h Management Example 13.4 Application and Subnet-based Bandwid th Management Y ou could also create bandwidth classes based on a combination of a subnet and an application. The following exam ple table shows bandwidth alloca tions for application speci[...]

Chapter 13 Bandwidth Management P-660HW-Dx User’s Guide 189 13.5.2 Fairness-based Scheduler The ZyXEL Device divides bandwidth equally among bandwidth classes when using the fairness-based scheduler; thus preventing one ba ndwidth class from using all of the interface’ s bandwidth. 13.6 Maximize Bandwid th Usage The maximize bandwi dth usage op[...]

Chapter 13 Bandwid th Manageme nt P-660HW-Dx User’s Guide 190 The ZyXEL Device divides up the unb udgeted 2048 kbps among the class es that require more bandwidth. If the administratio n department only uses 1024 kbps of the budg eted 2048 kbps, the ZyXEL Device also divides the remaining 10 24 kbps among the classes that re quire more bandwidth.[...]

Chapter 13 Bandwidth Management P-660HW-Dx User’s Guide 191 13.6.3 Bandwid th Management Priorities The following table describes the priorities th at you can apply to traf fic that the ZyXEL Device forwards out through an interface. 13.7 Over Allotment of Bandwid th Y ou can set the bandwidth management speed fo r an interface higher than the in[...]

Chapter 13 Bandwid th Manageme nt P-660HW-Dx User’s Guide 192 Figure 105 Bandwidth Ma nagement: Summary The following table describes the labels in this screen. 13.9 Bandwid th Management Rule Setup Y ou must use the Bandwidth Management Summary scr een to enable bandwi dth management on an interface before yo u can configure rules for that inter[...]

Chapter 13 Bandwidth Management P-660HW-Dx User’s Guide 193 Click Advanced > Bandwidth MGMT > Rule Setup to open the following screen. Figure 106 Bandwidth Management: Rule Setup The following table describes the labels in this screen. T able 76 Bandwidth Management: Rule Setup LABEL DESCRIPTION Direction Select the direction of traffic to [...]

Chapter 13 Bandwid th Manageme nt P-660HW-Dx User’s Guide 194 13.10 DiffServ DiffServ is a class of service (CoS) mode l that ma rks packets so that the y receive specific per- hop treatment at DiffServ-compliant network de vices along the route based on the application types and traf fic flow . Packets are marked with DiffServ Code Points (DSCPs[...]

Chapter 13 Bandwidth Management P-660HW-Dx User’s Guide 195 Figure 108 Bandwidth Mana gement Rule Configuration The following table describes the labels in this screen. T able 78 Bandwidth Management Rule Configu ration LABEL DESCRIPTION Rule Configuration Activ e Select this check bo x to have the Zy XEL Device apply thi s bandwidth management r[...]

Chapter 13 Bandwid th Manageme nt P-660HW-Dx User’s Guide 196 DiffServ mark Se lect the marking rule from the drop-down list. The first thre e digits are the DiffServ code point. A p a cket with the lowest priority mark will be dropped when the line is bu sy . Filter Configuration Servi ce This field simplifies ba ndwidth class configuration by a[...]

Chapter 13 Bandwidth Management P-660HW-Dx User’s Guide 197 13.1 1 Bandwid th Monitor T o view the ZyXEL Device’ s bandwidth usage and allotments, click Advanced > Bandwidth MGMT > Mon itor . The screen appears as shown. Selec t an interface from the drop-down list box to view the bandwidth usage of its bandwidth rules . The gray section [...]

Chapter 13 Bandwid th Manageme nt P-660HW-Dx User’s Guide 198 Figure 109 Bandwidth Ma nagement: Monitor T able 80 Bandwidth Managemen t Monitor LABEL DESCRIPTION Monitor This section allows you to se lect which network to monitor . Y ou may select either a LAN , WLAN , or WA N . After selecting a network to monitor , information on active service[...]

P-660HW-Dx User’s Guide 199 C HAPTER 14 Dynamic DNS Setup This chapter discusses how to configure your ZyXEL Device to use Dynamic DNS. 14.1 Dynamic DNS Overview Dynamic DNS allows you to update your curre nt dynamic IP address with one or many dynamic DNS services so that anyone can c ont act you (in Ne tMeeting, CU-SeeMe, etc.). Y ou can also a[...]

Chapter 14 Dy namic DNS Se tup P-660HW-Dx User’s Guide 200 Figure 1 10 Dynamic DNS The following table describes th e fields in this screen. T able 81 Dynamic DNS LABEL DESCRIPTION Dynamic DNS Setup Active Dynamic DNS Select this check box to use dy namic DNS. Service Prov ider This is the name of your Dynamic DNS service provider . Dynamic DNS T[...]

Chapter 14 Dynamic DNS Setup P-660HW-Dx User’s Guide 201 Dynamic DNS server auto detect IP Address Select this option only when the re are one or more NA T routers between the ZyXEL Device and the DDNS server . This fea ture has the D DNS server auto matically detect and use the IP address of the NA T router that has a public IP address. Note: Th[...]

Chapter 14 Dy namic DNS Se tup P-660HW-Dx User’s Guide 202[...]

P-660HW-Dx User’s Guide 203 C HAPTER 15 Remote Management Configuration This chapter provides information on config uring remote management. 15.1 Remote Management Overview Remote management allows you to determ ine which services/protocols can access which ZyXEL Device interface (if any) from which computers. " When you configure remote man[...]

Chapter 15 Remote Management Configuration P-660HW-Dx User’s Guide 204 15.1.1 Remote Management Limit ations Remote management over LAN or W AN will not work when: • Y ou have disabled that service in one of the remote management screens. • The IP address in the Secured Client IP field does not match th e client IP address. If it does not mat[...]

Chapter 15 Remote Ma nagement Configuration P-660HW-Dx User’s Guide 205 The following table describes the labels in this screen. 15.3 T elnet Y ou can configure your ZyXEL Device for remote T elnet access as shown next. The administrator uses T elnet from a computer on a remote netw ork to access the ZyXEL Device. Figure 1 12 T elnet Configuratio[...]

Chapter 15 Remote Management Configuration P-660HW-Dx User’s Guide 206 Figure 1 13 Remote Management: T elnet The following table describes the labels in this screen. 15.5 T elnet Login Use the following steps to T elnet into your ZyXEL Device’ s command interpreter . See Appendix G on pa ge 331 for more about the commands. 1 If your computer i[...]

Chapter 15 Remote Ma nagement Configuration P-660HW-Dx User’s Guide 207 15.6 Configuring FTP Y ou can upload and download the ZyXEL Devi ce’ s firmware and c onfiguration files using FTP , please se e the chapter on firmware and configuration file maintenance for details. T o use this feature, your computer must have an FTP client. T o change y[...]

Chapter 15 Remote Management Configuration P-660HW-Dx User’s Guide 208 " SNMP is only available if TCP/IP is configured. Figure 1 15 SNMP Management Mo del An SNMP managed network consis ts of two main types of comp onent: ag ents and a manager . An agent is a management software module that resi des in a managed device (the ZyXEL Device). A[...]

Chapter 15 Remote Ma nagement Configuration P-660HW-Dx User’s Guide 209 15.7.1 Supported MIBs The ZyXEL Device supports MIB II that is defined in RFC-1213 and RFC-1215. The focus of the MIBs is to let administrators collect sta tistical data and monitor status and performance. 15.7.2 SNMP T rap s The ZyXEL Device will send traps to the SNMP manag[...]

