ZyXEL Communications Internet Security Appliance ZyWALL5UTM 4.0 User Manual

User’s guide

Text mode
Original mode

ZyWALL 5/35/70 Series

Internet Security Appliance

User’s Guide

Version 4.00

10/2005

Table of contents

Document Outline

ZyWALL 5/35/70 User's Guide
Copyright
Federal Communications Commission (FCC) Interference Statement
Safety Warnings
ZyXEL Limited Warranty
Customer Support
Table of Contents
List of Figures
List of Tables
Preface
1. Getting to Know Your ZyWALL
- 1.1 ZyWALL Internet Security Appliance Overview
- 1.2 ZyWALL Features
  - 1.2.1 Physical Features
  - 1.2.2 Non-Physical Features
- 1.3 Applications for the ZyWALL
2. Introducing the Web Configurator
- 2.1 Web Configurator Overview
- 2.2 Accessing the ZyWALL Web Configurator
- 2.3 Resetting the ZyWALL
  - 2.3.1 Procedure To Use The Reset Button
  - 2.3.2 Uploading a Configuration File Via Console Port
- 2.4 Navigating the ZyWALL Web Configurator
  - 2.4.3 Navigation Panel
3. Wizard Setup
- 3.1 Wizard Setup Overview
  - 3.2.1 ISP Parameters
4. Registration
- 4.1 myZyXEL.com overview
  - 4.1.1 Subscription Services Available on the ZyWALL
5. LAN Screens
- 5.1 LAN Overview
- 5.2 DHCP Setup
  - 5.2.1 IP Pool Setup
- 5.3 LAN TCP/IP
- 5.4 DNS Servers
6. Bridge Screens
- 6.1 Bridge Loop
- 6.2 Spanning Tree Protocol (STP)
7. WAN Screens
- 7.1 WAN Overview
- 7.2 Multiple WAN
- 7.3 Load Balancing Introduction
- 7.4 Load Balancing Algorithms
- 7.5 TCP/IP Priority (Metric)
- 7.7 Configuring Load Balancing
- 7.9 WAN IP Address Assignment
- 7.10 DNS Server Address Assignment
- 7.11 WAN MAC Address
- 7.14 Configuring Traffic Redirect
- 7.17 Configuring Advanced Modem Setup
8. DMZ Screens
- 8.2 Configuring DMZ
- 8.5 DMZ Public IP Address Example
- 8.6 DMZ Private and Public IP Address Example
9. Wireless LAN
- 9.1 Wireless LAN Introduction
  - 9.1.1 Additional Installation Requirements for Using 802.1x
- 9.6 Wireless Security
- 9.7 Security Parameters Summary
- 9.8 WEP Encryption
- 9.9 802.1x Overview
  - 9.9.1 Introduction to RADIUS
    - 9.9.1.1 Types of RADIUS Messages
  - 9.9.2 EAP Authentication Overview
- 9.10 Dynamic WEP Key Exchange
- 9.11 Introduction to WPA
  - 9.11.1 User Authentication
  - 9.11.2 Encryption
- 9.12 WPA-PSK Application Example
- 9.13 Introduction to RADIUS
- 9.14 WPA with RADIUS Application Example
- 9.15 Wireless Client WPA Supplicants
10. Firewalls
- 10.1 Firewall Overview
- 10.2 Types of Firewalls
- 10.3 Introduction to ZyXEL’s Firewall
- 10.4 Denial of Service
  - 10.4.1 Basics
  - 10.4.2 Types of DoS Attacks
- 10.5 Stateful Inspection
- 10.6 Guidelines For Enhancing Security With Your Firewall
- 10.7 Packet Filtering Vs Firewall
  - 10.7.1 Packet Filtering:
    - 10.7.1.1 When To Use Filtering
  - 10.7.2 Firewall
    - 10.7.2.1 When To Use The Firewall
11. Firewall Screens
- 11.1 Access Methods
- 11.2 Firewall Policies Overview
- 11.3 Rule Logic Overview
