Manuel d'utilisation / d'entretien du produit Unified Security Gateway ZyWALL 1000 du fabricant ZyXEL Communications
Aller à la page of 780
www .zyxel.com ZyW ALL USG 1000 Unified Security Gateway User ’ s Guide V ersion 2.00 10/2007 Edition 1 DEFAULT LOGIN LAN Port P1 IP Address http://1 92 .
.
About This User's Guide ZyWALL USG 1000 User’s Guide 3 About This User's Guide This manual is designed to guide you thr ough the configuration of your ZyW ALL for its various applications .
About This User's Guide ZyWALL USG 1000 U ser’s Guide 4 " It is recommended you use the web conf igurator to configure the ZyW ALL. • W eb Configurator Online Help Click the help icon in any screen for help in configuring that screen and supplementa ry information.
Document Conventions ZyWALL USG 1000 User’s Guide 5 Document Conventions W arnings and Notes These are how warnings and notes are shown in this User ’ s Guide.
Document Conventions ZyWALL USG 1000 U ser’s Guide 6 Icons Used in Figures Figures in this User ’ s Guide may use the followi ng generic icons. The ZyW ALL icon is not an exact representation of your device.
Safety Warnings ZyWALL USG 1000 User’s Guide 7 Safety Warnings 1 For your safety , be sure to read and follow all warni ng notices and instructions. • Do NOT use this product near water , for example, in a wet basement or near a swimming pool. • Do NOT expose your device to dampness, dust or corrosive liquids.
Safety Warnings ZyWALL USG 1000 U ser’s Guide 8.
Contents Overview ZyWALL USG 1000 User’s Guide 9 Contents Overview Introduction .......................................... ........................................................................ .......... 51 Introducing the ZyWALL .............. .
Contents Overview ZyWALL USG 1000 U ser’s Guide 10 Content Filter Screens ................. ................ ................. ................ ................ ................ ...... ..... 463 Content Filter Reports ........ ................... ..
Table of Contents ZyWALL USG 1000 User’s Guide 11 Table of Contents About This User's Guide ..................................................... ................................................... .. 3 Document Conventions.....................
Table of Contents ZyWALL USG 1000 U ser’s Guide 12 3.1 Web Configurator Requirements .. ................ ................... ................ ................. ................ ... 65 3.2 Web Configurator Access ................ ................ ...
Table of Contents ZyWALL USG 1000 User’s Guide 13 5.2 T erminology in the ZyWALL ............. ................ ................ ............. ................ ................ ......1 12 5.3 Physical Ports, Interfaces , and Zones ....... ..........
Table of Contents ZyWALL USG 1000 U ser’s Guide 14 6.2.2 Set up the VPN Gatew ay . ............ ................. ................ ................ ................ ........... 132 6.2.3 Set up the VPN Connection ......... ................. ........
Table of Contents ZyWALL USG 1000 User’s Guide 15 8.1 myZyXEL.com Overview . ................ ............. ................ ................ ................ ................ ..... 1 65 8.1.1 Subscription S ervices Available on the ZyW ALL ........
Table of Contents ZyWALL USG 1000 U ser’s Guide 16 10.6.1 PPPoE/PPTP Overview ................. ................ ................ ................ ................ ........ 210 10.6.2 PPPoE/PPTP Interfaces Overview ... ............. ................
Table of Contents ZyWALL USG 1000 User’s Guide 17 13.3 OSPF Overview ......... ................ ................ ................ ................ ............. ................ ..... ... 237 13.3.1 OSPF Areas ...... ...... ............. ...........
Table of Contents ZyWALL USG 1000 U ser’s Guide 18 18.1 ALG Introduction ..... .... ......... ................ ................. ................ ............. ................ ......... ..... 265 18.1.1 Application Layer Gateway (ALG) and NA T ....
Table of Contents ZyWALL USG 1000 User’s Guide 19 20.4.2 Additional T opics for IKE SA ................................ ................ ................. ................. 310 20.4.3 VPN Gateway Summary ...... ................ ... ............. ...
Table of Contents ZyWALL USG 1000 U ser’s Guide 20 24.3.1 Downloading a F ile ............... ............. ................ ................ ................ ................ ..... 341 24.3.2 Saving a File ........... ... ............. ............
Table of Contents ZyWALL USG 1000 User’s Guide 21 27.5.1 Setting the Interface’s Bandwidth ................ ................ ................ ................ ........... 385 27.5.2 SIP Any to W AN B andwidth Management Example ................ ..
Table of Contents ZyWALL USG 1000 U ser’s Guide 22 29.3 Configuring IDP General .. .......... ................ ................ ................ ............. ................ ........ 4 18 29.4 Configuring IDP Bindings ................. ....... ...
Table of Contents ZyWALL USG 1000 User’s Guide 23 Chapter 31 Content Filter Screens......................................................... ................................................ .4 6 3 31.1 Content Filter Overvi ew . ................ ...
Table of Contents ZyWALL USG 1000 U ser’s Guide 24 34.1.4 Access Users and the ZyWALL ............ ....... ............. ................ ................ .............. 5 05 34.1.5 Force User Authenticati on Policy ......... ............. .........
Table of Contents ZyWALL USG 1000 User’s Guide 25 38.2 Directory Service (AD/ LDAP) Overview ............... ................ ................ ................ ........... 532 38.2.1 Directory S tructure ............................ ................
Table of Contents ZyWALL USG 1000 U ser’s Guide 26 Chapter 42 SSL Application ......................................................................................... ........................... 567 42.1 SSL Application Overv iew ... ..............
Table of Contents ZyWALL USG 1000 User’s Guide 27 44.3 Configuring WWW ............ ................ ................ ................. ................ ................ ............. .5 8 9 44.4 Service Control Rules ... .......... ................
Table of Contents ZyWALL USG 1000 U ser’s Guide 28 45.2 Configuration File Screen ................. ............. ................ ................ ............. ................ ..... 618 45.3 Firmware Package Screen .............. ................
Table of Contents ZyWALL USG 1000 User’s Guide 29 Appendix F Open Software Announcement s ...................................................... ................. 719 Appendix G Legal Information ............................................. .......
Table of Contents ZyWALL USG 1000 U ser’s Guide 30.
List of Figures ZyWALL USG 1000 User’s Guide 31 List of Figures Figure 1 ZyW ALL USG 1000 Front Panel .......................... ................ .................... ................ ............ .... 53 Figure 2 Managing the ZyW ALL: Web Configurator .
List of Figure s ZyWALL USG 1000 U ser’s Guide 32 Figure 39 VPN Advanced Wizard: S tep 3 ........... ............. ................ ................ ................ ............. .... .... 104 Figure 40 VPN Advanced Wizard: S tep 4 .......... .....
List of Figures ZyWALL USG 1000 User’s Guide 33 Figure 82 AppPatrol > http > Edit Default ..... ...... ................ ............. ................ ................ ............. ........ 1 44 Figure 83 Object > Schedule > Recurring > add .
List of Figure s ZyWALL USG 1000 U ser’s Guide 34 Figure 125 Network > Interface > Ethernet > Edit ........... ................ ................ ................ ................ ... .. 190 Figure 126 Network > Interface > Et hernet > Edit > Edit static DHCP table .
List of Figures ZyWALL USG 1000 User’s Guide 35 Figure 168 HTTP Redirect Example ................ ... ............. ................ ............. ................ ................ . ....... 262 Figure 169 Network > HTTP Redirect ... ............
List of Figure s ZyWALL USG 1000 U ser’s Guide 36 Figure 21 1 VPN > IPSec VPN > SA Monitor ...................... ................ ................ .................... ............. .3 2 1 Figure 212 VPN > SSL VPN > Ac cess Privilege ..
List of Figures ZyWALL USG 1000 User’s Guide 37 Figure 254 Connect L2TP to Zy W ALL: Security ....... ................. ................ ................ ................... ........ 359 Figure 255 Connect ZyW ALL L2TP: Security > Advanc ed .... .
List of Figure s ZyWALL USG 1000 U ser’s Guide 38 Figure 297 LAN to W AN, O utbound 200 kbps, Inbound 500 kbps .... ................ ................. ................ . 382 Figure 298 Bandwidth Management Behavior ...... ................ ..........
List of Figures ZyWALL USG 1000 User’s Guide 39 Figure 340 Base Profiles ....... ... ................ ................ ............. ................. ................ ............. . ................ 449 Figure 341 Anti-X > ADP > Profile ....
List of Figure s ZyWALL USG 1000 U ser’s Guide 40 Figure 383 Object > Service > Service > Edit ..... ................ ................ ................ .................... ......... ..... 5 23 Figure 384 Object > Service > Service Group .
List of Figures ZyWALL USG 1000 User’s Guide 41 Figure 426 Secure and Insecure Service Access From the WAN .......... ................... ................ ........... 587 Figure 427 HTTP/HTTPS Implementation ............. ................ ..........
List of Figure s ZyWALL USG 1000 U ser’s Guide 42 Figure 469 Maintenance > Log > L og Setting .................... ................ ................ ................. ............... .. 628 Figure 470 Maintenance > Log > L og Setting > E-mail > Edit .
List of Tables ZyWALL USG 1000 User’s Guide 43 List of Tables T able 1 Front Panel LEDs ........ ................ ................ ................. ................ ................ ............ .............. ... 54 T able 2 Managing the ZyW ALL: Cons ole Port .
List of Tables ZyWALL USG 1000 U ser’s Guide 44 T able 39 Licensing > Registration ................ ................ ................ ................... ................ ......... ........... . 167 T able 40 Licensing > Registration > Service .
List of Tables ZyWALL USG 1000 User’s Guide 45 T able 82 Network > HTTP Redirect > Edit ...... ...... ................ ............. ................ ................. ............ ..... 263 T able 83 Network > ALG ................. .......
List of Tables ZyWALL USG 1000 U ser’s Guide 46 T able 125 Anti-X > Anti-Virus > Setting > Black List Add .... ................. ................ ................... ........... 4 13 T able 126 Anti-X > Anti-Virus > Signature ........
List of Tables ZyWALL USG 1000 User’s Guide 47 T able 168 Object > Address > Address Group > Add .................. ................ ................ ................ ........ 5 18 T able 169 Object > Service > Service ...............
List of Tables ZyWALL USG 1000 U ser’s Guide 48 T able 21 1 SNMP T raps ...... ................ ................ ................ ................ ................ ................. .. ............... 607 T able 212 System > SNMP ...... .........
List of Tables ZyWALL USG 1000 User’s Guide 49 T able 254 Interface Logs ......... ................ ................ ................. ................ ................ ........... ........... ..... 699 T able 255 Account Logs .... ................ .
List of Tables ZyWALL USG 1000 U ser’s Guide 50.
51 P ART I Introduction Introducing the ZyW ALL (53) Features and Applications (57) W eb Configurator (65) Configuration Basics (1 11) T utorials (125) St atus (157) Registration (165) Update (171).
52.
ZyWALL USG 1000 User’s Guide 53 C HAPTER 1 Introducing the ZyWALL This chapter gives an overview of the ZyW ALL. It explains the front panel ports, LEDs, introduces the management meth ods, and lists different ways to start or stop the ZyW ALL.
Chapter 1 Introducing the ZyWALL ZyWALL USG 1000 U ser’s Guide 54 The following table describes the LEDs. 1.3 Management Overview Y ou can use the fol lowing ways to manage the ZyW ALL. Web Configurator The web configurator allows easy ZyW ALL setup and management using an Internet browser .
Chapter 1 Introducin g the ZyWALL ZyWALL USG 1000 User’s Guide 55 Command-Line Interface (CLI) The CLI allows you to use text-based comman ds to configure the ZyW ALL. Y ou can access it using remote management (for example, SSH or T elnet) or via the console port.
Chapter 1 Introducing the ZyWALL ZyWALL USG 1000 U ser’s Guide 56 " It is recommended you use the shutdown command before turning off the ZyW ALL. When you apply configuration files or running shell scripts, t he ZyW ALL does not stop or start the system processes.
ZyWALL USG 1000 User’s Guide 57 C HAPTER 2 Features and Applications This chapter introduces the main feat ures and applications of the ZyW ALL. 2.1 Features The ZyW ALL’ s security features include VPN, firewall, anti-virus, content filtering, IDP (Intrusion Detection and Prev ention), ADP (Anomaly Dete ction and Protection), and certificates.
Chapter 2 Features and Applications ZyWALL USG 1000 U ser’s Guide 58 Intrusion Detection and Prevention (IDP) IDP (Intrusion Detection an d Protection) can de tect malicious or suspicious packets and respond instantaneously . It detects pattern-ba sed attacks in order to protect against network- based intrusions.
Chapter 2 Features an d Applications ZyWALL USG 1000 User’s Guide 59 2.2.1 Interface to In terface (Through ZyW ALL) Ethernet -> VLAN -> Encap -> ALG -> AC -> DNA T -> Routing -> FW -> AC -> IDP -> A V - > AP -> CF -> SNA T -> BWM -> Encap -> VLAN -> Ethernet 2.
Chapter 2 Features and Applications ZyWALL USG 1000 U ser’s Guide 60 Ethernet -> VLAN -> Encap -> ALG -> AC -> DNA T -> Routing -> FW -> AC -> IDP -> A V -> AP -> CF -> SNA T -> IPSec E -> Routing -> BWM -> Encap -> VLAN -> Ethernet 2.
Chapter 2 Features an d Applications ZyWALL USG 1000 User’s Guide 61 W ith reverse proxy mode, remote users can easily acc ess any web-based applications on the local network by clicking on links or entering the provided URL. Y ou do not have to install additional client software on the re mote user computers for access.
Chapter 2 Features and Applications ZyWALL USG 1000 U ser’s Guide 62 Figure 6 Applications: User-Awar e Access Control 2.3.4 Multiple W AN Interfaces Set up multiple connections to the Internet on the same port, or set up multiple connections on different ports.
Chapter 2 Features an d Applications ZyWALL USG 1000 User’s Guide 63 Figure 8 Applications: Device HA.
Chapter 2 Features and Applications ZyWALL USG 1000 U ser’s Guide 64.
ZyWALL USG 1000 User’s Guide 65 C HAPTER 3 Web Configurator The ZyW ALL web configurator allows easy ZyW ALL setup and mana gement using an Internet browser . 3.1 W eb Configurator Requirement s In order to use the web con figurator , you must • Use Internet Explorer 6.
Chapter 3 Web Con figurator ZyWALL USG 1000 U ser’s Guide 66 Figure 9 Login Screen 3 T ype the user name (default: “adm in”) and password (default: “1234”). If your account is configured to use an AS AS authentication server , use the OTP (One - T ime Password) token to generate a number .
Chapter 3 Web Configurator ZyWALL USG 1000 User’s Guide 67 5 The screen above appears ever y time you log in using the de fault user name and default password. If you change the password for the de fault user account, this screen does not appear anymore.
Chapter 3 Web Con figurator ZyWALL USG 1000 U ser’s Guide 68 The icons provide th e following functions. 3.3.2 Navigation Panel Use the men u items on the navi gation panel to open screens to configure ZyW ALL features. The following tables describe each menu item.
Chapter 3 Web Configurator ZyWALL USG 1000 User’s Guide 69 Routing Policy Route Use this screen to create and manage routing policies. S tatic Route Use this screen to create and manage IP static routing information. RIP Use this screen to configure device-level RIP settings.
Chapter 3 Web Con figurator ZyWALL USG 1000 U ser’s Guide 70 IDP General Use this screen to look at and manage IDP bindi ngs. Profile Use this screen to create and manage IDP profiles. Custom Signatures Use this screen to create, import, or export custom signatures.
Chapter 3 Web Configurator ZyWALL USG 1000 User’s Guide 71 3.3.3 Main Window The main window shows the screen you select in th e menu. It is discussed in the rest of this document. Right after you log in, the St a t u s screen is displayed. See Chapter 7 on page 157 for more information about the St a t u s screen.
Chapter 3 Web Con figurator ZyWALL USG 1000 U ser’s Guide 72 3.3.4 Message Bar Check the message bar when you click Apply or OK to verify that the configuration has been updated. Figure 12 Message Bar 3.3.4.1 W arning Messages Click the up arrow to view the ZyW ALL’ s current warning message s.
Chapter 3 Web Configurator ZyWALL USG 1000 User’s Guide 73 Figure 14 CLI Messages Click Change Display S tyle to show or hide the index numbers for the co mmands (the commands are more convenient to copy and paste without the index numbers). Click Refr esh Now to update the screen.
Chapter 3 Web Con figurator ZyWALL USG 1000 U ser’s Guide 74.
ZyWALL USG 1000 User’s Guide 75 C HAPTER 4 Wizard Setup This chapter provides informa tion on configuring the Wizar d setup sc reens in the web configurator . See the feature-specific chapte rs in this User ’ s Guide for background information. 4.
Chapter 4 Wizard Setup ZyWALL USG 1000 U ser’s Guide 76 Use VPN SETUP to configure a VPN connection. See Section 4 .6 on page 95 . Figure 15 Wizard Setup Welcome 4.2 Inst allation Setup, One ISP The wizard screens vary depending on what enca psulation type you use.
Chapter 4 Wizard Setup ZyWALL USG 1000 User’s Guide 77 Figure 16 Internet Access: S tep 1 The following table describes the labels in this screen. 4.3 St ep 1 Internet Access Encapsula tion : Choose the Ethernet option when the W AN port is used as a regular Ethernet.
Chapter 4 Wizard Setup ZyWALL USG 1000 U ser’s Guide 78 IP Address Assignment : Select Auto If your ISP did not assign you a fixed IP address. Select St a t i c If the ISP assigned a fixed IP address. 4.3.1 Ethernet: Auto IP Address Assignment If you select Auto as the IP Addr ess Assignme nt in the previous screen, the following screen displays.
Chapter 4 Wizard Setup ZyWALL USG 1000 User’s Guide 79 Figure 18 Ethernet Encapsulation: Static The following table describes the labels in this screen.
Chapter 4 Wizard Setup ZyWALL USG 1000 U ser’s Guide 80 4.3.3 St ep 2 Inter net Access Ethernet Y ou do not configure this screen if you selected Au to as the IP Address Assignment in the previous screen. " Enter the Internet access information ex actly as given to you by your ISP .
Chapter 4 Wizard Setup ZyWALL USG 1000 User’s Guide 81 Y ou can click Ne xt and use the following screen to perform a basic registration (see Section 4.4 on page 91 ). If you want to do a more detailed regi stration or manag e your account details, click myZyXEL.
Chapter 4 Wizard Setup ZyWALL USG 1000 U ser’s Guide 82 The ZyW ALL applies the configuration settings. Figure 21 PPPoE Encapsulatio n: Auto: Fin ish Y ou have set up your ZyW ALL to access the Internet. " If you have not alr eady done so, you can register your ZyW ALL with myZyXEL.
