ZyXEL Communications 5 Series User Manual

User’s guide

Text mode
Original mode

ZyWALL 5/35/70 Series

Internet Security Appliance

User’s Guide

Version 4.01

7/2006

Edition 1

Table of contents

Document Outline

ZyWALL 5/35/70 Series
Copyright
Certifications
Safety Warnings
ZyXEL Limited Warranty
Customer Support
Table of Contents
List of Figures
List of Tables
Preface
Getting to Know Your ZyWALL
- 1.1 ZyWALL Internet Security Appliance Overview
- 1.2 ZyWALL Features
  - 1.2.1 Physical Features
  - 1.2.2 Non-Physical Features
- 1.3 Applications for the ZyWALL
Introducing the Web Configurator
- 2.1 Web Configurator Overview
- 2.2 Accessing the ZyWALL Web Configurator
- 2.3 Resetting the ZyWALL
  - 2.3.1 Procedure To Use The Reset Button
  - 2.3.2 Uploading a Configuration File Via Console Port
- 2.4 Navigating the ZyWALL Web Configurator
Wizard Setup
- 3.1 Wizard Setup Overview
- 3.2 Internet Access
- 3.3 VPN Wizard Gateway Setting
- 3.4 VPN Wizard Network Setting
- 3.5 VPN Wizard IKE Tunnel Setting (IKE Phase 1)
- 3.6 VPN Wizard IPSec Setting (IKE Phase 2)
- 3.7 VPN Wizard Status Summary
- 3.8 VPN Wizard Setup Complete
Tutorial
- 4.1 Security Settings for VPN Traffic
  - 4.1.1 IDP for From VPN Traffic Example
  - 4.1.2 IDP for To VPN Traffic Example
- 4.2 Firewall Rule for VPN Example
  - 4.2.1 Configuring the VPN Rule
  - 4.2.2 Configuring the Firewall Rules
Registration
- 5.1 myZyXEL.com overview
  - 5.1.1 Subscription Services Available on the ZyWALL
- 5.2 Registration
- 5.3 Service
LAN Screens
- 6.1 LAN, WAN and the ZyWALL
- 6.2 IP Address and Subnet Mask
  - 6.2.1 Private IP Addresses
- 6.3 DHCP
  - 6.3.1 IP Pool Setup
- 6.4 RIP Setup
- 6.5 Multicast
- 6.6 WINS
- 6.7 LAN
- 6.8 LAN Static DHCP
- 6.9 LAN IP Alias
- 6.10 LAN Port Roles
Bridge Screens
- 7.1 Bridge Loop
- 7.2 Spanning Tree Protocol (STP)
- 7.3 Bridge
- 7.4 Bridge Port Roles
WAN Screens
- 8.1 WAN Overview
- 8.2 Multiple WAN
- 8.3 Load Balancing Introduction
- 8.4 Load Balancing Algorithms
- 8.5 TCP/IP Priority (Metric)
- 8.6 WAN General
- 8.7 Configuring Load Balancing
- 8.8 WAN Route
- 8.9 WAN IP Address Assignment
- 8.10 DNS Server Address Assignment
- 8.11 WAN MAC Address
- 8.12 WAN
- 8.13 Traffic Redirect
- 8.14 Configuring Traffic Redirect
- 8.15 Configuring Dial Backup
- 8.16 Advanced Modem Setup
- 8.17 Configuring Advanced Modem Setup
DMZ Screens
- 9.1 DMZ
- 9.2 Configuring DMZ
- 9.3 DMZ Static DHCP
- 9.4 DMZ IP Alias
- 9.5 DMZ Public IP Address Example
- 9.6 DMZ Private and Public IP Address Example
- 9.7 DMZ Port Roles
Wireless LAN
- 10.1 Wireless LAN Introduction
  - 10.1.1 Additional Installation Requirements for Using 802.1x
- 10.2 Configuring WLAN
- 10.3 WLAN Static DHCP
- 10.4 WLAN IP Alias
- 10.5 WLAN Port Roles
- 10.6 Wireless Security
- 10.7 Security Parameters Summary
- 10.8 WEP Encryption
- 10.9 802.1x Overview
  - 10.9.1 Introduction to RADIUS
  - 10.9.2 EAP Authentication Overview