Chapter 15 Remote Management Configuration P-660HW-Dx User’s Guide 210 The following table describes the labels in this screen. 15.8 Configuring DNS Use DNS (Domain Name System) to map a domain name to its corresponding IP address and vice versa. Refer to the chapter on LAN for background information. T o change your ZyXEL Device’ s DNS setting[...]

Chapter 15 Remote Ma nagement Configuration P-660HW-Dx User’s Guide 21 1 Figure 1 17 Remote Management: DNS The following table describes the labels in this screen. 15.9 Configuring ICMP T o change your ZyX EL Device’ s security setting s, click Advanced > Remote MGMT > ICMP . The scre en appears as shown. If an outside user attempts to p[...]

Chapter 15 Remote Management Configuration P-660HW-Dx User’s Guide 212 Figure 1 18 Remote Management: ICMP The following table describes the labels in this screen. T able 88 Remote Managemen t : ICMP LABEL DESCRIPTION ICMP Internet Control Message Protocol is a message control and error-reporting protocol between a host server and a gateway to th[...]

P-660HW-Dx User’s Guide 213 C HAPTER 16 Universal Plug-and-Play (UPnP) This chapter introduces the UPnP feature in the web configura tor . 16.1 Introducing Universal Plug and Play Universal Plug and Play (UPnP) is a distributed, open networking standard that uses TCP/IP for simple peer-to-peer network connectiv ity between devices. A UPnP device [...]

Chapter 16 Universal Plug-and-Play (UPnP) P-660HW-Dx User’s Guide 214 When a UPnP device joins a network, it announ ces its presence with a multicast mess age. For security reasons, the ZyXEL Device allows multicast messages only on the LAN. All UPnP-enabled devices may communicate freely with eac h other without additional configuration. Disable[...]

Chapter 16 Universal Plug-and-Play (UPnP) P-660HW-Dx User’s Guide 215 16.3 Inst alling UPnP in Windows Example This section shows ho w to install UPnP in W indows Me and W indows XP . 16.3.1 Inst alling UPnP in Windows Me Follow the steps below to inst all the UPnP in W indows Me. 1 Click St a r t and Control Panel . Double-click Add/Remove Pr og[...]

Chapter 16 Universal Plug-and-Play (UPnP) P-660HW-Dx User’s Guide 216 Figure 121 Add/Remove Programs: Wind ows Setup: Communication: Component s 4 Click OK to go back to the Add/Re move Programs Pr operties window and click Next . 5 Restart the computer when prompted. 16.3.2 Inst alling UPnP in Windows XP Follow the steps below to install the UPn[...]

Chapter 16 Universal Plug-and-Play (UPnP) P-660HW-Dx User’s Guide 217 Figure 123 Windows Optiona l Networking Component s Wizard 5 In the Networking Services window , select the Universal Plug and Play check box. Figure 124 Networking Services 6 Click OK to go back to the W indows Optional Networking Component W izard window and click Next . 16.4[...]

Chapter 16 Universal Plug-and-Play (UPnP) P-660HW-Dx User’s Guide 218 Make sure the computer is co nnected to a LAN port of the ZyXEL Device. T urn on your computer and the ZyXEL Device. 16.4.1 Auto-discover Y our UPnP-enabled Network Device 1 Click start and Control Panel . Double-click Network Connections . An icon displays under Internet Gatew[...]

Chapter 16 Universal Plug-and-Play (UPnP) P-660HW-Dx User’s Guide 219 Figure 126 Internet Connection Properties 4 Y ou may edit or delete the port map pings or click Add to manually add port mappings. Figure 127 Internet Connection Properties: Adva nced Settings[...]

Chapter 16 Universal Plug-and-Play (UPnP) P-660HW-Dx User’s Guide 220 Figure 128 Internet Connection Proper ties: Adva nced Settings: Add " When the UPnP-enabled device is disconne cted from your computer , all port mappings will be deleted automatically . 5 Select Show icon in noti fication area when connected option and click OK . An icon [...]

Chapter 16 Universal Plug-and-Play (UPnP) P-660HW-Dx User’s Guide 221 Figure 130 Internet Connection S tatus 16.4.2 We b Configurator Easy Access W ith UPnP , you can access the web-based configurator on the ZyXEL Device without finding out the IP address of the ZyXEL Device first. Th is comes helpful if you do not know the IP address of the ZyXE[...]

Chapter 16 Universal Plug-and-Play (UPnP) P-660HW-Dx User’s Guide 222 Figure 131 Network Connections 4 An icon with the description for e ach UPnP-enabled device disp lays under Local Network . 5 Right-click on the icon for y our ZyXEL Device and s elect Invoke . The web config urator login screen displays.[...]

Chapter 16 Universal Plug-and-Play (UPnP) P-660HW-Dx User’s Guide 223 Figure 132 Network Connections: My Network Places 6 Right-click on the icon for your ZyXEL Device and select Pr operties . A properties window displays with basic info rmation about the ZyXEL Device. Figure 133 Network Connections: My Networ k Places: Properties: Example[...]

Chapter 16 Universal Plug-and-Play (UPnP) P-660HW-Dx User’s Guide 224[...]

225 P ART VI Maintenance and T roubleshooting System (227) Logs (233) T ools (251) Diagnostic (257) T roubleshooting (259)[...]

226[...]

P-660HW-Dx User’s Guide 227 C HAPTER 17 System Use this screen to configure the ZyXEL Device’ s time and date settings. 17.1 General Setup 17.1.1 General Setup and System Name General Setup contains administrative and system-related information. System Name is for identification purposes. However , because some ISPs c heck this name you should [...]

Chapter 17 System P-660HW-Dx User’s Guide 228 Figure 134 System General Setu p The following table describes the labels in this screen. T able 90 System General Setup LABEL DESCRIPTION General Setup System Name Choose a descriptive name for identificatio n purposes. It is recommended you enter your computer ’s “Computer name” in this field.[...]

Chapter 17 System P-660HW-Dx User’s Guide 229 17.2 T ime Setting T o change your ZyX EL Device’ s time and date, click Maintenance > System > Time Setting . The screen appears as shown. Use this screen to configure the ZyXEL Device’ s time based on your local time zone. Figure 135 System T ime Setting Old Password T ype the default admi[...]

Chapter 17 System P-660HW-Dx User’s Guide 230 The following table describes th e fields in this screen. T able 91 System Time Setting LABEL DESCRIPTION Current T ime and Date Current T ime This field displays the ti me of your ZyXEL Device. Each time you reload this page, the ZyXEL Device synchronizes the time with the time server . Current Date [...]

Chapter 17 System P-660HW-Dx User’s Guide 231 St a r t D a t e Con figure the day and time when Daylight Sa ving T ime starts if you selected Enable Daylight Saving . The o' clock field uses the 24 hour format. Here are a couple of examples: Daylight Saving T ime start s in most parts of the United St ate s on the first Sunday of April. Each[...]

Chapter 17 System P-660HW-Dx User’s Guide 232[...]

P-660HW-Dx User’s Guide 233 C HAPTER 18 Logs This chapter contains inform ation about configuring genera l log settings and viewing the ZyXEL Device’ s logs. Refer to the append ix for example log message explanations. 18.1 Logs Overview The web confi gurator allows you to choose which categories of events and/or alerts to have the ZyXEL Device[...]

Chapter 18 Logs P-660HW-Dx User’s Guide 234 Figure 136 Vi ew Log The following table describes th e fields in this screen. 18.3 Configuring Log Settings Use the Log Settings screen to configure to where the Zy XEL Device is to send logs; the schedule for when the ZyXEL Device is to send the logs and which logs and/or immediate alerts the ZyXEL De[...]

