Gebruiksaanwijzing /service van het product ZyWALL 2 Series van de fabrikant ZyXEL Communications
Ga naar pagina of 614
ZyW ALL 2 Series Internet Security Gateway User’s Guide Version 3.62 June 2004.
ZyWALL 2 Series User’s Guide ii Copyright Copyright Copyright © 2004 by Zy XEL Communications Corporation. The contents of this publ ication m ay not be repro duced in any pa rt or as a whole, tra .
ZyWALL 2 Series User’s Guide FCC iii Federal Communications Commission (FCC) Interference S tatement This device complies with Part 15 of FCC rules. Operation is subject to the following two cond itions: This device m ay not cause harm ful interferen ce.
ZyWALL 2 Series User’s Guide iv Information for Canadian Users Information for Canadian Users The Industry Canada label identifies certified equipmen t. This certification means that the equipment meets certain telecommunications network pr otective, op eration, and safety requirements.
ZyWALL 2 Series User’s Guide Warranty v ZyXEL Limited W arranty ZyXEL warrants to the original end us er (purchaser) that this product is free from any defects in materials or workmanshi p for a period of up to two y ears from the date of p urchase.
ZyWALL 2 Series User’s Guide vi Customer Support Customer Support When you contact your cu stomer support repr esenta tive please have t he followi ng infor mation ready : Please have th e following i nformation re ady when you cont act customer s upport.
ZyWALL 2 Series User’s Guide Table of Contents vii T able of Content s Copyright...................................................................................................................... ................................ii Federal Communications Commission (FCC) Interfer en ce S tatemen t.
ZyWALL 2 Series User’s Guide viii Table of Contents 5.6 Configur ing IP ................................................................................................................. ........... 5-3 5.7 Configuring St atic DHCP ..................
ZyWALL 2 Series User’s Guide Table of Contents ix 10.3 Introduction to ZyXE L’s Firewall........................................................................................ 10-2 10.4 Denial of Service ..........................................
ZyWALL 2 Series User’s Guide x Table of Contents 14.13 Configuri ng Advanced IKE Setup ...................................................................................... 14- 24 14.14 Manual Key Setup..............................................
ZyWALL 2 Series User’s Guide Table of Contents xi 17.9 Secure Telnet Using SSH Exam ples .................................................................................. 17-16 17.10 Secure FTP Using SS H Example ...................................
ZyWALL 2 Series User’s Guide xii Table of Contents 23.3 Configuring Dial Back up i n Menu 2 ..................................................................................... 23-2 23.4 Advanced WAN Set up .........................................
ZyWALL 2 Series User’s Guide Table of Contents xiii 30.5 Firewall Versus Filters ....................................................................................................... 3 0-16 30.6 Applying a Filte r .................................
ZyWALL 2 Series User’s Guide xiv Table of Contents Appendix F T ypes of EAP Authentication ......................................................................................... .... F-1 Appendix G PPPoE ..........................................
ZyWALL 2 Series User’s Guide List of Figures xv List of Figures Figure 1-1 Secure Internet Access vi a Cable, DSL or Wi reless Modem ........................................................ 1-6 Figure 1-2 Secure Internet Access and VP N Applica tion.
ZyWALL 2 Series User’s Guide xvi List of Figures Figure 8-3 Mul tiple Serv ers Behind NA T Exam ple ................................................................................. ....... 8-6 Figure 8-4 SUA Server .................................
ZyWALL 2 Series User’s Guide List of Figures xvii Figure 14-9 Advanced IKE VPN Rule Setup ................................................................................................ 14-25 Figure 14-10 Manual VPN Rule Setup .....................
ZyWALL 2 Series User’s Guide xviii List of Figures Figure 17-21 SNMP Managem ent Model ............................................................................................. ...... 17-23 Figure 17 -22 SN MP ...................................
ZyWALL 2 Series User’s Guide List of Figures xix Figure 23-9 Menu 1 1.5: Dial Backup Remote Node Filter ........................................................................ 23 -13 Figure 24-1 Menu 3: LAN Setup ...................................
ZyWALL 2 Series User’s Guide xx List of Figures Figure 28-20 Example 4: Menu 15.1 .1.1: Address Mapp ing Rule ............................................................. 28-16 Figure 28-21 Example 4: Menu 15.1 .1: Address Mapping Rules ...........
ZyWALL 2 Series User’s Guide List of Figures xxi Figure 33-12 Successful Restor ation Confirma tion Screen ....................................................................... 3 3-10 Figure 33-13 T elnet Into Menu 24.7 .1: Upload System Firmware.
ZyWALL 2 Series User’s Guide xxii List of Tables List of T ables T able 1-1 Model Sp ecific Features .............................................................................................. ................... 1-1 T able 2-1 W eb Configur ator S creens Summary.
ZyWALL 2 Series User’s Guide List of T ables xxiii T able 10-2 ICMP Commands That T rig ger Alerts ................................................................................... .... 10-6 T able 10-3 Legal NetBIOS Comm ands ....................
ZyWALL 2 Series User’s Guide xxiv List of Tables T able 16-2 RADIUS .............................................................................................................. ....................... 16-4 T able 17-1 WWW .........................
ZyWALL 2 Series User’s Guide List of T ables xxv T able 26-1 Menu 1 1.1: Remote Node Pr ofile for Ethernet Encapsulatio n ................................................... 26-2 T able 26-2 Fields in Menu 1 1.1 (PPPoE Enca psulation Specific) .....
ZyWALL 2 Series User’s Guide xxvi Preface Preface About This User's Manual Congratulations on your purchase of the ZyWALL 2 Internet Security Gateway Ser ies. This manual is designed to guide you through the configur ation of your ZyWALL for its various applications.
ZyWALL 2 Series User’s Guide Preface xxvii • The version number on the title page is the latest firm ware version that is documented in this User’s Guide . Earlier versi ons may also be included. • “Enter” means for you t o type one or more charact ers and press the carriage return.
.
Getting S tarted I Part I: Getting Started This part help s you get to know your ZyWALL, in troduces the web configurator and covers how to configure the Wizard Setup screens.
.
ZyW ALL 2 Serie s User ’s Guide Getting to Know Y our ZyW ALL 1-1 Chapter 1 Getting to Know Your ZyWALL This chapter introduces the main featu res and applications of the ZyWALL. 1.1 Introducing the ZyW ALL The ZyWALL is an ideal secure gateway for all data passing between the Internet and the LAN.
ZyW ALL 2 Serie s User ’s Guide 1-2 Getting to Know Y our ZyW ALL 1.2.1 Physical Features 4-Port Switch A combination of switch and router makes your ZyWA LL a cost-effective and viab le network solu tion. You can connect up to four com puters to the ZyWALL without the cost of a hub.
ZyW ALL 2 Serie s User ’s Guide Getting to Know Y our ZyW ALL 1-3 The ZyW ALL support s two simult aneous VPN connections. X-Auth (Extended Authentication) X-Auth pr ovides adde d security for VPN by requiring ea ch VPN cli ent to use a username and passwor d.
ZyW ALL 2 Serie s User ’s Guide 1-4 Getting to Know Y our ZyW ALL Universal Plug and Play (UPnP) Using the standar d TCP/IP p rotocol, t he ZyWALL a nd other UPnP enable d devices can dynamical ly join a network, obtain an IP address and convey its cap abilities to other devices on th e network.
ZyW ALL 2 Serie s User ’s Guide Getting to Know Y our ZyW ALL 1-5 Central Network Management Central Netwo rk Managem ent (CNM) allows an enter prise or ser vice provi der network a dminist rator to manage your ZyWA LL.
ZyW ALL 2 Serie s User ’s Guide 1-6 Getting to Know Y our ZyW ALL Management Term inal) interface. The SMT is a menu-driv en interface that you can acce ss from a terminal emulator t hrough the c onsole port or over a t elnet connection.
ZyW ALL 2 Serie s User ’s Guide Getting to Know Y our ZyW ALL 1-7 1.3.2 Secure Broadband Internet Access and VPN You can conne ct a cable, DSL or wireless modem to the ZyWALL via Ethe rnet for bro adband In ternet access. The ZyWALL also provi des IP address sha r ing and a firewall-prot ected local network with traffic management .
.
ZyW ALL 2 Serie s User ’s Guide Introducing the W eb Configurator 2-1 Chapter 2 Introducing the Web Configurator This chapter describes how to access the ZyWALL web configurator and pr ovides an overview of its screens.
ZyW ALL 2 Serie s User ’s Guide 2-2 Introducing the W eb Configurator Step 6. Click Apply in th e Replace Certificate screen to create a ce rtificate using your ZyWALL’s MAC address that will be specific to this devi ce. This feature is not availab le on the ZyWALL 2WE.
ZyW ALL 2 Serie s User ’s Guide Introducing the W eb Configurator 2-3 2.3.2 Uploading a Configurat ion File Via Console Port Step 3. Download the defau lt configuration file from th e ZyXEL Networks FTP site, unzip it and save it in a folder. Step 4.
ZyW ALL 2 Serie s User ’s Guide 2-4 Introducing the W eb Configurator Follow the instructions you see in the MAIN MENU screen or click the icon (located in the top right corner of most screens) to v iew online help. The icon does not appear in the MAIN MENU screen.
ZyW ALL 2 Serie s User ’s Guide Introducing the W eb Configurator 2-5 Table 2-1 Web Configurator Screens Summary LINK TA B FUNCTION General Use this screen to configure general s ystem settings. DDNS Use this screen to configure Dynamic Domain Name System settings.
ZyW ALL 2 Serie s User ’s Guide 2-6 Introducing the W eb Configurator Table 2-1 Web Configurator Screens Summary LINK TA B FUNCTION General This screen allo ws you to enable content filtering and block certain web features.
ZyW ALL 2 Serie s User ’s Guide Introducing the W eb Configurator 2-7 Table 2-1 Web Configurator Screens Summary LINK TA B FUNCTION SNMP Use this screen to configure your Z yWALL’s settings for Simple Network Management Protocol managemen t.
.
ZyW ALL 2 Serie s User ’s Guide Wizard Setup 3-1 Chapter 3 Wizard Setup This chapter provides information on the Wiza rd Setup screens in the web configurator. 3.1 Wizard Setup Overview The web configur ator’s setup wizard helps yo u config ure your device to access the Internet.
ZyW ALL 2 Serie s User ’s Guide 3-2 Wizard Setup Figure 3-1 Wizard 1 3.3 Internet Access The ZyWALL offers three c hoices of enca psulation. They are Ethernet , PPTP or PPPoE. 3.3.1 Ethernet Choose Eth erne t when the WAN port is used as a regula r Ethernet.
ZyW ALL 2 Serie s User ’s Guide Wizard Setup 3-3 Figure 3-2 Wizard 2: Ethernet Encapsulation The following table describes the labels in this screen. Table 3-1 Ethernet Encapsulation LA BEL DESCRIPTION ISP Parameters fo r Internet Access Encapsulation You must choo se the Ethernet option when the WAN port is used as a reg ular Ethernet.
ZyW ALL 2 Serie s User ’s Guide 3-4 Wizard Setup Table 3-1 Ethernet Encapsulation LA BEL DESCRIPTION Login Server IP Address Type the authentication server IP address her e if your ISP gave you one. Login Server (Telia Login onl y) Type the domain name of the T elia login server, for example “login1.
ZyW ALL 2 Serie s User ’s Guide Wizard Setup 3-5 Figure 3-3 Wizard2: PPPoE Encapsulation The following table describes the labels in this screen. Table 3-2 PPPoE Encapsulation LABEL DESCRIPTION ISP Parameter for Internet Access Encapsulation Choose a n encapsulation method from the p ull-down list box.
ZyW ALL 2 Serie s User ’s Guide 3-6 Wizard Setup Table 3-2 PPPoE Encapsulation LABEL DESCRIPTION Idle Timeout Type the time in seconds that elapse s before the router automatically disconnects from the PPPoE server. The default time is 100 seconds. Next Click Next to continue.
ZyW ALL 2 Serie s User ’s Guide Wizard Setup 3-7 Figure 3-4 Wizard 2: PPTP Encapsulation The following table describes the labels in this screen. Table 3-3 PPTP Encapsulation LABEL DESCRIPTION ISP Parameters fo r Internet Access Encapsulation Select PPTP from the drop-down list box.
ZyW ALL 2 Serie s User ’s Guide 3-8 Wizard Setup Table 3-3 PPTP Encapsulation LABEL DESCRIPTION My IP Address Type the (static) IP address assigned to you by your ISP. My IP Subnet Mask Type the subnet mask assigned to you b y your ISP (if given). Server IP Address T ype the IP address of the PPTP server.
ZyW ALL 2 Serie s User ’s Guide Wizard Setup 3-9 Regardless of your p articular situation, do not create an arbitrary IP address; always follow the guidelines above. For more information on addres s assignment, please refer to RFC 15 97, Address Allocation for Private Internet s and RFC 1466, Guidelines for Management of IP Address Sp ace.
ZyW ALL 2 Serie s User ’s Guide 3-10 Wizard Setup 3.4.4 W AN MAC Address Every Ethernet device ha s a unique MAC (Media Access Control) address. The MAC address is assigned at the factory an d consists of six pairs of hexadeci mal characters, for exampl e, 00: A0:C5: 00:00:0 2.
ZyW ALL 2 Serie s User ’s Guide Wizard Setup 3-1 1 Figure 3-5 Wizard 3 The following table describes the labels in this screen. Table 3-6 Wizard 3 LA BEL DESCRIPTION WAN IP Address Assignment Get automatically from ISP Select this option If your ISP did not assign you a fixed IP address.
ZyW ALL 2 Serie s User ’s Guide 3-12 Wizard Setup Table 3-6 Wizard 3 LA BEL DESCRIPTION Remote IP Subnet Mask Enter the gateway IP subnet mask (if your ISP gave you o ne) in this field if you selected Use Fixed IP Address . This field is only available when you select PPTP encapsulatio n in the previous wizard screen.
ZyW ALL 2 Serie s User ’s Guide Wizard Setu p 3-13 Figure 3-6 Internet Access Wizard Setup Complete.
.
System and LAN II Part II: System and LAN This part covers configuration of the system, and LAN screens..
.
ZyWALL 2 Series User’s Guide System 4-1 Chapter 4 System Screens This chapter provides information on the System screens. 4.1 System Overview See the Wizard Setup cha pter for more info rmation on the next few sc reens. 4.2 Configuring General Setup Click SYSTEM to open the General screen.
ZyWALL 2 Series User’s Guide 4-2 System Table 4-1 System General Setup LABEL DESCRIPTION System Name Choose a descriptive name for i dentification purposes. It is recommended you enter your computer’s “Computer name” in this fiel d (see the Wizard Setup chapter for how to find your computer’s name).
ZyWALL 2 Series User’s Guide System 4-3 4.3 Dynamic DNS Dynamic DNS allows you to update your curr ent dynamic IP address with one or many dynamic DNS services so that anyone can c ontact you (in NetMee ting, CU-SeeMe, etc.). Yo u can also access your FTP server or We b site on y our own com puter using a domain nam e (for instance myhost.
ZyWALL 2 Series User’s Guide 4-4 System Figure 4-2 DDNS The following table describes the fields in this screen. Table 4-2 DDNS LABEL DESCRIPTION Active Select this che ck box to use dynamic DNS. Service Provider Select the name of your Dynamic DNS service provider.
ZyWALL 2 Series User’s Guide System 4-5 Table 4-2 DDNS LABEL DESCRIPTION Host Names 1~3 Enter the host names in the three fields provided. You can specify up to two host names in each field separated by a comma (","). User Enter your user name.
ZyWALL 2 Series User’s Guide 4-6 System Figure 4-3 Password The following table describes the fields in this screen. Table 4-3 Password LABEL DESCRIPTION Old Password Type the default password or the ex isting p assword you use to access the system in this field.
ZyWALL 2 Series User’s Guide System 4-7 Table 4-4 Default Time Servers ntp1.cs.wisc.edu ntp1.gbg.netnod.se ntp2.cs.wisc.edu tock.usno.navy.mil ntp3.cs.wisc.edu ntp.cs.strath.ac.uk ntp1.sp.se time1.stupi.se tick.stdtime.gov.tw tock.stdtime.gov.tw time.
ZyWALL 2 Series User’s Guide 4-8 System Figure 4-4 Time Setting The following table describes the fields in this screen. Table 4-5 Time Setting LABEL DESCRIPTION Time Protocol Select the time service protocol that your time server sends when you turn on the ZyWALL.
ZyWALL 2 Series User’s Guide System 4-9 Table 4-5 Time Setting LABEL DESCRIPTION Time Server Address Enter the address of your time server. Check with your ISP/net work administrator if you are unsure of this information (the def ault is tick.stdtime.
.
ZyWALL 2 Series User’s Guide LAN 5-1 Chapter 5 LAN Screens This chapter describes how to configure LAN settings. 5.1 LAN Overview Local Area Network (L AN) is a shared comm unication sy stem to which many computers are attached.
ZyWALL 2 Series User’s Guide 5-2 LAN three numbers specify the network number while the last number identifies an indi vidual computer on that network. Once you have decided on t he network number, pick an IP address that is e asy to remember, for instance, 192.
ZyWALL 2 Series User’s Guide LAN 5-3 RIP Version control s the for mat and the broadcasti ng metho d of the RIP packets th at the ZyWALL se nds (it recognizes both formats whe n receiving). RIP-1 is universally supported; but RIP-2 carries m ore informat ion.
ZyWALL 2 Series User’s Guide 5-4 LAN Figure 5-1 IP The following table describes the fields in this screen. Table 5-1 IP LABEL DESCRIPTION DHCP Setup.
ZyWALL 2 Series User’s Guide LAN 5-5 Table 5-1 IP LABEL DESCRIPTION DHCP Server DHCP (Dynamic Host Confi guration Pr otocol, RFC 2131 a nd RFC 2132) allows individual clients ( workstations) to obtain TCP/IP configuration at startup from a server. Unless you are instruct ed by your ISP, leave the DHCP Server check box selected.
ZyWALL 2 Series User’s Guide 5-6 LAN Table 5-1 IP LABEL DESCRIPTION RIP Version The RIP Version field controls the format and the broadcas ting method of the RIP packets that the ZyWALL sends (it recognizes both formats when receivin g). RIP-1 is universally supported but RIP-2 carries more information.
ZyWALL 2 Series User’s Guide LAN 5-7 Figure 5-2 Static DHCP The following table describes the fields in this screen. Table 5-2 Static DHCP LABEL DESCRIPTION # This is the index number of th e Static IP table entry (row). MAC Address Type the MAC address (with colons) of a computer on your LAN.
ZyWALL 2 Series User’s Guide 5-8 LAN When you use IP alias, y ou can also configure fire wall rules to control acce ss between the LAN's logical networks (s ubnets). The following f igure shows a LAN divided into subnets A, B, and C. Figure 5-3 Physical Network Figure 5-4 Partitioned Logical Networks.
ZyWALL 2 Series User’s Guide LAN 5-9 The following table describes the fields in this screen. Table 5-3 IP Alias LABEL DESCRIPTION IP Alias 1,2 Select the check box to configure another L AN for the ZyWALL. IP Address Enter the IP address of your ZyWALL in dotted decim al notation.
.
WAN and Wireless LAN III Part III: WAN and Wireless LAN This part covers configuration of the W AN and Wireless LAN screens..
.
ZyWALL 2 Series User’s Guide WAN Screens 6-1 Chapter 6 WAN Screens This chapter describes how to configure WAN settings. 6.1 W AN Overview See the LAN chapter for information about Primary and Seconda ry DNS Server , DNS Server Address Assignment and IP Address and Subnet Mask .
ZyWALL 2 Series User’s Guide 6-2 WAN Screens Table 6-1 Private IP Address Ranges 10.0.0.0 - 10. 255.255.255 172.16.0.0 - 172.31.255.255 192.168.0.0 - 192. 168.255.255 You can obt ain your IP address fr om the IAN A, from an ISP or have it assigned by a priv ate network.