- 11.4 Connection Direction Examples
  - 11.4.1 LAN To WAN Rules
  - 11.4.2 WAN To LAN Rules
- 11.5 Alerts
- 11.12 Example Firewall Rule
12. Intrusion Detection and Prevention (IDP)
- 12.1 Introduction to IDP
13. Configuring IDP
- 13.1 Overview
  - 13.1.1 Interfaces
- 13.2 General Setup
14. Anti-Virus
- 14.1.1 Types of Computer Viruses
- 14.1.2 Computer Virus Infection and Prevention
- 14.1.3 Types of Anti-Virus Scanner
- 14.2 Introduction to the ZyWALL Anti-Virus Scanner
  - 14.2.1 How the ZyWALL Anti-Virus Scanner Works
  - 14.2.2 Notes About the ZyWALL Anti-Virus
- 14.3 General Anti-Virus Setup
  - 14.4.1 mySecurity Zone
  - 14.4.2 Configuring Anti-virus Update
15. Anti-Spam
- 15.1.1 Anti-Spam External Database
- 15.1.2 Spam Threshold
- 15.1.3 Phishing
- 15.1.4 Whitelist
- 15.1.5 Blacklist
- 15.1.6 SMTP and POP3
- 15.1.7 MIME Headers
- 15.2 Anti-Spam General Screen
16. Content Filtering Screens
- 16.1 Content Filtering Overview
- 16.3 Content Filtering with an External Database
- 16.6 Customizing Keyword Blocking URL Checking
17. Content Filtering Reports
- 17.1 Checking Content Filtering Activation
- 17.2 Viewing Content Filtering Reports
- 17.3 Web Site Submission
18. Introduction to IPSec
- 18.1 VPN Overview
- 18.2 IPSec Architecture
  - 18.2.1 IPSec Algorithms
  - 18.2.2 Key Management
- 18.3 Encapsulation
  - 18.3.1 Transport Mode
  - 18.3.2 Tunnel Mode
- 18.4 IPSec and NAT
19. VPN Screens
- 19.1 VPN/IPSec Overview
- 19.2 IPSec Algorithms
  - 19.2.1 AH (Authentication Header) Protocol
  - 19.2.2 ESP (Encapsulating Security Payload) Protocol
- 19.3 My ZyWALL
- 19.4 Remote Gateway Address
  - 19.4.1 Dynamic Remote Gateway Address
- 19.5 Nailed Up
- 19.6 NAT Traversal
  - 19.6.1 NAT Traversal Configuration
- 19.7 ID Type and Content
  - 19.7.1 ID Type and Content Examples
- 19.8 IKE Phases
- 19.9 X-Auth (Extended Authentication)
  - 19.9.1 Authentication Server
  - 19.15.1 Security Parameter Index (SPI)
- 19.18 Telecommuter VPN/IPSec Examples
  - 19.18.1 Telecommuters Sharing One VPN Rule Example
  - 19.18.2 Telecommuters Using Unique VPN Rules Example
- 19.19 VPN and Remote Management
20. Certificates
- 20.1 Certificates Overview
  - 20.1.1 Advantages of Certificates
- 20.2 Self-signed Certificates
- 20.3 Configuration Summary
  - 20.5.1 Certificate File Formats
- 20.12 Verifying a Trusted Remote Host’s Certificate
  - 20.12.1 Trusted Remote Host Certificate Fingerprints
21. Authentication Server
- 21.1 Authentication Server Overview
  - 21.1.1 Local User Database
  - 21.1.2 RADIUS
22. Network Address Translation (NAT)
- 22.1 NAT Overview
- 22.2 Using NAT
  - 22.2.1 SUA (Single User Account) Versus NAT
- 22.5 Port Forwarding
23. Static Route
- 23.2 IP Static Route
24. Policy Route
- 24.2 Benefits
- 24.3 Routing Policy
- 24.4 IP Routing Policy Setup
25. Bandwidth Management
- 25.2 Bandwidth Classes and Filters
- 25.3 Proportional Bandwidth Allocation