- 10.10 Dynamic WEP Key Exchange
- 10.11 Introduction to WPA
  - 10.11.1 User Authentication
  - 10.11.2 Encryption
- 10.12 WPA-PSK Application Example
- 10.13 Introduction to RADIUS
- 10.14 WPA with RADIUS Application Example
- 10.15 Wireless Client WPA Supplicants
- 10.16 Wireless Card
- 10.17 MAC Filter
Firewall
- 11.1 Firewall Overview
- 11.2 Packet Direction Matrix
- 11.3 Packet Direction Examples
- 11.4 Security Considerations
- 11.5 Firewall Rules Example
- 11.6 Asymmetrical Routes
  - 11.6.1 Asymmetrical Routes and IP Alias
- 11.7 Firewall Default Rule (Router Mode)
- 11.8 Firewall Default Rule (Bridge Mode)
- 11.9 Firewall Rule Summary
  - 11.9.1 Firewall Edit Rule
- 11.10 Anti-Probing
- 11.11 Firewall Thresholds
  - 11.11.1 Threshold Values
- 11.12 Threshold Screen
- 11.13 Service
  - 11.13.1 Firewall Edit Custom Service
- 11.14 My Service Firewall Rule Example
Intrusion Detection and Prevention (IDP)
- 12.1 Introduction to IDP
Configuring IDP
- 13.1 Overview
  - 13.1.1 Interfaces
- 13.2 General Setup
- 13.3 IDP Signatures
- 13.4 Update
  - 13.4.1 mySecurityZone
  - 13.4.2 Configuring IDP Update
- 13.5 Backup and Restore
Anti-Virus
- 14.1 Anti-Virus Overview
- 14.2 Introduction to the ZyWALL Anti-Virus Scanner
  - 14.2.1 How the ZyWALL Anti-Virus Scanner Works
  - 14.2.2 Notes About the ZyWALL Anti-Virus
- 14.3 General Anti-Virus Setup
- 14.4 Signature Searching
  - 14.4.1 Signature Search Example
- 14.5 Signature Update
  - 14.5.1 mySecurityZone
  - 14.5.2 Configuring Anti-virus Update
- 14.6 Backup and Restore
Anti-Spam
- 15.1 Anti-Spam Overview
- 15.2 Anti-Spam General Screen
- 15.3 Anti-Spam External DB Screen
- 15.4 Anti-Spam Lists Screen
- 15.5 Anti-Spam Lists Edit Screen
Content Filtering Screens
- 16.1 Content Filtering Overview
- 16.2 Content Filter General Screen
- 16.3 Content Filtering with an External Database
- 16.4 Content Filter Categories
- 16.5 Content Filter Customization
- 16.6 Customizing Keyword Blocking URL Checking
- 16.7 Content Filtering Cache
Content Filtering Reports
- 17.1 Checking Content Filtering Activation
- 17.2 Viewing Content Filtering Reports
- 17.3 Web Site Submission
IPSec VPN
- 18.1 IPSec VPN Overview
  - 18.1.1 IKE SA Overview
- 18.2 VPN Rules (IKE)
- 18.3 IKE SA Setup
  - 18.3.1 IKE SA Proposal
- 18.4 Additional IPSec VPN Topics
- 18.5 VPN Rules (IKE) Gateway Policy Edit
- 18.6 IPSec SA Overview
- 18.7 VPN Rules (IKE): Network Policy Edit
- 18.8 VPN Rules (IKE): Network Policy Move
- 18.9 IPSec SA Using Manual Keys
  - 18.9.1 IPSec SA Proposal Using Manual Keys
  - 18.9.2 Authentication and the Security Parameter Index (SPI)
- 18.10 VPN Rules (Manual)
- 18.11 VPN Rules (Manual): Edit
- 18.12 VPN SA Monitor
- 18.13 VPN Global Setting
- 18.14 Telecommuter VPN/IPSec Examples
  - 18.14.1 Telecommuters Sharing One VPN Rule Example
  - 18.14.2 Telecommuters Using Unique VPN Rules Example
- 18.15 VPN and Remote Management