ZyWALL 2 Series User’s Guide WAN Screens 6-3 Figure 6-1 WAN Setup: Route The following table describes the fields in this screen. Table 6-3 WAN Setup: Route LABEL DESCRIPTION WAN Traf fic Redirect D.
ZyWALL 2 Series User’s Guide 6-4 WAN Screens Figure 6-2 Ethernet Encapsulation The following table describes the fields in this screen. Table 6-4 Ethernet Encapsulation LABEL DESCRIPTION Encapsulation You must cho ose the Ethernet opt ion when the WAN port is used as a re gular Ethernet.
ZyWALL 2 Series User’s Guide WAN Screens 6-5 Table 6-4 Ethernet Encapsulation LABEL DESCRIPTION Reset Click Reset to begin co nfiguring this screen afresh. 6.5.2 PPPoE Encap sulation The ZyWALL sup ports PPPo E (Point -to-Point P rotocol o ver Ether net).
ZyWALL 2 Series User’s Guide 6-6 WAN Screens Figure 6-3 PPPoE Encapsulation The following table describes the fields in this screen. Table 6-5 PPPoE Encapsulation LABEL DESCRIPTION ISP Parameters fo r Internet Access Encapsulation The PPPoE choice is for a dial- up connection using PPPo E.
ZyWALL 2 Series User’s Guide WAN Screens 6-7 Table 6-5 PPPoE Encapsulation LABEL DESCRIPTION Password T ype the password associated with the User Name above. Retype to Confirm Type your password agai n to make sure that you have entered is correctl y.
ZyWALL 2 Series User’s Guide 6-8 WAN Screens Figure 6-4 PPTP Encapsulation The following table describes the fields in this screen. Table 6-6 PPTP Encapsulation LABEL DESCRIPTION ISP Parameters fo r.
ZyWALL 2 Series User’s Guide WAN Screens 6-9 Table 6-6 PPTP Encapsulation LABEL DESCRIPTION User Name Type the user name given to you b y your ISP. Password T ype the password associated with the User Name above. Retype to Confirm Type your password agai n to make sure that you have entered is correctl y.
ZyWALL 2 Series User’s Guide 6-10 WAN Screens Figure 6-5 IP Setup The following table describes the fields in this screen. Table 6-7 IP Setup LA BEL DESCRIPTION WAN IP Address Assignment Get automatically from ISP Select this option If your ISP did not assign you a fixed IP address.
ZyWALL 2 Series User’s Guide WAN Screens 6-11 Table 6-7 IP Setup LA BEL DESCRIPTION My WAN IP Address (or IP Address) Enter your WAN IP address in this field if yo u selected Use Fixed IP Address. My WAN IP Subnet Mask (Ethernet encapsulation only) Type your network's IP subnet mask.
ZyWALL 2 Series User’s Guide 6-12 WAN Screens Table 6-7 IP Setup LA BEL DESCRIPTION Private (PPPoE and PPTP only) This parameter determines if the Z yWALL will include the route to this remote node in its RIP broadcasts. If set to Ye s, this route is kept private and not included in RIP broadcast.
ZyWALL 2 Series User’s Guide WAN Screens 6-13 Table 6-7 IP Setup LA BEL DESCRIPTION Windows Networking (NetBIOS over TCP/IP): Windo ws Networking (NetBIOS over TCP/IP): NetBIOS (Network Basic Input/Output System) are TCP or UDP broadcast packets that enable a computer to connect to and communicate with a LAN.
ZyWALL 2 Series User’s Guide 6-14 WAN Screens The MAC address screen allows users to configure the WAN port' s MAC Addr ess by either usi ng the factory default or cloning the MAC addr ess from a computer on your LAN. Choose Factory De fault to select the factory assigned default MAC Address.
ZyWALL 2 Series User’s Guide WAN Screens 6-15 Figure 6-8 Traffic Redirect LAN Setup 6.9 Configuring T raffic Redirect To change your ZyWALL’s Traf fic Redirect settings, click WAN , then the Traffic Redirect tab.
ZyWALL 2 Series User’s Guide 6-16 WAN Screens Figure 6-9 Traffic Redirect The following table describes the fields in this screen. Table 6-8 Traffic Redirect LABEL DESCRIPTION Active Select this check box to have the Zy WALL use traffic redirect if the normal WAN connection goes down.
ZyWALL 2 Series User’s Guide WAN Screens 6-17 Table 6-8 Traffic Redirect LABEL DESCRIPTION Check WAN IP Address Configuration of this field is optiona l. If you do not enter an IP address here, the ZyWALL will use the default gate way IP address. Confi gure this field to test your ZyWALL's W AN accessibility.
ZyWALL 2 Series User’s Guide 6-18 WAN Screens Figure 6-10 Dial Backup Setup.
ZyWALL 2 Series User’s Guide WAN Screens 6-19 The following table describes the labels in this screen. Table 6-9 Dial Backup Setup LABEL DESCRIPTION Enable Dial Backup Select this che ck box to turn on dial backup. Basic Settings Login Name Type the login name assigned by your ISP.
ZyWALL 2 Series User’s Guide 6-20 WAN Screens Table 6-9 Dial Backup Setup LABEL DESCRIPTION Get IP Address Automatically from Remote Server Type the login name assigned by your ISP for this remote node. Used Fixed IP Address Select this check box if your ISP assign ed you a fi xed IP address, then enter the IP address in the follo wing field.
ZyWALL 2 Series User’s Guide WAN Screens 6-21 Table 6-9 Dial Backup Setup LABEL DESCRIPTION RIP Version T he RIP Version field controls the format and t he broadcasting metho d of the RIP packets that the ZyWALL sends (it recognizes both formats when receiving).
ZyWALL 2 Series User’s Guide 6-22 WAN Screens Table 6-9 Dial Backup Setup LABEL DESCRIPTION Configure Budget Select this check box to have the dial back up connection on during the time that you select.
ZyWALL 2 Series User’s Guide WAN Screens 6-23 6.11.3 Response Strings The response strings tell the ZyWALL the ta gs, or la bels, immediately preceding the various call parameters sent from the WAN device. The response strings have not been standardized; pl ease consult the document ation of yo ur WAN devi ce to fin d the correct t ags.
ZyWALL 2 Series User’s Guide 6-24 WAN Screens Figure 6-11 Advanced Setup The following table describes the labels in this screen. Table 6-10 Advanced Setup LABEL DESCRIPTION EXAMPLE AT Command Strings Dial Type the AT Command string to make a call.
ZyWALL 2 Series User’s Guide WAN Screens 6-25 Table 6-10 Advanced Setup LABEL DESCRIPTION EXAMPLE Drop T ype the AT Command string to drop a call. "~" represents a one second wait, for example, "~~~++ +~~ath" can be used if your modem has a slow response time.
.
ZyWALL 2 Series User’s Guide Wireless LAN Screens 7-1 Chapter 7 Wireless LAN Screens This chapter discusses how to configure Wireless LAN on the ZyWALL 2WE. 7.1 Wireless LAN Overview This section introduces the wireless LAN (WLAN) and so me basi c scenar ios.
ZyWALL 2 Series User’s Guide 7-2 Wireless LAN Screens is they do not know if the channel is currently being use d . Therefore, they are c onsidered hidden from each other. Figure 7-1 RTS Threshold When station A sends data to the ZyWALL, it might not know that the station B is already using the channel.
ZyWALL 2 Series User’s Guide Wireless LAN Screens 7-3 A large Fragmentation Thre shold is recommend ed for networks no t prone to interfere nce while you shou ld set a smaller t hreshold for busy networ ks or netw orks that a re prone to i n terference .
ZyWALL 2 Series User’s Guide 7-4 Wireless LAN Screens 7.4 Configuring Wireless LAN If you are configuring the Zy W ALL from a computer conne cted to the wireless LAN and you change the Zy W ALL ’ s ESSID or WEP settings, you will lose your wireless connection when you press Apply to confirm.
ZyWALL 2 Series User’s Guide Wireless LAN Screens 7-5 Table 7-1 Wireless LABEL DESCRIPTION Enable Wireless LAN The wireless LAN is turned off b y default, before you enable the wireless LAN you should configure some security b y setting MAC filters and/or 802.
ZyWALL 2 Series User’s Guide 7-6 Wireless LAN Screens 7.5 Configuring MAC Filter The MAC filter screen allows you to confi gure the ZyWALL to give exclusive access to specific devices ( Allow Association ) or exclude specific devices from accessing the Zy WALL ( Den y Association ).
ZyWALL 2 Series User’s Guide Wireless LAN Screens 7-7 Table 7-2 MAC Address Filter LA BEL DESCRIPTION Active Select or clear the check box to ena ble or disable MAC addr ess filtering. Enable MAC address filtering to have the ro uter allow or deny access to wireless stations based on MAC addresses.
ZyWALL 2 Series User’s Guide 7-8 Wireless LAN Screens • Access-Request Sent by the ZyWALL request ing authenticati on. • Access-Reject Sent by a RADIUS server rejecting access . • Access-Accept Sent by a RADIUS server allowing access. • Access-Challenge Sent by a RADIUS server requesting m ore inform ation in order to allow access.
ZyWALL 2 Series User’s Guide Wireless LAN Screens 7-9 Figure 7-5 EAP Authentication The details below provide a gener al description of how IEEE 802.1x EAP auth entication works. For an example list of EAP-MD5 authentication ste p s, see the IEE E 802.
ZyWALL 2 Series User’s Guide 7-10 Wireless LAN Screens Figure 7-6 802.1X Authentication The following table describes the fields in this screen. Table 7-3 802.1X Authentication LABEL DESCRIPTION Authentication Type Select Authentication Required , No A ccess or No Authentication Required from the drop-down list box.
NAT and Static Route IV Part IV: NAT and Static Route This part covers Network Address T r anslation and setting up static routes..
.
ZyWALL 2 Series User’s Guide NAT 8-1 Chapter 8 Network Address Translation (NAT) This chapter discusses how to configure NAT on the ZyWALL. 8.1 NA T Overview NAT (Network Address Tran slation - NAT, RFC 1631) is the translation of the IP addr ess of a host in a packet.
ZyWALL 2 Series User’s Guide 8-2 NAT local address before forwarding it to the original insid e host. Note that the IP address (either local or global ) of an outside host is neve r changed. The global IP a ddresses for the i nside hosts can be either static or dynam ically assigned b y the ISP.
ZyWALL 2 Series User’s Guide NAT 8-3 8.1.4 NA T Application The following figure illu strates a possible NAT applicatio n, where three inside LANs (logical LANs using IP Alias) behi nd the ZyWALL can comm unicate with three disti nct WAN netwo rks. More e xamples follow at the end of this chapter.
ZyWALL 2 Series User’s Guide 8-4 NAT Many to One : In M any-to-On e mode, the Zy WALL maps multiple local IP addresses t o one gl obal IP address. Thi s is equivalent to SUA (i.e., PAT, port address translation), the Single User Account feature (the S UA Only option).
ZyWALL 2 Series User’s Guide NAT 8-5 8.2.1 SUA (Single User Account) V ersus NA T SUA (Single U ser Account) i s an im plementat ion of a s ubset of N AT that supp orts two t ypes of mapping, Many-to-One and Server .
ZyWALL 2 Series User’s Guide 8-6 NAT Table 8-3 Services and Port Numbers SERVICES PORT NUMBER DNS (Domain Name System) 53 Finger 79 HTTP (Hyper Text Transfer proto col or WWW, We b) 80 POP3 (Post Of.
ZyWALL 2 Series User’s Guide NAT 8-7 8.4 Configuring SUA Server If you do not assign a Default Server IP address, the ZyW ALL discards all p ackets received for port s that are not specified here or in the remote management setup. Click SUA/NAT to open the SUA Server s creen.
ZyWALL 2 Series User’s Guide 8-8 NAT Table 8-4 SUA Server LABEL DESCRIPTION Default Server In addition to the servers for specified services, NAT supp orts a default server. A default server receives packets from ports t hat are not specified in this screen.
ZyWALL 2 Series User’s Guide NAT 8-9 Figure 8-5 Address Mapping The following table describes the fields in this screen. Table 8-5 Address Mapping LABEL DESCRIPTION Local Start IP This refers to the Inside Local Addre ss (ILA), that is the starti ng local IP address.
ZyWALL 2 Series User’s Guide 8-10 NAT Table 8-5 Address Mapping LABEL DESCRIPTION Type 1. One-to-One mode maps one local IP address to one global IP addr ess. Note that port numbers do not change for the One-to-one NAT mapping type. 2. Many-to-One mode maps multiple local IP addresses to one global IP address.
ZyWALL 2 Series User’s Guide NAT 8-11 Table 8-6 Address Mapping Rule LABEL DESCRIPTION Type Choose the po rt mapping type from one of the following. 1. One-to-One : One-to-one mode maps one local IP addres s to one global IP address. Note that port numbers do not change for One-to-one NAT mapping type.
ZyWALL 2 Series User’s Guide 8-12 NAT receives a response wit h a specific port num ber and pr otoc ol ("incomi ng" port), the ZyWALL forwards the traffic to the LAN IP address of the c omputer that sent the request.
ZyWALL 2 Series User’s Guide NAT 8-13 Figure 8-8 Trigger Port The following table describes the fields in this screen. Table 8-7 Trigger Port LABEL DESCRIPTION No. This is the rule index number (read-onl y). Name Type a uniqu e name (up to 15 characters) fo r identificatio n purposes.
ZyWALL 2 Series User’s Guide 8-14 NAT Table 8-7 Trigger Port LABEL DESCRIPTION Incoming Incoming is a port (or a range of ports) that a server on the WAN uses when it sends out a particular service. The ZyWALL for wards the traffic with this port (or range of ports) to the client computer on the LAN th at requested the service.
ZyWALL 2 Series User’s Guide Static Route Screens 9-1 Chapter 9 Static Route Screens This chapter shows you how to config ure static routes for your ZyWALL. 9.1 S t atic Route Overview Each remote n ode specifies only the netw ork to which the gateway is directly connected, and t he ZyWALL has no knowledge of the networ ks beyond.
ZyWALL 2 Series User’s Guide 9-2 Static Route Screens Figure 9-2 Static Route Screen The following table describes the fields in this screen. Table 9-1 IP Static Route Summary LABEL DESCRIPTION # Number of an individual static route. Name Name that describes or identifies this route.
ZyWALL 2 Series User’s Guide Static Route Screens 9-3 Table 9-1 IP Static Route Summary LABEL DESCRIPTION Gateway T his is the IP address of the gateway. The gateway is an immediate nei ghbor of your ZyWALL that will forward the packet to the de stination.
ZyWALL 2 Series User’s Guide 9-4 Static Route Screens Table 9-2 Edit IP Static Route LABEL DESCRIPTION Active This field allows you to acti vate/deactivate this static route. Destination IP Address This parameter specifies the IP net work addr ess of the final destination.
Firewall and Content Filters V Part V: Firewall and Content Filters This part introduces fire walls in general and the ZyW ALL firewall. It also explains how to configure the ZyW ALL firewall and content filtering.
.
ZyWALL 2 Series User’s Guide Firewalls 10-1 Chapter 10 Firewalls This chapter gives some background information on firewalls and introduces the ZyWALL firewall. 10.1 Firewall Overview Originally, the term firewall referred to a construction techn ique designed to preven t the spread of fire from one room to another.
ZyWALL 2 Series User’s Guide 10-2 Firewalls i. Inform ation hiding prevent s the name s of internal sy stems from being made known via D NS to outside system s, since the a pplication gat eway i s the only host whose nam e must be m ade known to outside systems.
ZyWALL 2 Series User’s Guide Firewalls 10-3 Figure 10-1 ZyWALL Fire w all Application 10.4 Denial of Service Denials of Service (DoS) attacks are aim ed at devices and networks with a connection to the Internet. T heir goal is not to steal information, but to disable a devi ce or network so users no longer ha ve access to network resources.
ZyWALL 2 Series User’s Guide 10-4 Firewalls Table 10-1 Common IP Ports 21 FTP 53 DNS 23 Telnet 80 HTT P 25 SMTP 110 POP3 10.4.2 T ypes of DoS Attacks There are four types of DoS a ttacks: 1. Those that ex ploit bugs in a TCP/IP impl ementati on. 2. Those that exploit weaknesse s in the TCP/IP specification.
ZyWALL 2 Series User’s Guide Firewalls 10-5 Figure 10-2 Three-Way Handshake Under normal circumstances, the application that initiates a session sends a SYN (synchronize) packet to the receiving serve r. The receiver se nds back an ACK (ac knowledgment) packet and its own SYN, and then the initiato r responds with an ACK (acknowledgment).
ZyWALL 2 Series User’s Guide 10-6 Firewalls 2-b In a LAND Atta ck , hackers flood S YN packets i nto th e network with a spoofed source IP address of the targeted system. Th is makes it appear as if the host computer sent t h e packets to itself, making the system unavailable while the target system tries to respond to itself.
ZyWALL 2 Series User’s Guide Firewalls 10-7 Illegal Commands (NetBIOS and SMTP) The only legal NetBIOS commands are th e following - all others are illegal. Table 10-3 Legal NetBIOS Command s MESSAGE: REQUEST: POSITIVE: NEGATIVE: RETARGET: KEEPALIVE: All SMTP commands are illegal excep t for th ose displayed in the following tables.
ZyWALL 2 Series User’s Guide 10-8 Firewalls all communications to th e Internet th at originate from the LAN, and bl ocks all traffic to the LAN that originates from the In ternet. In summary, st ateful inspection: Allows all sessions originating from the LA N (local network) to th e WAN (Internet).
ZyWALL 2 Series User’s Guide Firewalls 10-9 4. Based on the obtained state in form ation, a firewall rule creates a temporary access list entry that is inserted at the beginni ng of the WAN interfa ce's inbound extended access list.
ZyWALL 2 Series User’s Guide 10-10 Firewalls Below is a brief technical description of how these connections a re tracked. C onnections may either be defined by t he upper pr otocols (f or instance, TC P), or by t he ZyWALL its elf (as with the "virt ual connections" created for UDP and ICMP).
ZyWALL 2 Series User’s Guide Firewalls 10-11 10.5.5 Upper Layer Protocols Some higher layer protocols (such as FTP and RealAudio ) utilize multiple network connection s simultaneousl y.
ZyWALL 2 Series User’s Guide 10-12 Firewalls 10.7.1 Packet Filtering: The router filters packets as they pass through the router’s in terface according to the filter rules you designed. Packet filtering is a powerful tool, yet can be comple x to conf igure and maintain, especially if you n eed a chain of rules to filter a service.
ZyWALL 2 Series User’s Guide Firewalls 10-13 3. To selectively bl ock/allow inbound or outbound t raffic between i nside host/ networks and outside host/networks. Remember that filters canno t distingu ish traffic originating from an inside host or an outside host by IP address.
.
ZyWALL 2 Series User’s Guide Firewall Screens 11-1 Chapter 11 Firewall Screens This chapter shows you how to configure your ZyWALL firewall. 11.1 Access Methods The web confi gurator is, by far, the most comprehensive firewall configuration t ool your ZyWALL has t o offer.
ZyWALL 2 Series User’s Guide 11-2 Firewall Screens If you configure firewall rules without a good underst anding of how they work, you might inadvertently introduce security risks to the fire wall and to the protected network. Make sure y ou test your rules af ter you configure th em.
ZyWALL 2 Series User’s Guide Firewall Screens 11-3 1. Does this rule stop LAN users from accessing critical reso urces on the Internet? Fo r example, if IRC is blocked, are t here users that require this service ? 2.
ZyWALL 2 Series User’s Guide 11-4 Firewall Screens policies for managing the ZyWALL through th e LAN in terface) and policies for L AN-to-LAN (t he policies that control r outing betwee n two subnets on the LA N) . Similarly, WAN to WAN/ZyWALL polices apply in the same way to the WAN ports.