Chapter 4 Wizard Setup ZyWALL USG 1000 User’s Guide 83 Figure 22 PPPoE Encapsul ation: Static The following table describes the labels in this screen. T able 10 PPPoE Encapsulation: Static LABEL DESCRIPTION ISP Parameters Encapsulation This displays the type of Internet connection you are configuring.
Chapter 4 Wizard Setup ZyWALL USG 1000 U ser’s Guide 84 4.3.6 St ep 2 In ternet Access PPPoE " Enter the Internet access information ex actly as given to you by your ISP . 4.3.6.1 ISP Parameters T ype the PPPoE Serv ice Name from your service provider .
Chapter 4 Wizard Setup ZyWALL USG 1000 User’s Guide 85 Figure 23 PPPoE Encapsulatio n: Static: Finish Y ou have set up your ZyW ALL to access the Internet. " If you have not alr eady done so, you can register your ZyW ALL with myZyXEL.com and activate trials of services like IDP .
Chapter 4 Wizard Setup ZyWALL USG 1000 U ser’s Guide 86 Figure 24 PPTP Encapsulation: Auto The following table describes the labels in this screen. Ta b l e 11 PPTP Encapsulation: Auto LABEL DESCRIPTION ISP Parameters Encapsulation This displays the type of Internet connection you are configuring.
Chapter 4 Wizard Setup ZyWALL USG 1000 User’s Guide 87 The ZyW ALL applies the configuration settings. Figure 25 PPTP Encapsulation: Auto : Finish Y ou have set up your ZyW ALL to access the Internet. Connection ID En ter the connection ID or connection na me in this field.
Chapter 4 Wizard Setup ZyWALL USG 1000 U ser’s Guide 88 " If you have not alr eady done so, you can register your ZyW ALL with myZyXEL.com and activate trials of services like IDP . Y ou can click Ne xt and use the following screen to perform a basic registration (see Section 4.
Chapter 4 Wizard Setup ZyWALL USG 1000 User’s Guide 89 4.3.9 St ep 2 In ternet Access PPTP " Enter the Internet access information ex actly as given to you by your ISP . 4.3.9.1 ISP Parameters Ty p e t h e User Name given to you by your ISP . User Name T ype the user name given to you by your ISP .
Chapter 4 Wizard Setup ZyWALL USG 1000 U ser’s Guide 90 Ty p e t h e Password associated with the user name. Select Nailed-Up if you do not want the conn ection to time out. Otherwise, type the Idle Tim eo u t in seconds that elapses be fore the router automatica lly disconnects from the PP TP server .
Chapter 4 Wizard Setup ZyWALL USG 1000 User’s Guide 91 4.3.10 S tep 4 Internet Access - Finish Y ou have set up your ZyW ALL to access the Internet. " If you have not alr eady done so, you can register your ZyW ALL with myZyXEL.com and activate trials of services like IDP .
Chapter 4 Wizard Setup ZyWALL USG 1000 U ser’s Guide 92 Figure 28 Registrat ion The following table describes the labels in this screen. T able 13 Registration LABEL DESCRIPTION Device Registrati on If you select existing myZyXEL .com account , only the User N ame and Password fields are availab le.
Chapter 4 Wizard Setup ZyWALL USG 1000 User’s Guide 93 Figure 29 Registration: Re gistered Device 4.5 Inst allation Setup, T wo Internet Service Providers This wizard allows you to configure two in terfaces for Internet access through either two different Internet Service Providers (ISPs) or two dif fere nt accounts with the same ISP .
Chapter 4 Wizard Setup ZyWALL USG 1000 U ser’s Guide 94 Figure 30 Internet Acc ess: S tep 1: First W AN Interface After you configure the First W AN Interface , you can configur e the Second W AN Interface .
Chapter 4 Wizard Setup ZyWALL USG 1000 User’s Guide 95 Figure 32 Internet Access: Finish " Y ou can register your ZyW A LL with myZyXEL.com and activate trials of services like IDP . Use the myZyXEL.com link if you do alrea dy ha ve a myZyXEL.com account.
Chapter 4 Wizard Setup ZyWALL USG 1000 U ser’s Guide 96 Click VPN SETUP in the Wizard Setup W elcome screen ( Figure 1 5 on page 76 ) to open the following screen. Use it to select which type of VPN settings you want to configure. Figure 33 VPN Wizard: Wizard T ype The following table describes the labels in this screen.
Chapter 4 Wizard Setup ZyWALL USG 1000 User’s Guide 97 4.7.1 VPN Express Wizard Click the Express radio button as shown in Figure 33 on page 96 to display the following screen. Figure 34 VPN Express Wizard: S tep 2 The following table describes the labels in this screen.
Chapter 4 Wizard Setup ZyWALL USG 1000 U ser’s Guide 98 Name : T ype the name used to identify this VP N connection (and VPN gateway). Y ou may use 1-31 alphanumeric characters, underscores( _ ), or dashes (-), but the fi rst character cannot be a number .
Chapter 4 Wizard Setup ZyWALL USG 1000 User’s Guide 99 4.8.1 VPN Express Wizard - Policy Setting The Policy Setting specifies which devices can use the VPN tunnel. Local and remote IP addresses must be static. Local Policy (IP/Mask) : T ype the IP address of a computer on your network.
Chapter 4 Wizard Setup ZyWALL USG 1000 U ser’s Guide 100 4.8.2 VPN Express Wizard - Summary This summary of VPN tunnel settings is read-only . Name : Identifies the VPN gateway policy . Secure Gateway : IP addre ss or domain name of the peer IPSec device.
Chapter 4 Wizard Setup ZyWALL USG 1000 User’s Guide 101 " If you have not already done so, use the myZyXEL.co m link and register your ZyW ALL with myZyXEL.com and activate trials of services like IDP . Alternatively , click Close to exit the wizard.
Chapter 4 Wizard Setup ZyWALL USG 1000 U ser’s Guide 102 Figure 38 VPN Advanced Wizard: S tep 2 The following table describes the labels in this screen. T able 18 VPN Advanced Wizard: S tep 2 LABEL DESCRIPTION Remote Gateway Name T ype the name used to identify this VPN connection (and VPN gateway).
Chapter 4 Wizard Setup ZyWALL USG 1000 User’s Guide 103 4.8.5 VPN Advanced Wizard - Remote Gateway The Remote Gateway policy identifies the IPSec devices at either end of a VPN tunnel. Name : T ype the name used to identify this VP N connection (and VPN gateway).
Chapter 4 Wizard Setup ZyWALL USG 1000 U ser’s Guide 104 Figure 39 VPN Advanced Wizard: S tep 3 The following table describes the labels in this screen. T able 19 VPN Advanced Wizard: S tep 3 LABEL DESCRIPTION Negotiation Mode Select Main for identity p rotection.
Chapter 4 Wizard Setup ZyWALL USG 1000 User’s Guide 105 4.8.6 VPN Advanced Wizard - Phase 1 Phases : IKE (Internet Key Exchange) negotiatio n has two pha ses. A phase 1 exchange establishes an IKE SA (Security Association) and phase 2 (Key Ex change) uses the SA to negotiate SAs for IPSec.
Chapter 4 Wizard Setup ZyWALL USG 1000 U ser’s Guide 106 4.8.6.1 Phase 2 Setting Phase 2 in an IKE uses the SA that was establ ished in phase 1 to negotiate SAs for IPSec. Figure 40 VPN Advanced Wizard: S tep 4 The following table describes the labels in this screen.
Chapter 4 Wizard Setup ZyWALL USG 1000 User’s Guide 107 4.8.7 VPN Advanced Wizard - Phase 2 Active Protocol : ESP is compatible with NA T , AH is not. Encapsula tion : T unnel is compatible with NA T , Tr a n s p o r t is not. Proposal : 3DES and AES use encryption.
Chapter 4 Wizard Setup ZyWALL USG 1000 U ser’s Guide 108 Figure 41 VPN Advanced Wizard: S tep 5 The following table describes the labels in this screen. 4.8.8 VPN Advanced Wizard - Summary This summary of VPN tunnel settings is read-only . Name : Identifies the VPN connec tion (and the VPN gateway).
Chapter 4 Wizard Setup ZyWALL USG 1000 User’s Guide 109 Secure Gateway : IP addre ss or domain name of the peer IPSec device. Pre-Shar ed Key : VPN tunnel password. Local Policy : IP address and subnet mask of the computers on the netw ork behind your ZyW ALL that can use the tunnel.
Chapter 4 Wizard Setup ZyWALL USG 1000 U ser’s Guide 11 0 " If you have not alr eady done so, you can register your ZyW ALL with myZyXEL.com and activate trials of services like IDP . Y ou can click Ne xt and use the following screen to perform a basic registration (see Section 4.
ZyWALL USG 1000 User’s Guide 111 C HAPTER 5 Configuration Basics This section provides info rmation to help y ou configure the ZyW ALL effectively . Some of it is helpful when you are just gettin g started. Some of it is provid ed for your reference when you configure various features in the ZyW ALL.
Chapter 5 Configu ration Basics ZyWALL USG 1000 U ser’s Guide 11 2 5.2 T erminology in the ZyW ALL This section highlights some differences in terminology or o rganization between the ZyW ALL and other routers, particularly ZyNOS ro uters.
Chapter 5 Configura tion Basics ZyWALL USG 1000 User’s Guide 11 3 A physical port is the place to which y ou connect the cable. As shown above, you do not usually configure physical ports to use variou s features. Y ou configur e interfaces and zones.
Chapter 5 Configu ration Basics ZyWALL USG 1000 U ser’s Guide 11 4 Figure 43 Interfaces and Zones: Examp le • The LAN zone contains the ge1 (Gigabit Ethernet 1) interface. This is a protected zone and uses private IP addresses. ge1 uses 19 2.168.1.
Chapter 5 Configura tion Basics ZyWALL USG 1000 User’s Guide 11 5 Example: This provides a simple example to show you how to configure this feature. The example is usually based on the network topolo gy in Figure 43 on page 114 .
Chapter 5 Configu ration Basics ZyWALL USG 1000 U ser’s Guide 11 6 Example: See Chapter 6 on page 125 . 5.4.4 IPSec VPN Use IPSec VPN to prov ide secure communication between two sites over the Internet or any insecure network that uses TCP/IP for comm unication.
Chapter 5 Configura tion Basics ZyWALL USG 1000 User’s Guide 11 7 Zones cannot overlap. Each interface and VPN tu nnel can be assigned to at most one zone. V irtual interfaces are automatica lly assigned to the same zone as the interface on which they run.
Chapter 5 Configu ration Basics ZyWALL USG 1000 U ser’s Guide 11 8 2 Click Network > Routing > Policy Route to go to the policy ro ute configuration screen. Add a policy route. 3 Name the policy route. 4 Select the interface that the traffic comes in through ( ge4 in this example).
Chapter 5 Configura tion Basics ZyWALL USG 1000 User’s Guide 11 9 2 Create an address object for the V oIP server ( Object > Address ). 3 Click Fir e wall to go to the firewall configuration. 4 Select from the DMZ-2 zone to the LAN zone, and add a firewa ll rule using the items you have configured.
Chapter 5 Configu ration Basics ZyWALL USG 1000 U ser’s Guide 120 5.4.14 Anti-Virus Use anti-virus to detect a nd take action on viru ses. Y ou must subscribe to use anti-virus. Y ou can subscribe using the Licensing > Registration sc reens or one of the wizards.
Chapter 5 Configura tion Basics ZyWALL USG 1000 User’s Guide 121 11 Add a policy that uses the schedule, the filteri ng profile and the user that you created. 5.4.18 V irtual Server (Port Forwarding) Use this to change the address and/or port number of packets coming in from a specified interface.
Chapter 5 Configu ration Basics ZyWALL USG 1000 U ser’s Guide 122 5.4.20 ALG The ZyW ALL’ s Application Laye r Gateway (ALG) allows V oIP and FTP applicatio ns to go through NA T on the ZyW ALL. Y ou can also specify additional si gnaling port numbers.
Chapter 5 Configura tion Basics ZyWALL USG 1000 User’s Guide 123 If you want to force users to log in to the ZyW ALL before the ZyW ALL routes traffic for them, you might have to configure prerequisites first. 5.6 System Management and Maintenance This section introduces some of the management an d maintenance feature s in the ZyW ALL.
Chapter 5 Configu ration Basics ZyWALL USG 1000 U ser’s Guide 124 5.6.2 File Manager Use these screens to upload, download, delete, or run scri pts of CLI commands. Y ou can manage • Configuration files. Use configuration fil es to back up and restore the complete configuration of the ZyW ALL.
ZyWALL USG 1000 User’s Guide 125 C HAPTER 6 Tutorials This chapter provides so me examples of using th e web configurator to set up features in the ZyW ALL.
Chapter 6 Tutorials ZyWALL USG 1000 U ser’s Guide 126 Figure 44 Network > Interf ace > Port Grouping, Initial 2 Drag physical po rt 2 onto representative interface ge1 , as shown below . Figure 45 Network > Interface > Port Grouping, Dra g-and-Drop 3 Click Apply .
Chapter 6 Tutorials ZyWALL USG 1000 User’s Guide 127 Figure 46 S tatus: Interfa ce St atus Summary After Po rt Grouping 6.1.2 Set up Ethernet Interfaces This example sets up the Ethernet interfaces as shown below . Y ou have decided to use the defa ult settings for ge1 and ge3, so it is not necessary to edit these interfaces.
Chapter 6 Tutorials ZyWALL USG 1000 U ser’s Guide 128 Figure 48 Network > In terface > Et hernet > ge 4 3 Use the default values for the rest of the settings. Click Apply to save these changes and return to the previous screen. Click the Edit icon for ge5, and set up the IP address as shown below .
Chapter 6 Tutorials ZyWALL USG 1000 User’s Guide 129 Figure 51 S tatus > In terface S tatus Summary , After Ethernet Interface Edits 6.1.3 W AN T runk This example sets up trunk W AN_TRUNK with ge3 and ge4. Th is example uses the default settings for the trunk and shows how to add the interfaces to it.
Chapter 6 Tutorials ZyWALL USG 1000 U ser’s Guide 130 Figure 54 Network > Interface > T runk > Edit > Member 4 Use the default values for the rest of the settings. Click OK to save thes e changes and return to the previous screen. 6.1.4 Zones This example sets up the LAN, W AN, and DMZ zones as shown below .
Chapter 6 Tutorials ZyWALL USG 1000 User’s Guide 131 Figure 56 Network > Zone > DMZ , Remove ge4 3 Select IF ACE/ge4 and click the left arrow to remove ge4 from the Member list. Click OK to save these changes and retu rn to the previous screen.
Chapter 6 Tutorials ZyWALL USG 1000 U ser’s Guide 132 6.2 IPSec VPN This example is going to show you how to create the VPN tunnel illustrated below . Figure 59 VPN Example In this example, the ZyW ALL is router X (172.23.37.240/24), and the remote IPSec rou ter is router Y (220.
Chapter 6 Tutorials ZyWALL USG 1000 User’s Guide 133 Figure 60 VPN > IPSec VPN > VPN Gateway > Add 6.2.3 Set up the VPN Connectio n The VPN co nnection manages the IPSec SA. Y ou ha ve to set up the address objects for the local network and remote network befo re you can set up the VPN connection.
Chapter 6 Tutorials ZyWALL USG 1000 U ser’s Guide 134 Figure 62 VPN > IPSec VPN > VPN Connection > add 6.2.4 Set up the Policy Route for the VPN T unnel Y ou should create a new policy route to use th e VPN tunnel. This policy route will only use the existing address objects, so you do not have t o create any additional objects first.
Chapter 6 Tutorials ZyWALL USG 1000 User’s Guide 135 Figure 64 Network > Routing > Policy Route > Add Because the new VPN connection has not be en assign ed to a zone yet, there are no restrictions (for example, firewall) on traffic to or from this VPN connection.
Chapter 6 Tutorials ZyWALL USG 1000 U ser’s Guide 136 6.3 Device HA This example is going to show you how to set up device HA as illustrated below . Figure 66 Device HA Example In this example, router A is the default gateway for th e network and uses IP address 192.
Chapter 6 Tutorials ZyWALL USG 1000 User’s Guide 137 Figure 67 Device HA > VRRP Group > Add: ge 1 3 Click St a t u s , and scroll down to the Interface S tatus Summary .
Chapter 6 Tutorials ZyWALL USG 1000 U ser’s Guide 138 Figure 69 Network > Device HA > VRRP Group > Add: ge4 " Once you configure an interface in a VRRP group, you should not configure the interface to have a dynamic IP address. 6.3.3 Set up the Password for Synchronization 1 Click Device HA > Synchr onize .
Chapter 6 Tutorials ZyWALL USG 1000 User’s Guide 139 6.3.4 Finish Configuring the Master Finish configuring the master . The backup router will get th ese updates later , when it synchronizes w ith the master .
Chapter 6 Tutorials ZyWALL USG 1000 U ser’s Guide 140 6.3.7 Synchronize the Backup 1 Connect the backup to the same network as the master . 2 Click Device HA > Synchr onize .
Chapter 6 Tutorials ZyWALL USG 1000 User’s Guide 141 6.4.1 Set up User Account s Set up one user account for each user account in the RA DIUS server . If it is possible to export user names from the RADIUS server to a text file, then you might create a script to create the user accounts instead.
Chapter 6 Tutorials ZyWALL USG 1000 U ser’s Guide 142 6.4.3 Set up User Authenti cation Using th e RADIUS Server This step sets up user authentication using the RADIUS server . First, configure the settings for the RADIUS server . Then, set up the authentic ation method, and configure the ZyW ALL to use the authentication method.
Chapter 6 Tutorials ZyWALL USG 1000 User’s Guide 143 " The users will have to log in using the web configurator login screen before they can use HTTP or MSN.
Chapter 6 Tutorials ZyWALL USG 1000 U ser’s Guide 144 Figure 81 AppPatrol > http > Edit Default 4 Click the Add icon in the policy list . In the new polic y , s elect one of the user groups tha t is allowed to browse the web and set the co rresponding bandwidth restriction in the Inbound and Outbound fields.
Chapter 6 Tutorials ZyWALL USG 1000 User’s Guide 145 Figure 83 Object > Schedule > Recurring > add 3 Follow the steps in Section 6.4.4 o n page 143 to set up the appropriate policies for MSN in application patrol. Make su re to specif y the schedule when you configure the policy for the Sales group’ s MSN acc ess.
Chapter 6 Tutorials ZyWALL USG 1000 U ser’s Guide 146 Figure 85 Firewall > LAN > DMZ > Add 5 Repeat this process to set up firewall rules for the other user groups that are allowed to access the DMZ. 6.5 T runks The following examp le shows how to set up a trunk fo r two connections (ge2 and ge3) to the Internet.
Chapter 6 Tutorials ZyWALL USG 1000 User’s Guide 147 Figure 87 Network > In terface > Et hernet > Edit > ge2 2 Click the Edit icon for ge3, and en ter the available bandwidth (512 kbps ) in the Upstream Bandwid th and Downstream Bandwidth fields.