- 25.4 Application-based Bandwidth Management
- 25.5 Subnet-based Bandwidth Management
- 25.6 Application and Subnet-based Bandwidth Management
- 25.7 Scheduler
- 25.8 Bandwidth Borrowing
  - 25.8.1 Bandwidth Borrowing Example
- 25.9 Maximize Bandwidth Usage With Bandwidth Borrowing
- 25.10 Configuring Summary
26. DNS
- 26.2 DNS Server Address Assignment
- 26.3 DNS Servers
- 26.4 Address Record
  - 26.4.1 DNS Wildcard
- 26.5 Name Server Record
  - 26.5.1 Private DNS Server
- 26.6 System Screen
- 26.8 Configure DNS Cache
  - 26.10.1 DYNDNS Wildcard
  - 26.10.2 High Availability
- 26.11 Configuring Dynamic DNS
27. Remote Management
- 27.1 Remote Management Overview
  - 27.1.1 Remote Management Limitations
  - 27.1.2 System Timeout
- 27.2 Introduction to HTTPS
- 27.4 HTTPS Example
- 27.6 How SSH works
- 27.7 SSH Implementation on the ZyWALL
  - 27.7.1 Requirements for Using SSH
- 27.8 Configuring SSH
- 27.9 Secure Telnet Using SSH Examples
  - 27.9.1 Example 1: Microsoft Windows
  - 27.9.2 Example 2: Linux
- 27.10 Secure FTP Using SSH Example
- 27.12 Configuring TELNET
- 27.17 Configuring CNM
28. UPnP
- 28.1.1 How Do I Know If I'm Using UPnP?
- 28.1.2 NAT Traversal
- 28.1.3 Cautions with UPnP
- 28.1.4 UPnP and ZyXEL
- 28.2 Configuring UPnP
- 28.4 Installing UPnP in Windows Example
  - 28.4.1 Installing UPnP in Windows Me
  - 28.4.2 Installing UPnP in Windows XP
- 28.5 Using UPnP in Windows XP Example
  - 28.5.1 Auto-discover Your UPnP-enabled Network Device
  - 28.5.2 Web Configurator Easy Access
29. ALG Screen
- 29.1.1 ALG and NAT
- 29.1.2 ALG and the Firewall
- 29.1.3 ALG and Multiple WAN
- 29.2 FTP
- 29.3 H.323
- 29.4 RTP
  - 29.4.1 H.323 ALG Details
- 29.5 SIP
- 29.6 ALG Screen
30. Logs Screens
- 30.2 Log Description Example
31. Maintenance
- 31.1 Maintenance Overview
- 31.2 General Setup
  - 31.2.1 General Setup and System Name
- 31.5 Pre-defined NTP Time Servers List
  - 31.5.1 Resetting the Time
  - 31.5.2 Time Server Synchronization
- 31.6 Introduction To Transparent Bridging
- 31.7 Transparent Firewalls
32. Introducing the SMT
- 32.1 Introduction to the SMT
- 32.2 Accessing the SMT via the Console Port
  - 32.2.1 Initial Screen
  - 32.2.2 Entering the Password
- 32.3 Navigating the SMT Interface
  - 32.3.1 Main Menu
  - 32.3.2 SMT Menus Overview
- 32.4 Changing the System Password
- 32.5 Resetting the ZyWALL
33. SMT Menu 1 - General Setup
- 33.1 Introduction to General Setup
- 33.2 Configuring General Setup
  - 33.2.1 Configuring Dynamic DNS
    - 33.2.1.1 Editing DDNS Host
34. WAN and Dial Backup Setup
- 34.1 Introduction to WAN and Dial Backup Setup
- 34.2 WAN Setup
- 34.3 Dial Backup
- 34.4 Configuring Dial Backup in Menu 2
- 34.5 Advanced WAN Setup
- 34.6 Remote Node Profile (Backup ISP)
- 34.7 Editing PPP Options
- 34.8 Editing TCP/IP Options
- 34.9 Editing Login Script
- 34.10 Remote Node Filter
35. LAN Setup
- 35.1 Introduction to LAN Setup