ZyWALL 2 Series User’s Guide Firewall Screens 11-5 Figure 11-2 WAN to LA N Traffic 11.5 Alert s Alerts are reports on ev ents, such as attacks, that you may wan t to know about right away.
ZyWALL 2 Series User’s Guide 11-6 Firewall Screens Figure 11-3 Enabling the Fire wall The following table describes the fields in this screen. Select this check box to enable the firewall.
ZyWALL 2 Series User’s Guide Firewall Screens 11-7 Table 11-1 Firewall Rules Summary: First Screen LA BEL DESCRIPTION Enable Firewall Select this che ck box to activate the firewall. The ZyWALL performs access control and protects against Denial o f Service (DoS) attacks when the firewall is activated.
ZyWALL 2 Series User’s Guide 11-8 Firewall Screens Table 11-1 Firewall Rules Summary: First Screen LA BEL DESCRIPTION Log This field shows you if a log is creat ed for packets that match the rule ( Match ), don't match the rule ( Not Match ), both ( Both ) or no log is created ( None ).
ZyWALL 2 Series User’s Guide Firewall Screens 11-9 Figure 11-4 Creating/Editing A Fire w all Rule.
ZyWALL 2 Series User’s Guide 11-10 Firewall Screens The following table describes the fields in this screen. Table 11-2 Creating/Editing A Fire wall Rule LABEL DESCRIPTION Active Check the Act iv e check bo x to have the ZyWALL use this rule.
ZyWALL 2 Series User’s Guide Firewall Screens 11-11 Table 11-2 Creating/Editing A Fire wall Rule LABEL DESCRIPTION Log This field determines if a log i s creat ed for packets that match the rule ( Match ), don't match the rule ( Not Match ), both ( Both ) or no log is created ( None ).
ZyWALL 2 Series User’s Guide 11-12 Firewall Screens Table 11-3 Adding/Editing Source and Destination Addre sses LABEL DESCRIPTION Address Type Do you want your rule to app ly to pac kets with a particular (single) IP, a range of IP addresses (e.g., 192.
ZyWALL 2 Series User’s Guide Firewall Screens 11-13 Table 11-4 Creating/Editing A Custo m Port LABEL DESCRIPTION Service Name Enter a unique name for your custom port. Service Type Choose the IP port ( TCP , UDP or Both ) that defines your cu stomized port from the drop down list box.
ZyWALL 2 Series User’s Guide 11-14 Firewall Screens Figure 11-7 Fire wall IP Config Screen Step 4. Select Any in the Destination Address box and then click DestDelete .
ZyWALL 2 Series User’s Guide Firewall Screens 11-15 Step 5. Click DestAdd under t h e Destination Addre ss box. Step 6. Configure the Firewall Rule Edit IP screen as follows and click Apply .
ZyWALL 2 Series User’s Guide 11-16 Firewall Screens Custom port s show up with an “*” before their names in the Services list box and the Rule Summary list box. Click Apply after y ou’ve created your custom port. Figure 11-10 My Service Rule Configuration This is the address range of the “My Service” servers.
ZyWALL 2 Series User’s Guide Firewall Screens 11-17 On completing the configuration pro cedure for this Internet firewall rule, the Rule Summary screen should look like the following. Remember to click Apply when you hav e finished co nfiguring your rule(s) to save your settings back to the ZyWALL.
ZyWALL 2 Series User’s Guide 11-18 Firewall Screens 11.8 Predefined Services The Available Services list box in the Rule Config (uration) screen (see Figure 11-4 ) displays all predefined services that the ZyWALL already s upports. Next to the na me of the se rvice, two fields appea r in brack ets.
ZyWALL 2 Series User’s Guide Firewall Screens 11-19 Table 11-5 Predefined Services SERVICE DESCRIPTION IPSEC_TUNNEL(ESP:0) The IPSEC ESP (Encapsulation Se curity Protocol) tunnelin g protocol uses this service. IRC(TCP/UDP:6667) This is another popu lar Internet chat program.
ZyWALL 2 Series User’s Guide 11-20 Firewall Screens Table 11-5 Predefined Services SERVICE DESCRIPTION SMTP(TCP:25) Simple Mail Transfer Protocol is the message-exchange standard for the Internet. SMTP enables you to move messages from one e-mail server to another.
ZyWALL 2 Series User’s Guide Firewall Screens 11-21 11.9.1 Threshold V alues Tune these parameters when something is not work ing and after you have checked the firewall counters. These default values should work fi ne for normal small offices with ADSL bandwidth.
ZyWALL 2 Series User’s Guide 11-22 Firewall Screens Whenever the number of hal f-open sessions with t he same dest ination hos t address rises above a threshol d ( TCP Maximum Incomplete ), the ZyWAL L starts deleting half-open sessions according to one of the followin g methods: 1.
ZyWALL 2 Series User’s Guide Firewall Screens 11-23 Table 11-6 Attack Alert LABEL DESCRIPTION DEFAULT VALUES Generate alert when attack detected A detected attack automatically generates a log entry. Check this box to generate a n alert (as well as a log) whenever an attack is detected.
ZyWALL 2 Series User’s Guide 11-24 Firewall Screens Table 11-6 Attack Alert LABEL DESCRIPTION DEFAULT VALUES Maximum Incomplete High This is the number of existing half-open sessions that causes the firewall to start deleting half-open sessio ns.
ZyWALL 2 Series User’s Guide Content Filtering Screens 12-1 Chapter 12 Content Filtering Screens This chapter provides a brief overview of content filtering using the web embedded configurator . 12.1 Introduction to Content Filtering Internet content filtering allows you to c reate and enforce Internet access policies tailored to their needs.
ZyWALL 2 Series User’s Guide 12-2 Content Filtering Screens Figure 12-1 Content Filte r : General The following table describes the labels in this screen.
ZyWALL 2 Series User’s Guide Content Filtering Screens 12-3 Table 12-1 Content Filter : General LABEL DESCRIPTION Enable Content Filter Select this ch eck box to enabl e the content filter. Restrict Web Features : Select the check box(es) to restrict a feature.
ZyWALL 2 Series User’s Guide 12-4 Content Filtering Screens Table 12-1 Content Filter : General LABEL DESCRIPTION Exclude specified address ranges from the content filter enforcement Select this checkbox to exempt a specific range of users o n your LAN from content filter policies.
ZyWALL 2 Series User’s Guide Content Filtering Screens 12-5 Step 1. A computer se nds an HTTP request t o a web serve r . Step 2. The ZyWALL looks up the web site in its cache. If an attem pt to access the web site was made in the past, a record of that web site’s categ ory will be in the ZyWALL’s cache.
ZyWALL 2 Series User’s Guide 12-6 Content Filtering Screens Figure 12-3 Content Filte r : Categories.
ZyWALL 2 Series User’s Guide Content Filtering Screens 12-7 The following table describes the labels in this screen. Table 12-2 Content Filter : Ca tegories LABEL DESCRIPTION Enable Web Site Auto Ca.
ZyWALL 2 Series User’s Guide 12-8 Content Filtering Screens Table 12-2 Content Filter : Ca tegories LABEL DESCRIPTION Select Categories Select All Categories Select this check box to restrict access to all site categories listed below. Clear All Categories Select this check bo x to clear the selected categories belo w.
ZyWALL 2 Series User’s Guide Content Filtering Screens 12-9 Table 12-2 Content Filter : Ca tegories LABEL DESCRIPTION Gambling Selecti ng this category exclu des pages where a user can place a bet or participate in a betting pool (includi ng lotteries) online.
ZyWALL 2 Series User’s Guide 12-10 Content Filtering Screens Table 12-2 Content Filter : Ca tegories LABEL DESCRIPTION Education Selecti ng this category exclu des pages that offer educational inform ation, distance learning and trade s chool information or programs.
ZyWALL 2 Series User’s Guide Content Filtering Screens 12-11 Table 12-2 Content Filter : Ca tegories LABEL DESCRIPTION Computers/Internet Selecti ng this category exclud e s pages that sponsor or provide inform ation on computers, technology, the Internet and tech nology-related organizati ons and companies.
ZyWALL 2 Series User’s Guide 12-12 Content Filtering Screens Table 12-2 Content Filter : Ca tegories LABEL DESCRIPTION Shopping Selecting this category exc ludes pages that provide or a dvertise the means to obtain goods or services. It does not include pages that can be class ified in other categories (such as vehicles or weapons).
ZyWALL 2 Series User’s Guide Content Filtering Screens 12-13 Table 12-2 Content Filter : Ca tegories LABEL DESCRIPTION Software Downloads Selecting this category exclu des pages that are dedicated to the electro nic download of software packages, whether for payment or at no charge.
ZyWALL 2 Series User’s Guide 12-14 Content Filtering Screens Table 12-2 Content Filter : Ca tegories LABEL DESCRIPTION Register Click Register to go to a w eb site where you can register for category-based content filtering (using an external da tabase).
ZyWALL 2 Series User’s Guide Content Filtering Screens 12-15 Figure 12-4 Content Filte r : Customization.
ZyWALL 2 Series User’s Guide 12-16 Content Filtering Screens The following table describes the labels in this screen. Table 12-3 Content Filter : Customization LABEL DESCRIPTION Web Site List Customization Enable Web site customization Select this check box to allo w Trusted Domain web sites and block Forbidden Domain web sites.
ZyWALL 2 Series User’s Guide Content Filtering Screens 12-17 Table 12-3 Content Filter : Customization LABEL DESCRIPTION Delete Select a web site name from the Forbidden We b Site List , and then click this button to delete it from that list.
.
VPN/IPSec VI Part VI: VPN/IPSec This part prov ides information on how to configure VP N/IPSec..
.
ZyWALL 2 Series User’s Guide Introduction to IPSec 13-1 Chapter 13 Introduction to IPSec This chapter introduces the basics of IPSec VPNs. 13.1 VPN Overview A VPN (Virt ual Private Network) pr ovides secure communi cations betwe en sites wi thout the expe nse of leased site-to-site lines.
ZyWALL 2 Series User’s Guide 13-2 Introduction to IPSec Figure 13-1 Encryption and Dec ryption Dat a Confidentiality The IPSec sender can enc rypt packets befo re transmitting them across a network.
ZyWALL 2 Series User’s Guide Introduction to IPSec 13-3 13.2 IPSec Architecture The overall IPSec architect ure is shown as follows. Figure 13-2 IPSec Architecture 13.
ZyWALL 2 Series User’s Guide 13-4 Introduction to IPSec 13.3 Encap sulation The two modes of ope ration for IPSec VPNs are Tr ansport mode and Tu nnel mode. Figure 13-3 Transport and Tunnel Mo de IPSec Encapsulation 13.3.1 T ransport Mode Transport m ode is used to protect u pper lay er protoc ols and only affects t he data in the IP packet.
ZyWALL 2 Series User’s Guide Introduction to IPSec 13-5 13.4 IPSec and NA T Read this section if you are running IPS ec on a host computer be hind the ZyWALL.
.
ZyWALL 2 Series User’s Guide VPN Screens 14-1 Chapter 14 VPN Screens This chapter introduces the VPN Web configurat or. See the Logs chapter for information on viewing logs and the appendix for IPSe c log descriptions. 14.1 VPN/IPSec Overview Use the screens docum ented in this chapter to config uring and managing a VPN con nection.
ZyWALL 2 Series User’s Guide 14-2 VPN Sc reens Table 14-1 AH and ESP ESP AH DES (default) Data Encryption Standard (D ES) is a widely used method of data encryption using a pr ivate (secret) key. DES applies a 56-bit key to each 64-bit block of dat a.
ZyWALL 2 Series User’s Guide VPN Screens 14-3 You can also enter a remote secure g ateway’s domain name in the Secure Gateway Address field if the remote secure gateway has a dyn amic WAN IP address and is u sing DDNS.
ZyWALL 2 Series User’s Guide 14-4 VPN Sc reens Figure 14-2 VPN Rules The following table describes the fields in this screen. Table 14-2 VPN Rules LABEL DESCRIPTION # This field displays the VPN rule number. Name This field displa ys the identi fication name for this VPN policy.
ZyWALL 2 Series User’s Guide VPN Screens 14-5 Table 14-2 VPN Rules LABEL DESCRIPTION Remote IP Address This is the IP address(es) of computer(s) on the remote network be hind the remote IPSec router. This field displays N/A when th e Secure Gateway Address field displays 0.
ZyWALL 2 Series User’s Guide 14-6 VPN Sc reens When there is outbound traffic w ith no inbound traffic, the ZyW ALL automatically drop s the tunnel af ter two minutes. 14.7 NA T T raversal NAT traversal allows you to set up a VPN connection when there are NAT router s between IPSec routers A and B.
ZyWALL 2 Series User’s Guide VPN Screens 14-7 14.7.2 X-Auth (Extended Authentication) Extended a uthentication provides a dded security by allowi ng you to use usernam es and passwords for VP N connections. This is esp ecially helpful when multiple ZyWALLs use one VPN rule t o connect to a single ZyWALL.
ZyWALL 2 Series User’s Guide 14-8 VPN Sc reens If you do not specify an Intranet DNS server on the remote network, the n the VPN host must use IP addresses to access the compu ters on the remote net w ork. 14.8 ID T y pe and Content With aggressiv e negotiat ion m ode (see section 14.
ZyWALL 2 Series User’s Guide VPN Screens 14-9 Table 14-4 Peer ID Type and Conten t Fields PEER ID TYPE= CONTENT= IP Type the IP address of the computer wi th which you will make the VPN connection or leave the field blank to have t he ZyWALL automatically use the address i n the Secure Gateway field.
ZyWALL 2 Series User’s Guide 14-10 VPN Screens Table 14-6 Mismatching ID Ty pe and Content Configuration Example ZYWALL A ZYW ALL B Peer ID type: E-mail Peer ID type: IP Peer ID content: aa@yahoo.com Peer ID content: N/A 14.9 Pre-Shared Key A pre-shared key identifies a comm unicating party during a phase 1 IKE negotiati on (see section 14.
ZyWALL 2 Series User’s Guide VPN Screens 14-11 Figure 14-6 Site-to-Site VPN Example 14.11 Configuring Basic IKE VPN Rule Setup Select one of the VPN rules i n the VPN Rules screen and clic k Edit or click the Rule Setu p tab on the ZyWALL 2WE to configure the rule’s setting s.
ZyWALL 2 Series User’s Guide 14-12 VPN Screens Figure 14-7 Basic IKE VPN Rule Edit.
ZyWALL 2 Series User’s Guide VPN Screens 14-13 The following table describes the fields in this screen. Table 14-7 Basic IKE VPN Rule Edit LABEL DESCRIPTION Active Select this che ck box to activate this VPN tunnel. This option determines whether a VPN rule is applied before a packet leaves the fire wall.
ZyWALL 2 Series User’s Guide 14-14 VPN Screens Table 14-7 Basic IKE VPN Rule Edit LABEL DESCRIPTION Server Mode Select Server Mode to have this ZyWALL authenticat e extended auth entication clients that request this VPN connection.
ZyWALL 2 Series User’s Guide VPN Screens 14-15 Table 14-7 Basic IKE VPN Rule Edit LABEL DESCRIPTION Local IP Address Enter a static local IP addr ess. The local IP address must correspond to the remote IPSe c router's configured remote IP addresses.
ZyWALL 2 Series User’s Guide 14-16 VPN Screens Table 14-7 Basic IKE VPN Rule Edit LABEL DESCRIPTION Ending IP Address/ Subnet Mask When the Address T ype field is configured to Single Address , this field is N/A.
ZyWALL 2 Series User’s Guide VPN Screens 14-17 Table 14-7 Basic IKE VPN Rule Edit LABEL DESCRIPTION Local ID Type Select IP to identify this ZyWALL by its IP address. Select DNS to identify this Z yWALL by a domain name. Select E-mail to identify this ZyWALL by an e-mail ad dress.
ZyWALL 2 Series User’s Guide 14-18 VPN Screens Table 14-7 Basic IKE VPN Rule Edit LABEL DESCRIPTION Peer ID Type Select from the following when you set Authentication Method to Pre-shared Key . Select IP to identify the remote IPSec router by its IP address.
ZyWALL 2 Series User’s Guide VPN Screens 14-19 Table 14-7 Basic IKE VPN Rule Edit LABEL DESCRIPTION Content The configuration of the peer content dep ends on the peer ID type. Do the following when you set Authentication Method to Pre-shared Key . For IP , type the IP address of the computer with which you will make the VPN connection.
ZyWALL 2 Series User’s Guide 14-20 VPN Screens Table 14-7 Basic IKE VPN Rule Edit LABEL DESCRIPTION My IP Address Enter the WAN IP address of your ZyWALL. The VPN tunnel has to be rebuilt if this IP address changes. The following applies if this field is configure d as 0.
ZyWALL 2 Series User’s Guide VPN Screens 14-21 Table 14-7 Basic IKE VPN Rule Edit LABEL DESCRIPTION Encryption Algorithm Select DES , 3DES , AE S or NULL from the drop-down list box.
ZyWALL 2 Series User’s Guide 14-22 VPN Screens Figure 14-8 T wo Phases to Set Up the IPSec SA In phase 1 you m ust: Choose a negot iation m ode. Authenticate the connection by en tering a pre-shar ed key. Choo se an en cryption a lgorith m.
ZyWALL 2 Series User’s Guide VPN Screens 14-23 IPSec SA lifetime period ex pires. The ZyWALL als o automatically renegotiates th e IPSec SA if both IPSec routers have keep alive enabled, even i f there is no traffic. If an IPSec SA tim es out, then the IPSec router must renegotiate the SA the next time someone attempts to send traffic.
ZyWALL 2 Series User’s Guide 14-24 VPN Screens 14.12.5 Perfect Forward Secrecy (PFS) Enabling PFS means that the key is tran sient. The key is thrown away and replaced by a brand new key using a new Diffie -Hellm an exchange fo r each new I PSec SA set up.
ZyWALL 2 Series User’s Guide VPN Screens 14-25 Figure 14-9 Advanced IKE VPN Rule Setup The following table describes the fields in this screen. Table 14-8 Advanced IKE VPN Rule Setup LA BEL DESCRIPTION Protocol Enter 1 for ICMP, 6 for TCP, 17 for UDP, etc.
ZyWALL 2 Series User’s Guide 14-26 VPN Screens Table 14-8 Advanced IKE VPN Rule Setup LA BEL DESCRIPTION Enable Replay Detection As a VPN setup is processing intensive, the system is vulnerable to Denial of Service (DoS) attacks The IPSec receiver can detect and reject old or duplicate p ackets to protect against replay attacks.
ZyWALL 2 Series User’s Guide VPN Screens 14-27 Table 14-8 Advanced IKE VPN Rule Setup LA BEL DESCRIPTION Authentication Algorithm Select SHA1 or MD5 from the drop-down list box. MD5 (Message Digest 5) and SHA1 (Secure Hash Algorithm) are hash algorith ms used to authenticate packet data.
ZyWALL 2 Series User’s Guide 14-28 VPN Screens Table 14-8 Advanced IKE VPN Rule Setup LA BEL DESCRIPTION SA Life Time (seconds) Define the length of time before an IKE SA autom atically renegotiates i n this field. It may range from 180 to 3,000,000 seconds (almost 35 days).
ZyWALL 2 Series User’s Guide VPN Screens 14-29 Select Manual Key (or Man ual ) in the Key Mana gement (or IPSec Keying Mode ) field to display the manual VPN rule setup screen .
ZyWALL 2 Series User’s Guide 14-30 VPN Screens The following table describes the labels in this screen. Table 14-9 VPN Manual Setup LABEL DESCRIPTION Active Select this check box to activate this VPN policy. Name Type up to 32 characters to i dentify th is VPN policy.
ZyWALL 2 Series User’s Guide VPN Screens 14-31 Table 14-9 VPN Manual Setup LABEL DESCRIPTION Remote: Remote IP addresses must be static and correspo nd to the remote IPSec router's configured local IP addresses. Two active SAs cannot have the local and remote IP address(es) both the same.