Chapter 18 Lo gs P-660HW-Dx User’s Guide 235 Figure 137 Log Settings The following table describes the fields in this screen. T able 93 Log Settings LABEL DESCRIPTION E-mail Log Settings Mail Server Enter the server name or the IP address of the mail serve r for the e-mail ad dresses specified below . If this field is left blank, logs and alert m[...]

Chapter 18 Logs P-660HW-Dx User’s Guide 236 18.3.1 Example E-mail Log An "End of Log" message displays for each ma il in which a complete log has been sent. The following is an example of a log sent by e-mail. • Y ou may edit the subject title. • The date format here is Day-Month-Y ear . • The date format here is Month-Day-Y ear .[...]

Chapter 18 Lo gs P-660HW-Dx User’s Guide 237 Figure 138 E-mail Log Example 18.4 Log Descriptions This section provides descriptio ns of example log messages. Subject: Firewall Alert From xxxxx Date: Fri, 07 Apr 2000 10:05:42 From: user@zyxel.com To: user@zyxel.com 1| Apr 7 00 |From:192.168.1.1 To:192.168.1.255 |default policy |forward | 09:54:03 [...]

Chapter 18 Logs P-660HW-Dx User’s Guide 238 Starting Connectivity Monitor S tarting Connectivity Monitor . Time initialized by Daytime Server The router got the time and date from the Daytime server . Time initialized by Time server The router got the time and date from the time server . Time initialized by NTP server The router got the time and [...]

Chapter 18 Lo gs P-660HW-Dx User’s Guide 239 Triangle route packet forwarded: [TCP | UDP | IGMP | ESP | GRE | OSPF] The firewall allowe d a triangle route sessi on to pass through. Packet without a NAT table entry blocked: [TCP | UDP | IGMP | ESP | GRE | OSPF] The router blocked a packet that didn't have a corresponding NA T table entry . Ro[...]

Chapter 18 Logs P-660HW-Dx User’s Guide 240 T able 99 ICMP Logs LOG MESSAGE DESCRIPTION Firewall default policy: ICMP <Packet Direction>, <type:%d>, <code:%d> ICMP access matched the default pol icy and was blocked or forwarded according to the user's setting. For type and code d etails, see T able 1 10 on page 248 . Firewa[...]

Chapter 18 Lo gs P-660HW-Dx User’s Guide 241 T able 102 UPnP Logs LOG MESSAGE DESCRIPTION UPnP pass through Firewall UPnP packets can p ass throu gh the firewall. T able 103 Content Filtering Logs LOG MESSAGE DESCRIPTION %s: Keyword blocking The conte nt of a requested web page matched a user defined keyword. %s: Not in trusted web list The web s[...]

Chapter 18 Logs P-660HW-Dx User’s Guide 242 T able 104 Attack Logs LOG MESSAGE DESCRIPTION attack [TCP | UDP | IGMP | ESP | GRE | OSPF] The firewall detected a TCP/ UDP/IGMP/ESP/GR E/OSPF attack. attack ICMP (type:%d, code:%d) The firewall detected an ICMP attack. For type and code details, see T able 1 10 on page 248 . land [TCP | UDP | IGMP | E[...]

Chapter 18 Lo gs P-660HW-Dx User’s Guide 243 Rule <%d> idle time out, disconnect The router droppe d a connection that had outbound traffic and n o inbound traffic for a certain time perio d. Y ou can use the "ipsec timer chk_conn" CI command to set the ti me period. The d efault value is 2 minutes. WAN IP changed to <IP> Th[...]

Chapter 18 Logs P-660HW-Dx User’s Guide 244 Recv <packet> IKE uses ISAKMP to transmit dat a. Each ISAKMP packet contains many different types of payloads. All of them show in the LOG . Refer to RFC2408 – ISAKMP for a list of all ISAKMP payload types. Recv <Main or Aggressive> Mode request from <IP> The router received an IKE n[...]

Chapter 18 Lo gs P-660HW-Dx User’s Guide 245 Rule [%d] Phase 1 authentication method mismatch The listed rule’s IKE phase 1 authentication method did not match between the router and the peer. Rule [%d] Phase 1 key group mismatch The listed rule’s IKE phase 1 key group did not match between the router a nd the peer. Rule [%d] Phase 2 protocol[...]

Chapter 18 Logs P-660HW-Dx User’s Guide 246 T able 107 PKI Logs LOG MESSAGE DESCRIPTION Enrollment successful The SCEP online certificate enrollment was successful. The Destination field records the certific ation autho rity server IP address and port. Enrollment failed The SCEP online certificate enrollment failed . The Destination field records[...]

Chapter 18 Lo gs P-660HW-Dx User’s Guide 247 T able 108 Certificate Path Verification Failure Reason Codes CODE DESCRIPTION 1 Algorithm mismatch between the cert ificate and the search constraints. 2 Key usage mismatch between the cert ificate and the search constra ints. 3 Certificat e was not valid in the time interval. 4 (Not used) 5 Certifica[...]

Chapter 18 Logs P-660HW-Dx User’s Guide 248 T able 1 10 ICMP Notes TYPE CODE DESCRIPTION 0 Echo Reply 0 Echo reply message 3 Destination Unreachable 0 Net unreachable 1 Host unreachable 2 Protocol unreachable 3 Port unreachable 4 A packet that needed fra gmentation was dropped because it was set to Don't Fragment (DF) 5 Source route failed 4[...]

Chapter 18 Lo gs P-660HW-Dx User’s Guide 249 The following table shows RFC-2408 ISAKMP payload types that the log displays. Please refer to the RFC for detailed information on each type. Ta b l e 1 11 Syslog Logs LOG MESSAGE DESCRIPTION <Facility*8 + Severity>Mon dd hr:mm:ss hostname src="<srcIP:srcPort>" dst="<dstIP[...]

Chapter 18 Logs P-660HW-Dx User’s Guide 250[...]

P-660HW-Dx User’s Guide 251 C HAPTER 19 Tools This chapter describes how to upload new firm ware, manage configuration and restart your ZyXEL Device. 19.1 Firmware Upgrade Find firmware at www .zyxel.com in a file that (usually) uses the system model name with a .bin extension, for example, "ZyXEL Device.bin". The upload process uses HT[...]

Chapter 19 Tools P-660HW-Dx User’s Guide 252 1 Do NOT turn off the ZyXEL Device while firmware upload is in progress! After you see the Firmware Upload in Pr ogress screen, wait two minutes before logging into the ZyXEL Device again. Figure 140 Firmware Uplo ad In Progres s The ZyXEL Device automatically restarts in this time causing a temporary [...]

Chapter 19 Tools P-660HW-Dx User’s Guide 253 Figure 142 Error Message 19.2 Configuration Screen Click Maintenance > T ools > Configuration . Information related to factory defaults, backup configuration, and rest oring configuration app ears as shown next. Figure 143 Configuration 19.2.1 Backup Configuration Backup configuration allows you [...]

Chapter 19 Tools P-660HW-Dx User’s Guide 254 19.2.2 Restore Configuration Restore configuration allows you to upload a new or previously saved configuration file from your computer to your ZyXEL Device. 1 Do not turn off the ZyXEL De vice while configuration file upload is in progress After you see a “Restore Configuration successful” screen,[...]

Chapter 19 Tools P-660HW-Dx User’s Guide 255 Figure 146 Configuration Restore Er ror 19.2.3 Back to Factory Default s Pressing the RESET button in this section clears all us er -entered configuration information and returns the ZyXEL Device to its factory defaults. Y ou can also press the RESET button on the rear panel to reset the factory defaul[...]