Chapter 6 Tutorials ZyWALL USG 1000 U ser’s Guide 148 The firewall is enabled, so you also need to cr eate a rule to allow traf fic in from the W AN zone.
Chapter 6 Tutorials ZyWALL USG 1000 User’s Guide 149 6.6.2 NA T 1:1 V i rtual Server This section sets up a virtual se rver rule that changes the des tination of SMTP traffic coming to IP address 1.1.1.1 at the ZyW ALL’ s ge3 (W AN) interface, to the LAN SMTP server ’ s IP address (192.
Chapter 6 Tutorials ZyWALL USG 1000 U ser’s Guide 150 Figure 94 NA T 1:1 Examp le Policy Route Click Network > Routing > Policy Route > Add and configure the scree n as shown next. Be careful of where you create the route as routes are ordered in descending priority .
Chapter 6 Tutorials ZyWALL USG 1000 User’s Guide 151 Figure 96 Create a Firewall Rule 6.7 NA T Loopback The NA T 1:1 example in Section 6.6 on page 147 maps a public IP address to the private IP address of a LAN SMTP mail server to allow user s to access the SMTP mail server from the W A N.
Chapter 6 Tutorials ZyWALL USG 1000 U ser’s Guide 152 6.7.1 NA T Loopback Vi rtual Server When a LAN user sends SMTP traffic to IP a ddress 1.1.1.1, the traf fic comes into the ZyW ALL through the ge1 (LAN) interface, thus it does not match the NA T 1:1 mapping’ s virtual server rule for SMTP traffic coming to IP 1.
Chapter 6 Tutorials ZyWALL USG 1000 User’s Guide 153 6.7.2 NA T Loopback Policy Route W ithout a NA T loopback policy route, the LAN user SMTP tr af fic goes to the LAN SMTP server has the LAN computer ’ s IP address as the source. The source address is in the same subnet, so the LAN SMTP server replies directly .
Chapter 6 Tutorials ZyWALL USG 1000 U ser’s Guide 154 Figure 102 Create a Policy Route Now the LAN SMTP server replies to th e ZyW ALL’ s LAN IP address and the ZyW ALL changes the source address to 1.1.1.1 before sending it to the LAN user ’ s computer .
Chapter 6 Tutorials ZyWALL USG 1000 User’s Guide 155 6.8 Service Control and the Firewall Service control lets you config ure rules that control HTTP an d HTTPS management access (to the web configurator) and separate rules that control HTTP and HTTPS user access (logging into SSL VPN for example).
Chapter 6 Tutorials ZyWALL USG 1000 U ser’s Guide 156 Figure 105 System > WWW > Service Control Rule Edit 4 Click Apply . Figure 106 System > WWW Now administrators can only log into the we b configurator from the LAN zone.
ZyWALL USG 1000 User’s Guide 157 C HAPTER 7 Status This chapter explains the St a t u s screen, which is the screen you see when you first log in to the ZyW ALL or when you click St a t u s .
Chapter 7 Status ZyWALL USG 1000 U ser’s Guide 158 The following table describes the labels in this screen. T able 34 Status LABEL DESCRIPTION Device Information System Name This field displays the name used to identify the ZyWALL on any network. Click the icon on the right to o pen the screen where you can change it.
Chapter 7 Status ZyWALL USG 1000 User’s Guide 159 Signature Ve r s i o n This field displays the version number , da te, and time of the current set of signature s the ZyWALL is using. Last Update Ti m e This field displ ays the last time the Z yW ALL received updated si gnatures.
Chapter 7 Status ZyWALL USG 1000 U ser’s Guide 160 7.2 VPN S t atus Use this screen to look at the VPN tunnels that are currently established. T o access this scre en, click VPN S tatus in the St a t u s screen. HA S tatus This field displays the status of the interface in the virtual router .
Chapter 7 Status ZyWALL USG 1000 User’s Guide 161 Figure 108 S tatus > VPN S tatus The following table describes the labels in this screen. 7.3 DHCP T able Use this screen to look at the IP addresses currently assigned to DHCP clients and the IP addresses reserved for specific MAC addresses.
Chapter 7 Status ZyWALL USG 1000 U ser’s Guide 162 Figure 109 S tatus > DHCP T able The following table describes the labels in this screen. 7.4 Port S t atistics Use this screen to look at packet statistics for each physical port. T o acc ess this screen, click Port S tatistics in the St a t u s screen.
Chapter 7 Status ZyWALL USG 1000 User’s Guide 163 Figure 1 10 S tatus > Port S tatistics The following table describes the labels in this screen. 7.5 Current Users Use this screen to look at a list of the users currently logged into th e ZyW ALL.
Chapter 7 Status ZyWALL USG 1000 U ser’s Guide 164 Figure 1 1 1 S tatus > Current User s The following table describes the labels in this screen. T able 38 Status > Current Use rs LABEL DESCRIPTION # This field is a seq uential value and is not associated with any entry .
ZyWALL USG 1000 User’s Guide 165 C HAPTER 8 Registration This chapter shows you how to register for the ZyW ALL’ s subscription services. 8.1 myZyXEL.com Overview myZyXEL.com is ZyXEL ’ s online services center wh ere you can register your ZyW ALL and manage subscription services available for the ZyW ALL.
Chapter 8 Registration ZyWALL USG 1000 U ser’s Guide 166 • SSL VPN tunnels provide secure network access to remote users. Y ou can purchase and enter a license key to have the ZyW ALL use more SSL VPN tunnels. • The content filter allows or blocks access to web sites.
Chapter 8 Registration ZyWALL USG 1000 User’s Guide 167 The following table describes the labels in this screen. " If the ZyW ALL is register ed already , this screen is read-only and indicates whether trial services are activated (if any). Y ou can still select the unchecked trial service(s) to acti vate it after regist ration.
Chapter 8 Registration ZyWALL USG 1000 U ser’s Guide 168 Figure 1 13 Lic ensing > Registration: Re gistered Device 8.3 Service After you activate a trial, you can also use this screen to register and enter your iCard’ s PIN number (license key).
Chapter 8 Registration ZyWALL USG 1000 User’s Guide 169 Expiration date This field displays the date your service expires. Y ou can continue to use IDP/AppPatrol or Anti-Virus after the registration expires, you just won’t receive up dated signatures.
Chapter 8 Registration ZyWALL USG 1000 U ser’s Guide 170.
ZyWALL USG 1000 User’s Guide 171 C HAPTER 9 Update This chapter shows you h o w to upda te the ZyW ALL’ s signature packages. 9.1 Up dating Anti-virus Signatures When scheduling signature updates, choose a day and time when your network is least busy to minimize disruption to your netw ork.
Chapter 9 Upda te ZyWALL USG 1000 U ser’s Guide 172 Figure 1 15 Licensing > Update >Anti-V irus The following table describes the labels in this screen. LABEL DESCRIPTION Signature Information Current V e rsion This field displays the signa tures version number currently used by the ZyW A LL.
Chapter 9 Update ZyWALL USG 1000 User’s Guide 173 9.2 Up dating IDP and Application Patrol Signatures The ZyW A LL comes with signatures for the ID P and application patrol features. The se signatures are continually updated as new attack types evolve.
Chapter 9 Upda te ZyWALL USG 1000 U ser’s Guide 174 Figure 1 17 Downloading IDP Signatures Figure 1 18 Successful IDP Signature Download Auto Update Select this check box to have the ZyW A LL automatically check fo r new IDP signatures regularly at t he time and day specified.
Chapter 9 Update ZyWALL USG 1000 User’s Guide 175 9.3 Up dating System Protect Signatures The ZyW A LL comes with signatures that the ZyW ALL uses to protect itself from intrusions. These signatures are continually updated as new attack types evolve.
Chapter 9 Upda te ZyWALL USG 1000 U ser’s Guide 176 Figure 120 Downloading System Protect Signatur es Figure 121 Successful System Protect Sign ature Down load Daily Sel ect this option to have the ZyWA L L check for new signatures every day at the specified time.
177 P ART II Network Interface (179) T runks (219) Policy and S tatic Routes (225) Routing Protocols (235) Zones (245) DDNS (249) V irtual Servers (255) HTTP Redirect (261) ALG (265).
178.
ZyWALL USG 1000 User’s Guide 179 C HAPTER 10 Interface See Section 5.4.2 on page 1 15 for related information on these screens. 10.1 Interface Overview In general, an interface has the following characteristics. • An interface is a logical entity th rough which (layer -3) packets pass.
Chapter 10 Interface ZyWALL USG 1000 U ser’s Guide 180 • T runks mana ge load balancing betwe en interfaces. Port groups, trunks, and the aux iliary interface have a lot of char acteristics that are specific to each type of interface. They are discussed in more detail in Section 10.
Chapter 10 Interfac e ZyWALL USG 1000 User’s Guide 181 Figure 122 Example: Entry in the Routing T able Derived from Interfaces For example, if the ZyW ALL ge ts a packet wi th a destination address of 100.100.25.25, it routes the packet to interface ge1.
Chapter 10 Interface ZyWALL USG 1000 U ser’s Guide 182 10.1.3 Interface Parameters The ZyW A LL restricts the amount of traffi c into and out of the ZyW ALL through each interface. • Upstream bandwidth is the amount of traf fi c from the ZyW ALL through the interface to the network.
Chapter 10 Interfac e ZyWALL USG 1000 User’s Guide 183 The ZyW A LL cannot assign the first addre ss (network address) or the last address (broadcast address) in the subn et defined by the interface’ s IP address and subnet mask. For example, in the first entry , if the subne t mask is 255.
Chapter 10 Interface ZyWALL USG 1000 U ser’s Guide 184 10.1.6 Relationship s Between Interfaces In the ZyW ALL, interfaces are usually created on top of other interfaces. Only Et hernet interfaces are created directly on top of the physical ports (or port groups).
Chapter 10 Interfac e ZyWALL USG 1000 User’s Guide 185 In addition, you use Ethern et interfaces to control which physical ports exchange routing information with other routers and how much information is ex changed through each one. The more routing information is exchanged, the more efficient th e routers should be.
Chapter 10 Interface ZyWALL USG 1000 U ser’s Guide 186 Figure 123 Network > Interface > Interface Summary Each field is described in the following table.
Chapter 10 Interfac e ZyWALL USG 1000 User’s Guide 187 S tatus This field displays the current status of each interfa ce. The possible values depend on what type of interface it is. For port groups: Inactive - The port group is disabled. Port Group Down - The port g roup is enabled b ut not connected.
Chapter 10 Interface ZyWALL USG 1000 U ser’s Guide 188 10.2.3 Ethernet Summary Screen This screen lists every Etherne t interface an d virtual interface created on top of Ethernet interfaces.
Chapter 10 Interfac e ZyWALL USG 1000 User’s Guide 189 Each field is described in the following table. 10.2.4 Ethernet Edit The Ethernet Edit screen lets you configure IP a ddress assignment, interface parameters, RIP settings, OSPF settings, DHCP settings, and ping check settings.
Chapter 10 Interface ZyWALL USG 1000 U ser’s Guide 190 Figure 125 Network > Interface > Ethernet > Edit.
Chapter 10 Interfac e ZyWALL USG 1000 User’s Guide 191 Each field is described in the table below . T able 50 Network > Interface > Ethernet > Edit LABEL DESCRIPTION Ethernet Interface Properties Enable Select this to enable this interface.
Chapter 10 Interface ZyWALL USG 1000 U ser’s Guide 192 Direction This field is e ffect ive when RIP is enabled. Select the RIP direction from the drop-down list box. BiDir - This interface sends and recei ves routing information. In-Only - This interface re ceives routing information.
Chapter 10 Interfac e ZyWALL USG 1000 User’s Guide 193 Relay Server 2 This field is optional. Enter the IP address of another DHCP server for the network. These fields appear if the ZyW AL L is a DHCP Server . IP Pool S tart Address Enter the IP address fro m which the ZyWALL begins allocating IP addresses.
Chapter 10 Interface ZyWALL USG 1000 U ser’s Guide 194 10.3 Port Grouping This section introduces po rt groups and then explains the screen for port groups. 10.3.1 Port Grouping Overview Use port grouping to create port groups and to assign physical ports and port groups to Ethernet interfaces.
Chapter 10 Interfac e ZyWALL USG 1000 User’s Guide 195 Each physical port is assigned to one Ethernet interface. In port gro uping, the Ethernet interfaces are ca lled repr esentative inte rfaces . If you assign more than one physical port to a representative interface, you create a port group .
Chapter 10 Interface ZyWALL USG 1000 U ser’s Guide 196 Figure 129 Network > Interface > Port Grouping Each section in this scr een is described below . 10.4 VLAN Interfaces This section introduces VLAN and VLAN interfa ces and then explains the screens for VLAN interfaces.
Chapter 10 Interfac e ZyWALL USG 1000 User’s Guide 197 Figure 130 Example: Before VLAN In this example, there are two phys ical networks and three departmen ts A , B , and C . The physical networks are conn ected to hubs, and the hubs are connected to the router .
Chapter 10 Interface ZyWALL USG 1000 U ser’s Guide 198 • Better manageability - Y ou can align network policies more ap propriately for users. For example, you can create different content filte ring rules for each VLAN (each department in the example above), and you can set diff erent bandwidth limits for each VLAN.
Chapter 10 Interfac e ZyWALL USG 1000 User’s Guide 199 10.4.4 VLAN Add/Edit This screen lets you configure IP address assi gnment, interface bandwidth parameters, DHCP settings, and ping check for each VLAN inte rface.
Chapter 10 Interface ZyWALL USG 1000 U ser’s Guide 200 Figure 133 Network > Interface > VLAN > Edit.
Chapter 10 Interfac e ZyWALL USG 1000 User’s Guide 201 Each field is explained in the following table. T able 53 Network > Interface > VLAN > Edit LABEL DESCRIPTION VLAN Interface Properties Enable Select this to enable this interface. Clear this to disable this interface.
Chapter 10 Interface ZyWALL USG 1000 U ser’s Guide 202 DHCP Select what type of DHCP service t he ZyWALL provides to the network. Choices ar e: None - the ZyW ALL does not provide any DHCP services. There is already a DHCP server on the network. DHCP Relay - the ZyW ALL routes DHCP requests to one or more DHCP servers you specify .
Chapter 10 Interfac e ZyWALL USG 1000 User’s Guide 203 10.5 Bridge Interfaces This section introduces bridges and bridge interfaces and then explains the screens for bridge interfaces. Edit static DHCP tab le Click this if you want the ZyW ALL to a ssign static IP addre sses to computers.
Chapter 10 Interface ZyWALL USG 1000 U ser’s Guide 204 10.5.1 Bridge Overview A bridge creates a connectio n between two or more netw ork segments at the layer-2 (MAC address) level. In the foll owing example, bridge X co nnects four network segments.
Chapter 10 Interfac e ZyWALL USG 1000 User’s Guide 205 10.5.2 Bridge Interface Overview A bridge interface creates a software bridge be tween the members of the bridge interface.
Chapter 10 Interface ZyWALL USG 1000 U ser’s Guide 206 10.5.4 Bridge Add/Edit This screen lets you configure IP address assi gnment, interface bandwidth parameters, DHCP settings, and ping check for each bridge interface.
Chapter 10 Interfac e ZyWALL USG 1000 User’s Guide 207 Figure 136 Network > Interface > Bridge > Edit.
Chapter 10 Interface ZyWALL USG 1000 U ser’s Guide 208 In this example, you are creating a ne w bridge. If you are editing a bridge, the Interface Name field is read-only .
Chapter 10 Interfac e ZyWALL USG 1000 User’s Guide 209 MTU Maximum T ran smission Unit. T ype the maximum size of ea ch data packet, in bytes, that can move through this inte rface. If a larger packet arrives, the ZyW ALL di vides it into smaller fragm ents.
Chapter 10 Interface ZyWALL USG 1000 U ser’s Guide 210 10.6 PPPoE/PPTP Interfaces This section introduces PPPoE, PP TP , and PPPoE/PP TP interfaces and then explains the screens for PPPoE/PP TP interfaces.
Chapter 10 Interfac e ZyWALL USG 1000 User’s Guide 21 1 PPPoE is often used with cable modems an d DSL connections. It provides the following advantages: • The access and authentication method works with existing systems, including RADIUS. • Y ou can access one of several network servi ces.
Chapter 10 Interface ZyWALL USG 1000 U ser’s Guide 212 10.6.3 PPPoE/PPTP Interface Summary " Y ou have to set up an ISP account before you create a PPPoE/PP TP interface. This screen lists every PPPoE/PP TP inte rface. T o access this screen, click Network > Interface > PPPoE/PP TP .
Chapter 10 Interfac e ZyWALL USG 1000 User’s Guide 213 10.6.4 PPPoE/PPTP Interface Add/Edit " Y ou have to set up an ISP account before you create a PPPoE/PP TP interface.
Chapter 10 Interface ZyWALL USG 1000 U ser’s Guide 214 Each field is explained in the following table. T able 60 Network > Interface > PPPoE/PPTP > Edit LABEL DESCRIPTION PPP Interfac e Properties Enable Select this to enable this interface.
Chapter 10 Interfac e ZyWALL USG 1000 User’s Guide 215 10.7 Auxiliary Interface This section introduces the auxiliary interface and then explains the screen for it. 10.7.1 Auxiliary Interface Overview Use the auxiliary interface to dial out from th e ZyW ALL’ s auxiliary port.
Chapter 10 Interface ZyWALL USG 1000 U ser’s Guide 216 Figure 141 Network > Interface > Auxiliary Each field is described in the table below . T able 61 Network > Interface > Auxiliary LABEL DESCRIPTION Auxiliary Interface Properties Enable Select this to turn on the auxiliary dial up interface.
Chapter 10 Interfac e ZyWALL USG 1000 User’s Guide 217 10.8 V irtual Interfaces Use virtual interfaces to tell the ZyW ALL where to route pack ets. V irtual interfaces can also be used in VPN gateways (see Chapter 20 on page 291 ) and VRRP groups (see Chapter 33 on page 493 ).
Chapter 10 Interface ZyWALL USG 1000 U ser’s Guide 218 Figure 142 Network > Interface > Add Each field is described in the table below . T able 62 Network > Interface > Add LABEL DESCRIPTION Virtual Interface Properties Interface Name This field is read-only .
ZyWALL USG 1000 User’s Guide 219 C HAPTER 11 Trunks This chapter shows you how to configure trunks on your ZyW ALL. See Section 5 .4.3 on page 11 5 for related informa tion on these screens.
Chapter 11 Trun ks ZyWALL USG 1000 U ser’s Guide 220 Maybe you have two conn ections with diff erent bandwidths . For jitter-sensitive traf fic (like video for example), you could set up a trunk gr .