ZyWALL 2 Series User’s Guide 14-32 VPN Screens Table 14-9 VPN Manual Setup LABEL DESCRIPTION Secure Gateway Addr Type the WAN IP address or the URL (up to 31 characters) of the IPSec router with which you're making the VPN connection. SPI Type a unique SPI (Security Parameter Index) from one to four characters long.
ZyWALL 2 Series User’s Guide VPN Screens 14-33 Table 14-9 VPN Manual Setup LABEL DESCRIPTION Authentication Key Type a unique authentication key to be used by IPSec if applicable. Enter 16 characters for MD5 authentication or 20 cha racters for SHA-1 authentication.
ZyWALL 2 Series User’s Guide 14-34 VPN Screens The following table describes the fields in this screen. Table 14-10 VPN SA Monitor LA BEL DESCRIPTION # This is the security association inde x number. Name This field displays the identifi cation name for this VPN policy.
ZyWALL 2 Series User’s Guide VPN Screens 14-35 Table 14-11 VPN Global Setting LA BEL DESCRIPTION Windows Networking (NetBIOS over TCP/IP) NetBIOS (Network Basic Input/Output System) are TCP or UDP broadcast pa ckets that enable a computer to connect to and communicate with a LAN.
ZyWALL 2 Series User’s Guide 14-36 VPN Screens Figure 14-13 Telecommuters Sharing One VPN Ru le Example Table 14-12 Telecommuters Sharing One VPN Rule Example FIELDS TELECOMMUTERS HEADQUARTERS My IP Address: 0.0.0.0 (dynamic IP address assigned by the ISP) Public static IP address Secure Gateway IP Address: Public static IP address 0.
ZyWALL 2 Series User’s Guide VPN Screens 14-37 See the following table and fi gure for an exam ple wh ere three telecommuters each use a diffe rent VPN rule for a VPN connection with a Zy W ALL located at he adquarters.
ZyWALL 2 Series User’s Guide 14-38 VPN Screens Table 14-13 Telecommuters Using Unique VPN Rules Example TELECOMMUTERS HEADQUARTERS Local IP Address: 192.168.2.12 Secure Gateway Address: telecommuter1.com Remote Address 192.168.2.12 Telecommuter B (telecommuter b.
VPN/IPSec VII Part VII: Certificates This part provides informati on and configurat ion instructions for public-key certificates..
.
ZyW ALL 2 Series User’s Guide Certificates 15-1 Chapter 15 Certificates This chapter gives background information about public-key certificates and explains how to use them. This chapter is only app licable to the ZyWALL 2. 15.1 Certificates Overview The ZyWALL can use ce rtificates (also called digital IDs) to authenticate users.
ZyW ALL 2 Series User’s Guide 15-2 Certificates Certification authorities maintain directory servers w ith databases of valid and revok ed certificates. A directory of certificates that have been revoked before th e scheduled expiration is called a CRL (Certificate Revocation List).
ZyW ALL 2 Series User’s Guide Certificates 15-3 15.4 My Certificates Click CERTIFICATES , My Certificates to open the ZyWALL’s summary list of certificates and certification requests. Certificates display in black and certification requests disp lay in gray.
ZyW ALL 2 Series User’s Guide 15-4 Certificates Table 15-1 My Certificate s LABEL DESCRIPTION PKI Storage Space in Use This bar displays the percent age of the Zy WALL’s PKI storage space that is currently in use. When you are using 8 0% or less of the storage space, t he bar is green.
ZyW ALL 2 Series User’s Guide Certificates 15-5 Table 15-1 My Certificate s LABEL DESCRIPTION Details Select the radio button next to a cert ificate’s index number and the n click Details to open a screen with an in-depth list of information ab out that certificate.
ZyW ALL 2 Series User’s Guide 15-6 Certificates 15.6 Importing a Certificate Click CERTIFICATES , My Certificates and then Import to open the My Certificate Import screen. Follow the instructions in this screen to save an exis ting certificate to the ZyWALL , see the following figure.
ZyW ALL 2 Series User’s Guide Certificates 15-7 Table 15-2 My Certificate Import LA BEL DESCRIPTION Apply Click Apply to save the certificate on the ZyWALL.
ZyW ALL 2 Series User’s Guide 15-8 Certificates The following table describes the labels in this screen. Table 15-3 My Certificate Create LABEL DESCRIPTION Certificate Name Type up to 31 ASCII characte rs (not including spaces) to identify this certificate.
ZyW ALL 2 Series User’s Guide Certificates 15-9 Table 15-3 My Certificate Create LABEL DESCRIPTION Create a certification request and enroll for a certificate immediately online Select Create a cert.
ZyW ALL 2 Series User’s Guide 15-10 Certificates After you click Apply in th e My Certificate Create screen, you see a screen that tells you the ZyWALL is generating the self-signed certifi cate or certification request.
ZyW ALL 2 Series User’s Guide Certificates 15-1 1 Figure 15-5 My Certificate Details.
ZyW ALL 2 Series User’s Guide 15-12 Certificates The following table describes the labels in this screen. Table 15-4 My Certificate Details LABEL DESCRIPTION Name This field displays the identifying name of this certificate. If you want to change the name, type up to 31 characters to ident ify this certificate.
ZyW ALL 2 Series User’s Guide Certificates 15-13 Table 15-4 My Certificate Details LABEL DESCRIPTION Signature Algorithm This field displays the t ype of algorithm that was used to sign the certificate. The ZyWALL uses rsa-pkcs1-sha1 (RSA public- private key encryption algorith m and the SHA1 hash algorithm).
ZyW ALL 2 Series User’s Guide 15-14 Certificates Table 15-4 My Certificate Details LABEL DESCRIPTION Certificate in PEM (Base-64) Encoded Format This read-only text bo x displa ys the certific ate or certif ication request in Privac y Enhanced Mail (PEM) format.
ZyW ALL 2 Series User’s Guide Certificates 15-15 Figure 15-6 Trusted CAs The following table describes the labels in this screen. Table 15-5 Trusted CAs LABEL DESCRIPTION PKI Storage Space in Use This bar displays the percent age of the Zy WALL’s PKI storage space that is currently in use.
ZyW ALL 2 Series User’s Guide 15-16 Certificates Table 15-5 Trusted CAs LABEL DESCRIPTION Issuer This field displa ys identifying informati on about the certificate’ s issuing certification authority, such as a common name, organ iza tional unit or department, organization or company and country.
ZyW ALL 2 Series User’s Guide Certificates 15-17 Y ou must remove any sp aces from the certificate’ s filename before you can import the certificate.
ZyW ALL 2 Series User’s Guide 15-18 Certificates Figure 15-8 Trusted CA Details.
ZyW ALL 2 Series User’s Guide Certificates 15-19 The following table describes the labels in this screen. Table 15-7 Trusted CA Details LABEL DESCRIPTION Name This field displays the identifying name of this certificate. If you want to change the name, type up to 31 characters to identif y this key certificate.
ZyW ALL 2 Series User’s Guide 15-20 Certificates Table 15-7 Trusted CA Details LABEL DESCRIPTION Signature Algorithm This field displays the type of al gorithm that was used to sign the certificate. Some certification authorities use rsa-pkcs1-sh a1 (RSA public-private ke y encryption algorithm and the SHA1 hash algorithm).
ZyW ALL 2 Series User’s Guide Certificates 15-21 Table 15-7 Trusted CA Details LABEL DESCRIPTION Certificate in PEM (Base-64) Encoded Format This read-only text bo x displa ys the certific ate or certif ication request in Privac y Enhanced Mail (PEM) format.
ZyW ALL 2 Series User’s Guide 15-22 Certificates Figure 15-9 Trusted Remote Hosts The following table describes the labels in this screen. Table 15-8 Trusted Remo te Hosts LABEL DESCRIPTION PKI Storage Space in Use This bar displays the percent age of the Zy WALL’s PKI storage space that is currently in use.
ZyW ALL 2 Series User’s Guide Certificates 15-23 Table 15-8 Trusted Remo te Hosts LABEL DESCRIPTION Subject This field displa ys identifying informa tion about the certificate’s o wner, such as CN (Common Name), OU (Organizational Unit or department), O (Organizatio n or company) and C (Country).
ZyW ALL 2 Series User’s Guide 15-24 Certificates Table 15-9 Remote Host Certificates Step 3. Double-click the certificate’s icon to open the Certificate window. Click th e Details tab and scroll down to the Thumbprint Algorithm and Thumbpri nt fields.
ZyW ALL 2 Series User’s Guide Certificates 15-25 The trusted remote host certi ficate must be a self-signed certificate; and you must remove any sp aces from its filename before y ou c an import it. Figure 15-10 Trusted Remote Ho st Import The following table describes the labels in this screen.
ZyW ALL 2 Series User’s Guide 15-26 Certificates Figure 15-11 Trusted Remote Ho st Details.
ZyW ALL 2 Series User’s Guide Certificates 15-27 The following table describes the labels in this screen. Table 15-12 Trusted Remote Host Details LABEL DESCRIPTION Name This field displays the identifying name of this certificate. If you want to change the name, type up to 31 characters to identif y this key certificate.
ZyW ALL 2 Series User’s Guide 15-28 Certificates Table 15-12 Trusted Remote Host Details LABEL DESCRIPTION Key Algorithm T his field displays the type of algo rithm that was used to generate the certificate’s key pair (the ZyWALL uses RSA encr yption) and the length of the key set in bits (1024 bits for example).
ZyW ALL 2 Series User’s Guide Certificates 15-29 15.16 Directory Servers Click CERTIFICATES , Directory Serve rs to open the Directory Servers screen. This screen displays a summary li st of directory servers (that contain l ists of vali d and revoke d certificates) that have bee n saved into the ZyWALL.
ZyW ALL 2 Series User’s Guide 15-30 Certificates Table 15-13 Directory Servers LABEL DESCRIPTION Port This field displays the port num ber that the directory server uses.
ZyW ALL 2 Serie s User ’s Guide Certificates 15-31 Table 15-14 Directory Server Add LABEL DESCRIPTION Directory Service Setting Name Type up to 31 ASCII characters (spaces are not permitted) to identif y this directory server. Access Protocol Use the drop-do wn list box to select the access protocol used by the directory server.
.
Remote Management and UPnP VIII Part VIII: Authentication Server, Remote Management and UPnP This part prov ides information and config uration in structions for configuration of the authentication server screens, remote managem ent and Universal Plug and Play .
.
ZyWALL 2 Series User’s Guide Authentication Server 16-1 Chapter 16 Authentication Server This chapter discusses how to configure the authentication server on the ZyWALL.
ZyWALL 2 Series User’s Guide 16-2 Authentication Server Figure 16-1 Local User Database.
ZyWALL 2 Series User’s Guide Authentication Server 16-3 The following table describes the fields in this screen. Table 16-1 Local User Databa se LABEL DESCRIPTION Active Select this check box to enabl e the user profile. User Name Enter the user name of the user profil e.
ZyWALL 2 Series User’s Guide 16-4 Authentication Server Figure 16-2 RADIUS The following table describes the fields in this screen. Table 16-2 RADIUS LABEL DESCRIPTION Authentication Server Active Enable this feature to have the ZyWALL use an external authentication ser ver in performing user authentication.
ZyWALL 2 Series User’s Guide Authentication Server 16-5 Table 16-2 RADIUS LABEL DESCRIPTION Port Number The default por t of the RADIUS server for authentication is 1812 . You need not change this value unl ess your network adminis trator instructs you to do so with additional information.
.
ZyWALL 2 Series User’s Guide Remote Management Screens 17-1 Chapter 17 Remote Management Screens This chapter provides information on the Remote Management screens. 17.1 Remote Management Overview Remote management allows you to determ ine whic h services/protocols can access which ZyWALL interface (if any) fr om which computers .
ZyWALL 2 Series User’s Guide 17-2 Remote Management Screens 17.1.1 Remote Management Limitations Remote ma nagement over LAN or WAN wil l not work when: 1. A filter in SMT menu 3.1 (LAN) or in m enu 11.5 (WAN) is applied to block a Telnet, FTP or Web service.
ZyWALL 2 Series User’s Guide Remote Management Screens 17-3 data), authenti cation (one party can identify the other pa rty) and data integrity ( you know if data has been changed). It relies upon certificates, public ke ys, and private keys (see the Certificates chapter for more info rmation).
ZyWALL 2 Series User’s Guide 17-4 Remote Management Screens If you disable HTTP Serv er Access ( Disable ) in the REMOTE MGMT WWW screen, then the ZyW ALL blocks all HTTP connection attempt s. 17.3 Configuring WWW To change your ZyWALL’s web settings, click REMOTE MG NT , then th e WWW tab.
ZyWALL 2 Series User’s Guide Remote Management Screens 17-5 Table 17-1 WWW LABEL DESCRIPTION HTTPS: This feature is not availa ble on the ZyWALL 2WE.
ZyWALL 2 Series User’s Guide 17-6 Remote Management Screens Table 17-1 WWW LABEL DESCRIPTION Reset Click Reset to beg in configuring this screen afresh.
ZyWALL 2 Series User’s Guide Remote Management Screens 17-7 17.4.2 Netscape Navigator W arning Messages When you attempt to access the ZyWAL L HTTPS server, a Website Certified by a n Unknown Authority screen pops up asking if you trus t the server certificate.
ZyWALL 2 Series User’s Guide 17-8 Remote Management Screens Figure 17-5 Security Certifica te 2 (Netscape) 17.4.3 A voiding the Brow ser Warning Messages The following describes the main reason s that your browser disp lays warnings about the ZyWALL’s HTTPS server certificate and what you can do to avo id seeing the warnings .
ZyWALL 2 Series User’s Guide Remote Management Screens 17-9 Step 2. Click CERTIFICATES . Find the certificate and check its Subject column. CN sta nds for certificate’s common nam e (see Figure 17-9 for an examp le) . Use this procedure to have the ZyWALL use a cer tificate with a common name that matches the ZyWALL’s actual IP address.
ZyWALL 2 Series User’s Guide 17-10 Remote Management Screens Figure 17-6 Login Screen (Internet E xplorer).
ZyWALL 2 Series User’s Guide Remote Management Screens 17-11 Figure 17-7 Login Screen (Netsc ape) Click Login and you then see the ne xt screen. The factory default certificate is a comm on defau lt certificate for all ZyWALL models.
ZyWALL 2 Series User’s Guide 17-12 Remote Management Screens Figure 17-8 Replace Certificate Click Apply in th e Replace Certificate screen to create a ce rtificate using your ZyWALL ’s MAC address that will be specific to this device. Click CERTIFICATES to open the My Certificates screen.
ZyWALL 2 Series User’s Guide Remote Management Screens 17-13 Click Ignore in th e Replace Certificate screen to use the common ZyWALL certificate. You will then see this information in the My Certificates screen. Figure 17-10 Common ZyWALL Certifi cate 17.
ZyWALL 2 Series User’s Guide 17-14 Remote Management Screens Figure 17-11 SSH Communication Example 17.6 How SSH works The following table summarizes ho w a secure connection is established between two rem ote hosts. 1. Host Identificat ion The SSH client sends a connection request to the SSH server.
ZyWALL 2 Series User’s Guide Remote Management Screens 17-15 17.7 SSH Implement ation on the ZyW ALL Your ZyWAL L supports S SH versi on 1.5 usin g RSA aut h entication a nd three enc ryption m ethods (DES, 3DES and Bl owfish). T he SSH serve r is im plemented o n the Zy WALL for rem ote SMT m anagement and file transfer on port 22.
ZyWALL 2 Series User’s Guide 17-16 Remote Management Screens Table 17-2 SSH LABEL DESCRIPTION Server Host Key Select the certif icate whose correspond ing private key is to be used to identif y the ZyWALL for SSH connections.
ZyWALL 2 Series User’s Guide Remote Management Screens 17-17 Step 3. A window di splays pr ompting y ou to store the host key in you com puter. Click Yes to continue. Figure 17-14 SSH Example 1: Store Host Key Enter the password to log in to the ZyWALL.
ZyWALL 2 Series User’s Guide 17-18 Remote Management Screens Step 2. Enter “ ssh –1 192.168.1.1 ”. This command forces your c omputer to connect to the ZyWALL using SSH version 1. If this is the first time you are connecting to th e ZyWALL usin g SSH, a m essage displays prompt ing you to save the host information of the ZyWALL.
ZyWALL 2 Series User’s Guide Remote Management Screens 17-19 Step 3. Use the “ put ” command to upload a new firmware to the ZyWALL. Figure 17-17 Secure FTP: Firmware Upload Example 17.11 T elnet You can confi gure your ZyWALL for re mote Telnet access as sh own next.
ZyWALL 2 Series User’s Guide 17-20 Remote Management Screens 17.12 Configuring TELNET Click REMOTE MGNT to open the TEL NET screen. Figure 17-19 Telnet The following table describes the labels in this screen.
ZyWALL 2 Series User’s Guide Remote Management Screens 17-21 17.13 Configuring FTP You can upl oad and downl oad the ZyWALL’s fi rmware and co nfiguratio n files usi ng FTP, please see the chapter on firmware and configuration file maintenance for details.
ZyWALL 2 Series User’s Guide 17-22 Remote Management Screens Table 17-4 FTP LABEL DESCRIPTION Secure Client IP Address A secure client is a “trusted” computer that is allowed to communicate with the ZyWALL using this service. Select Al l to allo w any computer to access the ZyWALL usin g this service.
ZyWALL 2 Series User’s Guide Remote Management Screens 17-23 Figure 17-21 SNMP Management Mod el An SNMP m a naged netwo rk consists of two m ain types of compone nt: agents an d a manage r. An agent is a managem ent software m o dule that resides i n a managed device (the Zy WALL).
ZyWALL 2 Series User’s Guide 17-24 Remote Management Screens • Get - Allows the manager to retrieve an object variable from the agent. • GetNext - Allows the manager to retrieve the next object variable from a table or list within an agent.
ZyWALL 2 Series User’s Guide Remote Management Screens 17-25 17.14.3 REMOTE MANAGEMENT : SNMP To change your ZyWALL’s SNMP settings, click REMOTE MGNT , then th e SNMP tab . The sc reen appe ars as show n. Figure 17-22 SNMP The following table describes the fields in this screen.
ZyWALL 2 Series User’s Guide 17-26 Remote Management Screens Table 17-6 SNMP LABEL DESCRIPTION SNMP Configuration Get Community Enter the Get Community , which is the password for the incoming Get and GetNext requests from the management station. T he default is public and al lows all requests.
ZyWALL 2 Series User’s Guide Remote Management Screens 17-27 T o chang e your ZyW ALL ’ s DNS settings, click REMOTE MGNT , then the DNS tab. The screen appears as shown.
ZyWALL 2 Series User’s Guide 17-28 Remote Management Screens 17.16 Configuring Security T o change your ZyW ALL ’ s Security settings, click REMOTE MG NT , then the Security tab. T he screen appe ars as show n. If an outside user attempts to prob e an unsupported port on your ZyWALL, an ICMP response packet is automatically returned.
ZyWALL 2 Series User’s Guide Remote Management Screens 17-29 Table 17-8 Security LABEL DESCRIPTION Respond to Ping on The ZyWALL will not respond to an y incoming Ping requests when Disable is selected. Select LAN to repl y to incoming LAN Ping re quests .
.
ZyWALL 2 Series User’s Guide UPnP 18-1 Chapter 18 UPnP This chapter introduces the Universal Plug and Play feature. 18.1 Universal Plug and Play Overview Universal Plug and Play (U PnP) is a distri buted, open networking standard that uses TCP/IP fo r simple peer-to-peer network connectiv ity between dev ices.
ZyWALL 2 Series User’s Guide 18-2 UPnP 18.1.3 Cautions with UPnP The automat ed nature of N AT traversal applicat ions in esta blishing t heir own servi ces and ope ning fire wall ports may present netwo rk security issues. Netw ork inform ation and configuration m ay also be obtained and modifi ed by users i n some net work envi ronments.