Chapter 19 Tools P-660HW-Dx User’s Guide 256[...]

P-660HW-Dx User’s Guide 257 C HAPTER 20 Diagnostic These read-only screens display information to help you identify problems with the ZyXEL Device. 20.1 General Diagnostic Click Maintenance > Diagnostic to open the screen shown next. Figure 148 Diagnostic: General The following table describes th e fields in this screen. 20.2 DSL Line Diagnost[...]

Chapter 20 Diagnostic P-660HW-Dx User’s Guide 258 Figure 149 Diagnostic: DSL Line The following table describes th e fields in this screen. T able 1 16 Diagnostic: DSL Line LABEL DESCRIPTION AT M S t a t u s Click this butt on to view A TM stat us. A TM Loopb ack Te s t Click this button to start the A TM loopback test. Make sure you have configu[...]

P-660HW-Dx User’s Guide 259 C HAPTER 21 Troubleshooting This chapter offers some sugg estions to solve problems you might encounter . The potential problems are divided into the following categories. • Power , Hardware Connections, and LEDs • ZyXEL Device Access and Login • Internet Access 21.1 Power , Hardware Connections, and LEDs V The Z[...]

Chapter 21 Trou bleshooting P-660HW-Dx User’s Guide 260 21.2 ZyXEL Device Access and Login V I forgot the IP address for the ZyXEL Device. • The default IP address is 192.168.1.1 . 6 If you changed the IP addre ss and have forgotten it, you might get the IP address o f the ZyXEL Device by looking up th e IP address of the default gate way for y[...]

Chapter 21 Trou bleshooting P-660HW-Dx User’s Guide 261 5 Reset the device to its factory defaults, an d try to access the ZyXEL Device with the default IP address. See Section 2.3 on page 40 . 6 If the problem continues, contact the network administrator or vendor , or try one of the advanced suggestio ns. Advanced Suggestions • T ry to access[...]

Chapter 21 Trou bleshooting P-660HW-Dx User’s Guide 262 1 Check the hardware connections , and make su re the LEDs are be having as expected. Se e the Quick S tart Guide and Section 1.4 on page 35 . 2 If your ISP gave you Internet connection information, make sure you entered it correctly in the Network > WA N > Internet Connection screen. [...]

263 P ART VII Appendices and Index Product Specifications and W all Mounting (265) W ireless LANs (271) Setting up Y our Computer ’ s IP Address (285) IP Addresses and Subnetting (301) Firewall Commands (309) Internal SP TGEN (315) Command Interpreter (331) Pop-up W indows, JavaScripts and Java Permissions (333) NetBIOS Filter Commands (339) Spli[...]

264[...]

P-660HW-Dx User’s Guide 265 A PPENDIX A Product S pecifications and W all Mounting Product S pecifications The following tables summarize the ZyXEL Devi ce’ s hardware and firmware features.M4 T able 1 17 Hardware Specifications Dimensions (W x D x H) 180 x 128 x 36 mm Power S pecification 12V AC 1A Built-in Switch Four auto-negotiating, auto M[...]

Appendix A Product Specifications and Wa ll Mounting P-660HW-Dx User’s Guide 266 Configuration Backup & Restoration Make a copy of the ZyXEL Device’s configuration. Y ou can put it back on the ZyXEL Device later if you de cide to revert back to an earl i er configuration. Network Address T ranslation (NA T) Each computer on your network mu [...]

Appendix A Product Specifications and Wall Mounting P-660HW-Dx User’s Guide 267 T able 1 19 Wireless Firmware Specifications The following list, which is not exhaustive, i llustrates the standards su pported in the ZyXEL Device. Any IP The Any IP feature allows one comp uter to connect to the ZyXEL De vice (and then to other computers) when their[...]

Appendix A Product Specifications and Wa ll Mounting P-660HW-Dx User’s Guide 268 RFC 1305 Network T ime Protocol (NTP version 3) RFC 1441 SNMPv2 Simple Network Management Protocol version 2 RFC 1483 Multiprotocol Encapsulation over A TM Adap tation Layer 5 RFC 1631 IP Network Address Translator (NA T) RFC 1661 The Point-to-Point Protocol (PPP) RF[...]

Appendix A Product Specifications and Wall Mounting P-660HW-Dx User’s Guide 269 W all-mounting Instructions Complete the following step s to hang your ZyXEL Device on a wall. " See the Hardware S pecifications table for the s ize of screws to use and how far ap art to place them. 1 Select a high position on a sturdy wa ll that is free of obs[...]

Appendix A Product Specifications and Wa ll Mounting P-660HW-Dx User’s Guide 270 Figure 151 Masonry Plug and M4 T ap Screw[...]

P-660HW-Dx User’s Guide 271 A PPENDIX B W ireless LANs Wireless LAN T opologies This section discusses ad-hoc and in frastructure w ireless LAN topologies. Ad-hoc Wireless LAN Configuration The simplest WLAN configuration is an inde pendent (Ad-hoc) WLAN that connects a se t of computers with wireless adapters (A, B, C). An y time two or more wir[...]

Appendix B Wireless LANs P-660HW-Dx User’s Guide 272 Figure 153 Basic Service Set ESS An Extended Service Set (ESS) consists of a series of overlappi ng BSSs, each containing an access point, with each access point connected together by a wired network. This wired connection between APs is called a Distribution System (DS). This type of wireless [...]

Appendix B Wir eless LANs P-660HW-Dx User’s Guide 273 Figure 154 Infrastructure WLAN Channel A channel is the radio frequency(ies) used by wireless devices to transmit and receive data. Channels available depend on your g eographical area. Y ou may have a choice of channels (for your region) so you should use a channel different from an adjacent [...]

Appendix B Wireless LANs P-660HW-Dx User’s Guide 274 Figure 155 RTS/ CT S When station A sends data to the AP , it might not know that the station B is already using the channel. If these two stations se nd data at the same time, collis ions may occur when both sets of data arrive at the AP at the same time, r esulting in a loss of me ssages for [...]

Appendix B Wir eless LANs P-660HW-Dx User’s Guide 275 If the Fragmentation Threshold value is smaller than the RT S / C T S value (see previously) you set then the R TS (Request T o Send)/CTS (Clear to Send) handshake will never occur as data frames will be fragmen ted before they reach R TS/CTS size. Preamble T ype Preamble is used to signal tha[...]

Appendix B Wireless LANs P-660HW-Dx User’s Guide 276 W ireless security methods availabl e on the ZyXEL Device are data encryption, wireless client authentication, restricting access by devi ce MAC address and hiding the ZyXEL Device identity . The following figure shows th e relative effectiveness of th ese wireless security methods available on[...]

Appendix B Wir eless LANs P-660HW-Dx User’s Guide 277 Determines the network services available to authenticated users once they are connected to the network. • Accounting Keeps track of the client’ s network activity . RADIUS is a simple package exchange in whic h your AP acts as a message rela y between the wireless client and the network R[...]

Appendix B Wireless LANs P-660HW-Dx User’s Guide 278 For EAP-TLS authentication type, you must firs t hav e a wired connection to the network and obtain the certificate(s) from a certificate authorit y (CA). A certificate (als o called digital IDs) can be used to authenticate users and a CA issu es certificates and guar antees the identity of eac[...]

Appendix B Wir eless LANs P-660HW-Dx User’s Guide 279 Dynamic WEP Key Exchange The AP maps a unique ke y that is generated w ith the RADIUS se rver . This key expires when the wireless connection times out, disconnects or reauthentic ation times out. A new WEP key is generated each time r eauthentication is performed. If this feature is enabled, [...]