- 35.2 Accessing the LAN Menus
- 35.3 LAN Port Filter Setup
- 35.4 TCP/IP and DHCP Ethernet Setup Menu
  - 35.4.1 IP Alias Setup
36. Internet Access
- 36.1 Introduction to Internet Access Setup
- 36.2 Ethernet Encapsulation
- 36.3 Configuring the PPTP Client
- 36.4 Configuring the PPPoE Client
- 36.5 Basic Setup Complete
37. DMZ Setup
- 37.1 Configuring DMZ Setup
- 37.2 DMZ Port Filter Setup
- 37.3 TCP/IP Setup
  - 37.3.1 IP Address
  - 37.3.2 IP Alias Setup
38. Route Setup
- 38.1 Configuring Route Setup
- 38.2 Route Assessment
- 38.3 Traffic Redirect
- 38.4 Route Failover
39. Wireless Setup
- 39.1 Wireless LAN Setup
  - 39.1.1 MAC Address Filter Setup
- 39.2 TCP/IP Setup
  - 39.2.1 IP Address
  - 39.2.2 IP Alias Setup
40. Remote Node Setup
- 40.1 Introduction to Remote Node Setup
- 40.2 Remote Node Setup
- 40.3 Remote Node Profile Setup
- 40.4 Edit IP
- 40.5 Remote Node Filter
- 40.6 Traffic Redirect
41. IP Static Route Setup
- 41.1 IP Static Route Setup
42. Network Address Translation (NAT)
- 42.1 Using NAT
  - 42.1.1 SUA (Single User Account) Versus NAT
  - 42.1.2 Applying NAT
- 42.2 NAT Setup
  - 42.2.1 Address Mapping Sets
- 42.3 Configuring a Server behind NAT
- 42.4 General NAT Examples
- 42.5 Trigger Port Forwarding
  - 42.5.1 Two Points To Remember About Trigger Ports
43. Introducing the ZyWALL Firewall
- 43.1 Using ZyWALL SMT Menus
  - 43.1.1 Activating the Firewall
44. Filter Configuration
- 44.1 Introduction to Filters
  - 44.1.1 The Filter Structure of the ZyWALL
- 44.2 Configuring a Filter Set
- 44.3 Example Filter
- 44.4 Filter Types and NAT
- 44.5 Firewall Versus Filters
- 44.6 Applying a Filter
45. SNMP Configuration
- 45.1 SNMP Configuration
- 45.2 SNMP Traps
46. System Information & Diagnosis
- 46.1 Introduction to System Status
- 46.2 System Status
- 46.3 System Information and Console Port Speed
  - 46.3.1 System Information
  - 46.3.2 Console Port Speed
- 46.4 Log and Trace
- 46.5 Diagnostic
  - 46.5.1 WAN DHCP
47. Firmware and Configuration File Maintenance
- 47.1 Introduction
- 47.2 Filename Conventions
- 47.3 Backup Configuration
- 47.4 Restore Configuration
- 47.5 Uploading Firmware and Configuration Files
48. System Maintenance Menus 8 to 10
- 48.1 Command Interpreter Mode
  - 48.1.1 Command Syntax
  - 48.1.2 Command Usage
- 48.2 Call Control Support
  - 48.2.1 Budget Management
  - 48.2.2 Call History
- 48.3 Time and Date Setting
49. Remote Management
- 49.1 Remote Management
  - 49.1.1 Remote Management Limitations
50. IP Policy Routing
- 50.1 IP Routing Policy Summary
- 50.2 IP Routing Policy Setup
  - 50.2.1 Applying Policy to Packets
- 50.3 IP Policy Routing Example
51. Call Scheduling
- 51.1 Introduction to Call Scheduling
52. Troubleshooting
- 52.1 Problems Starting Up the ZyWALL
- 52.2 Problems with the LAN Interface
- 52.3 Problems with the DMZ Interface
- 52.4 Problems with the WAN Interface
- 52.5 Problems Accessing the ZyWALL