ZyWALL 2 Series User’s Guide UPnP 18-3 Figure 18-1 Configuring UPnP The following table describes the fields in this screen. Table 18-1 Configuring UPnP FIELD DESCRIPTION Device Name This identifies the device in UPnP applicatio ns. Enable the Universal Plug and Play (UPnP) feature Select this checkbox to activate UPnP.
ZyWALL 2 Series User’s Guide 18-4 UPnP Table 18-1 Configuring UPnP FIELD DESCRIPTION Reset Click Reset to begin co nfiguring this screen afresh 18.4 Displaying UPnP Port Mapping Click UPnP and then Ports to display the screen as shown nex t. Use t his screen to view the NAT port mapping rules that UPnP creates on the ZyWALL.
ZyWALL 2 Series User’s Guide UPnP 18-5 Table 18-2 UPnP Ports LA BEL DESCRIPTION # This is the index number of the UPnP-created NAT mapping rule entry. Remote Host This field displays the source IP address (on the W AN) of inbound IP packets. Since this is often a wildcard, the field may be bla nk.
ZyWALL 2 Series User’s Guide 18-6 UPnP 18.5.1 Installing UPnP in Windows Me Follow the steps below to install UPnP in Windo ws Me. Click Start and Control Panel . Double-click Add/Remove Programs . Click on the Windows Setup tab and select Communication in the Components selection box.
ZyWALL 2 Series User’s Guide UPnP 18-7 Step 1. Click Start and Control Panel . Step 2. Double-click Network Connections . Step 3. In the Networ k Connections window, click Advanced in the main menu and select Optional Networking Components … . The Windows Opti onal Netw orking Components Wizard window displays.
ZyWALL 2 Series User’s Guide 18-8 UPnP 18.6 Using UPnP in Windows XP Example This section sh ows you ho w to use t he UPnP feat ure in Windows XP. You must already hav e UPnP installed in Wind ows XP and UPnP activate d on the device. Make sure the computer is connected to a LAN po rt of the device.
ZyWALL 2 Series User’s Guide UPnP 18-9 Step 4. You may edit or delete the port mappings or click Add to ma nually add port ma ppings. When the UPnP-enabled device is disconn ected from your computer , all port mappings will be deleted automaticall y .
ZyWALL 2 Series User’s Guide 18-10 UPnP 18.6.2 Web Configurator Easy Access With UPnP, you can access the web-base d configurator wi thout first finding out its IP a ddress. This is helpful if you do not know the I P address of your ZyWALL. Follow the steps below to access the web configur ator.
Logs IX Part IX: Logs This part prov ides information and instru ctions for the logs and repo rts..
.
ZyWALL 2 Series User’s Guide Log Screens 19-1 Chapter 19 Logs Screens This chapter contains informa tion about configuring general log s ettings and viewing the ZyWALL’s logs. Refer to appendices for example log message explanations. 19.1 Configuring View Log The web configurator allows you to look at all of the ZyWALL’s logs in one location.
ZyWALL 2 Series User’s Guide 19-2 Log Screens Figure 19-1 View Log The following table describes the labels in this screen. Table 19-1 View Log LABEL DESCRIPTION Display T he categories that you select in the Log Settings page (see section 19.2 ) display in the drop-down list box.
ZyWALL 2 Series User’s Guide Log Screens 19-3 Table 19-1 View Log LABEL DESCRIPTION Note This field displays additional informatio n about the log entry.
ZyWALL 2 Series User’s Guide 19-4 Log Screens Figure 19-2 Log Settings.
ZyWALL 2 Series User’s Guide Log Screens 19-5 The following table describes the labels in this screen. Table 19-2 Log Settings LABEL DESCRIPTION Address Info Mail Server Enter the server name or the IP address of the mail serv er for the e-mail addresses specified belo w.
ZyWALL 2 Series User’s Guide 19-6 Log Screens Table 19-2 Log Settings LABEL DESCRIPTION Time for Sending Log Enter the time of the day in 24-hour fo rmat (for example 23:00 equals 11:00 pm) to send the logs. Log Select the categories of logs that y ou want to record.
ZyWALL 2 Series User’s Guide Log Screens 19-7 The ZyWALL records web site hits by counting the HTTP GET packets. Ma ny web sites include HTTP GET references to other web sites and the ZyWALL may count these as hits, thus the web hit count is not (yet) 100% accurate.
ZyWALL 2 Series User’s Guide 19-8 Log Screens Table 19-3 Reports LABEL DESCRIPTION Refresh Click Refresh to update the re port display. The report also refreshes a utomatically when you close and reop en the screen. All of the recorded report s data is era sed when you turn off the Zy W ALL.
ZyWALL 2 Series User’s Guide Log Screens 19-9 Table 19-4 Web Site Hits Report LABEL DESCRIPTION Web Site T his column lists the domain names of the web sites visited most often from computers on the LAN. The names are rank ed by the num ber of visits to each web site and listed in descending order with the most visited web site listed first.
ZyWALL 2 Series User’s Guide 19-10 Log Screens Table 19-5 Protocol/ Port Report LABEL DESCRIPTION Protocol/Port T his column lists the protocols or service ports for which the most traffic has gone through the ZyWALL. The prot ocols or se rvice ports are listed in desce nding order with the most used protocol or service port listed first.
ZyWALL 2 Series User’s Guide Log Screens 19-11 The following table describes the labels in this screen. Table 19-6 LAN IP Address Rep ort LABEL DESCRIPTION IP Address T his column lists the LAN IP addresses to and/or from which the most traffic has been sent.
.
Maintenance X Part X: Maintenance This part covers the maint enance screens..
.
ZyWALL 2 Series User’s Guide Maintenance 20-1 Chapter 20 Maintenance This chapter displays system information such as firmware, port IP addresses and port traffic statistics. 20.1 Maintenance Overview The maintenance scree ns can help you view syst em info rm ation, uploa d new firm ware, manage configurat ion and restart your ZyWALL.
ZyWALL 2 Series User’s Guide 20-2 Maintenance The following table describes the labels in this screen. Table 20-1 System Status LA BEL DESCRIPTION Syst em Na me This is the System Name you chose in the first Internet Access Wizard screen. It is for identification purposes Model Name The model na me identifies your device t ype.
ZyWALL 2 Series User’s Guide Maintenance 20-3 Figure 20-2 System Status: Sho w Statistics The following table describes the labels in this screen. Table 20-2 System Status: Sho w Statistics LA BEL DESCRIPTION Port This is the WAN or LAN port.
ZyWALL 2 Series User’s Guide 20-4 Maintenance Table 20-2 System Status: Sho w Statistics LA BEL DESCRIPTION Stop Click Stop to stop refreshing statistics, click Stop . 20.3 DHCP T a ble Screen DHCP (Dynamic Ho st Configuration Protoco l, RFC 2131 and RFC 2132) allows indiv idual clients to obtain TCP/IP config uration at sta rt-up from a server.
ZyWALL 2 Series User’s Guide Maintenance 20-5 Table 20-3 DHCP Table LABEL DESCRIPTION IP Address This field displays the IP address relativ e to the # field listed above. Host Name T his field displays the computer host name. MAC Address This field sho ws the MAC address of the computer with the name in the Host Name field.
ZyWALL 2 Series User’s Guide 20-6 Maintenance The following table describes the fields in this screen. Figure 20-5 Firm ware Upload LA BEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse to find it.
ZyWALL 2 Series User’s Guide Maintenance 20-7 Figure 20-7 Net work Temporarily Disconnected After two m inutes, log in again an d check y our new fi rmware versi on in the System Status screen. If the upload was not successful, the fo llowing sc reen will appear.
ZyWALL 2 Series User’s Guide 20-8 Maintenance Figure 20-9 Configuration 20.5.1 Backup Configuration Backup Configurat ion allows you to back up (save) t he current syst em (ZyWALL) co nfiguratio n to your computer. Backup is high ly recommended once your ZyWALL is fun ctioning properly.
ZyWALL 2 Series User’s Guide Maintenance 20-9 20.5.2 Restore Configuration Restore Config uration allo ws you to restore a previ ously saved co nfigurati on file from your computer to you r ZyWALL.
ZyWALL 2 Series User’s Guide 20-10 Maintenance If you uploaded the d efault configuration file you may need to change t h e IP addre ss of you r comput er to be in the same subnet as that o f the defaul t device IP a ddress (192.1 68.1.1). S ee your Quick Start Guide for details on how to set up your computer’s IP address.
ZyWALL 2 Series User’s Guide Maintenance 20-11 You can also press the RESET button on the rear panel to reset the factory defaults of your ZyWALL. Refer to the section on resetting the ZyWALL for more information on the RES ET button. 20.6 Rest art Screen System restart allows you to reboot the ZyWALL without turning the power off.
.
SMT General Configuration XI Part XI: SMT General Configuration This part introduces the Sy stem Management T e rminal and covers t he General setup menu, W AN, LAN and wireless LAN setup, and Internet access. See the web configurator p arts of this guide for background information on features configurable by web configurator a nd SMT .
.
ZyWALL 2 Series User’s Guide Introducing the SMT 21-1 Chapter 21 Introducing the SMT This chapter explains how to a ccess the System Management Terminal and gives an overview of its menus.
ZyWALL 2 Series User’s Guide 21-2 Introducing the SMT 21.2.2 Entering the Password The login sc reen appea rs after y ou press [E NTER] , prom pting you to ent er the pas sword, as s hown below. For your first login, en ter the default password “ 1234 ”.
ZyWALL 2 Series User’s Guide Introducing the SMT 21-3 Table 21-1 Main Menu Commands OPERATION KEYSTROKES DESCRIPTION Entering information Fill in, or press [SPACE BAR], then press [ENTER] to select from choices. You need to fill in two types of fields.
ZyWALL 2 Series User’s Guide 21-4 Introducing the SMT Table 21-2 Main Menu Summary NO. Menu Title FUNCTION 1 General Setup Use this menu to set up dy namic DNS and administrativ e information. 2 WAN Setup Use this menu to clone a MAC address from a computer on your LAN and configure the backup WAN dial-up conn ection.
ZyWALL 2 Series User’s Guide Introducing the SMT 21-5 Menu 3 LAN S etup Menu 4 Internet Access Setu p Menu 12 S t atic Routing Setup Menu 11 Remote Node Setup Menu 1 1.1 Remote N ode Profil e (Backu p I SP) Menu 3.2 TCP/IP and DHCP Setu p ZyWALL Main Menu Menu 1 General Setup Menu 15 NA T Setup Menu 2 1 Filt er and Firew all Set up Menu 2 1 .
ZyWALL 2 Series User’s Guide 21-6 Introducing the SMT 21.4 Changing the System Password Change the sys tem passwor d by foll owing the ste ps shown next. Step 1. Enter 23 in the main menu to open Menu 23 - System Password as shown next. Figure 21-5 Menu 23: Sy stem Password Step 2.
ZyWALL 2 Series User’s Guide SMT Menu 1 – General Setup 22-1 Chapter 22 SMT Menu 1 - General Setup Menu 1 - General Setup contains adm inistrative and system-related information. 22.1 Introduction to General Setup Menu 1 - General Setup contains administrative and system-related information.
ZyWALL 2 Series User’s Guide 22-2 SMT Menu 1 – General Setup Table 22-1 Menu 1: General Setup FIELD DESCRIPTION EXAMPLE Domain Name Enter the dom ain name (if you kno w it) here. If you leave this field blank, the ISP may assign a domain name via DHCP.
ZyWALL 2 Series User’s Guide SMT Menu 1 – General Setup 22-3 Figure 22-2 Configure Dy namic DNS Follow the instructions in the next tabl e to configure Dynamic DNS parame ters. Table 22-2 Configure Dynamic DNS FIELD DESCRIPTION EXAMPLE Service Provider This is the name of your Dynamic DNS service provider.
ZyWALL 2 Series User’s Guide 22-4 SMT Menu 1 – General Setup Table 22-2 Configure Dynamic DNS FIELD DESCRIPTION EXAMPLE Offline T his field is only avail able when CustomDNS is selected i n the DDNS Type field. Press [SPACE BAR] and then [ENTER] to select Yes .
ZyWALL 2 Series User’s Guide WAN and Dial Backup Setup 23-1 Chapter 23 WAN and Dial Backup Setup This chapter describes how to configure the WAN using menu 2 and dial- backup using menus 2.1 and 11.1. 23.1 Introduction to W AN This chapte r explains how to configure set tings for your WAN port.
ZyWALL 2 Series User’s Guide 23-2 WAN and Dial Backu p Setup Table 23-1 MAC Address Cloning in WAN Setup FIELD DESCRIPTION EXAMPLE IP Address This field is applicable only if you choose the IP address attached on LA N method in the Ass igned By field.
ZyWALL 2 Series User’s Guide WAN and Dial Backup Setup 23-3 The following table describes the fields in this menu. Table 23-2 Menu 2: Dial Backup Setup FIELD DESCRIPTION EXAMPLE Dial-Backup: Active Use this field to turn the dial-backup feature on ( Yes ) or off ( No ).
ZyWALL 2 Series User’s Guide 23-4 WAN and Dial Backu p Setup Figure 23-3 Menu 2.1 Adv anced WAN Setup The followin g table descri bes fields i n this m enu. Table 23-3 Advanced WAN Port Setup: AT Commands Fields FIELD DESCRIPTION DEFAULT AT Command Strings: Dial Enter the AT Command string to make a call.
ZyWALL 2 Series User’s Guide WAN and Dial Backup Setup 23-5 Table 23-4 Advanced WAN Port Setup: Call Con trol Parameters FIELD DESCRIPTION DEFAULT Call Control Dial Timeout (sec) Enter a number of seconds for the ZyWALL to keep trying to set up an outgoing call before timi ng out (stopping).
ZyWALL 2 Series User’s Guide 23-6 WAN and Dial Backu p Setup Figure 23-4 Menu 11.1 Remote Node Profile (Back up ISP) The following table describes the fields in this menu. Table 23-5 Menu 11.1 Remote Node Profile (Back up ISP) FIELD DESCRIPTION EX AMPLE Rem Node Name Enter a descriptive name for the remote node.
ZyWALL 2 Series User’s Guide WAN and Dial Backup Setup 23-7 Table 23-5 Menu 11.1 Remote Node Profile (Back up ISP) FIELD DESCRIPTION EX AMPLE Pri Phone # Sec Phone # Enter the first (primary) phone number from the ISP for this remote node.
ZyWALL 2 Series User’s Guide 23-8 WAN and Dial Backu p Setup Table 23-5 Menu 11.1 Remote Node Profile (Back up ISP) FIELD DESCRIPTION EX AMPLE Idle Timeout Enter the number of seconds of idle time ( when there is no traffic from the ZyWALL to the remote node) that can elapse before th e ZyWALL automatically disconnects the PPP c onnectio n.
ZyWALL 2 Series User’s Guide WAN and Dial Backup Setup 23-9 23.7 Editing TCP/IP Options Move the cur sor to t he Edit IP field in m enu 11.1, the n press [SPACE BAR] to select Yes . Press [ENTER] to open Menu 11.3 - Remote Node Networ k Layer Options .
ZyWALL 2 Series User’s Guide 23-10 WAN and Dial Backup Setup Table 23-6 Menu 11.3: Remote No de Network Layer Option s FIELD DESCRIPTION EXAMPLE Network Address Translation Network Address Translati.
ZyWALL 2 Series User’s Guide WAN and Dial Backup Setup 23-11 23.8 Editing Login Script For some remote gate ways, text l ogin is re quired before PPP neg otiation i s started. T he ZyWALL provides a script facility for this purpose. The scrip t has six programmable sets; each set is composed of an ‘Expect’ string and a ‘ Send’ stri ng.
ZyWALL 2 Series User’s Guide 23-12 WAN and Dial Backup Setup Figure 23-8 Menu 11.4: Remote Nod e Script The following table describes the fields in this menu. T able 23-7 Menu 1 1.4: Remote Node Script FIELD DESCRIPTION EXAMPLE Active Press [SPACE BAR] and then [ENTER] to select either Yes to enable the AT strings or No to disable them.
ZyWALL 2 Series User’s Guide WAN and Dial Backup Setup 23-13 Figure 23-9 Menu 11.5: Dial Backup Remote No de Filter Menu 11.5 - Remote Node Filter Input Filter Sets: protocol filters= device filters.
.
ZyWALL 2 Series User’s Guide LAN Setup 24-1 Chapter 24 LAN Setup This chapter describes how to configure the LAN using Menu 3: LAN Setup . 24.1 Introduction to LAN Setup This chapter describes how to configure the ZyWALL for LAN c onnections. 24.2 Accessing the LAN Menus From the m ain menu, enter 3 to open Menu 3 – LA N Setup .
ZyWALL 2 Series User’s Guide 24-2 LAN Setup Figure 24-2 Menu 3.1: LAN Port Filte r Setup 24.4 TCP/IP and DHCP Ethernet Setup Menu From the main menu, enter 3 to open Menu 3 - LAN Setup to configure TCP/IP (RFC 1155) and DHCP Ethernet setup.
ZyWALL 2 Series User’s Guide LAN Setup 24-3 Figure 24-4 Menu 3.2: TCP/IP and DHCP Ethernet Setup Follow the instructions in the next table on how to con figure the DHCP fields. Table 24-1 DHCP Ethernet Setup Menu Fields FIELD DESCRIPTION EX AMPLE DHCP This field enables/disables the DHCP server.
ZyWALL 2 Series User’s Guide 24-4 LAN Setup Table 24-2 LAN TCP/IP Setup Menu F ields FIELD DESCRIPTION EXAMPLE TCP/IP Setup: IP Address Enter the IP address of your ZyWALL in dotte d decimal notation 192.168.1.1 (default) IP Subnet Mask Your Z yWALL will automatically calculate the subnet mask based on the IP address that you assi gn.
ZyWALL 2 Series User’s Guide LAN Setup 24-5 Figure 24-5 Physical Network Figure 24-6 Partitioned Logical Net work You must use menu 3.2 to confi gure the first networ k. Move the cursor t o the Edit IP Alias field, press [SPACE BAR] to choose Yes and press [ENTER] to configure the second an d third network.
ZyWALL 2 Series User’s Guide 24-6 LAN Setup Table 24-3 Menu 3.2.1: IP Alias Setup FIELD DESCRIPTION DEFAULT IP Address Enter the IP address of your ZyWALL in dotte d decimal notation. 192.168.2.1 IP Subnet Mask Your Z yWALL will automatically calculate the subnet mask based on the IP address that you assi gn.
ZyWALL 2 Series User’s Guide LAN Setup 24-7 Figure 24-8 Menu 3.5: Wireless LAN Setup The settings of all client st ations on the wireless LAN must match those of the ZyW A LL. Follow the instructions in the next table on how to con figure the wireless LAN parameters.
ZyWALL 2 Series User’s Guide 24-8 LAN Setup Table 24-4 Menu 3.5: Wireless LAN S etup FIELD DESCRIPTION EXAMPLE Frag. Threshold The threshold (number of byte s) for the fragmentation boundary for directed messages. It is the maximum data fragment size that can be sent.
ZyWALL 2 Series User’s Guide LAN Setup 24-9 Step 3. In the Edit MAC Address Filter field, press [SPACE BAR] to select Yes and press [ENTER]. Menu 3.5.1 – WLAN M AC Address Filter displays as shown next. Figure 24-9 Menu 3.5.1: WLAN M AC Address Filter The following table describes the fields in this menu.
.
ZyWALL 2 Series User’s Guide Internet Access 25-1 Chapter 25 Internet Access This chapter show s you how to configure you r ZyWALL for Internet acce ss. 25.1 Introduction to Internet Access Setup Use information from your ISP along with the instructio ns in this chapter to set up your ZyWALL to access the Internet.
ZyWALL 2 Series User’s Guide 25-2 Internet Access Table 25-1 Menu 4: Internet Acces s Setup (Ethernet) FIELD DESCRIPTION Encapsulation Press [SPACE BAR] and the n press [ENTER] to choose Ethernet . The encapsulation method influences your choices for the IP Address field.