Chapter 11 Trunks ZyWALL USG 1000 User’s Guide 221 1 1.4.2 W eighted Round Robin Round Robin scheduling services queues on a rota ting basis and is activated only when an interface has more traf fic than it can handle. A queue is giv en an amount of bandwidth irrespective of the incoming traf fic on that interf ace.
Chapter 11 Trun ks ZyWALL USG 1000 U ser’s Guide 222 Figure 145 S p illover Algorithm Example 1 1.5 T runk Summary Click Network > Interface > T runk to open the T runk screen. This screen lists the configured trunks and the load balancing al gorithm that each is configured to use.
Chapter 11 Trunks ZyWALL USG 1000 User’s Guide 223 Figure 147 Network > Interface > T runk > Edit Each field is described in the table below . T able 65 Network > Interface > Trunk > Edit LABEL DESCRIPTION Name Enter a descriptive name for this trunk.
Chapter 11 Trun ks ZyWALL USG 1000 U ser’s Guide 224 S pillover This field displays with th e spillover load balancing algorithm. S pec ify the maximum bandwidth of traffic i n kilobits per second (1~1048576) to send out th rough the interface before using another interface.
ZyWALL USG 1000 User’s Guide 225 C HAPTER 12 Policy and Static Routes This chapter shows you how to configure policies for IP routin g and static routes on your ZyW ALL. See Section 5 .4.10 on page 1 17 for related information on the policy route screens.
Chapter 12 Policy and Static Routes ZyWALL USG 1000 U ser’s Guide 226 IPPR follows the existing packet filtering fac ility of RAS in style and in implementation.
Chapter 12 Policy and Sta tic Routes ZyWALL USG 1000 User’s Guide 227 Figure 148 T rigger Por t Forwarding Example 12.2.3 Maximize Bandwid th Usage The maximize bandwi dth usage option allows the Zy.
Chapter 12 Policy and Static Routes ZyWALL USG 1000 U ser’s Guide 228 Figure 149 Network > Routing > Policy Route The following table describes the labels in this screen. T able 66 Network > Routing > Policy Route LABEL DESCRIPTION Enable BWM This is a global settin g for enabling or disabling bandwidth management on the ZyW ALL .
Chapter 12 Policy and Sta tic Routes ZyWALL USG 1000 User’s Guide 229 12.4 Policy Route Edit Click Network > Routing to open the Policy Route screen. Then click the Add or Edit icon to open the Policy Route Edit screen. " Configure NA T loopback if you have a virtual server th at local users will use a domain name to access.
Chapter 12 Policy and Static Routes ZyWALL USG 1000 U ser’s Guide 230 Figure 150 Network > Routing > Policy Route > Edit The following table describes the labels in this screen. T able 67 Network > Routing > Policy Route > Edit LABEL DESCRIPTION Configuration Enable Select this to activate the policy .
Chapter 12 Policy and Sta tic Routes ZyWALL USG 1000 User’s Guide 231 T ype Select Auto to have the ZyW ALL use the rout in g table to find a n ext-hop and forward the matched packets automatically . Select Gateway to route the matched packets to the next-hop router or switch you specified in the Gate way field.
Chapter 12 Policy and Static Routes ZyWALL USG 1000 U ser’s Guide 232 12.5 IP S tatic Routes The ZyW ALL has no knowledge of the networ ks beyond the network that is directly connected to the ZyW ALL. For instan ce, th e ZyW ALL knows about network N2 in the following figure through gatew ay R1 .
Chapter 12 Policy and Sta tic Routes ZyWALL USG 1000 User’s Guide 233 12.6 S t atic Route Summary Click Network > Routing > S tatic Route to open the St a t i c R o u t e screen. Figure 152 Network > Routing > S tatic Route The following table describes the labels in this screen.
Chapter 12 Policy and Static Routes ZyWALL USG 1000 U ser’s Guide 234 The following table describes the labels in this screen. T able 69 Network > Routing > S tatic Route > Edit LABEL DESCRIPTION Destination IP This parameter specifies the IP network addr ess of the final destination.
ZyWALL USG 1000 User’s Guide 235 C HAPTER 13 Routing Protocols This chapter describes how to set up RIP and OSPF routing protocol settings for the ZyW ALL. First, it provides an overview of R IP and OSPF , and, then, it introduces the RIP and OSPF screens used to config ure routing protoc ols.
Chapter 13 Routing Protocols ZyWALL USG 1000 U ser’s Guide 236 RIP uses UDP port 520. 13.1.2 Authentication T ypes Authentication is used to gu arantee the integrity , but not the confidentiality , of routing updates.
Chapter 13 Routing Protocols ZyWALL USG 1000 User’s Guide 237 Figure 154 Network > Routing > RIP The following table describes the labels in this screen.
Chapter 13 Routing Protocols ZyWALL USG 1000 U ser’s Guide 238 • OSPF filters and summarizes routing informat ion, which reduces the size of routing tables throughout the network. • OSPF responds to ch anges in the network, such as the loss of a router , more quickly .
Chapter 13 Routing Protocols ZyWALL USG 1000 User’s Guide 239 This OSPF AS consists of four areas, areas 0- 3. Area 0 is always the backbone. In this example, areas 1, 2, and 3 are all connected to it. Area 1 is a normal area. It has routing information about the OSPF AS and networks X an d Y .
Chapter 13 Routing Protocols ZyWALL USG 1000 U ser’s Guide 240 Figure 156 OSPF: T ypes of Routers In order to reduce the amount of traffic betwee n routers, a group of routers that are directly connected to each other selects a des ignated router (DR) an d a backup des ignated router (BDR).
Chapter 13 Routing Protocols ZyWALL USG 1000 User’s Guide 241 2 Set up the OSPF areas. 3 Configure the appropriate interfaces. See Section 10.2.1 on page 184 . 4 Set up virtual links, as needed . 13.4 OSPF Screens The OSPF screens are used to specify the ID the ZyW ALL us es in the OSPF AS and to maintain the policies for redistribu tion.
Chapter 13 Routing Protocols ZyWALL USG 1000 U ser’s Guide 242 13.4.2 OSPF Area Add/Edit The OSPF Ar ea Add/Edit screen allows you to create a new area or edit an existing one. T o access this screen, go to the OSPF summary screen (see Section 13.4.
Chapter 13 Routing Protocols ZyWALL USG 1000 User’s Guide 243 Figure 159 Network > Routing > OSPF > Edit The following table describes the labels in this screen. T able 74 Network > Routing > OSPF > Edit LABEL DESCRIPTION Area ID T ype the unique , 32-bit identifie r for the area in IP address format.
Chapter 13 Routing Protocols ZyWALL USG 1000 U ser’s Guide 244 T ext Authentication Key This field is available if the Authentication is Te x t . T ype the password for text authentication. The key can consist of a lphanumeric characte rs and the underscore, and it can be up to 8 characte rs long.
ZyWALL USG 1000 User’s Guide 245 C HAPTER 14 Zones Set up zones to configure n etwork security and network policies in the ZyW ALL. See Section 5.4.7 on page 116 for related informa tion on these screens. 14.1 Zones Overview A zone is a group of interfaces and VPN tunnels.
Chapter 14 Zone s ZyWALL USG 1000 U ser’s Guide 246 Intra-zone traffic is traf fic betw een interfaces or VPN tunnels in the same zone. For e xample, in Figure 160 on page 245 , traffic between VLAN 2 and the Ethernet is intra-zone traf fic. In each zone, you can either allow or prohibit all intra-zone traffi c.
Chapter 14 Zones ZyWALL USG 1000 User’s Guide 247 14.3 Zone Add/Edit The Zone Add/Edit screen allows you to define a zone or edit an existing one. T o access this screen, go to the Zone screen (see Section 14.2 on page 246 ), and click either the Add icon or an Edit icon.
Chapter 14 Zone s ZyWALL USG 1000 U ser’s Guide 248.
ZyWALL USG 1000 User’s Guide 249 C HAPTER 15 DDNS This chapter describes how to configure dy namic DN S (DDNS) services for the ZyW ALL. First, it provides an overview , and then it introduces the screens. See Section 5.4.9 on page 11 7 for related informa tion on these screens.
Chapter 15 DDNS ZyWALL USG 1000 U ser’s Guide 250 15.1.2 High A vailability (HA) The DDNS server maps a domain name to th e IP address of one of the ZyW ALL’ s W AN ports. If that W AN port loses its connection, high availa bility allows the ZyW ALL to substitute the HA port’ s IP addre ss in the domain name mapping.
Chapter 15 DDNS ZyWALL USG 1000 User’s Guide 251 15.3 DDNS Summary The DDNS screen provides a summary of all DDNS do main names and their configuration. In addition, this screen allows yo u to add new domain names, edit the configuration for existing domain names, and de lete domain names.
Chapter 15 DDNS ZyWALL USG 1000 U ser’s Guide 252 15.4 Dynamic DNS Add/Edit The DDNS Add/Edit screen allows you to add a domain name to the ZyW ALL or to edit the configuration of an existing domain name. T o access this screen, click Network > DDNS , and click either the Add icon or an Edit icon.
Chapter 15 DDNS ZyWALL USG 1000 User’s Guide 253 HA Interface This field is only available when the IP Addre ss Update Policy is Interface . Select the alternative WAN interface to map to the do main name when the W AN interface is not available. If you do not want to use HA, select none .
Chapter 15 DDNS ZyWALL USG 1000 U ser’s Guide 254.
ZyWALL USG 1000 User’s Guide 255 C HAPTER 16 Virtual Servers This chapter describes how to set up, manage, and remove virtual servers. First, it provides an overview of virtual servers, and, then, it introduces the virtual server screens and commands.
Chapter 16 Virtual Serv ers ZyWALL USG 1000 U ser’s Guide 256 The ZyW A LL checks virtual servers before it applies to-ZyW ALL firewall rules, so to- ZyW ALL firewall rules do not apply to traffic that is forwarded by virtual servers.
Chapter 16 Virtual Servers ZyWALL USG 1000 User’s Guide 257 Figure 166 Network > Virtual Server The following table describes the labels in this screen.
Chapter 16 Virtual Serv ers ZyWALL USG 1000 U ser’s Guide 258 16.4.1 V irtual Server Add/Edit The V irtual Server Add/Edit screen lets you create new virtual servers and edit existing ones. T o open this window , open the Virtual Server summary screen.
Chapter 16 Virtual Servers ZyWALL USG 1000 User’s Guide 259 User Defined This field is availa ble if Ori ginal IP is User Define d . T ype the destina tion IP address that this virtual se rver supports. Mapped IP T y pe the translated destination IP address, if th is virtual server forwards th e packet.
Chapter 16 Virtual Serv ers ZyWALL USG 1000 U ser’s Guide 260.
ZyWALL USG 1000 User’s Guide 261 C HAPTER 17 HTTP Redirect This chapter shows you h o w to configure HTTP red irection on your ZyW ALL. See Section 5.
Chapter 17 HTTP Redirect ZyWALL USG 1000 U ser’s Guide 262 Figure 168 HTTP Redirect Example In the example, proxy server A is connected to ge4 in the DMZ zo ne. When a client connected to ge1 wants to open a web page, its HTTP requ est is redirected to proxy server A first.
Chapter 17 HTTP Redirect ZyWALL USG 1000 User’s Guide 263 Figure 169 Network > HTTP Redirect The following table describes the labels in this screen.
Chapter 17 HTTP Redirect ZyWALL USG 1000 U ser’s Guide 264 Interface Select the interface on which the HTTP request must be received for the ZyWALL to forward it to the specified proxy server . Proxy Ser ver Enter the IP address of the proxy server .
ZyWALL USG 1000 User’s Guide 265 C HAPTER 18 ALG This chapter covers how to use the ZyW ALL’ s AL G feature to allow certain applications to pass through the ZyW ALL.
Chapter 18 ALG ZyWALL USG 1000 U ser’s Guide 266 Y ou could also have a trun k with one interface set to active and a second interface set to passive. The ZyW ALL does not automatically ch ange ALG-managed connections to the second (pas sive) interface when the active interface’ s connection g oes down.
Chapter 18 ALG ZyWALL USG 1000 User’s Guide 267 Figure 171 H.323 ALG Examp le 18.1.6 SIP The Session Initiation Protocol (SIP ) is an application-layer cont rol (si gnaling) protocol that handles the setting up, altering and tearing down of voice and multimed ia sessions over the Internet.
Chapter 18 ALG ZyWALL USG 1000 U ser’s Guide 268 18.1.6.2 SIP Signaling Session Timeout Most SIP clients have an “ expire” mechanism indicating the lifetime of signaling sessions. The SIP user agent sends registration packe ts to the SIP server periodi cally and keeps the session alive in the ZyW ALL.
Chapter 18 ALG ZyWALL USG 1000 User’s Guide 269 For example, you configure firewall and virt ual server rules to allow LAN IP address A to receive calls through public W AN IP address 1 . Y ou configure different firewa ll and port forwarding rules to allow LAN IP address B to receive calls through public W AN IP address 2 .
Chapter 18 ALG ZyWALL USG 1000 U ser’s Guide 270 The following table describes the labels in this screen. T able 83 Network > ALG LABEL DESCRIPTION Enable SIP T ransformations SIP is a signaling protocol used in V oIP (V oi ce over IP), the sending of voice signals over Internet Protocol.
Chapter 18 ALG ZyWALL USG 1000 User’s Guide 271 18.4 W AN to LAN SIP Peer-to-peer Calls Example This example shows how to configure firewall an d virtual server (port forwarding) rules to allow H.323 calls to come in th rough W AN IP address 10.0.0.
Chapter 18 ALG ZyWALL USG 1000 U ser’s Guide 272 Figure 178 Firewall > W AN to LAN 5 Configure the screen as follows. For the Destination , select Create Object . Figure 179 Firewall > W AN > LAN > Add 6 Configure an address object for the ZyW ALL’ s 10.
Chapter 18 ALG ZyWALL USG 1000 User’s Guide 273 Figure 181 Firewall > W AN > LAN > Add.
Chapter 18 ALG ZyWALL USG 1000 U ser’s Guide 274.
275 P ART III Firewall and VPN Firewall (277) IPSec VPN (291) SSL VPN (323) SSL User Screens (331) SSL User Application Screens (337) SSL User File Sharing Screens (339) L2TP VPN (345) L2TP VPN Exampl.
276.
ZyWALL USG 1000 User’s Guide 277 C HAPTER 19 Firewall This chapter introduces the ZyW ALL’ s firewa ll and shows you ho w to configure your ZyW ALL’ s firewall. See Section 5.4.12 on page 1 18 for related information on these screens. 19.1 Firewall Overview The ZyW ALL’ s firewall is a s tateful inspec tion firewall.
Chapter 19 Firewall ZyWALL USG 1000 U ser’s Guide 278 Y our customized rules take precedence and override the ZyW ALL’ s default settings . The ZyW ALL checks the schedule, user name (user ’ s l.
Chapter 19 Firewall ZyWALL USG 1000 User’s Guide 279 The following table explains the default firewa ll rules for traf fic going through the ZyW ALL. See Section 19.2.1.2 on p a ge 279 for details on the firewall ru les for traffic going to the ZyW ALL itself.
Chapter 19 Firewall ZyWALL USG 1000 U ser’s Guide 280 " The ZyW ALL checks the firewall rules befor e the service control rules for traffic destined for the ZyW ALL. " Y ou can configure a to-ZyW ALL firewall rule (with From Any T o ZyW ALL direction) for traf fic from an interface which is not in a zone.
Chapter 19 Firewall ZyWALL USG 1000 User’s Guide 281 Y our firewall would have the following configuration. • The first row blocks LAN access to the IRC service on the W AN. • The second row is the firewall’ s default policy that allows all traffic from the LAN to go to the W AN.
Chapter 19 Firewall ZyWALL USG 1000 U ser’s Guide 282 Y our firewall would have the following configuration. • The first row allows the LAN computer at IP address 192.168.1.7 to access the IRC service on the W AN . • The second row blocks LAN access to the IRC servic e on the W AN.
Chapter 19 Firewall ZyWALL USG 1000 User’s Guide 283 Y ou can have the ZyW ALL permit the use of asymmetrical route topology on the network (not reset the connection). Allowing asymmetrical routes may let traffic from the W AN go directly to the LAN without passing through the ZyW ALL.
Chapter 19 Firewall ZyWALL USG 1000 U ser’s Guide 284 Figure 186 Firewall The following table describes the labels in this screen. T able 88 Firewall LABEL DESCRIPTION Global Setting Enable Firewall Select this check box to activate the firew all. The ZyWALL performs access control when the firewall is activated.
Chapter 19 Firewall ZyWALL USG 1000 User’s Guide 285 Maximum session per ho st Use this field to se t the highest number of sessions that the ZyW ALL will permit a computer with the same IP address to h ave at one time .
Chapter 19 Firewall ZyWALL USG 1000 U ser’s Guide 286 19.6.1 Edit a Firewall Rule In the Fir e wall screen, click the Edit or Add icon to display the Fir ewall Rule Edit screen. Refer to the following table for information on the labels. Figure 187 Firewall > Edit The following table describes the labels in this screen.
Chapter 19 Firewall ZyWALL USG 1000 User’s Guide 287 19.7 Firewall Rule Configuration Example The following Internet firewall rule example allows a hypoth etical MyService from the W AN to IP addresses 10.0.0.10 through 10.0.0.15 (Dest_1) on the LAN.
Chapter 19 Firewall ZyWALL USG 1000 U ser’s Guide 288 Figure 188 Firewall Example: Select the Traveling Direction of T raffic 2 Select From W AN and To L A N and enter a description.
Chapter 19 Firewall ZyWALL USG 1000 User’s Guide 289 Figure 190 Firewall Example: Create an Address Object 4 Select Create Object in the Service drop-down list box. 5 The screen for configuring a service object opens. Configure it as follows and click OK .
Chapter 19 Firewall ZyWALL USG 1000 U ser’s Guide 290 Figure 193 Firewall Example: MyService Example Rule in Summary.
ZyWALL USG 1000 User’s Guide 291 C HAPTER 20 IPSec VPN This chapter explains how to set up and maintain IPSec VPNs in the ZyW ALL. See Section 5.4.4 on page 116 for related informa tion on these screens.
Chapter 20 IPSec VPN ZyWALL USG 1000 U ser’s Guide 292 Figure 195 VPN: IKE SA and IPSec SA In this example, a computer in network A is exchanging data with a computer in network B . Inside networks A and B , the data is transmitte d the same way data is normally transmitted in the networks.
Chapter 20 IPSec VPN ZyWALL USG 1000 User’s Guide 293 Usually , you should select ESP . AH does not support encryption, and ESP is more suitable with NA T . 20.1.1.3 Encap sulation There are two ways to e ncapsulate packets. Usua lly , you should use tunnel mode because it is more secure.
Chapter 20 IPSec VPN ZyWALL USG 1000 U ser’s Guide 294 If you enable PFS, the ZyW ALL and remote IPSe c router perform a DH key exchan ge every time an IPSec SA is established, changing the root key from which encryption keys are generated. As a result, if on e encryption key is comprom ised, other encryp tion keys remain secure.