Appendix B Wireless LANs P-660HW-Dx User’s Guide 280 Encryption Both WP A and WP A2 improve data encryption by using T emporal Key Integrity Protocol (TKIP), Message Integrity Check (MIC) and IE EE 802.1x. WP A and WP A2 use Advanced Encryption S tandard (AES) in the Counter mode with Cipher block chaining Message authentication code Protocol (CC[...]

Appendix B Wir eless LANs P-660HW-Dx User’s Guide 281 Wireless Client WP A Supp licant s A wireless client supplicant is the software that runs on an operating system instructing the wireless client how to use WP A. At the time of writing, the most widely available supplicant is the WP A patch for W indows XP , Funk Software's Odyssey client[...]

Appendix B Wireless LANs P-660HW-Dx User’s Guide 282 3 The AP and wireless clients generate a common PMK (Pairwise Master Key). The key itself is not sent over the network, but is derived from the PSK and the SSID. 4 The AP and wireless clients use the TKIP or AES encryption process, the PMK and information exchanged in a handshake to create temp[...]

Appendix B Wir eless LANs P-660HW-Dx User’s Guide 283 Antenna Overview An antenna couples RF signals onto air . A tran smitter within a wireless device sends an RF signal to the antenna, which propagates the signal through the air . The antenna also operates in reverse by capturing RF signals fro m the air . Positioning the antennas properly incr[...]

Appendix B Wireless LANs P-660HW-Dx User’s Guide 284 Positioning Antennas In general, antennas should be mounted as high as practically possible and free of obstructions. In point-to–point ap plication, position both antennas at the same height and in a direct line of si ght to each othe r to attain the best performance. For omni-directional an[...]

P-660HW-Dx User’s Guide 285 A PPENDIX C Setting up Y our Computer ’ s IP Address All computers must have a 10M or 100M Et hernet adapter card and TCP/IP installed. W indows 95/98/Me/NT/2000/XP , Macintosh OS 7 and later operating systems and all versions of UNIX/LINUX include the software components you need to install and use TCP/ IP on your c[...]

Appendix C Setting up Your Computer’s IP Address P-660HW-Dx User’s Guide 286 Figure 158 WIndows 95/98 /Me: Networ k: Configuratio n Inst alling Components The Network window Configuration tab displays a list of installed components. Y ou need a network adapter , the TCP/IP protocol and Client for Microsoft Netwo rks. If you need the adapter: 1 [...]

Appendix C Setting up Your Computer’s IP Address P-660HW-Dx User’s Guide 287 Configuring 1 In the Network window Configuration tab, select your network adapter's TCP/IP entry and click Properties 2 Click the IP Address tab. • If your IP address is dynamic, select Obtain an IP address automatically . • If you have a static IP address, s[...]

Appendix C Setting up Your Computer’s IP Address P-660HW-Dx User’s Guide 288 Figure 160 Windows 95/98/Me : TCP/IP Pr operties: DNS Configuration 4 Click the Gateway tab. • If you do not know you r gateway’ s IP addr ess, remove previously installed gateways. • If you have a gateway IP address, type it in the New gateway field and click Ad[...]

Appendix C Setting up Your Computer’s IP Address P-660HW-Dx User’s Guide 289 Figure 161 Windows XP: S tart Menu 2 In the Control Panel , double-click Network Connections ( Network and Dial-up Connections in W indow s 2000/NT). Figure 162 Windows XP: Control Panel 3 Right-click Local Area Connection and then click Pr operties .[...]

Appendix C Setting up Your Computer’s IP Address P-660HW-Dx User’s Guide 290 Figure 163 Windows XP: Control Panel: Network Connections: Pro perties 4 Select Internet Protocol (TCP/IP) (under the Genera l tab in W in XP) and then click Properties . Figure 164 Windows XP: Local Area Conne ction Properties 5 The Internet Protocol TCP/IP Pr opertie[...]

Appendix C Setting up Your Computer’s IP Address P-660HW-Dx User’s Guide 291 Figure 165 Windows XP: Internet Protocol (TCP/IP) Propert ies 6 If you do not know your gateway's IP ad dress, remove any previously installed gateways in the IP Settings tab and click OK . Do one or more of the fo llowing if you want to configure additi onal IP a[...]

Appendix C Setting up Your Computer’s IP Address P-660HW-Dx User’s Guide 292 Figure 166 Windows XP: Advanced TCP/IP Properties 7 In the Internet Protocol TCP/IP Pr operties window (the General tab in W indows XP): • Click Obtain DNS server address automatically if yo u do not know your DNS server IP address(es). • If you know your DNS serve[...]

Appendix C Setting up Your Computer’s IP Address P-660HW-Dx User’s Guide 293 Figure 167 Windows XP: Internet Protocol (TCP/IP) Propert ies 8 Click OK to close the Internet Protocol (TCP/IP) Properties window . 9 Click Close ( OK in W i ndows 2000/NT) to close the Local Area Connecti o n Properties window . 10 Close the Network Connections w ind[...]

Appendix C Setting up Your Computer’s IP Address P-660HW-Dx User’s Guide 294 Figure 168 Macintosh OS 8/9: Apple Menu 2 Select Ethernet built-in from the Connect via list. Figure 169 Macintosh O S 8/9: TC P/IP 3 For dynamically assigned settings, select Using DHCP Server from the Configure: list. 4 For statically assigned settings, do the follow[...]

Appendix C Setting up Your Computer’s IP Address P-660HW-Dx User’s Guide 295 • T ype your IP address in the IP Address box. • T ype your subnet mask in the Subnet mask box. • T ype the IP address of your ZyXEL Device in the Router address box. 5 Close the TCP/IP Contr ol Panel . 6 Click Save if prompted, to save chan ges to your configura[...]

Appendix C Setting up Your Computer’s IP Address P-660HW-Dx User’s Guide 296 Figure 171 Macintosh O S X: Netw ork 4 For statically assigned settings, do the following: •F r o m t h e Configure box, select Manually . • T ype your IP address in the IP Address box. • T ype your subnet mask in the Subnet mask box. • T ype the IP address of [...]

Appendix C Setting up Your Computer’s IP Address P-660HW-Dx User’s Guide 297 " Make sure you are logged in as the root administrator . Using the K Desktop Environment (KDE) Follow the steps below to configure your computer IP address using the KDE. 1 Click the Red Hat button (located on the bottom left corner), select System Setting and cl[...]

Appendix C Setting up Your Computer’s IP Address P-660HW-Dx User’s Guide 298 • If you have a dynamic IP address click Automatically obtain IP address settings with and select dhcp from the drop down list. • If you have a static IP address click S tatically set IP Addresses and fill in the Address , Sub net mask , and Default Gateway Address[...]

Appendix C Setting up Your Computer’s IP Address P-660HW-Dx User’s Guide 299 Figure 176 Red Hat 9.0: Dynamic IP Address Setting in ifconfig-eth0 • If you have a static IP address, enter static in t he BOOTPROTO= field. T ype IPADDR = followed by the IP address (in do tted decimal notation) and type NETMASK = followed by the subnet mask. The f[...]

Appendix C Setting up Your Computer’s IP Address P-660HW-Dx User’s Guide 300 V erifying Settings Enter ifconfig in a terminal screen to ch eck your TCP/IP properties. Figure 180 Red Hat 9.0: Checking TCP/IP Properties [root@localhost]# ifconfig eth0 Link encap:Ethernet HWadd r 00:50:BA:72:5B:44 inet addr:172.23.19.129 B cast:172.23.19.255 Mask:[...]