  - 52.5.1 Pop-up Windows, JavaScripts and Java Permissions
- 52.6 Packet Flow
A. Product Specifications
- Specification Tables
- Compatible ZyXEL WLAN Cards
- WLAN Card and ZyWALL Turbo Card Installation
- Cable Pin Assignments
B. Hardware Installation
- General Installation Instructions
- Desktop Installation
- Rack-mounted Installation Requirements
- Rack-Mounted Installation
C. Removing and Installing a Fuse
- Removing a Fuse
- Installing a Fuse
D. C. Removing and Installing a Fuse
- Windows 95/98/Me
- Windows 2000/NT/XP
  - Verifying Settings
- Macintosh OS 8/9
  - Verifying Settings
- Macintosh OS X
  - Verifying Settings
- Linux
E. IP Subnetting
- IP Addressing
- IP Classes
- Subnet Masks
- Subnetting
- Example: Two Subnets
- Example: Four Subnets
- Example Eight Subnets
- Subnetting With Class A and Class B Networks.
F. PPPoE
- PPPoE in Action
- Benefits of PPPoE
- Traditional Dial-up Scenario
- How PPPoE Works
- ZyWALL as a PPPoE Client
G. PPTP
- What is PPTP?
  - How can we transport PPP frames from a computer to a broadband modem over Ethernet?
- PPTP and the ZyWALL
- PPTP Protocol Overview
- Control & PPP Connections
  - Call Connection
  - PPP Data Connection
H. Wireless LANs
- Wireless LAN Topologies
- Channel
- RTS/CTS
- Fragmentation Threshold
- Preamble Type
- IEEE 802.1x
- RADIUS
  - Types of RADIUS Messages
- EAP Authentication
- Types of Authentication
- WEP Authentication Steps
  - Dynamic WEP Key Exchange
- WPA
  - User Authentication
  - Encryption
- Security Parameters Summary
- Roaming
  - Requirements for Roaming
I. Triangle Route
- The Ideal Setup
- The “Triangle Route” Problem
- The “Triangle Route” Solutions
- IP Aliasing
- Gateways on the WAN Side
- Configuring Triangle Route via Commands
J. Windows 98 SE/Me Requirements for Anti-Virus Message Display
K. VPN Setup
- General Notes
  - Dynamic IPSec Rule
  - Full Feature NAT Mode
- VPN Configuration
  - Dialing the VPN Tunnel via Web Configurator
- VPN Troubleshooting
  - VPN Log
  - IPSec Debug
- Use a VPN Tunnel
  - FTP Example
L. Importing Certificates
- Import ZyWALL Certificates into Netscape Navigator
- Importing the ZyWALL’s Certificate into Internet Explorer
- Enrolling and Importing SSL Client Certificates
  - Installing the CA’s Certificate
  - Installing Your Personal Certificate(s)
- Using a Certificate When Accessing the ZyWALL Example
M. Command Interpreter
- Command Syntax
- Command Usage
N. Firewall Commands
O. NetBIOS Filter Commands
- Introduction
- Display NetBIOS Filter Settings
- NetBIOS Filter Configuration
P. Certificates Commands
Q. Brute-Force Password Guessing Protection
- Example
R. Boot Commands
S. Log Descriptions
- Syslog Logs
- Log Commands
  - Configuring What You Want the ZyWALL to Log
  - Displaying Logs
- Log Command Example
Index
- Numerics
- A
- B
- C
- D
- E
- F
- G
- H
- I
- J
- K
- L
- M
- N
- O
- P
- Q
- R
- S
- T
- U
- V
- W
- X
- Z