Chapter 20 IPSec VPN ZyWALL USG 1000 User’s Guide 295 • Source address in outbound packets - this translation is necessary if you want the ZyW ALL to route packets from computers outs ide the local network through the IPSec SA. • Source address in inbound packets - this tran slation hides the source address of computers in the remote network.
Chapter 20 IPSec VPN ZyWALL USG 1000 U ser’s Guide 296 • Destination - the original destination address; the local network ( A ). • SNA T - the translated source address; a dif ferent IP address (range of addresses) to hide the original source address.
Chapter 20 IPSec VPN ZyWALL USG 1000 User’s Guide 297 • Make sure the to-ZyW ALL firewall rules allow IPSec VPN traffic to the ZyW ALL. IKE uses UDP port 500, AH uses IP protocol 51, and ESP uses IP protocol 50. • The ZyW ALL supports UDP port 500 and UDP p o rt 4500 for NA T traversal.
Chapter 20 IPSec VPN ZyWALL USG 1000 U ser’s Guide 298 Each field is discussed in the following table. See Section 20.3.3 on page 302 and Section 20.
Chapter 20 IPSec VPN ZyWALL USG 1000 User’s Guide 299 Figure 199 VPN > IPSec VPN > VPN Connection > Edit (IKE) Each field is described in the following table. T able 91 VPN > IPSec VPN > VPN Connection > Edit LABEL DESCRIPTION VPN Connection Connection Name T ype the name used to identi fy this IPSec SA.
Chapter 20 IPSec VPN ZyWALL USG 1000 U ser’s Guide 300 Active Protocol Select which protocol you want to use in the IPSec SA. Choices are: AH (RFC 2402) - provides integrity , aut henti cation, sequence integri ty (replay resistance), and non-repudiation but not encryption.
Chapter 20 IPSec VPN ZyWALL USG 1000 User’s Guide 301 Policy Enforcem ent Select this if you want the ZyWALL to drop traffic whose source and destination IP addresses do not match the local and remote policy . This makes the IPSec SA more secure. Note: Y ou must clear this field, however , if you want to use the IPSec SA in a VPN concentrator .
Chapter 20 IPSec VPN ZyWALL USG 1000 U ser’s Guide 302 20.3.3 VPN Connection Add/Edit Manual Key The VPN Connection Add/Edit Manual Key screen allows you to create a new VPN connection or edit an exist ing one using a manual key . This is useful if you h ave problems with IKE key management.
Chapter 20 IPSec VPN ZyWALL USG 1000 User’s Guide 303 Figure 200 VPN > IPSec VPN > VPN Connec tion > Manual Key > Edit The following table describes the labels in this screen.
Chapter 20 IPSec VPN ZyWALL USG 1000 U ser’s Guide 304 Encapsulation Mode Select which t ype of encapsul ation the IPSec SA uses. Choices are T unnel - this mode encrypts the IP header information and the data Tr a n s p o r t - this mode only encrypts the data.
Chapter 20 IPSec VPN ZyWALL USG 1000 User’s Guide 305 Authentication Key Enter the authenticati on key , which dep ends on the authentication algorithm. MD5 - type a unique ke y 16-20 characters long SHA1 - type a uniq ue key 20 characters long Y ou ca n use any alphanu meric characters or ,;|`~!@#$%^&*()_ +{}':.
Chapter 20 IPSec VPN ZyWALL USG 1000 U ser’s Guide 306 20.4 VPN Gateway Screens Y ou use the VPN Gate way summary screen to look at the VPN gateways you have set up, and you use the VPN Gateway Add/Edit screen to create or to edit VPN gateways. 20.4.
Chapter 20 IPSec VPN ZyWALL USG 1000 User’s Guide 307 It takes several steps to establish an IKE SA. The negotiation mode determines how many . There are two negotiation modes--main mode and aggressive mode. Main mode provides better security , while aggressive mode is faster .
Chapter 20 IPSec VPN ZyWALL USG 1000 U ser’s Guide 308 " Both routers must use the same encryption algorithm , authentication algorithm, and DH key group. In most ZyW ALLs, you c an select one of th e following encryption algorithms for each proposal.
Chapter 20 IPSec VPN ZyWALL USG 1000 User’s Guide 309 In main mode, the ZyW ALL and remote IPSec rout er authenticate each other in steps 5 and 6, as illustrated below . The identities are also en crypted using the encryption algorithm and encryption key the ZyW ALL and remote IP Sec router selected in previous steps.
Chapter 20 IPSec VPN ZyWALL USG 1000 U ser’s Guide 310 For example, in T able 93 on page 31 0 , the ZyW ALL and the remote IPSec rou ter authenticate each other successfully . In contrast, in T able 94 on page 310 , the ZyW ALL and the remote IPSec router cannot authenticate each other an d, therefore, ca nnot establish an IKE SA.
Chapter 20 IPSec VPN ZyWALL USG 1000 User’s Guide 31 1 20.4.2.2 VPN, NA T, and NA T T raversal In the following example, there is another router ( A ) between router X and router Y . Figure 204 VPN/NA T Example If router A does NA T , it might change the IP addre sses, port numbers, or both.
Chapter 20 IPSec VPN ZyWALL USG 1000 U ser’s Guide 312 • Instead of using the pre -shared key , th e ZyW ALL and remote IPSec router check the signatures on each other ’ s certificates. Unlike pre-share d keys, the signatures do not have to match.
Chapter 20 IPSec VPN ZyWALL USG 1000 User’s Guide 313 20.4.4 VPN Gateway Add/Edit The VPN Gatew ay Add/Edit screen allows you to create a new VPN gateway or edit an existing one. T o access this screen, go to the VPN Gateway summary screen (see Section 20.
Chapter 20 IPSec VPN ZyWALL USG 1000 U ser’s Guide 314 Figure 206 VPN > IPSec VPN > VPN Gateway > Edit Each field is described in the following table. T able 96 VPN > IPSec VPN > VPN Gateway > Edit LABEL DESCRIPTION VPN Gateway VPN Gateway Name T ype the name used to identify this VPN gateway .
Chapter 20 IPSec VPN ZyWALL USG 1000 User’s Guide 315 Proposal # This field is a sequential value , and it is not associated with a specific proposal. The sequence of proposals sho uld not affect performance significantly . Encryption Select which key size and encryption algorithm to use in the IKE SA.
Chapter 20 IPSec VPN ZyWALL USG 1000 U ser’s Guide 316 Secure Gateway Address T ype the IP address or the domain name of the remo te IPSec router . Set this fie ld to 0.0.0.0 if the remote IPSec router has a dynamic IP address. Y ou can provide a second IP address or domain name.
Chapter 20 IPSec VPN ZyWALL USG 1000 User’s Guide 317 Peer ID T ype Select which type of identificatio n is used to i dentify the remo te IPSec router during authentica tion.
Chapter 20 IPSec VPN ZyWALL USG 1000 U ser’s Guide 318 20.5 VPN Concentrator A VPN concentrator combines several VPN connections into one secure netw ork. Figure 207 on page 318 shows an example of this, as well as one alternative approach. Figure 207 VPN T opologies The VPN concentrator is used in the second approach.
Chapter 20 IPSec VPN ZyWALL USG 1000 User’s Guide 319 20.5.1 VPN Concentrator Summary Yo u u s e t h e VPN Concentrator summa ry screen to look at the VPN concentrators you have set up. The VPN Conce ntrator summary screen displays th e VPN concentrators in the ZyW ALL.
Chapter 20 IPSec VPN ZyWALL USG 1000 U ser’s Guide 320 Each field is described in the following table. 20.6 SA Monitor Screen Y ou can use the SA Mon itor screen to display and to mana ge active IPSec SA . T o access this screen, click VPN > IPSec VPN > SA Monitor .
Chapter 20 IPSec VPN ZyWALL USG 1000 User’s Guide 321 Figure 21 1 VPN > IPSec VPN > SA Monitor Each field is described in the following table. T able 99 VPN > IPSec VPN > SA Monitor LABEL DESCRIPTION Name Enter the name of a IPSec SA here and click Search to find it (if it i s associated).
Chapter 20 IPSec VPN ZyWALL USG 1000 U ser’s Guide 322 20.6.1 Regular Expressions in Sear ching IPSec SAs by Name or Policy A question mark (?) lets a single character in the VPN co nnection or policy name vary . For example, use “a?c” (without the quotation ma rks) to specify abc, acc and so on.
ZyWALL USG 1000 User’s Guide 323 C HAPTER 21 SSL VPN This chapter shows you how to set up secure SSL VPN access for remote user login. See Section 5.
Chapter 21 SSL VPN ZyWALL USG 1000 U ser’s Guide 324 21.1.2 SSL Access Policy Limit ations Y ou cannot delete an object that is used by an SSL access policy . T o delete the object, you must first unassociate the obje ct from the SSL access policy .
Chapter 21 SSL VPN ZyWALL USG 1000 User’s Guide 325 21.3 Creating/Editing an SSL Access Policy T o create a new or edit an existing SSL access policy , click the Add or Edit icon in the Access Privilege screen. Figure 213 VPN > SSL VPN > Access Privilege > Add/Edit The following table describes the labels in this screen.
Chapter 21 SSL VPN ZyWALL USG 1000 U ser’s Guide 326 21.4 SSL Connection Monitor The ZyW ALL keeps track of the users who ar e currently logged in to the VPN SSL client portal. Click VPN > SSL VPN in the navigation panel and click the Connection Moni tor tab to display the user list.
Chapter 21 SSL VPN ZyWALL USG 1000 User’s Guide 327 • log out a user and delete related session information. Once a user logs out, the corres ponding entry is removed from the Connection Monitor screen. Figure 214 VPN > SSL VPN > Connection Monitor The following table describes the labels in this screen.
Chapter 21 SSL VPN ZyWALL USG 1000 U ser’s Guide 328 Figure 215 VPN > SSL VPN > Global Setting The following table describes the labels in this screen.
Chapter 21 SSL VPN ZyWALL USG 1000 User’s Guide 329 21.5.1 Uploading a Custom Logo Follow the steps below to upload a custom logo on the ZyW ALL. 1 Click VPN > SSL VPN and click the Global Setting tab to display the configurati on screen. 2 Click Br owse to locate the logo graphic.
Chapter 21 SSL VPN ZyWALL USG 1000 U ser’s Guide 330 Figure 217 SSL VPN Client Portal Screen Example If the user account is not set up for SSL VPN access, an “SSL VPN connection is not activated” message displays in the Login screen. Clear the Login to SSL VPN check box and try logging in again.
ZyWALL USG 1000 User’s Guide 331 C HAPTER 22 SSL User Screens This chapter introduces secure network access and gives an overview of the remote user screens on the ZyW ALL.
Chapter 22 SSL User Screen s ZyWALL USG 1000 U ser’s Guide 332 • Internet Explorer 5.5 and above (for IE7, JRE 1.6 must be enabled) • Netscape 7.2 and above • Firefox 1.0 and ab ove • Mozilla 1.7.3 and above • Sun Java V irtua l Machine (JVM) installed with a minimum version of 1.
Chapter 22 SSL User Screens ZyWALL USG 1000 User’s Guide 333 Figure 220 Login Security Screen 3 A login screen displays. Enter the user na me and password of you r login account. If a token password is also required, enter it in the One-Time Password field.
Chapter 22 SSL User Screen s ZyWALL USG 1000 U ser’s Guide 334 " Available resource lin ks vary depending on the confi guration your network administrator made. 22.3 SSL VPN User Screens This section describes the main elements in the remote user screens.
Chapter 22 SSL User Screens ZyWALL USG 1000 User’s Guide 335 22.4 Bookmark Y ou can create a bookmark of the ZyW ALL by clicking the Add to Favorite icon. This allows you to access the ZyW ALL using the bo okmark without having to enter the address every time.
Chapter 22 SSL User Screen s ZyWALL USG 1000 U ser’s Guide 336.
ZyWALL USG 1000 User’s Guide 337 C HAPTER 23 SSL User Application Screens This chapter describes the Application screens you use to acce ss an application on the network through the SSL VPN co nnection.
Chapter 23 SSL User Application Screens ZyWALL USG 1000 U ser’s Guide 338.
ZyWALL USG 1000 User’s Guide 339 C HAPTER 24 SSL User File Sharing Screens This chapter describes the File Sharing screen you use to access files on a file server through the SSL VPN connection. 24.1 Overview Use the File Sharing screen to display and access shared files/folders on a file server .
Chapter 24 SSL User File Shar ing Screens ZyWALL USG 1000 U ser’s Guide 340 Figure 228 File Sharing 24.3 Opening a File or Folder Y ou can open a file if the file extension is recognized by the web browser and the associated application is installed on your computer .
Chapter 24 SSL User File Sharing Screens ZyWALL USG 1000 User’s Guide 341 4 A list of files/folders displays. Click on a f ile to open it in a separate browser window . Y ou can also click a folder to access it. For this exam ple, click on a .doc file to open the W ord document.
Chapter 24 SSL User File Shar ing Screens ZyWALL USG 1000 U ser’s Guide 342 Figure 231 File Sharing: Save a W ord File 24.4 Creating a New Folder T o create a new folder in the file share location, click the New Folder icon. Specify a descriptive name for the folder .
Chapter 24 SSL User File Sharing Screens ZyWALL USG 1000 User’s Guide 343 Figure 233 File Sharing: Rename A popup window displa ys. Specify the new name an d/or file extension in the field provided. Y ou can enter up to 356 characters. Then click App ly .
Chapter 24 SSL User File Shar ing Screens ZyWALL USG 1000 U ser’s Guide 344 24.7 Uploading a File Follow the steps below to upload a file to the file server . 1 Log into the remote user screen and click the File Sharing tab. 2 Specify the location and/or name of th e file you want to upload.
ZyWALL USG 1000 User’s Guide 345 C HAPTER 25 L2TP VPN This chapter explains how to set up and maintain L2TP VPNs in the ZyW ALL. See Section 5.4.6 on page 116 for related informa tion on these screens.
Chapter 25 L2TP VPN ZyWALL USG 1000 U ser’s Guide 346 • Use transport mode. • Not be a manual key VPN co nnection. •U s e Pr e-Shared Key authentication. • Use a VPN ga teway with the Secure Gateway set to 0.0.0.0 if you need to allow L2TP VPN clients to connect from more than one IP address.
Chapter 25 L2TP VPN ZyWALL USG 1000 User’s Guide 347 25.4 L2TP VPN Configuration Click VPN > L2TP VPN to open the following screen. Use this screen to configure the ZyW ALL’ s L2TP VPN settings. " Disconnect any existing L2TP VPN se ssions before modifying L2TP VPN settings.
Chapter 25 L2TP VPN ZyWALL USG 1000 U ser’s Guide 348 25.5 L2TP VPN Session Monitor Click VPN > L2TP VPN > Session Monitor to open the following scr een.
Chapter 25 L2TP VPN ZyWALL USG 1000 User’s Guide 349 Disconnect Click the Disconnect icon next to an L2TP VPN connection to disconnect it. Refresh Click Refre sh to update the information in the display .
Chapter 25 L2TP VPN ZyWALL USG 1000 U ser’s Guide 350.
ZyWALL USG 1000 User’s Guide 351 C HAPTER 26 L2TP VPN Example This chapter shows how to create a basic L2TP VPN tunnel. 26.1 L2TP VPN Example This chapter uses the following settings in creating a basic L2TP VPN tunnel. Figure 241 L2TP VPN Example • The ZyW ALL has a static IP address of 172.
Chapter 26 L2TP VPN E xample ZyWALL USG 1000 U ser’s Guide 352 Figure 242 VPN > IPSec VPN > VPN Gateway > Edit • Configure the My Addr ess setting. This example uses interface ge3 with static IP address 172.23.37.205 . • Configure the Pr e-Shared Key .
Chapter 26 L2TP VPN Example ZyWALL USG 1000 User’s Guide 353 26.3 Configuring the Default L2TP VPN Connection Example 1 Click VPN > Network > IPSec VPN to open the screen that lists the VPN connections. Click the Default_L2TP_VPN_Connection ’s Edit icon.
Chapter 26 L2TP VPN E xample ZyWALL USG 1000 U ser’s Guide 354 Figure 245 VPN > IPSec VPN > VPN Connection (Enable) 26.4 Configuring the L2TP VPN Settings Example 1 Click VPN > L2TP VPN to open the following screen. Figure 246 VPN > L2TP VPN Example 2 Configure the following.
Chapter 26 L2TP VPN Example ZyWALL USG 1000 User’s Guide 355 Figure 247 Routing > Add: L2TP VPN Example 2 Configure the following. • Enable the policy route . • Set the policy route’ s Source Addr ess to the address object tha t you want to allow the remote users to access ( LAN_SUBNET in this example).
Chapter 26 L2TP VPN E xample ZyWALL USG 1000 U ser’s Guide 356 26.6.1 Configuring L2TP in Windows XP In W indows XP do the following to establish an L2TP VPN connection. 1 Click S tart > Control Panel > Network Co nnect ions > New Connection Wizard .
Chapter 26 L2TP VPN Example ZyWALL USG 1000 User’s Guide 357 Figure 250 New Connection Wizard: Conn ection Name 6 Select Do not dial the initial connection and click Ne xt .
Chapter 26 L2TP VPN E xample ZyWALL USG 1000 U ser’s Guide 358 Figure 252 New Connection Wizard: VPN Server Selection 8 Click Finish . 9 The Connect L2TP to ZyW ALL screen appears. Click Properties > Security . Figure 253 Connect L2TP to ZyW ALL 10 Click Security , select Advanced (custom settings) and click Settings .
Chapter 26 L2TP VPN Example ZyWALL USG 1000 User’s Guide 359 Figure 254 Connect L2TP to ZyW ALL: S ecurity 11 Select Optional encryption (conne ct even if no encryption) and the Allow these pro tocols radio button. Select Unencrypted password (P AP) and clear all of the other check boxes.
Chapter 26 L2TP VPN E xample ZyWALL USG 1000 U ser’s Guide 360 Figure 256 L2TP to Z y W ALL Properties > Secu rity 13 Select the Use pre-shar ed key for authentication check box and enter the pre-shared key used in the VPN gateway configuratio n that the ZyW ALL is using for L2TP VPN.
Chapter 26 L2TP VPN Example ZyWALL USG 1000 User’s Guide 361 Figure 259 Connect L2TP to ZyW ALL 16 A window appears while the user name and password are verified. 17 A ZyW ALL-L2TP icon displays in your s ystem tray . Double-click it to open a status screen.
Chapter 26 L2TP VPN E xample ZyWALL USG 1000 U ser’s Guide 362 1 Click St a r t > R u n . T ype regedit and click OK . Figure 262 S tarting the Registry Editor 2 Click Registry > Export Registry File and save a b ackup copy of your registry . Y ou can go back to using this backup if you misconfigure the registry settings.