ZyWALL 2 Series User’s Guide Internet Access 25-3 25.3 PPTP Encap sulation Point-to-Poi nt Tunnelin g Protocol (PPTP) is a network prot ocol that e nables secure tra nsfer of dat a from a remote client to a private server , creating a Vi rtual Private Network (VP N) using TC P/IP-based net works.
ZyWALL 2 Series User’s Guide 25-4 Internet Access Table 25-2 New Fields in Menu 4 (PPTP) Screen FIELD DESCRIPTION EXAMPLE Encapsulation Press [SPACE BAR] and the n press [ENTER] to choose PPTP . The encapsulation method influences your choices for the IP Address field.
ZyWALL 2 Series User’s Guide Internet Access 25-5 Figure 25-3 Internet Access Setup (PPPoE) The following table contains instructions about the new fi elds when y ou choose PPPoE in the Encapsulation fiel d in m enu 4.
.
SMT Advanced Applications XII Part XII: SMT Advanced Applications This part covers setting up remote nodes, IP st atic routes and Network Address T ranslation.
.
ZyWALL 2 Series User’s Guide Remote Node Setup 26-1 Chapter 26 Remote Node Setup This chapter shows you how to configure a remote node. 26.1 Introduction to Remote Node Setup A remote node is required for placing calls to a remote gateway. A remote node represents both the remote gateway and th e network be hind it acr oss a WAN c onnection.
ZyWALL 2 Series User’s Guide 26-2 Remote Node Setup Figure 26-1Menu 11.1: Remote Node Profile for Ethernet Encapsulation The following table describes the fields in this screen. Table 26-1 Menu 11.1: Remote No de Profile for Ethernet Encapsulation FIELD DESCRIPTION EXAMPLE Rem Node Name Enter a descriptive name for the remote node.
ZyWALL 2 Series User’s Guide Remote Node Setup 26-3 Table 26-1 Menu 11.1: Remote No de Profile for Ethernet Encapsulation FIELD DESCRIPTION EXAMPLE My Password Enter the password assigned by your ISP when the ZyWALL calls this remote node. Valid for PPPoE encapsulation only.
ZyWALL 2 Series User’s Guide 26-4 Remote Node Setup Encapsulation t o PPPoE, then you will see the next screen. Please see the appendix for m ore information on PPPoE.
ZyWALL 2 Series User’s Guide Remote Node Setup 26-5 Do not specify a nailed-up connection unless your telephone company offers flat- rate service or you need a constant connectio n and the co st is of no concern. The following tabl e describes the fields not already describe d in Table 26-1 .
ZyWALL 2 Series User’s Guide 26-6 Remote Node Setup 26.2.3 PPTP Encap sulation If you change t he Encapsulation to PPTP in menu 11.1, then you will see the next screen. Please see the appendix for i nformati on on PPTP. Figure 26-3 Menu 11.1: Remote Node Profile for PPTP Encapsulation The next table shows how to configure fields in menu 11.
ZyWALL 2 Series User’s Guide Remote Node Setup 26-7 26.3 Edit IP Move the cur sor to t he Edit IP field in m enu 11.1, the n press [SPACE BAR] to select Yes .
ZyWALL 2 Series User’s Guide 26-8 Remote Node Setup Table 26-4 Remote Node Net work Layer Options Menu Fields FIELD DESCRIPTION EXAMPLE My WAN Addr T his field is applicable to PPPoE and PPTP encapsulations only.
ZyWALL 2 Series User’s Guide Remote Node Setup 26-9 Table 26-4 Remote Node Net work Layer Options Menu Fields FIELD DESCRIPTION EXAMPLE Multicast IGMP (Internet Group Multicast Prot ocol) is a session-layer protocol us ed to establish membership in a Multicast group.
ZyWALL 2 Series User’s Guide 26-10 Remote Node Setup Figure 26-6 Menu 11.5: Remote Node Filter (PPPoE or PPTP Encapsulation) 26.5 T raffic Redirect To configure t he parameters for tra ffic redir ect, enter 11 from the main menu to display Menu 11.1— Remote Node Profile as shown next.
ZyWALL 2 Series User’s Guide Remote Node Setup 26-11 Table 26-5 Menu 11.1: Remote No de Profile (Traffic Redirect Field) FIELD DESCRIPTION EX AMPLE Edit Traffic Redirect Press [SPACE BAR] to select Yes or No . Select No (default) if you do not want to configure this feature.
ZyWALL 2 Series User’s Guide 26-12 Remote Node Setup Table 26-6 Menu 11.6: Traffic Redirect Setup FIELD DESCRIPTION EXAMPLE Active Press [SPACE BAR] and select Yes (to enable) or No (to disable) traffic redirect setup.
ZyWALL 2 Series User’s Guide Remote Node Setup 26-13 Table 26-6 Menu 11.6: Traffic Redirect Setup FIELD DESCRIPTION EXAMPLE When you have completed thi s menu, press [ENTER] at the prompt “Press [ENTER] to confirm or [ESC] to cancel” to save your configuration or press [E SC] to cancel and go back to the prev ious screen.
.
ZyWALL 2 Series User’s Guide IP Static Route Setup 27-1 Chapter 27 IP Static Route Setup This chapter shows you how to configu re static routes with your ZyWALL. 27.1 IP S t atic Route Setup Enter 12 fr om the m ain menu. Select on e of the IP static routes as shown ne xt to configure IP static routes in menu 12.
ZyWALL 2 Series User’s Guide 27-2 IP Static Route Setup Figure 27-2 Menu 12. 1: Edit IP Static Route `The followi ng table de scribes t he IP Static R oute Menu fi elds. T able 27-1 Menu 12. 1: Edit IP St atic Route FIELD DESCRIPTION Route # This is the index number of the static route that y ou chose i n menu 12.
ZyWALL 2 Series User’s Guide NAT 28-1 Chapter 28 Network Address Translation (NAT) This chapter discusses how to configure NAT on the ZyWALL. 28.1 Using NA T Y ou must create a firewall rule in addition to setting up SUA/NA T , to allow traffic from the W AN to be forwarded through the ZyW ALL.
ZyWALL 2 Series User’s Guide 28-2 NAT Figure 28-1 Menu 4: Apply ing NAT for Internet Access The following fig ure shows how you appl y NAT to the rem ote node in menu 11.1. Step 1. Enter 11 from the main menu. Step 2. Move the cur sor to t he Edit IP field, press [SPACE BAR] to select Yes and then press [ENTER] to bring up Menu 11.
ZyWALL 2 Series User’s Guide NAT 28-3 Table 28-1 Applying NAT in Menus 4 & 11.3 FIELD DESCRIPTION OPTIONS When you select this option the SMT will use Address Mapping Set 1 (menu 15.1 - see section 28.2.1 for further discussion). You can configure any of the mapping types describe d in the Web Configurator User’s Guide.
ZyWALL 2 Series User’s Guide 28-4 NAT Configure LAN IP addresses in NA T menus 15.1 and 15.2. 28.2.1 Address Mapping Sets Enter 1 to brin g up Menu 15.1 — Address Mapping Se ts . Figure 28-4 Menu 15.1: Address Mapping Sets SUA Address Mapping Set Enter 255 to display the next screen (see also section 28.
ZyWALL 2 Series User’s Guide NAT 28-5 Table 28-2 SUA Address Mapping Rules FIELD DESCRIPTION EXAMPLE Set Name T his is the name of the set yo u selected in menu 15.1 or enter the name of a new set you want to create. SUA Idx This is the index or rule number.
ZyWALL 2 Series User’s Guide 28-6 NAT Figure 28-6 Menu 15.1.1: First Set The T ype, Local and Global S t art/End IPs are configured in menu 15.1.1.1 (described later) and the v alues are displayed here. Ordering Y our Rules Ordering yo ur rules is important because the ZyWALL ap p lies the rules in the order that you specify.
ZyWALL 2 Series User’s Guide NAT 28-7 Table 28-3 Fields in Menu 15.1.1 FIELD DESCRIPTION EX AMPLE Set Name Enter a name for this set of rules. Th is is a required field. If this field is left blank, the entire set will be deleted. NAT_ SE T Action The default is Edit .
ZyWALL 2 Series User’s Guide 28-8 NAT The following table describes the fields in this screen. Table 28-4 Menu 15.1.1.1: Editing/Configuring an Indiv idual Rule in a Set FIELD DESCRIPTION EX AMPLE Type Press [SPACE BAR] and then [ENTER] to select from a total of five types.
ZyWALL 2 Series User’s Guide NAT 28-9 Step 5. Press [ENTER] at the “Press ENTER to confirm …” prompt to save your configuratio n after you define all the s ervers or press [ESC] at any time to cancel. Figure 28-8 Menu 15.2: NAT Serv er Setup You assign the private networ k IP addresse s.
ZyWALL 2 Series User’s Guide 28-10 NAT 28.4.1 Internet Access Only In the following Internet access ex am ple, you only need one rule wh ere al l your ILAs (Inside Local addresses) map t o one dy namic IGA (I nside Glo bal Address) assi gned by your ISP.
ZyWALL 2 Series User’s Guide NAT 28-11 28.4.2 Example 2: Internet A ccess w ith an Inside Server Figure 28-12 NAT Example 2 In this case, you do exactly as above (use the convenient pre-configured S UA Only set) and also go to menu 15.2 to specify the Inside Server behin d the NAT as s hown in the next fi gure.
ZyWALL 2 Series User’s Guide 28-12 NAT other LAN traffic to the remaining IGA. Map the third IGA to an insi de web server and m ail server. Fo ur rules need to be configured, two bi-directional and two uni-directional as follo ws.
ZyWALL 2 Series User’s Guide NAT 28-13 Step 5. Select Type as One-to-One (di rect mappin g for packets going bot h ways) , and enter the local Start IP as 192.168.1.10 (th e IP address of FTP Server 1), th e global Start I P as 10.132.50.1 (ou r first IGA).
ZyWALL 2 Series User’s Guide 28-14 NAT Figure 28-17 Example 3: Final Menu 15.1.1 Now conf igure th e IGA3 to map to our web serv er and mail serv er on the LAN. Step 8. Enter 15 from the main menu. Step 9. Now enter 2 from this menu and configur e it as shown in Figure 28-18 .
ZyWALL 2 Series User’s Guide NAT 28-15 28.4.4 Example 4: NA T Unfr iendly Application Programs Some applications do not support NAT Mapping using TCP or UDP port address translation. In this case it is better to use Many-One-to -One mapping as port numbers do not change for Many -One-to-One (and One-to-One ) NAT m app ing types.
ZyWALL 2 Series User’s Guide 28-16 NAT Figure 28-20 Example 4: Menu 15.1.1.1: Ad dress Mapping Rule After you’ve configured your rule, you should b e able to check the settings in menu 15.1.1 as shown next. Figure 28-21 Example 4: Menu 15.1.1: Address Ma pping Rules 28.
ZyWALL 2 Series User’s Guide NAT 28-17 LAN comput er, you have t o manually replace the LA N com puter's IP address in the fo rwarding p ort with another LAN c omputer' s IP address, Trigger port forwardi ng solves this pro blem by all owing com puters on the LAN to dyna mically take turns using the service.
ZyWALL 2 Series User’s Guide 28-18 NAT 5. Only A can connect to the Real Audio server until th e connection is closed or times out. The ZyWALL times out in three minutes with UDP (Use r Datagram Protocol) or two hours w ith TCP/IP (Transfer Co ntrol Protoc ol/Internet Protocol) .
ZyWALL 2 Series User’s Guide NAT 28-19 T able 28-5 Menu 15.3: T rigger Port Setup FIELD DESCRIPTION EXA MPLE Rule This is the rule index numb er. 1 Name Enter a unique name for identification purposes. You may enter up to 15 characters in this field.
.
ZyWALL 2 Series User’s Guide Introducing the Firewall 29-1 Chapter 29 Introducing the Firewall This chapter shows you how to get started with the firewall. 29.1 Using SMT Menus From the main menu enter 21 to go to Menu 21 - Filter Set an d Firewall Configuration to disp lay the screen shown next .
ZyWALL 2 Series User’s Guide 29-2 Introducing the Firewall Figure 29-2 Menu 21.2: Fire w all Setup Configure the fire wall rules using the web configurator or CLI commands. Menu 21.2 - Firewall Setup The firewall protects against Denial of Service (DoS) attacks when it is active.
ZyWALL 2 Series User’s Guide Filter Configuration 30-1 Chapter 30 Filter Configuration This chapter shows you how to create and apply filters. 30.1 Introduction to Filters Your ZyWALL uses filters to decide whether to allow pa ssage of a data packet and/or to make a call.
ZyWALL 2 Series User’s Guide 30-2 Filter Configu ration Figure 30-1 Outgoing Packet Filtering Process For incoming packets, your ZyWALL ap plies data f ilters only. Packets are pro cessed depending up on whether a match is found. The following sections describ e how to configure filter sets.
ZyWALL 2 Series User’s Guide Filter Configuration 30-3 Start Fetch First Filter Set Fetch First Filter Rule Active? Execute Filter Rule Fetch Next Filter Rule Next filter Rule Available? Fetch Next .
ZyWALL 2 Series User’s Guide 30-4 Filter Configu ration You can apply up to four filter sets to a particular port to b lock multiple types of packets. With each filter set having up t o six rules, you can have a maximum of 24 rul es active for a single port.
ZyWALL 2 Series User’s Guide Filter Configuration 30-5 Step 4. Enter a descriptive name or comment in th e Edit Comments field and press [ENTER] . Step 5. Press [ENTER] at the message [Press ENTER to confirm] to open Menu 21.1 .1 - Filter Rules Summary .
ZyWALL 2 Series User’s Guide 30-6 Filter Configu ration Table 30-2 Rule Abbreviations Used ABBREVIATION DESCRIPTION IP Pr Protocol SA Source Address SP Source Port number DA Destination Address DP Destination Port number GEN Off Offset Len Length Refer to the next section for information on configuring the filter ru les.
ZyWALL 2 Series User’s Guide Filter Configuration 30-7 To configure TCP/IP rules, select TCP/IP Filter Rule from the Filter Type field and press [ENTER] to open Menu 21.1.1.1 - TCP/IP Filt er Rule , as shown next. Figure 30-5 Menu 21.1.1.1: TCP/IP Filter Rul e The following table describes how to con figure your TCP/IP filter rule.
ZyWALL 2 Series User’s Guide 30-8 Filter Configu ration Table 30-3 TCP/IP Filter Rule Menu Fields FIELD DESCRIPTION OPTIONS Port # Enter the destination port of t he packets that you wish to filter. The range of this field is 0 to 6553 5. This field is ignor ed if it is 0.
ZyWALL 2 Series User’s Guide Filter Configuration 30-9 Table 30-3 TCP/IP Filter Rule Menu Fields FIELD DESCRIPTION OPTIONS Log Press [SPACE BAR] and then [ENT ER] to select a logging option from the following: None – No packets will be logged. Action Matched - Only packets that match the rule parameters will be logged.
ZyWALL 2 Series User’s Guide 30-10 Filter Configuration Packet into IP Filter Matched Matched Yes Action Matched Action Not Matched More? No Filter Active? Check IP Protocol Drop Drop Packet Accept .
ZyWALL 2 Series User’s Guide Filter Configuration 30-11 30.2.3 Configuring a Generic Filter Rule This section shows you how to configure a generic filter rule. The purpose of gen eric rules is to allow you to filter non-IP packets. For IP, it is genera lly easier to use the IP rules directly.
ZyWALL 2 Series User’s Guide 30-12 Filter Configuration Table 30-4 Menu 21.1.1.1: Generic Filter Rule FIELD DESCRIPTION OPTIONS Filter Type Use [SPACE BAR] and then [ENTER] to select a rule type. Parameters displayed belo w each type will be different.
ZyWALL 2 Series User’s Guide Filter Configuration 30-13 30.3 Example Filter Let’s look at an example to block outside users from accessing the ZyWALL via telnet. Please see our included disk for more example filters. Figure 30-8 Telnet Filter Example Step 1.
ZyWALL 2 Series User’s Guide 30-14 Filter Configuration Figure 30-9 Example Filter: Menu 21. 1.3.1 When you press [ENTER] to confirm, you will see the following screen .
ZyWALL 2 Series User’s Guide Filter Configuration 30-15 Figure 30-10 Example Filter Rules Summary : Men u 21.1.3 After you’ve created the filter set, you must apply it. Step 1. Enter 11 fr om the main menu to go to m enu 11. Step 2. Go to the Edit Filter Sets field, press [SPACE BAR] to select Yes and press [ENTER] .
ZyWALL 2 Series User’s Guide 30-16 Filter Configuration 30.4 Filter T y pes and NA T There are two classe s of filter rules, Generic Filter (Device) rules and protocol filter ( TCP/ IP ) rules. Generic filter rules act on the raw data from/to LAN and WAN.
ZyWALL 2 Series User’s Guide Filter Configuration 30-17 30.6 Applying a Filter This section shows you wh ere to apply the filter(s ) after you design it (them). The ZyWALL already has filters to prevent NetBIOS traffic from triggeri ng calls, and blo ck incoming telnet, FTP and HTTP connections.
ZyWALL 2 Series User’s Guide 30-18 Filter Configuration Figure 30-13 Filtering Remote Node T raffic Menu 11.5 – Remote Node Filter Setup Input Filter Sets: protocol filters= device filters= Output.
ZyWALL 2 Series User’s Guide SNMP Configuration 31-1 Chapter 31 SNMP Configuration This chapter explains SNMP configuration menu 22. 31.1 SNMP Configuration To configure SN MP, enter 22 from the main menu to display Menu 22 - SNMP Configura tion as shown next.
ZyWALL 2 Series User’s Guide 31-2 SNMP Configuration Table 31-1 Menu 22: SNMP Configuration FIELD DESCRIPTION EXAMPLE Trap Community Type the Trap community, which is the password se nt with each trap to the SNMP manager. Public Destination Type the IP address of the stat ion to send your SNMP traps to.
SMT System Maintenance XIII Part XIII: SMT System Maintenance This part covers system in formation and diagnosi s, firmware and configuration file maintenance, as well as providing information on the system maintenan ce and information functions and how to configure remote managem ent and VPN.
.
ZyWALL 2 Series User’s Guide System Information and Diagnosis 32-1 Chapter 32 System Information & Diagnosis This chapter covers SMT menus 24.1 to 24.4. 32.1 Introduction to System St atus This chapter cov ers the diagnostic tools that help you to maintain your ZyWALL.
ZyWALL 2 Series User’s Guide 32-2 System Information and Diagnosis monitor your Z yWALL. Specifically, it gives you info rmation on y our system firmware version, number of packets sent and number of pa ckets received. To get to the System Status: Step 1.
ZyWALL 2 Series User’s Guide System Information and Diagnosis 32-3 Table 32-1 System Maintenance: Sta tus Menu Fields FIELD DESCRIPTION Status Shows the port speed and d uplex setting if you’r e u.
ZyWALL 2 Series User’s Guide 32-4 System Information and Diagnosis Step 2. Enter 2 t o open Me nu 24.2 - System Information and Co nsole Port Speed. Step 3. From thi s menu you ha ve two choices as shown in t he next figure: Figure 32-3 Menu 24.2: Sy stem Information and Console Port Speed 32.
ZyWALL 2 Series User’s Guide System Information and Diagnosis 32-5 Table 32-2 Fields in System Maintenance: Info rmation FIELD DESCRIPTION ZyN OS F/W Version Refers to the ZyNOS (ZyXEL Network Oper ating System) system firmware version. ZyNOS is a registered trademark of ZyXEL Communic ations Corporation.
ZyWALL 2 Series User’s Guide 32-6 System Information and Diagnosis Figure 32-6 Menu 24.3: Sy stem Maintenance: Log and Trace 32.4.1 UNIX Syslog The ZyWALL uses the UNIX syslog facility to log the CDR (Call Detail Record) and system messages to a syslog server.