P-660HW-Dx User’s Guide 301 A PPENDIX D IP Addresses and Subnetting This appendix introduces IP addresses and subnet masks. IP addresses identify ind ividual devices on a network. Every networking device (includin g computers, servers, routers, printe rs, etc.) ne eds an IP address to communicate across the network. These networking devices a re [...]

Appendix D IP Addresses a nd Subnetting P-660HW-Dx User’s Guide 302 Figure 181 Network Number and Host ID How much of the IP address is the network number and how much is the host ID varies according to the s ubnet mask. Subnet Masks A subnet mask is used to dete rmine which bits are part of th e network number , and which bits are part of the ho[...]

Appendix D IP Addresses and Subnetting P-660HW-Dx User’s Guide 303 Subnet masks are expressed in dotted decimal no tation just like IP addresses. The follow ing examples show the binary and decimal not ation for 8-bit, 16-bit, 24-bit an d 29-bit subnet masks. Network Size The size of the network number determines the maximum number of po ssible h[...]

Appendix D IP Addresses a nd Subnetting P-660HW-Dx User’s Guide 304 Subnetting Y ou can use subnetting to divide one network into multiple sub-networks. In the foll owing example a network administrator creates two sub-networks to isolate a group of servers from the rest of the c ompany network for security reasons. In this example, the company n[...]

Appendix D IP Addresses and Subnetting P-660HW-Dx User’s Guide 305 Figure 183 Subnetting Example: Af ter Subnetting In a 25-bit subnet the host ID has 7 bits , so each sub-network has a maximum of 2 7 – 2 or 126 possible hosts (a host ID of all zeroes is the subnet’ s address itself, all ones is the subnet’ s broadcast address). 192.168.1.0[...]

Appendix D IP Addresses a nd Subnetting P-660HW-Dx User’s Guide 306 Example: Eight Subnet s Similarly , use a 27-bit mask to create eight subnets (000, 00 1, 010, 01 1, 100, 101, 1 10 and 111 ) . The following table shows IP address last octet values for each subnet. T able 130 Subnet 2 IP/SUBNET MASK NETWORK NUMBER LAST O CTET BIT VA L U E IP Ad[...]

Appendix D IP Addresses and Subnetting P-660HW-Dx User’s Guide 307 Subnet Planning The following table is a summary for su bnet planning on a network with a 24-bit network number . The following table is a summary for su bnet planning on a network with a 16-bit network number . 5 128 129 158 159 6 160 161 190 191 7 192 193 222 223 8 224 225 254 2[...]

Appendix D IP Addresses a nd Subnetting P-660HW-Dx User’s Guide 308 Configuring IP Addresses Where you obtain your netwo rk number depends on your particular situation. If the ISP or your network administrator assigns yo u a bloc k of registered IP addresses, follow their instructions in selecting the IP addresses and the subnet mask. If the ISP [...]

P-660HW-Dx User’s Guide 309 A PPENDIX E Firewall Commands The following describes the firewall commands. T able 136 Firewall Commands FUNCTION COMMAND DESCRIPTION Firewall SetUp config edit firewall active <yes | no> This command turns the firewall on or off. config retrieve firewall This c ommand return s the previously saved firewall se t[...]

Appendix E Firewall Commands P-660HW-Dx User’s Guide 310 Edit E-mail config edit firewall e-mail mail-server <ip address of mail server> This command set s the IP address to which the e-mail messages are sent. config edit firewall e-mail return-addr <e-mail address> This command sets the source e-mail address of the firewall e-mails. [...]

Appendix E Firewall Commands P-660HW-Dx User’s Guide 31 1 config edit firewall attack minute-high <0-255> This command sets the threshold rate of new half-open sessions per min ute where the ZyXEL Device starts deleting old half-opene d sessions until it gets them down to the minute-low threshold . config edit firewall attack minute-low <[...]

Appendix E Firewall Commands P-660HW-Dx User’s Guide 312 Config edit firewall set <set #> tcp-idle-timeout <seconds> This command sets how long ZyXEL Device lets an inactive TCP connection remai n open before considering it closed. Config edit firewall set <set #> log <yes | no> This command sets whether or not th e ZyXEL [...]

Appendix E Firewall Commands P-660HW-Dx User’s Guide 313 config edit firewall set <set #> rule <rule #> destaddr- single <ip address> This command sets the rule to have the ZyXEL Device check for traf fic with this individual destination add ress. config edit firewall set <set #> rule <rule #> destaddr- subnet <ip[...]

Appendix E Firewall Commands P-660HW-Dx User’s Guide 314 config delete firewall set <set #> rule<rule #> This command removes th e specified rule in a firewall co nfiguration set. T able 136 Firewall Commands (continued) FUNCTION COMMAND DESCRIPTION[...]

P-660HW-Dx User’s Guide 315 A PPENDIX F Internal SPTGEN This appendix introduces Internal SP TGEN. A ll menus shown in this appendix are example menus meant to show SP TGEN usage. Actual menu s for your product may differ . Internal SPTGEN Overview Internal SP TGEN (System Parame ter T able Generator) is a configuration text file useful for effic[...]

Appendix F Internal SPTGEN P-660HW-Dx User’s Guide 316 " DO NOT alter or delete a ny field except parameters in the Input column. This appendix introduces Internal SP TGEN. A ll menus shown in this appendix are example menus meant to show SP TGEN usage. Actual menu s for your product may differ . Internal SPTGEN File Modification - Importa n[...]

Appendix F I nternal SPTG EN P-660HW-Dx User’s Guide 317 Figure 187 Internal SPTGEN FTP Download Example " Y ou can rename your “ rom-t ” file when you save it to your computer bu t it must be named “ rom-t ” when you upload it to your ZyXEL Device. Internal SPTGEN FTP Upload Example 1 Launch your FTP application. 2 Enter " bin [...]

Appendix F Internal SPTGEN P-660HW-Dx User’s Guide 318 Example Internal SPTGEN Menus This section provides example Internal SP TGEN menus. T able 137 Abbreviations Used in the Example Inte rnal SPTGEN Screens Table ABBREVIA TION MEAN ING FIN Field Identification Number FN Field Name PV A Parameter V alues Allowed INPUT An example of what you may [...]

Appendix F I nternal SPTG EN P-660HW-Dx User’s Guide 319 / Menu 3.2 TCP/IP and DHCP Ethernet Setup FIN FN PVA INPUT 30200001 = DHCP <0(None) | 1(Server) | 2(Relay)> = 0 30200002 = Client IP Pool Starting Address = 192.168.1.33 30200003 = Size of C lient IP Pool = 32 30200004 = Primary D NS Server = 0.0.0.0 30200005 = Secondary DNS Server = [...]

Appendix F Internal SPTGEN P-660HW-Dx User’s Guide 320 30201008 = IP Alias #1 Incoming protocol filters Set 3 = 256 30201009 = IP Alias #1 Incoming protocol filters Set 4 = 256 30201010 = IP Alias #1 Outgoing protocol filters Set 1 = 256 30201011 = IP Alias #1 Outgoing protocol filters Set 2 = 256 30201012 = IP Alias #1 Outgoing protocol filters [...]

Appendix F I nternal SPTG EN P-660HW-Dx User’s Guide 321 40000001 = ISP <0(No) | 1(Yes)> = 1 40000002 = Active <0(No) | 1(Yes)> = 1 40000003 = ISP's Name = ChangeMe 40000004 = Encapsulation <2(PPPOE) | 3(RFC 1483)| 4(PPPoA )| 5(ENET ENCAP)> = 2 40000005 = Multiplexing <1(LLC-based) | 2(VC-based) = 1 40000006 = VPI # = 0 [...]