Chapter 26 L2TP VPN Example ZyWALL USG 1000 User’s Guide 363 Figure 265 ProhibitIpSec DWORD V alue 6 Restart the computer an d con tinue with the next section.
Chapter 26 L2TP VPN E xample ZyWALL USG 1000 U ser’s Guide 364 Figure 268 Add > IP Security Policy Management > Finish 4 Right-click IP Security Policies on Local Machine and click Cr eate IP Security Policy . Click Next in the welcome scree n.
Chapter 26 L2TP VPN Example ZyWALL USG 1000 User’s Guide 365 Figure 270 IP Security Policy: Name 6 Clear the Activate the default response rule check box and click Next . Figure 271 IP Security Policy: Request for Secure Communication 7 Leave the Edit Properties check box selected and click Finish .
Chapter 26 L2TP VPN E xample ZyWALL USG 1000 U ser’s Guide 366 8 In the properties d ialog box, click Add > Next . Figure 273 IP Security Policy Properties > Add 9 Select This rule does not specify a tunnel and click Next . Figure 274 IP Security Policy Properties : Tunnel En dpoint 10 Select All network connections and click Next .
Chapter 26 L2TP VPN Example ZyWALL USG 1000 User’s Guide 367 Figure 275 IP Security Policy Pr opertie s: Network T ype 11 Select Use this string to protect the key exchange (preshar ed key) , type password in the text box, and click Next . Figure 276 IP Security Policy Proper ties: Authentication Method 12 Click Add .
Chapter 26 L2TP VPN E xample ZyWALL USG 1000 U ser’s Guide 368 Figure 277 IP Securit y Policy Properties: IP Filt er List 13 Ty p e ZyW ALL W A N_IP in the Name field. Clear the Use Add Wizard chec k box and click Add . Figure 278 IP Security Policy Prop erties: IP Filter List > Add 14 Configure the following in the Addr essing tab.
Chapter 26 L2TP VPN Example ZyWALL USG 1000 User’s Guide 369 Figure 279 Filter Propertie s: Addressing 15 Configure the following in the Filter Pr operties window’ s Protocol tab. Set the protocol type to UDP from port 1701. Select To a n y p o r t .
Chapter 26 L2TP VPN E xample ZyWALL USG 1000 U ser’s Guide 370 Figure 281 IP Securit y Policy Properties: IP Filt er List 17 Select Require Security and click Next . Then click Finish and Close . Figure 282 IP Securit y Policy Properties: IP Filt er List 18 In the Console window , right-click L2TP to ZyW ALL and sele ct Assign .
Chapter 26 L2TP VPN Example ZyWALL USG 1000 User’s Guide 371 26.6.2.3 Configure the W indows 2000 Network Connection After you have configured the IPSec policy , use these directions to create a network connection. 1 Click S tart > Settings > Network and Dial-up connections > Make New Connection .
Chapter 26 L2TP VPN E xample ZyWALL USG 1000 U ser’s Guide 372 Figure 286 New Connection Wizard: Destination Address 4 Select For all users and click Next . Figure 287 New Connection Wizard: Connection Availability 5 Name the co nnection L2TP to ZyW ALL and clic k Finish .
Chapter 26 L2TP VPN Example ZyWALL USG 1000 User’s Guide 373 6 Click Pr operties . Figure 289 Connect L2TP to ZyW ALL 7 Click Security and select Advanced (custom settings) and click Settings .
Chapter 26 L2TP VPN E xample ZyWALL USG 1000 U ser’s Guide 374 Figure 291 Connect L2TP to ZyW ALL: S ecurity > Advanced 9 Click Networking and select Layer 2 T unneling Pr otocol (L2TP) from the drop-down list box. Click OK . Figure 292 Connect L2TP to ZyW ALL: Networking 10 Enter your user name and password and click Connect .
Chapter 26 L2TP VPN Example ZyWALL USG 1000 User’s Guide 375 Figure 293 Connect L2TP to ZyW ALL 11 A ZyW ALL-L2TP icon displays in your s ystem tray .
Chapter 26 L2TP VPN E xample ZyWALL USG 1000 U ser’s Guide 376.
377 P ART IV Application Patrol & Anti-X Application Patrol (379) Anti-V irus (403) IDP (417) ADP (445) Content Filter Screens (463) Content Filter Reports (483).
378.
ZyWALL USG 1000 User’s Guide 379 C HAPTER 27 Application Patrol This chapter describes how to use application patrol for the ZyW ALL. It provides an overview first and then introduces the screens. See Section 5.4.13 on page 1 19 for related information on these screens.
Chapter 27 Applicat ion Patrol ZyWALL USG 1000 U ser’s Guide 380 " The ZyW ALL allows the fi rst eight packets to go through the firewall, regardless of the applicat ion patrol policy for the application. The ZyW ALL examines these first eight packet s to ide ntify the applicatio n.
Chapter 27 Application Patrol ZyWALL USG 1000 User’s Guide 381 27.4.1 Connection and Packet Directions Application patrol looks at the connection direction, that is from which zone the connection was initiated and to which zone the connection is going.
Chapter 27 Applicat ion Patrol ZyWALL USG 1000 U ser’s Guide 382 Figure 297 LAN to W AN, Outbound 200 kbps, Inbound 500 kbps 27.4.3 Bandwid th Management Priority The ZyW A LL gives bandwidth to higher -priority traffic first, until it reaches its configured bandwidth rate.
Chapter 27 Application Patrol ZyWALL USG 1000 User’s Guide 383 Figure 298 Bandwidth Ma nagement Behavior 27.4.5.1 Configured Rate Effect In the following table the configured rates total less than the available bandwidth and maximize bandwidth usa ge is disabled, both servers get their configured rate.
Chapter 27 Applicat ion Patrol ZyWALL USG 1000 U ser’s Guide 384 27.4.5.4 Priority and Over Allotment of Bandwid th Effect Server A has a configured rate that equals the total amount of available bandwidth and a higher priority .
Chapter 27 Application Patrol ZyWALL USG 1000 User’s Guide 385 Figure 299 Application Patrol B andwidth Managem ent Example 27.5.1 Setting the Interface’ s Bandwidth Use the interface screens to set the W AN zone in terface’ s upstream bandwidth to be equal to (or slightly less than) what th e connected device can supp ort.
Chapter 27 Applicat ion Patrol ZyWALL USG 1000 U ser’s Guide 386 Figure 300 SIP Any to W AN Bandwidth Management Example 27.5.3 SIP W AN to Any Bandwid th Management Example Y ou also create a policy for calls coming in from the SIP server on the W AN.
Chapter 27 Application Patrol ZyWALL USG 1000 User’s Guide 387 • Third highest priority (3). • Disable maximize bandwidth usage since you do no t want to give FTP more bandwidth.
Chapter 27 Applicat ion Patrol ZyWALL USG 1000 U ser’s Guide 388 27.6 Other Applications Sometimes, the ZyW ALL cannot identify the application. For example, the application might be a new application, or the pac kets might arrive out of sequence . (The ZyW ALL does not reorder packets when id entifying the application.
Chapter 27 Application Patrol ZyWALL USG 1000 User’s Guide 389 Figure 304 AppPatrol > General The following table describes the labels in this screen. See Section 27.9.1 on page 391 for more information as well. T able 1 12 AppPatrol > Genera l LABEL DESCRIPTION Enable Applicati on Patrol Select this check box to turn on application patrol.
Chapter 27 Applicat ion Patrol ZyWALL USG 1000 U ser’s Guide 390 27.9 Application Patrol Applications Use the application patrol Common , Instant Messenger , Peer to Peer , Vo I P , or St r e a m i n g screen to manage traffic o f individual applications.
Chapter 27 Application Patrol ZyWALL USG 1000 User’s Guide 391 27.9.1 Application Patrol Edit Use this screen to edit the settin gs for an applicat ion. T o access this screen, go to the application patrol Comm on , Instant Me ssenger , Peer to Peer , Vo I P , or St r e a m i n g screen and click an application’ s Edit icon.
Chapter 27 Applicat ion Patrol ZyWALL USG 1000 U ser’s Guide 392 # This fiel d is a sequentia l value, and it is not associated with a specific condition.
Chapter 27 Application Patrol ZyWALL USG 1000 User’s Guide 393 27.9.2 Application Patrol Policy Edit The Application Policy Edit screen allows you to edit a group of settings for an application.
Chapter 27 Applicat ion Patrol ZyWALL USG 1000 U ser’s Guide 394 Schedule Select a schedule that defines when the policy applies or select Create Object to configure a new one (see Chapter 37 on page 527 for details). Otherwise, select none to make the policy always effec tive.
Chapter 27 Application Patrol ZyWALL USG 1000 User’s Guide 395 27.10 Other Protocol Screen The Other Pr otocol screen controls the default policy for TCP and UDP traffic that the ZyW ALL cannot identify . In other words, you can control what the ZyW ALL does when it does not recognize the application.
Chapter 27 Applicat ion Patrol ZyWALL USG 1000 U ser’s Guide 396 The following table describes the labels in this screen. See Section 27.10 .1 on page 397 for more information as well. T able 1 16 AppPatrol > Other LABEL DESCRIPTION Policy This table lists the policies config ured for traffic which does not match an application.
Chapter 27 Application Patrol ZyWALL USG 1000 User’s Guide 397 27.10.1 Other Conf iguration Add/Edit The Other Configuration Add/Ed it screen allows you to create a new condition or edit an existing one. T o access this screen, go to the Other Protocol scree n (see Section 27.
Chapter 27 Applicat ion Patrol ZyWALL USG 1000 U ser’s Guide 398 Schedule Select a schedule that defines when the policy applies or select Create Object to configure a new one (see Chapter 37 on page 527 for details). Otherwise, select any to make the policy always effectiv e.
Chapter 27 Application Patrol ZyWALL USG 1000 User’s Guide 399 27.1 1 Application Patrol St atistics This screen displays a band width usage gr aph and statistics for selected protocols. Click AppPatr ol > S tatistics to open the following screen.
Chapter 27 Applicat ion Patrol ZyWALL USG 1000 U ser’s Guide 400 The following table describes the labels in this screen. 27.1 1.2 Application Patrol St atistics: Bandwidth S t atistics The middle of the AppPatrol > S tatistics screen displays a bandwidth usage line graph for the selected protocols.
Chapter 27 Application Patrol ZyWALL USG 1000 User’s Guide 401 Figure 312 AppPatrol > S tatistics: Pr otocol S tatistics The following table describes the labels in this screen. T able 1 19 AppPatrol > S tatistics: Protocol S tatistics LABEL DESCRIPTION Service This is the protocol.
Chapter 27 Applicat ion Patrol ZyWALL USG 1000 U ser’s Guide 402 Forwarded Data (KB) This is how much of the application’s traf fic the ZyW ALL has se nt (in kilobytes). Dropped Data (KB) This is how much of the application’s tr affic the ZyWALL has discarded without notifying the client (in kil obytes).
ZyWALL USG 1000 User’s Guide 403 C HAPTER 28 Anti-Virus This chapter introduces and shows you ho w to configure the anti-virus scanner . See Section 5.
Chapter 28 Anti-Viru s ZyWALL USG 1000 U ser’s Guide 404 4 Once the virus is spread through the network, the number of infected networked computers can grow exponentially . 28.1.3 T ypes of Anti-Virus Scanner The section describes two types of anti-viru s scanner: host-based and ne twork-based.
Chapter 28 Anti-Viru s ZyWALL USG 1000 User’s Guide 405 Figure 313 ZyW ALL Anti-virus Example The following describes the virus scanning process on the ZyW ALL. 1 The ZyW ALL first identifies SMTP , POP3 , IMAP 4, HTTP and FTP packets through standard ports.
Chapter 28 Anti-Viru s ZyWALL USG 1000 U ser’s Guide 406 • Encrypted traffic. This could be password-protected files or VPN traf fic where the ZyW ALL is not the endpoint (pass-through VPN traffic). • T raffic thro ugh custom (non-standard) port s.
Chapter 28 Anti-Viru s ZyWALL USG 1000 User’s Guide 407 The following table describes the labels in this screen. T able 121 Anti-X > Anti-V irus > General LABEL DESCRIPTION Enable Anti -Virus and Anti-S pyware Select this check box to check traffic fo r viruses and spyware.
Chapter 28 Anti-Viru s ZyWALL USG 1000 U ser’s Guide 408 28.3.1 Anti-V irus Policy Edit Click the Add or Edit icon in the Anti-X > Anti-V irus > General screen to display the configuration screen as sh own next. Figure 315 Anti-X > Anti-Virus > Gene ral > Edit The following table describes the labels in this screen.
Chapter 28 Anti-Viru s ZyWALL USG 1000 User’s Guide 409 Protocol s to Scan Select which protocols of traf fic to scan for viruses. FTP applies to traffic using the TCP port number spe cified for FTP in the ALG screen. HTTP applies to traffic using TCP ports 80, 8080 and 3128.
Chapter 28 Anti-Viru s ZyWALL USG 1000 U ser’s Guide 410 28.4 Anti-V irus Setting Click Anti-X > Anti-V irus > Setting screen to display the configuration screen as shown next.
Chapter 28 Anti-Viru s ZyWALL USG 1000 User’s Guide 41 1 The following table describes the labels in this screen. T able 123 Anti-X > Anti-Virus > Setting LABEL DESCRIPTION Scan EICA R Select this option to have the ZyWALL check for the EICAR test file an d treat it in the same way as a rea l virus file.
Chapter 28 Anti-Viru s ZyWALL USG 1000 U ser’s Guide 412 28.5 Anti-V irus White List Add/Edit From the Anti-X > Anti-V irus > Setting screen, click a white list Add icon or Edit icon to display the following screen.
Chapter 28 Anti-Viru s ZyWALL USG 1000 User’s Guide 413 28.6 Anti-V irus Black List Add/Edit From the Anti-X > Anti-V irus > Setting screen, click a black list Add icon or Edit icon to display the following screen.
Chapter 28 Anti-Viru s ZyWALL USG 1000 U ser’s Guide 414 Figure 319 Anti-X > Anti-Virus > Signature: Search by Severity The following table describes the labels in this screen. T able 126 Anti-X > Anti-V irus > Signature LABEL DESCRIPTION Signatures Search Select the criteria on whic h to perform the search.
Chapter 28 Anti-Viru s ZyWALL USG 1000 User’s Guide 415 Severity This is the severity le vel of the an ti-viru s signature. Cli ck the severity column header to sort your search results by ascending or descending severity . Category This column displays whether the signat ure is for identifying a virus or spyware.
Chapter 28 Anti-Viru s ZyWALL USG 1000 U ser’s Guide 416.
ZyWALL USG 1000 User’s Guide 417 C HAPTER 29 IDP This chapter introduces IDP (In trusion, Detection and Preventio n), IDP profiles, binding an IDP profile to a traffic direction, custom signatures and updating signatures. See Section 5.4.15 on page 120 for related information on these screens.
Chapter 29 IDP ZyWALL USG 1000 U ser’s Guide 418 29.1.4 Signatures If a packet matches a signature, the action specifi ed by the signature is taken. Y ou can ch ange the default signature actions in the profile screens. 29.2 T raffic Directions and Profiles A zone is a combination of ZyW ALL interfaces and VPN connections for security .
Chapter 29 IDP ZyWALL USG 1000 User’s Guide 419 Figure 320 Anti-X > IDP > General The following table describes th e screens in this screen. T able 127 Anti-X > IDP > General LABEL DESCRIPTION General Setup Enable Signature Detection Y ou must register for IDP service in orde r to use packet inspection signatures.
Chapter 29 IDP ZyWALL USG 1000 U ser’s Guide 420 29.4 Configuring IDP Bindings Click Anti-X > IDP > General and then an Add or Edit icon to display the following screen. Use this screen to bind an IDP profile to a traffic direction. (Icons) Click the Add icon in the headi ng row to add a new first entry .
Chapter 29 IDP ZyWALL USG 1000 User’s Guide 421 Figure 321 Anti-X > IDP > General > Add The following table describes th e screens in this screen. 29.5 Introducing IDP Profiles An IDP profile is a set of packet inspection signatures. Packet inspection signatures examine packet co ntent for malicious data.
Chapter 29 IDP ZyWALL USG 1000 U ser’s Guide 422 Figure 322 Base Profiles The following table describes this screen. 29.6 Profile Summary Screen Select Anti-X > IDP > Pr ofile .
Chapter 29 IDP ZyWALL USG 1000 User’s Guide 423 Figure 323 Anti-X > IDP > Profile The following table describes th e fields in this screen. 29.7 Creating New Profiles Y ou may want to create a new profile if not all signatures in a base profile are applicable to your network.
Chapter 29 IDP ZyWALL USG 1000 U ser’s Guide 424 " If Internet Explorer opens a warning screen about a scrip t making Internet Explorer run slowly and the computer maybe becoming unr esponsive, just click No to continue. 3 T ype a new profile name 4 Enable or disable individu al signatures.
Chapter 29 IDP ZyWALL USG 1000 User’s Guide 425 Figure 324 Anti-X > IDP > Profile > Edit : Group View.
Chapter 29 IDP ZyWALL USG 1000 U ser’s Guide 426 The following table describes th e fields in this screen. T able 131 Anti-X > IDP > Profile > Group V iew LABEL DESCRIPTION Name Thi s is the name of the profile. Y ou may use 1-31 alpha numeric characters, underscores( _ ), or dashes (-), but the first character cannot be a number .
Chapter 29 IDP ZyWALL USG 1000 User’s Guide 427 29.8.2 Policy T ypes This section describes IDP policy types, also kn own as attack types, as categorized in the ZyW ALL. Y ou may refer to these types wh en categorizing your own custom rules. Action Select what action the ZyW A LL should take when a packet matches a signature here.
Chapter 29 IDP ZyWALL USG 1000 U ser’s Guide 428 29.8.3 IDP Service Group s An IDP service group is a set of related packet inspec tion signatures. DoS/DDoS The goa l of Denial of Service (DoS) at tacks is not to steal information, but to disable a device or network on the Internet.
Chapter 29 IDP ZyWALL USG 1000 User’s Guide 429 The following figure sh ows the WEB_PHP service g roup that contains signatures related to attacks on web servers using PHP ex ploits. PHP (PHP: Hypertext Preprocessor) is a server- side HTML embedded scripting language that allows web developers to build d ynamic websites.
Chapter 29 IDP ZyWALL USG 1000 U ser’s Guide 430 Figure 326 Anti-X > IDP > Profile: Query View The following table describes th e fields in this screen. T able 134 Anti-X > IDP > Profile: Query View LABEL DESCRIPTION Name This is the name of the profile that you created in the IDP > Profiles > Gr oup View screen.
Chapter 29 IDP ZyWALL USG 1000 User’s Guide 431 29.8.5 Query Example This example shows a search with these criteria: • Severity: severe and high • Attack T ype: DDoS • Platform: W indo ws 200.