ZyWALL 2 Series User’s Guide System Information and Diagnosis 32-7 Table 32-3 System Maintenance Men u Syslog Parameters PARAMETER DESCRIPTION Log Facility Press [SPACE BAR] and then [ENTER] to select a location. The log facilit y allows you to log the messages to different file s in the syslog server.
ZyWALL 2 Series User’s Guide 32-8 System Information and Diagnosis Filter log Message Format SdcmdSyslogSend(SYSLOG_FILLOG, SYSLOG_NOTICE, String ); String = IP[Src=xx.xx.xx.xx Dst=xx.xx.xx.xx prot spo=xxxx dpo=xxxx] S04>R01mD IP[…] is the packet header and S04>R01mD means filter set 4 (S) and rule 1 (R), match (m) drop (D).
ZyWALL 2 Series User’s Guide System Information and Diagnosis 32-9 32.4.2 Call-T riggering Packet Call-Triggering Packet displays info rmation about th e packet that triggered a dial-out call in an easy readable fo rmat. Equi valent in formation i s avail able in m enu 24.
ZyWALL 2 Series User’s Guide 32-10 System Information and Diagnosis Follow the procedure below to get to Menu 24.4 - System Mainten ance – Diagnostic. Step 1. From the m ain menu, sel ect option 2 4 to open Menu 24 - System Main tenance . Step 2. From this menu, select option 4.
ZyWALL 2 Series User’s Guide System Information and Diagnosis 32-11 Figure 32-10 WAN & LAN DHCP The following table describes the diagnostic tests available in menu 24.
.
ZyWALL 2 User’s Guide Firmware and Configuration File Maintenance 33-1 Chapter 33 Firmware and Configuration File Maintenance This chapter tells you how to back up and restore your configurati on file as well as upload new firmware and a new configuration file.
ZyWALL 2 User’s Guide 33-2 Firmware and Configuration File Maintenan ce ftp> get rom-0 config.cfg This is a sample FTP session saving the current configuration to t he computer file “confi g.
ZyWALL 2 User’s Guide Firmware and Configuration File Maintenance 33-3 preferred metho d for backing up your cur rent configuration to your computer since it is faster. You can also perform back up and rest ore using m enu 24 through the c onsole po rt.
ZyWALL 2 User’s Guide 33-4 Firmware and Configuration File Maintenan ce Step 6. Use “get” to transfer files from the ZyW ALL to the computer , for example, “get rom-0 config.rom” transfers the c onfig uration file on the ZyW A LL to your computer and renames it “config.
ZyWALL 2 User’s Guide Firmware and Configuration File Maintenance 33-5 33.3.5 File Maintenance Over W AN TFTP, FTP and Telnet over the WAN will not work when: 1. The firewall is active (turn the firewall off in menu 21.2 or create a firewall rule to allow access from the WAN).
ZyWALL 2 User’s Guide 33-6 Firmware and Configuration File Maintenan ce TFTP client program. For UNIX, use “get” to tra nsfer from the ZyWALL to the computer an d “bin ary” to set binary t ransfer m ode. 33.3.7 TFTP Command Example The following is an exam ple TFTP command: tftp [-i] host get rom-0 config.
ZyWALL 2 User’s Guide Firmware and Configuration File Maintenance 33-7 Step 1. Display m enu 24.5 an d enter “y ” at the following screen. Figure 33-3 System Maintena nce: Backup Configuration Step 2. The followin g screen indicates t hat the Xm odem downl oad has start ed.
ZyWALL 2 User’s Guide 33-8 Firmware and Configuration File Maintenan ce 33.4 Restore Configuration This section sh ows you ho w to restore a previously save d co nfiguration.
ZyWALL 2 User’s Guide Firmware and Configuration File Maintenance 33-9 Step 1. Launch the FTP client on your c omputer. Step 2. Enter “open”, followed by a space and the IP addres s of your Zy WALL. Step 3. Press [ENTER] when prom pted for a username.
ZyWALL 2 User’s Guide 33-10 Firmware and Configuration File Maintenance Step 1. Display m enu 24.6 an d enter “y ” at the following screen. Figure 33-9 System Maintena nce: Restore Con figuration Step 2. The followin g screen indicates t hat the Xm odem downl oad has start ed.
ZyWALL 2 User’s Guide Firmware and Configuration File Maintenance 33-11 33.5 Uploading Firmware and Configuration Files This section s hows you how to upl oad firmware and co nfiguratio n files.
ZyWALL 2 User’s Guide 33-12 Firmware and Configuration File Maintenance 33.5.2 Configuration File Upload You see the following screen when you telnet into menu 24.7.2 . Figure 33-14 Telnet Into Menu 24.7.2: System Maintenance To upload the firmware and the conf iguration file, follow these examples 33.
ZyWALL 2 User’s Guide Firmware and Configuration File Maintenance 33-13 transfers the confi gura tion file on the ZyWALL to your computer and renames it “config.rom.” See earlier in this chapter for more information on filename conventions. Step 7.
ZyWALL 2 User’s Guide 33-14 Firmware and Configuration File Maintenance Step 3. Enter the command “sys stdio 0” to disable the co nsole timeou t, so the TFTP transfer will no t be interrupte d. Enter “comm and sys stdio 5” to rest ore the fiv e-mi nute console t imeout (defa ult) when the file transfer is complete.
ZyWALL 2 User’s Guide Firmware and Configuration File Maintenance 33-15 33.5.8 Uploading Firmw are File V ia Console Port Step 1. Select 1 from M enu 24.7 – System Maintena nce – Upload Firmware to d ispla y Menu 24.7.1 - System Mai ntenance - Upload System Firmware , and then follow the instructions as shown in the following screen.
ZyWALL 2 User’s Guide 33-16 Firmware and Configuration File Maintenance Figure 33-17 Example Xmodem Upload After the firmware upload process has completed, the ZyWALL will automatically restart. 33.5.10 Uploading Configuration File Vi a Console Port Step 1.
ZyWALL 2 User’s Guide Firmware and Configuration File Maintenance 33-17 Figure 33-18 Menu 24.7.2 As Seen Using the Console Port Step 2. After the "St arting Xm odem upload" message ap pears, activat e the Xmod em prot ocol on y our computer.
ZyWALL 2 User’s Guide 33-18 Firmware and Configuration File Maintenance Figure 33-19 Example Xmodem Upload After the co nfiguratio n uploa d process has compl eted, restart t he ZyWAL L by enteri ng “atgo”. Type the configuration file’s location, or click Browse to search for it.
ZyWALL 2 User’s Guide System Maintenance & Information 34-1 Chapter 34 System Maintenance Menus 8 to 10 This chapter leads you through SM T menus 24.8 to 24.10. 34.1 Command Interpreter Mode The Comm and Interpreter (CI) is a pa rt of the main r outer firm ware.
ZyWALL 2 User’s Guide 34-2 System Maintenance & Information 34.1.1 Command Syntax The comm and keywords are i n courier new font. Enter the com mand keyw ords exactly as shown, do not abbre viate. The required fields in a c ommand are enclosed in angle brackets <> .
ZyWALL 2 User’s Guide System Maintenance & Information 34-3 Table 34-1 Valid Commands ether These commands display Ethernet info rmation and configu re Ethernet settings. aux These commands display dial backup inform ation a nd control dial backup conn ections.
ZyWALL 2 User’s Guide 34-4 System Maintenance & Information Figure 34-4 Budget Managemen t The total budget is the time limit on the accum u lated time for outgoing calls to a rem ote node. When this limit is reached, the call will be droppe d and further out going calls t o that remote node will be blocked.
ZyWALL 2 User’s Guide System Maintenance & Information 34-5 Figure 34-5 Call History The following table describes the fields in this screen. Table 34-3 Call History Fields FIELD DESCRIPTION Phone Number The PPPoE service names ar e shown here. Dir T his shows whether the call was incoming or outgo ing.
ZyWALL 2 User’s Guide 34-6 System Maintenance & Information Select menu 24 in the main menu to open Menu 24 - System Maintenance , as shown next.
ZyWALL 2 User’s Guide System Maintenance & Information 34-7 Table 34-4 Menu 24.10 System Main tenance: Time and Date Setting FIELD DESCRIPTION Enter the time service protocol that your timeserver sends when you turn on the ZyWALL.
ZyWALL 2 User’s Guide 34-8 System Maintenance & Information ii. When the ZyWALL starts up, if there is a timeserver configured in menu 24.10. iii.
ZyWALL 2 User’s Guide Remote Management 35-1 Chapter 35 Remote Management This chapter covers remote management found in SMT menu 24.11. 35.1 Remote Management Remote management allows you to determ ine which services/protocols can access which ZyWALL interface (if any) from whic h computers.
ZyWALL 2 User’s Guide 35-2 Remote Management Figure 35-1 Menu 24.11 – Remote Manageme nt Control The following table describes the fields in this screen.
ZyWALL 2 User’s Guide Remote Management 35-3 Table 35-1 Menu 24.11 – Remote Managemen t Control FIELD DESCRIPTION EXAMPLE Once you have filled in this menu, press [ENT ER] at the message "Press ENTER to Confirm or ESC to Cancel" to save your configur ation, or press [ESC] to cancel.
.
SMT Advanced Management XIV Part XIV: SMT Advanced Management This part provides informati on on how to configure call scheduling, and VPN/IPSec. See the web configurator p arts of this guide for background information on features configurable by web configurator a nd SMT .
.
ZyWA LL 2 Series User ’ s Guide Call Scheduling 36-1 Chapter 36 Call Scheduling Call scheduling allows you to dictate when a remote node should be called and for how long.
ZyW ALL 2 Series User’s Guide 36-2 Call Scheduli ng To set up a schedule set, select the schedule set you want to setup fr om menu 26 (1-12) an d press [ENTER] to see Menu 26.1 - Sch edule Set Setup as sho wn next. Figure 36-2 Schedule Set Setup If a connection has been already established, your Zy WALL will not drop it.
ZyWA LL 2 Series User ’ s Guide Call Scheduling 36-3 Table 36-1 Schedule Set Setup FIELD DESCRIPTION OPTIONS Day If you selected Weekl y in the How Often field above, then select the day(s) when the set should activate (and rec ur) by going to that day(s) and pressing [SPACE BAR] to select Yes , then press [ENTER].
ZyW ALL 2 Series User’s Guide 36-4 Call Scheduli ng Figure 36-3 Applying Schedule Set( s) to a Remote Node (PPPoE) You can ap ply up to f our schedul e sets, separ ated by com mas, for one rem ote node. Cha nge the sc hedule set numbers to your prefe rence(s).
ZyWA LL 2 Series User ’ s Guide VPN/IPSec Setup 37-1 Chapter 37 VPN/IPSec Setup This chapter introduces the VPN SMT menus. 37.1 Introduction The VPN/IPSe c main SMT menu has these main subm enus: 1. Define VPN policies i n menu 2 7.1 submenu s, includi ng security policies, endpoint IP addresses, peer IPSec router IP address and key manage ment.
ZyW ALL 2 Series User’s Guide 37-2 VPN/IPSec Setup Figure 37-2 Menu 27: VPN/IPSec Setup 37.2 IPSec Summary Screen Type 1 in m enu 27 and then press [ENTE R] to display Menu 27.1 — IPSec Sum mary . This is a summary read-only m enu of your IPSec rule s (tunnels ).
ZyWA LL 2 Series User ’ s Guide VPN/IPSec Setup 37-3 Table 37-1 Menu 27.1: IPSec Summary FIELD DESCRIPTION EX AMPLE Name This field displays the unique ide n tification na me for this VPN rule. The name may be up to 32 characters long but onl y 10 characters will be displayed her e.
ZyW ALL 2 Series User’s Guide 37-4 VPN/IPSec Setup Table 37-1 Menu 27.1: IPSec Summary FIELD DESCRIPTION EX AMPLE Key Mgt T his field displays the SA’s type of key management, ( IKE or Manual ). IKE Remote Addr Start When the Addr Type field in Menu 27.
ZyWA LL 2 Series User ’ s Guide VPN/IPSec Setup 37-5 Table 37-1 Menu 27.1: IPSec Summary FIELD DESCRIPTION EX AMPLE Select Command Press [SPACE BAR] to choose from None , Edit , Delete , Go To Rule , Next Page or Previous Page and then press [ENTER].
ZyW ALL 2 Series User’s Guide 37-6 VPN/IPSec Setup Figure 37-4 Menu 27.1.1: IPSec Setup Y ou must also configure menu 27.1.1.1 or menu 27.1.1.2 to full y configure and use a VPN. The following table describes the fields in this screen. Table 37-2 Menu 27.
ZyWA LL 2 Series User ’ s Guide VPN/IPSec Setup 37-7 Table 37-2 Menu 27.1.1: IPSec Setup FIELD DESCRIPTION EXAMPLE NAT Traversal Select this check box to enable NAT traversal. NAT traversal allows you to set up a VPN connection when ther e are NAT routers bet ween the two IPSec routers.
ZyW ALL 2 Series User’s Guide 37-8 VPN/IPSec Setup Table 37-2 Menu 27.1.1: IPSec Setup FIELD DESCRIPTION EXAMPLE Peer ID type Press [SPACE BAR] to choose IP , DNS , or E-mail and press [ENTER]. Select IP to identify the remote IPSec router by its IP address.
ZyWA LL 2 Series User ’ s Guide VPN/IPSec Setup 37-9 Table 37-2 Menu 27.1.1: IPSec Setup FIELD DESCRIPTION EXAMPLE Local Loca l IP addresses must be static and correspond to the remote IPSec router's configured remote IP addresses. Two active SAs can have the same configur ed local or remote IP address, but not both.
ZyW ALL 2 Series User’s Guide 37-10 VPN/IPSec Setup Table 37-2 Menu 27.1.1: IPSec Setup FIELD DESCRIPTION EXAMPLE End Enter a port number in this field to define a port range. This port number must be greater than that specified in the previous field.
ZyWA LL 2 Series User ’ s Guide VPN/IPSec Setup 37-1 1 Table 37-2 Menu 27.1.1: IPSec Setup FIELD DESCRIPTION EXAMPLE Port Start 0 is the default and signifies any port.
ZyW ALL 2 Series User’s Guide 37-12 VPN/IPSec Setup Figure 37-5 Menu 27.1.1.1: IKE Setup Table 37-3 Menu 27.1.1.1: IKE Setup FIELD DESCRIPTION EXAMPLE Phase 1 Negotiation Mode Press [SPACE BAR] to choose from Main or Aggressive and then press [ENTER].
ZyWA LL 2 Series User ’ s Guide VPN/IPSec Setup 37-13 Table 37-3 Menu 27.1.1.1: IKE Setup FIELD DESCRIPTION EXAMPLE Encryption Algorithm When DES is used for data communications, both sender and receiver mus t know the same secret key, which can be used to encrypt and decrypt the message or to generate and verif y a message authentication code.
ZyW ALL 2 Series User’s Guide 37-14 VPN/IPSec Setup Table 37-3 Menu 27.1.1.1: IKE Setup FIELD DESCRIPTION EXAMPLE Encapsulation Press [SPACE BAR] to choose from Tunnel mode or Transport mode and then press [ENTER]. See earlier for a discuss ion of these.
ZyWA LL 2 Series User ’ s Guide VPN/IPSec Setup 37-15 To edit this menu, move the curso r to the Edit Manual Setup field in Menu 27.1.1 – IPSec Se tup press [SPACE BAR] to select Yes and then press [ENTER] to go to Menu 27 .1.1.2 – Manual Se tup .
ZyW ALL 2 Series User’s Guide 37-16 VPN/IPSec Setup Table 37-5 Menu 27.1.1.2: Manual Setup FIELD DESCRIPTION EXAMPLE Key3 Enter a unique eight-character key. It can be comprised of any character including spaces (but trailing spaces are truncated). Authentication Algorithm Press [SPACE BAR] to choose from MD5 or SHA1 and then press [ENTER].
ZyWA LL 2 Series User ’ s Guide SA Monitor 38-1 Chapter 38 SA Monitor This chapter teaches you how to manage your SA s by using the SA Monitor in SMT menu 27.2. 38.1 Introduction A Security Association (SA) is the group of security settings related to a specific VPN tunnel.
ZyW ALL 2 Series User’s Guide 38-2 SA Monitor Table 38-1 Menu 27.2: SA Monitor FIELD DESCRIPTION EXAMPLE # This is the security association index number. Name This field displ ays th e identification name for this VPN policy. This name is unique for each connection where the secure gateway IP address is a public static IP address.
General Appendice s XV Part XV: General Appendices This part prov ides background information abo ut troubleshooting, setting up your compute r ’s IP address, triangle route, how functions are re lated, PPPoE, PPTP , wireless LAN, 802.1x, EAP authentication, IP subnetting and safety warnings.
.
ZyWALL 2 Series User’s Guide T roubleshooting A-1 Appendix A Troubleshooting This chapter covers potential problems and possible remedies. After each problem description, some instructions are provided to help you to diagnose and to solve the problem.
ZyWALL 2 Series User’s Guide Troubleshooting A-2 Problems with the LAN Interface Chart 3 Troubleshooting the L AN Interface PROBLEM CORRECTIVE ACTION Check your Ethernet cable t ype and connections. Refer to the Quick Start Guide for LAN connection instructions.
ZyWALL 2 Series User’s Guide T roubleshooting A-3 Problems with Internet Acces s Chart 5 Troubleshooting Internet Acc ess PROBLEM CORRECTIVE ACTION Connect your cable/DSL mod em with t he ZyWALL using the appropriate c able.
.
ZyWALL 2 Series User’s Guide Setting Up Y our Computer ’s IP Address B-1 Appendix B Setting up Your Computer’s IP Address All computers must have a 10M or 10 0M Ethe rnet adapte r card and TCP/IP installed.
ZyWALL 2 Series User’s Guide Setting Up Your Computer’s IP Address B-2 The Network window Configuration ta b displays a list of i nstalled com ponents. You need a network adapter, the T CP/IP prot ocol an d Client for Micros oft Network s. If yo u need th e adap ter: a.
ZyWALL 2 Series User’s Guide Setting Up Y our Computer ’s IP Address B-3 1. Click the IP Address tab. -If your IP address is dynamic, select Obtain an IP address automatically . -If you have a static IP address, select Specify an IP address and type your informatio n into the IP Address and Subne t Mask fields.
ZyWALL 2 Series User’s Guide Setting Up Your Computer’s IP Address B-4 3. Click the Gateway tab. -If you do not know your gateway’s IP address, remove previously installed gate ways. -If you have a gateway IP address, type it in the Ne w ga te way fie ld and click Add .
ZyWALL 2 Series User’s Guide Setting Up Y our Computer ’s IP Address B-5 1. For Windows XP, click Start , Control Panel . In Windows 2000/NT, click Start , Settings , Control Panel . 2. For Windows XP, click Network Connections . For Windows 2000/NT, click Network and Dial-up Connections .
ZyWALL 2 Series User’s Guide Setting Up Your Computer’s IP Address B-6 4. Select Internet Protocol (TCP/IP) (under the General tab in Win XP) and click Properties . 5. The Internet Protocol TCP/IP Prope rties window opens (the General tab in Windows XP).
ZyWALL 2 Series User’s Guide Setting Up Y our Computer ’s IP Address B-7 6. -If you do not know your gateway's IP address, remove any previously installed gate ways in the IP Settin gs tab and click OK . Do one or more of the following if you want to configure additional IP addres ses: -In the IP Settings tab, in IP addresses, click Add .
ZyWALL 2 Series User’s Guide Setting Up Your Computer’s IP Address B-8 7. In the Internet Protocol TCP/IP Properties window (the Gene ral tab in Windows XP): -Click Obtain DNS server address automatically if you do not know your DNS server IP address(es).
ZyWALL 2 Series User’s Guide Setting Up Y our Computer ’s IP Address B-9 1. Click the Apple menu, Control Panel and double-click TCP/IP to open the TCP/IP Control Panel . 2. Select Ethernet built-in from the Connect v ia list. 3. For d ynamically assigned settings, select Using DHCP Server from the Configure: list.