- 18.16 Hub-and-spoke VPN
Certificates
- 19.1 Certificates Overview
  - 19.1.1 Advantages of Certificates
- 19.2 Self-signed Certificates
- 19.3 Verifying a Certificate
  - 19.3.1 Checking the Fingerprint of a Certificate on Your Computer
- 19.4 Configuration Summary
- 19.5 My Certificates
- 19.6 My Certificate Details
- 19.7 My Certificate Export
  - 19.7.1 Certificate File Export Formats
- 19.8 My Certificate Import
  - 19.8.1 Certificate File Formats
- 19.9 My Certificate Create
- 19.10 Trusted CAs
- 19.11 Trusted CA Details
- 19.12 Trusted CA Import
- 19.13 Trusted Remote Hosts
- 19.14 Trusted Remote Hosts Import
- 19.15 Trusted Remote Host Certificate Details
- 19.16 Directory Servers
- 19.17 Directory Server Add or Edit
Authentication Server
- 20.1 Authentication Server Overview
  - 20.1.1 Local User Database
  - 20.1.2 RADIUS
- 20.2 Local User Database
- 20.3 RADIUS
Network Address Translation (NAT)
- 21.1 NAT Overview
- 21.2 Using NAT
  - 21.2.1 SUA (Single User Account) Versus NAT
- 21.3 NAT Overview Screen
- 21.4 NAT Address Mapping
  - 21.4.1 NAT Address Mapping Edit
- 21.5 Port Forwarding
- 21.6 Port Forwarding Screen
- 21.7 Port Triggering
Static Route
- 22.1 IP Static Route
- 22.2 IP Static Route
  - 22.2.1 IP Static Route Edit
Policy Route
- 23.1 Policy Route
- 23.2 Benefits
- 23.3 Routing Policy
- 23.4 IP Routing Policy Setup
- 23.5 Policy Route Edit
Bandwidth Management
- 24.1 Bandwidth Management Overview
- 24.2 Bandwidth Classes and Filters
- 24.3 Proportional Bandwidth Allocation
- 24.4 Application-based Bandwidth Management
- 24.5 Subnet-based Bandwidth Management
- 24.6 Application and Subnet-based Bandwidth Management
- 24.7 Scheduler
- 24.8 Bandwidth Borrowing
  - 24.8.1 Bandwidth Borrowing Example
- 24.9 Maximize Bandwidth Usage With Bandwidth Borrowing
- 24.10 Over Allotment of Bandwidth
- 24.11 Configuring Summary
- 24.12 Configuring Class Setup
  - 24.12.1 Bandwidth Manager Class Configuration
  - 24.12.2 Bandwidth Management Statistics
- 24.13 Bandwidth Manager Monitor
DNS
- 25.1 DNS Overview
- 25.2 DNS Server Address Assignment
- 25.3 DNS Servers
- 25.4 Address Record
  - 25.4.1 DNS Wildcard
- 25.5 Name Server Record
  - 25.5.1 Private DNS Server
- 25.6 System Screen
  - 25.6.1 Adding an Address Record
  - 25.6.2 Inserting a Name Server Record
- 25.7 DNS Cache
- 25.8 Configure DNS Cache
- 25.9 Configuring DNS DHCP
- 25.10 Dynamic DNS
  - 25.10.1 DYNDNS Wildcard
  - 25.10.2 High Availability
- 25.11 Configuring Dynamic DNS
Remote Management
- 26.1 Remote Management Overview
  - 26.1.1 Remote Management Limitations
  - 26.1.2 System Timeout
- 26.2 WWW (HTTP and HTTPS)
- 26.3 WWW
- 26.4 HTTPS Example
- 26.5 SSH
- 26.6 How SSH Works
- 26.7 SSH Implementation on the ZyWALL
  - 26.7.1 Requirements for Using SSH
- 26.8 Configuring SSH
- 26.9 Secure Telnet Using SSH Examples
  - 26.9.1 Example 1: Microsoft Windows
  - 26.9.2 Example 2: Linux