Appendix F Internal SPTGEN P-660HW-Dx User’s Guide 322 40000031= RIP Direction <0(None) | 1(Both) | 2(In Only) | 3(Out Only)> = 0 40000032= RIP Version <0(Rip-1) | 1(Rip-2B) |2(Rip-2M)> = 0 40000033= Nailed-up Connection <0(No) |1(Yes)> = 0 T able 140 Menu 4 Internet Access Setup (continued) T able 141 Menu 12 / Menu 12.1.1 IP S[...]

Appendix F I nternal SPTG EN P-660HW-Dx User’s Guide 323 150000004 = SUA Server #2 Port Start = 0 150000005 = SUA Server #2 Port End = 0 150000006 = SUA Server #2 Local IP address = 0.0.0.0 150000007 = SUA Server #3 Active <0(No) | 1( Yes)> = 0 150000008 = SUA Server #3 Protocol <0(All)|6(TCP)|17(U DP)> = 0 150000009 = SUA Server #3 P[...]

Appendix F Internal SPTGEN P-660HW-Dx User’s Guide 324 150000038 = SUA Server #9 Protocol <0(All)|6(TCP)|17(U DP)> = 0 150000039 = SUA Server #9 Port Start = 0 150000040 = SUA Server #9 Port End = 0 150000041 = SUA Server #9 Local IP address = 0.0.0.0 150000042 = SUA Server #10 Active <0(No) | 1(Yes)> = 0 150000043 = SUA Server #10 Pr[...]

Appendix F I nternal SPTG EN P-660HW-Dx User’s Guide 325 210101009 = IP Filter Set 1,Rule 1 Src Subnet Mask = 0 210101010 = IP Filter Set 1,Rule 1 Src Port = 0 210101011 = IP Filter Set 1,Rule 1 Src Port Comp <0(none)|1(equal) |2(not equal)|3(less)|4( greater)> = 0 210101013 = IP Filter Set 1,Rule 1 Act Match <1(check next)|2(forward)| 3[...]

Appendix F Internal SPTGEN P-660HW-Dx User’s Guide 326 FIN FN PVA INPUT 210201001 = IP Filter Set 2, Rule 1 Type <0(none)|2(TCP/ IP)> = 2 210201002 = IP Filter Set 2, Rule 1 Activ e <0(No)|1( Yes)> = 1 210201003 = IP Filter Set 2, Rule 1 Proto col = 6 210201004 = IP Filter Set 2, Rule 1 Dest IP address = 0.0.0.0 210201005 = IP Filter [...]

Appendix F I nternal SPTG EN P-660HW-Dx User’s Guide 327 210202009 = IP Filter Set 2, Rule 2 Src Subnet Mask = 0 210202010 = IP Filter Set 2,Rule 2 Src Po rt = 0 210202011 = IP Filter Set 2, Rule 2 Src P ort Comp <0(none)|1(equal)| 2(not equal)|3(less)|4(g reater)> = 0 210202013 = IP Filter Set 2, Rule 2 Act M atch <1(check next)|2(forwa[...]

Appendix F Internal SPTGEN P-660HW-Dx User’s Guide 328 230400002 = ReAuthentication Timer (in second) = 555 230400003 = Idle Timeout (in second) = 999 230400004 = Authentication Databases <0(Local User Database Only) |1(RADIUS Only) |2(Local,RADIUS) |3(RADIUS,Local)> = 1 230400005 = Key Management Protocol <0(8021x) |1(WPA) |2(WPAPSK)>[...]

Appendix F I nternal SPTG EN P-660HW-Dx User’s Guide 329 Command Examples The following are example Internal SP TGEN screens associated with the ZyXEL Device’ s command interpreter commands. T able 147 Command Examples FIN FN PV A INPUT /ci command (for annex a): wan adsl openc md FIN FN PVA INPUT 990000001 = ADSL OPMD <0(glite)|1(t1.413 )|2[...]

Appendix F Internal SPTGEN P-660HW-Dx User’s Guide 330[...]

P-660HW-Dx User’s Guide 331 A PPENDIX G Command Interpreter The following describes how to u se the command interpreter . Y o u can telnet to access the CLI (Command Line Interface) on th e ZyXEL Device. See the includ ed disk or zyxel.com for more detailed informatio n on these commands. 1 Use of undocumented commands or misconfiguration can dam[...]

Appendix G Comm and Interprete r P-660HW-Dx User’s Guide 332[...]

P-660HW-Dx User’s Guide 333 A PPENDIX H Pop-up Windows, JavaScript s and Java Permissions In order to use the web configurator you need to allow: • W eb browser pop-up windows from your device. • JavaScripts (enabled by default). • Java permissions (enabled by default). " Internet Explorer 6 screens are u sed here. Screens for other In[...]

Appendix H Pop-up Windows, JavaScripts and Java Perm issions P-660HW-Dx User’s Guide 334 2 Clear the Block pop-ups check box in the Pop-up Block e r section of the screen. This disables any web po p-up blockers you may have enabled . Figure 190 Internet Options: Privacy 3 Click Apply to save this setting. Enable pop-up Blockers with Exceptions Al[...]

Appendix H Pop-up Windows, JavaScripts and Java Per m issions P-660HW-Dx User’s Guide 335 Figure 191 Internet Options: Privacy 3 T ype the IP address of your device (the web page that you do not want to have blocked) with the prefix “http://”. For example, http://192.168.167.1. 4 Click Add to move the IP address to the list of Allowed sites .[...]

Appendix H Pop-up Windows, JavaScripts and Java Perm issions P-660HW-Dx User’s Guide 336 5 Click Close to return to the Privacy screen. 6 Click Apply to save this setting. JavaScript s If pages of the web configura tor do not display properly in Internet Explorer , ch eck that JavaScripts are allowed. 1 In Internet Explorer , click T ools , Inter[...]

Appendix H Pop-up Windows, JavaScripts and Java Per m issions P-660HW-Dx User’s Guide 337 Figure 194 Security Settings - Java Scripting Java Permissions 1 From Internet Explorer , click To o l s , Internet Options and then the Security tab. 2 Click the Custom Level... button. 3 Scroll down to Microsoft VM . 4 Under Java permissions make sure that[...]

Appendix H Pop-up Windows, JavaScripts and Java Perm issions P-660HW-Dx User’s Guide 338 JA V A (Sun) 1 From Internet Explorer , click To o l s , Internet Options and then the Advanced tab. 2 Make sure that Use Java 2 for <applet> under Java (Sun) is sele cted. 3 Click OK to clos e the window . Figure 196 Java (Sun)[...]

P-660HW-Dx User’s Guide 339 A PPENDIX I NetBIOS Filter Commands The following describes the Ne tBIOS packet filter commands. Introduction NetBIOS (Network Basic Input/Output System ) are TCP or UDP broadcast packets that enable a computer to connect to and communicate with a LAN. For some dial-up services such as PPPoE or PP TP , NetBIOS packets [...]

Appendix I NetBIOS Filter Commands P-660HW-Dx User’s Guide 340 The filter types and their defa ult settings are as follows. NetBIOS Filter Configuration Syntax:sys filter netbios config <ty pe> <on|off> where T able 148 NetBIOS Filter Default Settings NAME DESCRIPTION EXAMPLE Between LAN and W AN This field displays whether NetBIOS pa[...]

P-660HW-Dx User’s Guide 341 A PPENDIX J S plitters and Microfilters This appendix tells you how to install a POTS splitter or a telephone microfilter . Connecting a POTS S plitter When you use the Full Rate (G .dmt) ADSL standard, you can use a POTS (Plain Old T elephone Service) splitter to separate th e telephone and ADSL si gnals. This allows [...]