Chapter 29 IDP ZyWALL USG 1000 U ser’s Guide 432 Figure 328 Query Example Sear ch Results 29.9 Introducing IDP Custom Signatures Create custom signatures for new attacks or attacks peculiar to your network. Custom signatures can also be saved to/from your computer so as to share with others.
Chapter 29 IDP ZyWALL USG 1000 User’s Guide 433 Figure 329 IP v4 Packet Headers The header fields are discussed below: T able 135 IP v4 Packet Headers HEADER DESCRIPTIO N V ersion The value 4 ind icates IP version 4. IHL IP Header Len gth is the number of 32 b it words forming the total length of the header (usually five).
Chapter 29 IDP ZyWALL USG 1000 U ser’s Guide 434 29.10 Configuring Custom Signatures Select Anti-X > IDP > Custom Signature s. The first screen shows a summary of all custom signatures created. Click the SID or Name heading to sort. Click the Add icon to create a new signature or click the Edit icon to edit an existing signature.
Chapter 29 IDP ZyWALL USG 1000 User’s Guide 435 The following table describes th e fields in this screen. 29.10.1 Creating or Ed iting a Custom Signature Click the Add icon to create a new signature or click the Edit icon to edit an existing signature in the screen as shown in Figure 330 on page 434 .
Chapter 29 IDP ZyWALL USG 1000 U ser’s Guide 436 Figure 331 Anti-X > IDP > Custom Signatures > Add/Edit.
Chapter 29 IDP ZyWALL USG 1000 User’s Guide 437 The following table describes the fields in this screen. T able 137 Anti-X > IDP > Custom Signatures > Add/Edit LABEL DESCRIPTION Name T ype the name of your custom si gnature.
Chapter 29 IDP ZyWALL USG 1000 U ser’s Guide 438 IP Options IP options is a vari able-length list of IP options for a datagram that define IP Security Option, IP Stream Identifier , (security and ha.
Chapter 29 IDP ZyWALL USG 1000 User’s Guide 439 29.10.2 Custom Signature Example Before creating a custom signature, you must fi rst clearly understand the vulnerability . 29.10.2.1 Underst and the V ulnerability Check the ZyW ALL logs when the attack oc curs .
Chapter 29 IDP ZyWALL USG 1000 U ser’s Guide 440 29.10.2.2 Analyze Packet s Then use a packet sniffer such as TCPdum p or Ethereal to investigate some more. From the NetBIOS header you see that the first byte ‘00’ defines the message type. The next three bytes represent the length of data , so you can ignore it.
Chapter 29 IDP ZyWALL USG 1000 User’s Guide 441 Figure 335 Example Custom Signature.
Chapter 29 IDP ZyWALL USG 1000 U ser’s Guide 442 29.10.3 Applying Custom Signatures After you create your custom signature, it beco mes available in the IDP service group category in the IDP > Profile > Packet Inspection screen. Custom signatures have an SID from 9000000 t o 9999999.
Chapter 29 IDP ZyWALL USG 1000 User’s Guide 443 Figure 337 Custom Signature Log 29.10.5 Snort Signatures Y ou may want to refer to open source Snort signatures when creating custom ZyW ALL ones.
Chapter 29 IDP ZyWALL USG 1000 U ser’s Guide 444 " Not all Snort functionality is supported in the ZyW ALL. Flow flow Flags fl ags Sequence Number seq Ack Number ack Window Size wi ndow T ransp.
ZyWALL USG 1000 User’s Guide 445 C HAPTER 30 ADP This chapter introduces ADP (Anomaly Detection and Prev ention), anomaly profiles and binding an ADP profile to a traffic direction. See Section 5.4.16 on page 120 for related information on these screens.
Chapter 30 ADP ZyWALL USG 1000 U ser’s Guide 446 30.1.3 ADP on the ZyW ALL ADP on the ZyW ALL protec ts against network-based intrusions. See Section 30.8 on page 450 and Section 30.9 on page 4 56 for more on the kinds of attacks that the ZyW ALL can protect against.
Chapter 30 ADP ZyWALL USG 1000 User’s Guide 447 The following table describes th e screens in this screen. 30.4 Configuring Anomaly Profile Bindings Click Anti-X > ADP > General and then an Add or Edit icon to display the following screen. Use this screen to bind an anomaly profile to a traf fic direction.
Chapter 30 ADP ZyWALL USG 1000 U ser’s Guide 448 Figure 339 Anti-X > ADP > General > Add The following table describes th e screens in this screen. 30.5 Introducing ADP Profiles An ADP profile is a set of traffic anom aly rules and protocol anomaly rules.
Chapter 30 ADP ZyWALL USG 1000 User’s Guide 449 Figure 340 Base Profiles These are the default base profiles at the time of writing. 30.6 Profile Summary Screen Select Anti-X > ADP > Pr ofile .
Chapter 30 ADP ZyWALL USG 1000 U ser’s Guide 450 30.7 Creating New Profiles Y ou may want to create a new profi le if not all rules in a base profile are applicable to your network. In this case you should disab le non- applicable rules so as to improve ZyW ALL ADP processing efficiency .
Chapter 30 ADP ZyWALL USG 1000 User’s Guide 451 30.8.1 Port Scanning An attacker scans device(s) to determine what types of network protocols or services a device supports. One of the most common port scanning tools in use today is Nmap. Many connection attempts to di fferent ports (services) may in dicate a port scan.
Chapter 30 ADP ZyWALL USG 1000 U ser’s Guide 452 30.8.1.4 Filtered Port Scans A filtered port scan may indicate that there we re no network errors (ICMP unreachables or TCP RST s ) or responses on closed ports have been suppressed.
Chapter 30 ADP ZyWALL USG 1000 User’s Guide 453 30.8.2.3 TCP SYN Flood Att ack Usually a client starts a session by sending a SYN (synchronize) packet to a serve r . The receiver returns an AC K (acknowledgment) pack et and its own SYN, and then the initiator responds with an ACK (acknowledgment).
Chapter 30 ADP ZyWALL USG 1000 U ser’s Guide 454 30.8.2.5 UDP Flood Att ack UDP is a connection-less protoc ol and it does no t require any connection setup procedure to transfer data. A UDP flood attack is possible when an attacker sends a UDP packet to a random port on the victim system.
Chapter 30 ADP ZyWALL USG 1000 User’s Guide 455 30.8.3 Profile > T r affic Anomaly Screen Figure 345 Profiles: T raffic Anomaly.
Chapter 30 ADP ZyWALL USG 1000 U ser’s Guide 456 The following table describes th e fields in this screen. 30.9 Profiles: Protocol Anomaly Protocol anomaly is the third screen in an ADP profile. Protocol anomaly (P A) rules check for protocol compliance ag ainst the rele vant RFC (Request for Comments).
Chapter 30 ADP ZyWALL USG 1000 User’s Guide 457 Protocol anomaly detection includes HTTP Inspection, TC P Decoder, UDP Decoder and ICMP Decoder where each category refl ects the packet type inspec ted. Protocol anomaly rules may be upda ted when you upload n e w firmware.
Chapter 30 ADP ZyWALL USG 1000 U ser’s Guide 458 OVERSIZE-CHUNK- ENCODING A TT ACK This rule is an anomaly detector for abnormally large chun k sizes. This picks up the apache chunk encod ing exploits and may also be triggered on HTTP tunneling t hat uses chun k encoding.
Chapter 30 ADP ZyWALL USG 1000 User’s Guide 459 30.9.2 Protocol Anomaly Configuration In the Anti-X > ADP > Pr ofile screen, click the Edit icon or click the Add icon and choose a base profile, then select the Protocol Anomaly tab.
Chapter 30 ADP ZyWALL USG 1000 U ser’s Guide 460 Figure 346 Profiles: Proto col Anomaly.
Chapter 30 ADP ZyWALL USG 1000 User’s Guide 461 The following table describes th e fields in this screen. T able 145 ADP > Profile > Pr otocol Anomaly LABEL DESCRIPTION Name This is the name of the profile. Y o u may use 1-31 alphanumeric characters, underscores( _ ), or dashes (-), but the first char acter cannot be a nu mber .
Chapter 30 ADP ZyWALL USG 1000 U ser’s Guide 462.
ZyWALL USG 1000 User’s Guide 463 C HAPTER 31 Content Filter Screens This chapter covers how to use the conten t filter feature to control web access.
Chapter 31 Content Filter Screens ZyWALL USG 1000 U ser’s Guide 464 31.1.3 Content Filter Configuration Guidelines Y ou must configure an address ob ject, a schedule object and a filtering profile before you can set up a content filter policy .
Chapter 31 Conten t Filter Screens ZyWALL USG 1000 User’s Guide 465 Block web access when no policy is applied Select this check box to stop users fr om accessing the Internet by default when their attempted access does not match a content filter po licy .
Chapter 31 Content Filter Screens ZyWALL USG 1000 U ser’s Guide 466 31.3 Content Filter Policy Screen Click Anti-X > Content Filter > General > Add or Edit to open the Content Filter Policy screen. Use this screen to configure a content filter policy .
Chapter 31 Conten t Filter Screens ZyWALL USG 1000 User’s Guide 467 The following table describes the labels in this screen. 31.4 Content Filter Profile Screen Click Anti-X > Content Filter > Filter Pr ofile to open the Filter Profile screen.
Chapter 31 Content Filter Screens ZyWALL USG 1000 U ser’s Guide 468 31.5 External W eb Filtering Service When you register for and enable the external web filtering service, your ZyW ALL accesses an external database that has millions of web sites categorized based on content.
Chapter 31 Conten t Filter Screens ZyWALL USG 1000 User’s Guide 469 31.6 Content Filter Categories Screen Click Anti-X > Content Filter > Filter Pr ofile > Add or Edit to open the Categories screen. Use this screen to enable external database content filtering and select which web site categories to block and/or log.
Chapter 31 Content Filter Screens ZyWALL USG 1000 U ser’s Guide 470 Figure 351 Anti-X > Content Filter > Filter Profile > Add The following table describes the labels in this screen. T able 149 Anti-X > Content Filter > Filter Profile > Add LABEL DESCRIPTION Name Enter a descriptive name for this content filtering profile name.
Chapter 31 Conten t Filter Screens ZyWALL USG 1000 User’s Guide 471 Enable External Web Filter Servi ce Enable external database content filt ering to have the ZyWALL check an external database to find to which category a requested web page belongs.
Chapter 31 Content Filter Screens ZyWALL USG 1000 U ser’s Guide 472 Intimate Apparel/Swimsuit Selectin g this category excludes pages that contain images or offer the sale of swimsuits or intimate apparel or other types of suggestive clothing. It does not include pages selling undergarments as a subsection of other products offered.
Chapter 31 Conten t Filter Screens ZyWALL USG 1000 User’s Guide 473 Arts/Entertainment Selectin g this category excludes pages that pro mote and provide information about motion pictures, video s, television, music and programming guides, books, comics, mo vie theatres, galleri es, artists or reviews on entertainment.
Chapter 31 Content Filter Screens ZyWALL USG 1000 U ser’s Guide 474 Political/Activist Groups Selecting this category excludes pages sponsored by or which provide information on political parties, s.
Chapter 31 Conten t Filter Screens ZyWALL USG 1000 User’s Guide 475 Open Image/Media Search Selecting this catego ry excludes pages with image or video search capabilities which return graphical re sults (i.
Chapter 31 Content Filter Screens ZyWALL USG 1000 U ser’s Guide 476 Sexuality/Alternative Lifestyles Selecting this category excludes pages that provide info rmation, promote, or cater to gays, lesbians, swinger s, oth er sexual orientations or practices, or a particular fetish.
Chapter 31 Conten t Filter Screens ZyWALL USG 1000 User’s Guide 477 31.7 Content Filter Customization Screen Click Anti-X > Content Filter > Filter Pr ofile > Add or Edit > Customization to open the Customization screen. Y ou can c reate a list of good (allowed) web site addresses and a list of bad (blocked) web site addresses.
Chapter 31 Content Filter Screens ZyWALL USG 1000 U ser’s Guide 478 Figure 352 Anti-X > Content Filter > F ilter Profile > Customization The following table describes the labels in this screen.
Chapter 31 Conten t Filter Screens ZyWALL USG 1000 User’s Guide 479 Allow Web traf fic for trusted web sites only When this box is select ed, the ZyW ALL blocks Web access to sites that are not on the T rusted We b Sites list. If they are chosen carefully , this is the most effective way to block objectionable material.
Chapter 31 Content Filter Screens ZyWALL USG 1000 U ser’s Guide 480 31.8 Keyword Blocking URL Checking The ZyW A LL checks the URL ’ s domain name (or IP address) and file path separately when performing keyword blocking. The URL ’ s domain name or IP address is the char acters that come before the first slash in the URL.
Chapter 31 Conten t Filter Screens ZyWALL USG 1000 User’s Guide 481 Please see Section 32.2 on page 488 for how to submit a web site that has been incorrectly categorized. Figure 353 Anti-X > Content Filter > Cache The following table describes the labels in this screen.
Chapter 31 Content Filter Screens ZyWALL USG 1000 U ser’s Guide 482 Page x of x This is the number of the page of entrie s currently displayed and the total number of pages of entries. T ype a page number to go to or use the arrows to navigate the pages of entries.
ZyWALL USG 1000 User’s Guide 483 C HAPTER 32 Content Filter Reports This chapter describes how to view content filtering reports after yo u have activated the category-based content filtering subscription service. See Chapter 8 on pa ge 165 on how to create a myZyXEL.
Chapter 32 Content Filter Reports ZyWALL USG 1000 U ser’s Guide 484 ZyW ALL using the Rename button in the Service Management screen (see Figure 35 6 on page 484 ). Figure 355 myZyXEL.com: Welcome 4 In the Service Management screen click Content Filter in the Service Name field to open the Blue Coat login screen.
Chapter 3 2 Content Filt er Reports ZyWALL USG 1000 User’s Guide 485 6 Click Submit . Figure 357 Blue Coat: Login 7 In the W eb Filter Home screen, click the Reports tab. Figure 358 Blue Coat Conten t Filter Repor ts Main Screen 8 Select items under Global Reports or Single Use r Reports to view the corresponding reports.
Chapter 32 Content Filter Reports ZyWALL USG 1000 U ser’s Guide 486 Figure 359 Blue Coat: Report Ho me 9 Select a time period in the Date Range field, either Allowed or Blocked in the Action Ta k e n field and a category (or enter the user name if you want to view sing le user reports) and click Run Report .
Chapter 3 2 Content Filt er Reports ZyWALL USG 1000 User’s Guide 487 Figure 360 Global Report Screen Example 11 Y ou can click a ca tegory in the Categories report or click URLs in the Report Home screen to see the URLs that were requested.
Chapter 32 Content Filter Reports ZyWALL USG 1000 U ser’s Guide 488 Figure 361 Requested URLs Example 32.2 W eb Site Submission Y ou may find that a web site has not been accura tely categorized or that a web site’ s contents have changed and the content filtering cate gory needs to be updat ed.
Chapter 3 2 Content Filt er Reports ZyWALL USG 1000 User’s Guide 489 Figure 362 Web Pag e Review Process Screen 3 T ype the web site’ s URL in the field and click Submit to have the web site reviewed.
Chapter 32 Content Filter Reports ZyWALL USG 1000 U ser’s Guide 490.
491 P ART V Device HA & Object s Device HA (493) User/Group (503) Addresses (515) Services (521) Schedules (527) AAA Server (531) Authentication Objects (541) Certificates (545) ISP Accounts (563).
492.
ZyWALL USG 1000 User’s Guide 493 C HAPTER 33 Device HA Use device HA and V irtual Router Redundancy Protocol (VRRP) to increase network reliability .
Chapter 33 Device HA ZyWALL USG 1000 U ser’s Guide 494 " Every router in a virtual router must use the same advertisement interval. If Router A becomes unavailable, it stop s sending messages to Router B . Router B detects this and assumes the role of the master router .
Chapter 33 Device HA ZyWALL USG 1000 User’s Guide 495 33.1.1 Additional VRRP Notes • It is possible to set up two virtual ro ut ers so that they back up each other . • VRRP uses IP protocol 1 12. 33.2 VRRP Group Overview In the ZyW ALL, you should create a VRRP group to add on e of its interfaces to a virtual router .
Chapter 33 Device HA ZyWALL USG 1000 U ser’s Guide 496 33.2.1 Link Monitoring and Remote Management W ith link monitoring enabled, a backup ZyW A LL that takes over for an unavailable master ZyW ALL takes over all of the master ZyW ALL’ s static IP addresses.
Chapter 33 Device HA ZyWALL USG 1000 User’s Guide 497 Figure 366 Device HA > VRRP Group The following table describes the labels in this screen. See Section 33.5 on page 49 8 for more information as well. T able 152 Device HA > VRRP Group LABEL DESCRIPTION Refresh Click this button to updat e the information in this screen.
Chapter 33 Device HA ZyWALL USG 1000 U ser’s Guide 498 33.5 VRRP Group Add/Edit The VRRP Gr oup Add/Edit screen allows you to add VRRP groups to the ZyW ALL or to edit the configuration of an existing VRRP group. • Y ou can only use interfa ces that have static IP addresses.
Chapter 33 Device HA ZyWALL USG 1000 User’s Guide 499 VRID T ype the virtu al router ID number . Description T ype the description of the VRRP group . This field is on ly for your refe rence. It may be up to sixty printable ASCII characters long. VRRP Interface Select the interface in this device that is part of the virtua l router .
Chapter 33 Device HA ZyWALL USG 1000 U ser’s Guide 500 33.6 Synchronization Overview In a virtual router , backup ro uters do not au tomatically get configur ation updates from the master router . In this c ase, the master ZyW A LL ca n send these upda tes to backup ZyW ALLs.
Chapter 33 Device HA ZyWALL USG 1000 User’s Guide 501 " Y ou must subscribe to serv ices on the backup ZyW ALL before synchronizing it with the master ZyW ALL. 33.6.2 Synchronize Screen Use this screen if you want the ZyW ALL to get or to send up dated IDP signatures, and configuration information in the virtual router .
Chapter 33 Device HA ZyWALL USG 1000 U ser’s Guide 502 Sync. Now Click this button to get updated ce rtificates, A V signatur es, IDP and appl ication patrol signatures, system prot ect signatures, and configur ation information from the specified ZyWALL router .
ZyWALL USG 1000 User’s Guide 503 C HAPTER 34 User/Group This chapter describes how to se t up user accounts, user grou ps, and user settings for the ZyW ALL. Y ou ca n also set up rules that contro l when users have to log in to the ZyW ALL before the ZyW ALL routes traffic for them.
Chapter 34 User /Group ZyWALL USG 1000 U ser’s Guide 504 34.1.2 Ext-User Account s Set up an Ext-User account if the user is authenticated by an external server and you want to set up specific policies for this user in the Zy W ALL. If you do not want to set up policies for this user , you do not ha ve to set up an Ext-User account.