- 26.10 Secure FTP Using SSH Example
- 26.11 Telnet
- 26.12 Configuring TELNET
- 26.13 FTP
- 26.14 SNMP
- 26.15 DNS
- 26.16 Introducing Vantage CNM
- 26.17 Configuring CNM
UPnP
- 27.1 Universal Plug and Play Overview
- 27.2 Configuring UPnP
- 27.3 Displaying UPnP Port Mapping
- 27.4 Installing UPnP in Windows Example
  - 27.4.1 Installing UPnP in Windows Me
  - 27.4.2 Installing UPnP in Windows XP
- 27.5 Using UPnP in Windows XP Example
  - 27.5.1 Auto-discover Your UPnP-enabled Network Device
  - 27.5.2 Web Configurator Easy Access
ALG Screen
- 28.1 ALG Introduction
- 28.2 FTP
- 28.3 H.323
- 28.4 RTP
  - 28.4.1 H.323 ALG Details
- 28.5 SIP
- 28.6 ALG Screen
Reports
- 29.1 Configuring Reports
- 29.2 System Reports Screen
- 29.3 IDP Threat Reports Screen
- 29.4 Anti-Virus Threat Reports Screen
- 29.5 Anti-Spam Threat Reports Screen
Logs Screens
- 30.1 Configuring View Log
- 30.2 Log Description Example
  - 30.2.1 About the Certificate Not Trusted Log
- 30.3 Configuring Log Settings
  - 30.3.1 Log Descriptions
- 30.4 Syslog Logs
Maintenance
- 31.1 Maintenance Overview
- 31.2 General Setup and System Name
  - 31.2.1 General Setup
- 31.3 Configuring Password
- 31.4 Time and Date
- 31.5 Pre-defined NTP Time Server Pools
  - 31.5.1 Resetting the Time
  - 31.5.2 Time Server Synchronization
- 31.6 Introduction To Transparent Bridging
- 31.7 Transparent Firewalls
- 31.8 Configuring Device Mode (Router)
- 31.9 Configuring Device Mode (Bridge)
- 31.10 F/W Upload Screen
- 31.11 Backup and Restore
- 31.12 Restart Screen
Introducing the SMT
- 32.1 Introduction to the SMT
- 32.2 Accessing the SMT via the Console Port
  - 32.2.1 Initial Screen
  - 32.2.2 Entering the Password
- 32.3 Navigating the SMT Interface
  - 32.3.1 Main Menu
  - 32.3.2 SMT Menus Overview
- 32.4 Changing the System Password
- 32.5 Resetting the ZyWALL
SMT Menu 1 - General Setup
- 33.1 Introduction to General Setup
- 33.2 Configuring General Setup
  - 33.2.1 Configuring Dynamic DNS
WAN and Dial Backup Setup
- 34.1 Introduction to WAN and Dial Backup Setup
- 34.2 WAN Setup
- 34.3 Dial Backup
- 34.4 Configuring Dial Backup in Menu 2
- 34.5 Advanced WAN Setup
- 34.6 Remote Node Profile (Backup ISP)
- 34.7 Editing PPP Options
- 34.8 Editing TCP/IP Options
- 34.9 Editing Login Script
- 34.10 Remote Node Filter
LAN Setup
- 35.1 Introduction to LAN Setup
- 35.2 Accessing the LAN Menus
- 35.3 LAN Port Filter Setup
- 35.4 TCP/IP and DHCP Ethernet Setup Menu
  - 35.4.1 IP Alias Setup
Internet Access
- 36.1 Introduction to Internet Access Setup
- 36.2 Ethernet Encapsulation
- 36.3 Configuring the PPTP Client
- 36.4 Configuring the PPPoE Client
- 36.5 Basic Setup Complete
DMZ Setup
- 37.1 Configuring DMZ Setup
- 37.2 DMZ Port Filter Setup
- 37.3 TCP/IP Setup
  - 37.3.1 IP Address
  - 37.3.2 IP Alias Setup
Route Setup
- 38.1 Configuring Route Setup
- 38.2 Route Assessment
- 38.3 Traffic Redirect
- 38.4 Route Failover