Appendix J Splitters and Microfilters P-660HW-Dx User’s Guide 342 2 Connect a cable from the wall jack to the “wall side” of the microfilter . 3 Connect the “phone side” of the microfilte r to your telephone as shown in the following figure. 4 After you are done, make sur e that your telephon e works. If your telephone does not work, disc[...]

Appendix J Splitters and Microfilters P-660HW-Dx User’s Guide 343 ZyXEL Device With ISDN This section relates to people who use thei r ZyXEL Device with ADSL over ISDN (digital telephone service) only . The following is an ex ample installation for the ZyXEL Device with ISDN. Figure 200 ZyXEL Device with ISDN[...]

Appendix J Splitters and Microfilters P-660HW-Dx User’s Guide 344[...]

P-660HW-Dx User’s Guide 345 A PPENDIX K T r iangle Route The Ideal Setup When the firewall is on, your ZyXEL Device acts as a secure gateway between your LAN and the Internet. In an ideal network topology , a ll incoming a nd outgoing network traf fic passes through the ZyXEL Device to pr otect your LAN against attacks. Figure 201 Ideal Setup The[...]

Appendix K Triangle Route P-660HW-Dx User’s Guide 346 Figure 202 “T riangle Route” Prob lem The “T riangle Route” Solutions This section presents you two solutions to the “triangle route” problem. IP Aliasing IP alias allows you to partition your network into logical sections over the same Ethernet interface. Y our ZyXEL Device suppor[...]

P-660HW-Dx User’s Guide 347 A PPENDIX L Legal Information Copyright Copyright © 2007 by ZyXEL Communications Corporation. The contents of this publication may not be reprod uced in any part or as a whole, transcribed, stored in a retrieval system, tran slated into any language, or transmitted in any form or by any means, el ectronic, mechanical [...]

Appendix L Legal Information P-660HW-Dx User’s Guide 348 If this device does cause harmful inte rference to radio/television reception, which can be determined by turning th e device off and on, the user is enc ouraged to try to correct the interference by one or more of the following measures: 1 Reorient or relocate the receiving antenna. 2 Incr[...]

Appendix L Legal Information P-660HW-Dx User’s Guide 349 3 Select the certification you wish to view from this page. ZyXEL Limited W arranty ZyXEL warrants to the original en d user (purchaser) that this product is free from any defects in materials or workmansh ip for a period of up to two ye ars from the date of purchase. Du ring the warranty p[...]

Appendix L Legal Information P-660HW-Dx User’s Guide 350[...]

P-660HW-Dx User’s Guide 351 A PPENDIX M Customer Support Please have the following information r eady when you contact customer support. Required Information • Product model and serial number . • W arranty Information. • Date that you received your de vice. • Brief description of the problem and the steps you took to solv e it. “+” is[...]

Appendix M Custom er Support P-660HW-Dx User’s Guide 352 • Re g u l ar M a il : ZyXEL Communications, Czech s.r .o., Modranská 621, 143 01 Praha 4 - Modrany , Ceská Republika Denmark • Support E-mail: support@zyxel.dk • Sales E-mail: sales@zyxel.dk • T elephone: +45-39-55-07-00 • Fax: +45-39-55-07-07 • W eb: www .zyxel.dk • Re g u[...]

Appendix M Customer Support P-660HW-Dx User’s Guide 353 India • Support E-mail: support@zyxel.in • Sales E-mail: sales@zyxel.in • T elephone: +91-1 1-30888144 to +91 -11-308 88153 • Fax: +91-1 1-30888149, +91 -11-2 6810715 • W eb: http://www .zyxel.in • Re g u l a r M a i l: India - ZyXEL T echnology Indi a Pvt Ltd. , II - F l o or, F[...]

Appendix M Custom er Support P-660HW-Dx User’s Guide 354 • Re g u la r Ma i l : ZyXEL Communications Inc., 1 130 N. Miller St., Anaheim, CA 92806- 2001, U.S.A. Norway • Support E-mail: support@zyxel.no • Sales E-mail: sales@zyxel.no • T elephone: +47-22-80-61-80 • Fax: +47-22-80-61-81 • W eb: www .zyxel.no • Re g u la r M ai l : ZyX[...]

Appendix M Customer Support P-660HW-Dx User’s Guide 355 Sweden • Support E-mail: support@zyxel.se • Sales E-mail: sales@zyxel.se • T elephone: +46-31-744-7700 • Fax: +46-31-744-7701 • W eb: www .zyxel.se • Re g ul a r M a i l: ZyXEL Communications A/S, Sjö porten 4, 41764 Götebor g, Sweden Thailand • Support E-mail: support@zyxel.[...]

Appendix M Custom er Support P-660HW-Dx User’s Guide 356[...]

Index P-660HW-Dx User’s Guide 357 Index A AAL5 76 access point see AP Address Resolution Protocol see ARP ADSL standards 34 ADSL line reinitialize 258 ADSL standards 34 Advanced Encryption St andard See AES. AES 280 alerts 233 ALG 132 alternative subnet mask notation 303 antenna directional 283 gain 283 omni-directional 283 antenna gain 11 6 Any [...]

Index P-660HW-Dx User’s Guide 358 see CBR copyright 347 CoS 194 CTS (Clear to Send) 274 custom ports creating / editing 164 customer support 351 customized services 164 D date and time settings 229 default 255 default LAN IP address 37 default settings 253 , 25 4 Denial of Service see DoS destination address 157 detection 54 device model number 2[...]

Index P-660HW-Dx User’s Guide 359 rule logic 156 rule security ramifications 156 services 169 types 143 when to use 153 firmware 33 , 251 upgrade 251 upload 251 upload error 252 fragment ation threshold 274 FTP 67 , 134 , 20 4 , 207 restrictions 204 full rate 341 H half-open sessions 173 help 41 hidden node 27 3 hide SSID 106 host 228 , 229 host [...]

Index P-660HW-Dx User’s Guide 360 using the command interface. See command interface. maximize bandwidth usage 189 Maximum Burst Size see MBS max-incomplete high 173 max-incomplete low 173 MBS 79 , 83 , 88 media access cont rol see MAC Message Integrity Check (MIC) 280 metric 78 MIB 208 microfilter 341 multicast 96 multiplexing 76 LLC-based 76 VC[...]

Index P-660HW-Dx User’s Guide 361 remote management limitations 204 reset 255 reset button 40 resetting the ZyXEL device 40 restart 251 , 255 restore configuration 254 restore settings 254 RFC 1483 76 RFC 1631 129 RFC-1483 77 RFC-2364 76 RIP 96 Direction 96 Ve r s i o n 96 Routing Information Protocol see RIP RTS (Request T o Send) 274 threshold [...]

Index P-660HW-Dx User’s Guide 362 temperature 265 T emporal Key Integrity Protocol (TKIP) 280 TFTP restrictions 204 three-way handshake 146 threshold value s 172 time and date settings 229 timeout 204 tools 251 traceroute 148 trademarks 347 traffic redirect 89 , 91 , 267 traffic shaping 78 transmission rates 33 triangle route 345 solutions 346 U [...]

Index P-660HW-Dx User’s Guide 363 user authentication 280 vs WP A2-PSK 280 wireless client supplicant 281 with RADIUS application example 281 WP A2-Pre-Shared Key 279 WP A2-PSK 279 , 280 application example 281 WP A-PSK 279 , 280 application example 281 WWW 127 Z zero configuration Internet access 80 ZyXEL ’s firewall introduction 144[...]

Index P-660HW-Dx User’s Guide 364[...]