ZyWALL 2 Series User’s Guide Setting Up Your Computer’s IP Address B-10 4. For staticall y assigned settings, do the following: -From the Configure box, select Manually . -Type your IP address in the IP Address box. -Type your subnet mask in the Subnet mask box.
ZyWALL 2 Series User’s Guide Setting Up Y our Computer ’s IP Address B-1 1 2. Click Network in the icon bar. - Select Automatic from the Location list. - Select Built-in Ethernet from the Show list. - Click the TCP/IP tab. 3. For dynamically assigned settings, sel ect Using DHCP from the Configur e list.
.
ZyWALL 2 Series User’s Guide T riangle Route C-1 Appendix C Triangle Route The Ideal Setup When the firewall is on, your ZyWALL acts as a secure gateway between your LAN and the Internet. In an ideal network top ology, all i ncoming an d outgoin g network traf fic passes thr ough the Zy WALL to prot ect your LAN against attacks.
ZyWALL 2 Series User’s Guide Triangle Route C-2 Diagram 2 “Triangle Route” Problem The “T riangle Route” Solutions This section presents you two solutions to the “triangle route” problem. IP Aliasing IP alias allows you to partition your network into logi cal sections over the same Ethernet interface.
ZyWALL 2 Series User’s Guide T riangle Route C-3 Diagram 3 IP Alias Gateways on the W AN Side A second sol ution to the “triangle route” pr oblem i s to put all of y our network gateways on the WAN side as the following fig ure shows. This en sures that all incoming netwo rk traffic pa sses through your ZyWALL to your LAN.
ZyWALL 2 Series User’s Guide Triangle Route C-4 Step 3. Use the following commands to allow/disallo w triangle route. sys firewall ignore triangle all off This command allows triangle route. sys firewall ignore triangle all on This command disall ows triangle route.
ZyWALL 2 Series User’s Guide Wireless LAN and IEEE 802.1 1 D-1 Appendix D Wireless LAN and IEEE 802.11 A wireless LAN (WLA N) provides a flexi ble data commun ications system that y ou can use to acces s various services (navigating the Internet, em ail, prin ter services, etc.
ZyWALL 2 Series User’s Guide D-2 Wireless LAN and IEEE 802.11 Spread Spectrum (DSSS) an d Fre quency-Hopping Spread S pectrum (FHSS), i n the 2.4 t o 2.
ZyWALL 2 Series User’s Guide Wireless LAN and IEEE 802.1 1 D-3 could be any type of net w ork, it i s almost inva riably an Ethe rnet LAN. M obile nodes can roam between Access Points and seam less campus-wide coverage is possible.
.
ZyWALL 2 Series User’s Guide Wireless LAN with IEEE 802.1x E-1 Appendix E Wireless LAN With IEEE 802.1x As wireless networks becom e popular for both portable com puting an d corporate networks, sec urity is now a priority. Security Flaws w ith IEEE 802.
ZyWALL 2 Series User’s Guide Wireless LAN with IEEE 802.1x E-2 RADIUS Server Authen tication Sequence The following fig ure depicts a typical wirel ess network with a remote RADIUS ser v er for user authentication using EAPOL (EAP Over LAN). Diagram E-1 Sequences for EAP MD5–Challenge Authentication Client computer access authorized.
ZyWALL 2 Series User’s Guide T ypes of EAP Authentication F-1 Appendix F Types of EAP Authentication This appendix discu sses three popular EAP auth entication types: EAP-MD5 , EAP-TLS and EAP-TTLS . The type of a uthenticatio n you use de pends on the R ADIUS serve r or the AP.
ZyWALL 2 Series User’s Guide Types of EAP Authentication F-2 TTLS supports EAP me thods and legacy authenticatio n m e thods such as PAP, CH AP, MS-CHAP and MS- CHAP v2.
ZyWALL 2 Series User’s Guide PPPoE G-1 Appendix G PPPoE PPPoE in Action An ADSL m odem brid ges a PPP sessi on over Ethe rnet (PPP o ver Ether net, RFC 25 16) from your PC t o an ATM PVC (Pe rmanent Virt ual Circuit), which con nects to a DSL Access Conce ntrator wh ere the PPP session terminates (see the next figure).
ZyWALL 2 Series User’s Guide G-2 PPPoE The PPPoE driver m akes the Ethernet appear as a serial link to the PC a nd the PC runs PPP over it, while the modem bridges the Et hernet frames to the Access Concen trator (AC).
ZyWALL 2 Series User’s Guide PPTP H-1 Appendix H PPTP What is PPTP? PPTP (Point -to-Point T unneling Pr otocol) i s a Micros oft prop rietary prot ocol (RFC 2637 for PPTP is informational only) to tunnel PPP frames.
ZyWALL 2 Series User’s Guide H-2 PPTP PPTP is very si milar to L2TP, since L2T P is based on both PPTP and L2F (Cisco’s Lay er 2 Forwa rding). Conceptually, there are three parties in PPTP, name ly the PNS (PPTP Network Serve r), the PAC (PPTP Access Concentrator) and the PPTP user.
ZyWALL 2 Series User’s Guide PPTP H-3 Diagram H-3 Example Message Exchange bet w een PC and an ANT PPP Data Connection The PPP frames are tunneled betwee n the PNS and PAC over GRE (General Ro uting Encapsulation, RFC 1701, 1702). The indiv idual calls within a tunnel are distingu ished using the Call ID field in the GRE header.
.
ZyWALL 2 Series User’s Guide IP Subnetting I-1 Appendix I IP Subnetting IP Addres sing Routers “route” base d on the network num ber. The rout er that delivers the data packet to the correct destination hos t uses the host ID.
ZyWALL 2 Series User’s Guide I-2 IP Subnetting A class “A” address (24 host bits) can have 2 24 –2 hosts (a pproxim ately 16 million hosts). Since the first octet of a class “A” IP addre ss must c ontain a “0”, the first octet of a class “A” ad dress can have a value of 0 to 127.
ZyWALL 2 Series User’s Guide IP Subnetting I-3 of ones beginning from the left most bit of the mask, followed by a continuou s sequence of zeros, for a total number of 32 bi ts.
ZyWALL 2 Series User’s Guide I-4 IP Subnetting Divide the network 19 2.168.1. 0 into two separate s ubnets by converting one of t he host ID bi ts of the IP address to a networ k number bit. The “borrow ed” host ID bit can be either “0” or “1” thus giving two subnets; 192.
ZyWALL 2 Series User’s Guide IP Subnetting I-5 actual host for the first subn et is 192.168.1.1 and the highest is 192.168.1 .126. Similarly the host ID range for the second subnet is 192.
ZyWALL 2 Series User’s Guide I-6 IP Subnetting Chart I-10 Subnet 4 NETWORK NUMBER LAST OCTET BIT VALUE IP Address 192.168.1. 192 IP Address (Binary) 11000000.1 0101000.000000 01. 11 000000 Subnet Mask (Binary) 11111111.11111111.11111111. 11 000000 Subnet Address: 192.
ZyWALL 2 Series User’s Guide IP Subnetting I-7 4 255.255.255.240 (/28) 16 14 5 255.255.255.248 (/29) 32 6 6 255.255.255.252 (/30) 64 2 7 255.255.255.
ZyWALL 2 Series User’s Guide I-8 IP Subnetting Chart I-13 Class B Subnet Planning NO. “BORROWED” HOST BITS SUBNET MASK NO. SUBNETS NO. HOSTS PER SUBNET (/29) 14 255.
ZyWALL 2 Series User’s Guide Safety Warnings and Instructions J-1 Appendix J Safety Warnings and Instructions 1. Be sure to read and follow all warning notices and instructions. 2. The maxim um recomm ended ambi ent temperat ure for the ZyWALL is 40º Cel sius (104º Fah renheit).
.
Command, Log Appendices and Ind ex XVI Part XVI: Command, Log Appendices and Index This part prov ides information on the command lin e interface, firewall and NetBIOS comma nds, logs and password p rotection.
.
ZyWALL 2 Series User’s Guide Command Interpreter K-1 Appendix K Command Interpreter The following describes how to use the command interpreter. Enter 24 in the main menu to bring up the system m a intenance m enu. Enter 8 to go t o Menu 24.8 - Comm and Interpreter Mode .
.
ZyWALL 2 Series User’s Guide Firewall Commands L-1 Appendix L Firewall Commands The foll o wi n g descr i bes t h e f i rewall c o mm a nd s . S e e the Command Interpreter appendix for information on t h e c o mma nd str u ctu r e.
ZyWALL 2 User’s Guide L-2 Firewall Comm ands Chart L-1 Firewall Comma nds FUNCTION COMMAND DESCRIPTION config display firewall e-mail This command shows all of the e-mail settings. config display firewall ? This command shows all of the available firewall sub commands.
ZyWALL 2 Series User’s Guide Firewall Commands L-3 Chart L-1 Firewall Commands FUNCTION COMMAND DESCRIPTION config edit firewall attack block <yes | no> Set this command to yes to block new traffic after the tcp-max-incomplete threshold is exceeded.
ZyWALL 2 User’s Guide L-4 Firewall Comm ands Chart L-1 Firewall Comma nds FUNCTION COMMAND DESCRIPTION Config edit firewall set <set #> default-permit <forward | block> This command sets whether a packet is dropped or allowed through, when it does not meet a rule within the set.
ZyWALL 2 Series User’s Guide Firewall Commands L-5 Chart L-1 Firewall Commands FUNCTION COMMAND DESCRIPTION Config edit firewall set <set #> rule <rule #> protocol <integer protocol value > This command sets the pr otocol specification number made in this rule for ICMP.
ZyWALL 2 User’s Guide L-6 Firewall Comm ands Chart L-1 Firewall Comma nds FUNCTION COMMAND DESCRIPTION config edit firewall set <set #> rule <rule #> TCP destport-single <port #> This command sets a rule to have the ZyWALL check for TCP traffic with this destination address.
ZyWALL 2 Series User’s Guide NetBIOS Filter Commands M-1 Appendix M NetBIOS Filter Commands The following describes the NetBIOS packet filter commands.
ZyWALL 2 User’s Guide M-2 NetBIOS Filter Commands Chart M-1 NetBIOS Filter Default Settings NAME DESCRIPTION EX AMPLE Between LAN and WAN This field displays whether NetBIOS packets are blocked o r forwarded between the LAN and the W AN.
ZyWALL 2 Series User’s Guide NetBIOS Filter Commands M-3 Command: sys filter netbios config 4 off This command stops NetBIOS commands from initiatin g calls.
.
ZyWALL 2 Series User’s Guide Boot Commands N-1 Appendix N Boot Commands The BootMod ule AT comm an ds execute from within the router’s bootu p software, w hen debug m ode is selected before the m ain router firm ware (ZyNOS) is started.
ZyWALL 2 User’s Guide N-2 Boot Commands Diagram N-2 Boot Module Command s AT just answer OK ATHE print help ATBAx change baudrate. 1:38.4k, 2:19.2k, 3:9.
ZyWALL 2 Series User’s Guide Log Descriptions O-1 Appendix O Log Descriptions Chart O-1 System Error Logs LOG MESSAGE DESCRIPTION %s exceeds the max. number of session per host! This attempt to create a SUA/NAT session exceeds the maximum number of SUA/NAT session table ent ries allo wed to be created per host.
ZyWALL 2 User’s Guide O-2 Log Descriptions Chart O-2 System Mainte nance Logs TELNET Login Fail Someo ne has failed to log on to the router via telnet. FTP Login Successfully Someone has logged on to the router via ftp. FTP Login Fail Someone has failed to log on to the router via ftp.
ZyWALL 2 Series User’s Guide Log Descriptions O-3 Chart O-5 Attack Logs LOG MESSAGE DESCRIPTION attack IGMP The firewall detected an IGMP attack. attack ESP The firewall detected an ESP attack. attack GRE The firewall detected a GRE attack. attack OSPF The firewall detected an OSPF attack.
ZyWALL 2 User’s Guide O-4 Log Descriptions Chart O-5 Attack Logs LOG MESSAGE DESCRIPTION syn flood TCP The firewall detected a T CP syn flood attack. ports scan TCP T he firewall detected a TCP port scan attack. teardrop TCP The firewall detected a TCP teardrop attack.
ZyWALL 2 Series User’s Guide Log Descriptions O-5 Chart O-6 Access Logs LOG MESSAGE DESCRIPTION Firewall default policy: TCP (set:%d) TCP access matched the default po licy of the listed ACL set and the ZyWALL blocked or for warded it according to the ACL set’s configuration.
ZyWALL 2 User’s Guide O-6 Log Descriptions Chart O-6 Access Logs LOG MESSAGE DESCRIPTION Firewall rule match: ESP (set:%d, rule:%d) ESP access matched the listed firewall rule and the Z yWALL blocked or forwarded it according to the rule’s configuration.
ZyWALL 2 Series User’s Guide Log Descriptions O-7 Chart O-6 Access Logs LOG MESSAGE DESCRIPTION Firewall rule NOT match: (set:%d, rule:%d) Access did not match the listed firewall rule and the Z yWALL logged it. Filter default policy DROP! TCP access matched a default filter polic y and the ZyWALL drop ped the packet to block access.
ZyWALL 2 User’s Guide O-8 Log Descriptions Chart O-6 Access Logs LOG MESSAGE DESCRIPTION Filter match DROP <set %d/rule %d> Access matched the listed filter rule an d the ZyWALL dropped the packet to block access.
ZyWALL 2 Series User’s Guide Log Descriptions O-9 Chart O-6 Access Logs LOG MESSAGE DESCRIPTION Packet without a NAT table entry blocked The router blocked a packet that did not have a corresponding SUA/NAT table entr y.
ZyWALL 2 User’s Guide O-10 Log Descriptions Chart O-8 ICMP Notes TYPE CODE DESCRIPTION 3 Destination Unreachabl e 0 Net unreachable 1 Host unrea chable 2 Protocol unreachable 3 Port unreachable 4 A .
ZyWALL 2 Series User’s Guide Log Descriptions O-11 Chart O-8 ICMP Notes TYPE CODE DESCRIPTION 14 Timestamp Reply 0 Timestamp reply message 15 Information Request 0 Information request message 16 Inf.
ZyWALL 2 User’s Guide O-12 Log Descriptions Diagram O-1 Example VPN Initiator IPSec Log VPN Responder IPSec Log The following f igure shows a typical log from the VPN c onnection pee r. Diagram O-2 Example VPN Responder IPSec Log This menu is useful f or troublesh ooting.
ZyWALL 2 Series User’s Guide Log Descriptions O-13 A PYLD_MALFORMED packet usuall y means that the tw o ends of the VPN tunnel are not using the same pre-shared k ey .
ZyWALL 2 User’s Guide O-14 Log Descriptions Chart O-10 Sample IKE Key Exchange Logs LOG MESSAGE DESCRIPTION !! Invalid IP <IP start>/<IP end> The peer’s “Local IP Addr” range is invalid. !! Remote IP <IP start> / <IP end> conflicts If the security gateway is “0.
ZyWALL 2 Series User’s Guide Log Descriptions O-15 Chart O-10 Sample IKE Key Exchange Logs LOG MESSAGE DESCRIPTION vs. My Local <IP address> The IP address type or IP address of an incoming packet does not match the peer IP address type or IP address configured on the loc al router.
ZyWALL 2 User’s Guide O-16 Log Descriptions The following table shows RFC-2408 I SAKMP payload types that the log displays. Please re fer to the RFC for detailed information on each type.
ZyWALL 2 Series User’s Guide Log Descriptions O-17 Chart O-13 Log Categories and Av aila ble Settings LOG CATEGORIES AVAILABLE PA R AMETERS attack 0, 1, 2, 3 error 0, 1, 2, 3 ike 0, 1, 2, 3 ipsec 0,.
ZyWALL 2 User’s Guide O-18 Log Descriptions ras> sys logs display access # .time source destination notes message 0|11/11/2002 15:10:12 |172.22.3.80:137 |172.22.255.255:137 |ACCESS BLOCK Firewall default policy: UDP(set:8) 1|11/11/2002 15:10:12 |172.
ZyWALL 2 Series User’s Guide Brute-Force Password Gu essing Protection P-1 Appendix P Brute-Force Password Guessing Protection The followin g describes t he commands for enabling, disabl ing and c onfiguri ng the brute -force password guessing pr otection m echanism for the passwo rd.
.
ZyWALL 2 Series User’s Guide Index Q-1 Appendix Q Index 1 10/100 Mbps Ethernet WA N ........................... 1-2 4 4-Port Switch ................................................... 1-2 A Access Point ............................................ 7-5, 24-7 Action for Matched Packets .
ZyWALL 2 Series User’s Guide Q-2 Index Configuration Fi le Uplo ad ................................ 33-16 File Bac kup ........................................................ 33-6 File Uplo ad....................................................... 33-15 Restoring Fi les .
ZyWALL 2 Series User’s Guide Index Q-3 Filter ................................. 23-12, 24 -1, 26-9, 30-1 Applying .......................................................... 30-17 Configura tion ..................................................... 30-1 Configurin g .
ZyWALL 2 Series User’s Guide Q-4 Index Inside Local A ddress ....................................... 8-1 Internet A ccess............................................... 25-1 ISP's Name ......................................................... 25-1 Internet Access Setu p .
ZyWALL 2 Series User’s Guide Index Q-5 N Nailed-up C onnection .................................... 26-4 Nailed-Up Connection .......................... 23-7, 26-5 NAT .... 3-4, 3-9, 5-1, 8-5, 8-6, 23-1 0, 26-8, 30-16 Applicati on...................
ZyWALL 2 Series User’s Guide Q-6 Index Replacement ........................................................ v Reports ........................................................... 19-6 Required fields ............................................... 21-3 Reset Button .
ZyWALL 2 Series User’s Guide Index Q-7 System Manageme nt Terminal ...................... 21-2 System Nam e .......................................... 4-2, 22-1 System Status ................................................. 32-1 System Tim eout ...
ZyWALL 2 Series User’s Guide Q-8 Index Wireless LAN Setup ...................................... 24-6 Wizard Setup ................................................... 3-1 WLAN ..................................... See Wireless LAN www.dyndns.or g ..
Een belangrijk punt na aankoop van elk apparaat ZyXEL Communications ZyWALL 2 Series (of zelfs voordat je het koopt) is om de handleiding te lezen. Dit moeten wij doen vanwege een paar simpele redenen:
Als u nog geen ZyXEL Communications ZyWALL 2 Series heb gekocht dan nu is een goed moment om kennis te maken met de basisgegevens van het product. Eerst kijk dan naar de eerste pagina\'s van de handleiding, die je hierboven vindt. Je moet daar de belangrijkste technische gegevens ZyXEL Communications ZyWALL 2 Series vinden. Op dit manier kan je controleren of het apparaat aan jouw behoeften voldoet. Op de volgende pagina's van de handleiding ZyXEL Communications ZyWALL 2 Series leer je over alle kenmerken van het product en krijg je informatie over de werking. De informatie die je over ZyXEL Communications ZyWALL 2 Series krijgt, zal je zeker helpen om een besluit over de aankoop te nemen.
In een situatie waarin je al een beziter van ZyXEL Communications ZyWALL 2 Series bent, maar toch heb je de instructies niet gelezen, moet je het doen voor de hierboven beschreven redenen. Je zult dan weten of je goed de alle beschikbare functies heb gebruikt, en of je fouten heb gemaakt die het leven van de ZyXEL Communications ZyWALL 2 Series kunnen verkorten.
Maar de belangrijkste taak van de handleiding is om de gebruiker bij het oplossen van problemen te helpen met ZyXEL Communications ZyWALL 2 Series . Bijna altijd, zal je daar het vinden Troubleshooting met de meest voorkomende storingen en defecten #MANUAl# samen met de instructies over hun opplosinge. Zelfs als je zelf niet kan om het probleem op te lossen, zal de instructie je de weg wijzen naar verdere andere procedure, bijv. door contact met de klantenservice of het dichtstbijzijnde servicecentrum.