Wireless Setup
- 39.1 Wireless LAN Setup
  - 39.1.1 MAC Address Filter Setup
- 39.2 TCP/IP Setup
  - 39.2.1 IP Address
  - 39.2.2 IP Alias Setup
Remote Node Setup
- 40.1 Introduction to Remote Node Setup
- 40.2 Remote Node Setup
- 40.3 Remote Node Profile Setup
- 40.4 Edit IP
- 40.5 Remote Node Filter
- 40.6 Traffic Redirect
IP Static Route Setup
- 41.1 IP Static Route Setup
Network Address Translation (NAT)
- 42.1 Using NAT
  - 42.1.1 SUA (Single User Account) Versus NAT
  - 42.1.2 Applying NAT
- 42.2 NAT Setup
  - 42.2.1 Address Mapping Sets
- 42.3 Configuring a Server behind NAT
- 42.4 General NAT Examples
- 42.5 Trigger Port Forwarding
  - 42.5.1 Two Points To Remember About Trigger Ports
Introducing the ZyWALL Firewall
- 43.1 Using ZyWALL SMT Menus
  - 43.1.1 Activating the Firewall
Filter Configuration
- 44.1 Introduction to Filters
  - 44.1.1 The Filter Structure of the ZyWALL
- 44.2 Configuring a Filter Set
- 44.3 Example Filter
- 44.4 Filter Types and NAT
- 44.5 Firewall Versus Filters
  - 44.5.1 Packet Filtering:
  - 44.5.2 Firewall
- 44.6 Applying a Filter
SNMP Configuration
- 45.1 SNMP Configuration
- 45.2 SNMP Traps
System Information & Diagnosis
- 46.1 Introduction to System Status
- 46.2 System Status
- 46.3 System Information and Console Port Speed
  - 46.3.1 System Information
  - 46.3.2 Console Port Speed
- 46.4 Log and Trace
- 46.5 Diagnostic
  - 46.5.1 WAN DHCP
Firmware and Configuration File Maintenance
- 47.1 Introduction
- 47.2 Filename Conventions
- 47.3 Backup Configuration
- 47.4 Restore Configuration
- 47.5 Uploading Firmware and Configuration Files
System Maintenance Menus 8 to 10
- 48.1 Command Interpreter Mode
  - 48.1.1 Command Syntax
  - 48.1.2 Command Usage
- 48.2 Call Control Support
  - 48.2.1 Budget Management
  - 48.2.2 Call History
- 48.3 Time and Date Setting
Remote Management
- 49.1 Remote Management
  - 49.1.1 Remote Management Limitations
IP Policy Routing
- 50.1 IP Routing Policy Summary
- 50.2 IP Routing Policy Setup
  - 50.2.1 Applying Policy to Packets
- 50.3 IP Policy Routing Example
Call Scheduling
- 51.1 Introduction to Call Scheduling
Troubleshooting
- 52.1 Problems Starting Up the ZyWALL
- 52.2 Problems with the LAN Interface
- 52.3 Problems with the DMZ Interface
- 52.4 Problems with the WAN Interface
- 52.5 Problems Accessing the ZyWALL
  - 52.5.1 Pop-up Windows, JavaScripts and Java Permissions
- 52.6 Packet Flow
Product Specifications
Hardware Installation
Removing and Installing a Fuse
Setting up Your Computer’s IP Address
IP Addresses and Subnetting
Common Services
Wireless LANs
Windows 98 SE/Me Requirements for Anti-Virus Message Display
VPN Setup
Importing Certificates
Command Interpreter
Firewall Commands
NetBIOS Filter Commands
Certificates Commands
Brute-Force Password Guessing Protection
Boot Commands
Index
- Numerics
- A
- B
- C
- D
- E
- F
- G
- H
- I
- J
- L
- M
- N
- O
- P
- Q
- R
- S
- T
- U
- V
- W
- X
- Z