Chapter 34 User/Group ZyWALL USG 1000 User’s Guide 505 34.1.2.2 Creating a Large Number of Ext-User Accounts If you plan to create a large number of Ext-User accounts, you might use CLI commands, instead of the web configurator , to create the accounts.
Chapter 34 User /Group ZyWALL USG 1000 U ser’s Guide 506 " This works with HTTP traffic only . The Zy W ALL does not force users to log in before it routes othe r kinds of traf fic. The ZyW ALL does not automatica lly route the request that prompted the login, h o wever , so users have to make this request again.
Chapter 34 User/Group ZyWALL USG 1000 User’s Guide 507 Figure 372 User/Group > User > Edit The following table describes the labels in this screen. T able 158 User/Group > User > Edit LABEL DESCRIPTION User Name T ype the user name for this user account.
Chapter 34 User /Group ZyWALL USG 1000 U ser’s Guide 508 34.2.1.1 Rules for User Names Enter a user name from 1 to 31 characters. The user name can only cont ain the follo wing characters: • Alpha.
Chapter 34 User/Group ZyWALL USG 1000 User’s Guide 509 34.3.1 Group Add/Edit The Gr oup Ad d/Edit screen allows you to cr eate a new u ser group or edit an existing one. T o access this screen, go to the Group screen (see Sectio n 34.3 on page 508 ), and click either the Add icon or an Edit icon.
Chapter 34 User /Group ZyWALL USG 1000 U ser’s Guide 510 34.4 Setting Screen The Setting screen controls default settings, login settings, lock out settings, and other user settings for the ZyW ALL. Y ou can also use this sc reen to specify when users must log in to the ZyW ALL before it ro utes traffic for them.
Chapter 34 User/Group ZyWALL USG 1000 User’s Guide 51 1 User Logon Setting Limit ... for administratio n account Select this check box if you wan t to set a li mit on the number of simultaneous logins by admin users.
Chapter 34 User /Group ZyWALL USG 1000 U ser’s Guide 512 34.4.1 Force User Authen tication Policy Add/Edit Use this screen to specify a cond ition when users must log in or do not have to log in to the ZyW ALL before their HTTP traf fic can pa ss through the ZyW ALL.
Chapter 34 User/Group ZyWALL USG 1000 User’s Guide 513 The following table describes the labels in this screen. 34.5 W eb Configurator for Non-Admin Users Access users cannot use the W eb configurator to browse the configuration of the ZyW ALL.
Chapter 34 User /Group ZyWALL USG 1000 U ser’s Guide 514 The following table describes the labels in this screen. T able 164 Web Configurator for Non-Admin Users LABEL DESCRIPTION User-defined lease time (max ... minutes) Access users can specify a lease time s horter than or equal to the one that you specified.
ZyWALL USG 1000 User’s Guide 515 C HAPTER 35 Addresses This chapter describes how to set up addr esses and address groups for the ZyW ALL. See Section 5.5 on page 12 2 for related information on these screens. 35.1 Addresses Overview Address objects can represent a single IP address or a ra nge of IP addresses.
Chapter 35 Addre sses ZyWALL USG 1000 U ser’s Guide 516 Figure 378 Object > Address > Address The following table describes the labels in this screen. See Section 35.2.2 on page 516 for more information as well. 35.2.2 Address Add/Edit The Addr ess Add/Edit screen allows you to create a new address or edit an existing one.
Chapter 35 Ad dresses ZyWALL USG 1000 User’s Guide 517 The following table describes the labels in this screen. 35.3 Address Group Screens Use the Address Gr oup summa ry screen and the Address Gr oup Add/Edit screen, to maintain address groups in the ZyW ALL.
Chapter 35 Addre sses ZyWALL USG 1000 U ser’s Guide 518 The following table describes the labels in this screen. See Section 35.3.2 on page 518 for more information as well. 35.3.2 Address Group Add/Edit The Addr ess Group Add/Edit screen allows you to create a new address group or edit an existing one.
Chapter 35 Ad dresses ZyWALL USG 1000 User’s Guide 519 Available This field displays the names of the addre ss and address group objects that can be added to the address group. Select address and address group objects that you want to be members of this group and click th e right arrow to add them to the member list.
Chapter 35 Addre sses ZyWALL USG 1000 U ser’s Guide 520.
ZyWALL USG 1000 User’s Guide 521 C HAPTER 36 Services Use service objects to define TCP applicatio ns, UDP applications, and ICMP messages. Y ou can also create service groups to refer to mu ltiple service objects in other features. See Section 5.5 on page 122 for related information on these screens.
Chapter 36 Service s ZyWALL USG 1000 U ser’s Guide 522 • UDP applications • ICMP messages • user -defined services (for other types of IP protocols) These objects are us ed in policy rout es, firewall rules, and IDP profiles.
Chapter 36 Services ZyWALL USG 1000 User’s Guide 523 36.2.1 Service Add/Edit The Service Add/Edit screen allows you to create a new service or edit an existing one. T o access this screen, go to the Service screen (see Section 36.2 o n page 522 ), and click either the Add icon or an Edit icon.
Chapter 36 Service s ZyWALL USG 1000 U ser’s Guide 524 36.3 Service Group Summary Screen The Service Gr oup summary screen provides a summary of all service groups. In addition, this screen allows you to add, edit, and remove service groups. T o access this screen, log in to the web configurator, and click Object > Service > Service Group .
Chapter 36 Services ZyWALL USG 1000 User’s Guide 525 Figure 385 Object > Service > Service Group > Edit The following table describes the labels in this screen. T able 172 Object > Service > Service Group > Edit LABEL DESCRIPTION Name Enter the name of the service group.
Chapter 36 Service s ZyWALL USG 1000 U ser’s Guide 526.
ZyWALL USG 1000 User’s Guide 527 C HAPTER 37 Schedules Use schedules to set up one-time and recurring schedules for policy routes, firewall rules, application patrol, and content filtering. See Section 5. 5 on page 122 for related information on these screens.
Chapter 37 Schedu les ZyWALL USG 1000 U ser’s Guide 528 Figure 386 Object > Schedule The following table describes the labels in this screen. See Section 37.
Chapter 37 Sc hedules ZyWALL USG 1000 User’s Guide 529 Figure 387 Object > Schedule > Edit (One Time) The following table describes the labels in this screen. 37.2.3 Recurring Schedule Add/Edit The Recurring Schedu le Add/Edit screen allows you to define a recurring schedule or ed it an existing one.
Chapter 37 Schedu les ZyWALL USG 1000 U ser’s Guide 530 Figure 388 Object > Schedule > Edit (Recurring) The Ye a r , Month , and Day columns are not used in recurri ng schedules and are disabled in this screen. The following table describes the remaining labels in this screen.
ZyWALL USG 1000 User’s Guide 531 C HAPTER 38 AAA Server This chapter introduces and shows you how to configure the ZyW ALL to use external authentication servers. 38.1 AAA Server Overview Y ou can use an AAA (Authent ication, Authoriz ation, Ac counting) server to provide access control to your network.
Chapter 38 AAA Server ZyWALL USG 1000 U ser’s Guide 532 5 Configure the ASAS as a RADI US server in the ZyW ALL’ s Object > AAA Server screens. 6 Give the OTP tokens to (local or remote) users. 38.1.2 User Authentication Method Y ou can select to authenticate users using th e local user database and/or a specified authentication server .
Chapter 38 AAA Server ZyWALL USG 1000 User’s Guide 533 Figure 390 Basic Directory S tructure 38.2.2 Distinguished Name (DN) A DN uniquely identifies an entry in a direct ory . A DN consists of attribute-value pairs separated by commas. The leftmo st attribute is the Relative Di stinguished Name (RDN).
Chapter 38 AAA Server ZyWALL USG 1000 U ser’s Guide 534 Figure 391 Object > AAA Server > Active Directory (or LDAP) > Default The following table describes the labels in this screen. 38.3 Active Directory or LDAP Group Summary Y ou can configure a group of AD or LDAP servers in the Active Dir ec tory (or LDAP ) > Group screen.
Chapter 38 AAA Server ZyWALL USG 1000 User’s Guide 535 1 Click Object > AAA Server > Active Directory (or LDAP ) > Group to display the screen. Figure 392 Object > AAA Server > Active Directory (or LDAP) > Group The following table describes the labels in this screen.
Chapter 38 AAA Server ZyWALL USG 1000 U ser’s Guide 536 The following table describes the labels in this screen. 38.4 RADIUS Server RADIUS (Remote Authentication Dial-In User Se rvice) authenticatio.
Chapter 38 AAA Server ZyWALL USG 1000 User’s Guide 537 Figure 394 RADIUS Server Network Example 38.5 Configuring a Default RADIUS Server T o configure the default extern al RADIUS server to use fo r user authentication, click Object > AAA Server > RADIUS to display the screen as shown.
Chapter 38 AAA Server ZyWALL USG 1000 U ser’s Guide 538 38.6 Configuring a Group of RADIUS Servers Y ou can configure a group of RADIUS servers in the RADIUS > Group screen. This is useful if you have more than one authentication se rver for user authentication in a network.
Chapter 38 AAA Server ZyWALL USG 1000 User’s Guide 539 The following table describes the labels in this screen. T able 181 Object > AAA Server > RADIUS > Group > Add LABEL DESCRIPTION Configuration All RADIUS servers in a group s hare the same settings in the fields below .
Chapter 38 AAA Server ZyWALL USG 1000 U ser’s Guide 540.
ZyWALL USG 1000 User’s Guide 541 C HAPTER 39 Authentication Objects This chapter shows you how to select different auth entication methods fo r user authentication using the AAA servers or the internal user data base.
Chapter 39 Authen tication Objects ZyWALL USG 1000 U ser’s Guide 542 39.3 Creating an Authentication Object Follow the steps below to crea te an authentication object. 1 Click Object > Auth. Method . 2 Click Add . 3 Specify a descriptive name fo r identification purposes in the Name field.
Chapter 39 Auth entication Objects ZyWALL USG 1000 User’s Guide 543 The following table describes the labels in this screen. 39.3.1 Example: Selecting a VPN Authentication Method After you set up an auth entication method i n the Auth.
Chapter 39 Authen tication Objects ZyWALL USG 1000 U ser’s Guide 544 Figure 400 Example: Using Authentication Method in VPN.
ZyWALL USG 1000 User’s Guide 545 C HAPTER 40 Certificates This chapter gives background in formation about public-key certificates and explains how to use the Certificates screens. See Section 5.5 on page 122 for related information on these screens.
Chapter 40 Certificates ZyWALL USG 1000 U ser’s Guide 546 Certification authorities maintain directory ser vers with databases of valid and revoked certificates. A directory of certificates that have been revoked before the scheduled exp iration is called a CRL (Certificate Revocation List).
Chapter 40 Certificates ZyWALL USG 1000 User’s Guide 547 " Be careful to not convert a binary file to text during the transf er process. It is easy for this to occur since many programs use text files by default. 40.4 Certificate Configuration Screens Summary This section summarizes how to manage certificates on the ZyW ALL.
Chapter 40 Certificates ZyWALL USG 1000 U ser’s Guide 548 Figure 402 Certificate Details 4 Use a secure method to verify that the certificate owner ha s the same information in the Thumbprint Algorithm and Thumbprint fields. The secure method may very based on your situation.
Chapter 40 Certificates ZyWALL USG 1000 User’s Guide 549 The following table describes the labels in this screen. 40.6.1 My Certificates Add Screen Click Object > Certificate > My Certificates and then the Add icon to open the My Certificates Add screen.
Chapter 40 Certificates ZyWALL USG 1000 U ser’s Guide 550 Figure 404 Object > Certificate > My Certificates > Add The following table describes the labels in this screen. T able 185 Object > Certificate > My Certificates > Add LABEL DESCRIPTION Name T ype a name to identify th is certific ate.
Chapter 40 Certificates ZyWALL USG 1000 User’s Guide 551 Organization Identify the company or group to which the certificate ow ner belongs. Y ou can use up to 31 characters. Y ou can use a lphanumeric characte rs, the hyphen and the underscore. Country Identify the nation where the certi ficat e owner i s located.
Chapter 40 Certificates ZyWALL USG 1000 U ser’s Guide 552 If you configured the My Cert ificate Create screen to have the ZyW ALL enroll a certificate and the certificate enrollment is not successful, you see a screen with a Return button that takes you back to the My Certif icate Create screen.
Chapter 40 Certificates ZyWALL USG 1000 User’s Guide 553 Figure 405 Object > Certificate > My Certificates > Edit The following table describes the labels in this screen. T able 186 Object > Certificate > My Certificates > Edit LABEL DESCRIPTION Name This field displays the identifying name of this certificat e.
Chapter 40 Certificates ZyWALL USG 1000 U ser’s Guide 554 T ype T his field displays general informa ti on about the certificat e. CA-signed mea ns that a Certification Authority signed the certificate . Self-signed means that the certificate’s owner signed the certificate (not a certification authority).
Chapter 40 Certificates ZyWALL USG 1000 User’s Guide 555 40.6.3 My Certificate Import Screen Click Object > Certificate > My Certificates > Import to open the My Certif icate Import screen. Follow the instruc tions in this screen to save an existing certificate to the ZyW ALL.
Chapter 40 Certificates ZyWALL USG 1000 U ser’s Guide 556 The following table describes the labels in this screen. 40.7 T rusted Certificates Screen Click Object > Certificate > T rusted Certificates to open the T rusted Certificates screen.
Chapter 40 Certificates ZyWALL USG 1000 User’s Guide 557 40.8 T rusted Certif icates Edit Screen Click Object > Certificate > T rusted Certificates and then a certificate’ s Edit icon to open the T rusted Certificates Edit screen.
Chapter 40 Certificates ZyWALL USG 1000 U ser’s Guide 558 Figure 408 Object > Certificate > Tr us ted Certificates > Edit The following table describes the labels in this screen. T able 189 Object > Certificate > T r usted Certificat es > Edit LABEL DESCRIPTION Name This field displays the identifying name of this certificate.
Chapter 40 Certificates ZyWALL USG 1000 User’s Guide 559 Refresh Click Refresh to display the certification path. Enable X.509v3 CRL Distribution Points and OCSP checking Select this check box to have the ZyWALL check incoming certificates that ar e signed by this certificate against a Cert ificate Revocati on List (CRL) or an OCSP server .
Chapter 40 Certificates ZyWALL USG 1000 U ser’s Guide 560 40.9 T rusted Certif icates Import Screen Click Object > Certificate > T rusted Certificates > Import to open the T rusted Certificates I mport screen. Follow the instructions in this screen to save a trusted certificate to the ZyW ALL.
Chapter 40 Certificates ZyWALL USG 1000 User’s Guide 561 Figure 409 Object > Certificate > Tr us ted Certificates > Import The following table describes the labels in this screen.
Chapter 40 Certificates ZyWALL USG 1000 U ser’s Guide 562.
ZyWALL USG 1000 User’s Guide 563 C HAPTER 41 ISP Accounts Use ISP accounts to manage Internet Service Provider (ISP) account information for PPPoE/ PP TP interfaces. See Section 5.5 on page 122 for related informa tion on these screens. 41.1 ISP Account s Overview An ISP account is a profile of settings fo r Internet access using PPPoE or PP TP .
Chapter 41 ISP Accoun ts ZyWALL USG 1000 U ser’s Guide 564 41.3 ISP Account Edit The ISP Account Edit screen lets you add informa tion about new accounts and edit information about existing accounts. T o open this window , open the ISP Account screen.
Chapter 41 ISP Accoun ts ZyWALL USG 1000 User’s Guide 565 Encryption Method This field is a vailable if th is ISP account uses the PPTP protocol. Use th e drop- down list box to select the type of Micr osoft Point-to-Point Encryption (MPPE). Options are: nomppe - This ISP account does not use MPPE.
Chapter 41 ISP Accoun ts ZyWALL USG 1000 U ser’s Guide 566.
ZyWALL USG 1000 User’s Guide 567 C HAPTER 42 SSL Application This chapter describes how to configure SS L application objects for use in SSL VPN. 42.1 SSL Application Overview Configure an SSL application object to specify a service and a co rresponding IP address of the server on the local network.
Chapter 42 SSL Application ZyWALL USG 1000 U ser’s Guide 568 The following table describes the labels in this screen. 42.3 Creating/Editing an SSL Application T o create or edit an SSL application object, click the Add or Edit button in the SSL Application screen.
Chapter 42 SSL Application ZyWALL USG 1000 User’s Guide 569 The following table describes the labels in this screen. 42.3.2 Example: S p ecifying a Web Site for Access This example shows you how to create a web-based application for an internal web site.
Chapter 42 SSL Application ZyWALL USG 1000 U ser’s Guide 570 7 Click Apply to save the settings. The configuration screen should look similar to the following figure.
Chapter 42 SSL Application ZyWALL USG 1000 User’s Guide 571 " Y ou must then configure the shared folder on the file server for remote access. Refer to the document that co mes with your file server .
Chapter 42 SSL Application ZyWALL USG 1000 U ser’s Guide 572.
573 P ART VI System System (575) Service Control (587).
574.
ZyWALL USG 1000 User’s Guide 575 C HAPTER 43 System This chapter provides information on the general system screens. See Chapter 44 on page 587 for details on the system screens that control service access.
Chapter 43 System ZyWALL USG 1000 U ser’s Guide 576 43.3 T ime and Date This section shows yo u how: 1 T o manually set the ZyW ALL date and time. 2 T o get the ZyW ALL date and time from a time server . For effective scheduling and logging, the ZyW ALL system time must be accurate.
Chapter 43 System ZyWALL USG 1000 User’s Guide 577 Manual Select this radio button to enter the time and da te manually . If you configure a new time and date, time zone and daylight saving at the same time, th e time zone and daylight saving will affect the new time and date you entered.
Chapter 43 System ZyWALL USG 1000 U ser’s Guide 578 43.3.1 Pre-define d NTP Time Servers List When you turn on the ZyW ALL for t he first time, the date an d time start at 2003-01-01 00:00:00. The ZyW ALL then atte mpts to synchronize with one of the followi ng pre-defined list of Network T ime Protocol (NTP) time servers.
Chapter 43 System ZyWALL USG 1000 User’s Guide 579 Figure 418 Synchronization in Process The Curr ent T ime and Current Date fields will display the appropriate settings if the synchronization is successful. If the synchronization was not successful, a log displays in the Vi e w L o g screen.
Chapter 43 System ZyWALL USG 1000 U ser’s Guide 580 Figure 419 System > Console Po rt S peed The following table describes the labels in this screen. 43.5 DNS Overview DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa.
Chapter 43 System ZyWALL USG 1000 User’s Guide 581 Figure 420 System > DNS The following table describes the labels in this screen. T able 200 System > DNS LABEL DESCRIPTION Address/PTR Record This record specifies the mappin g of a fully qualified d omain name (FQDN) to an IP address.
Chapter 43 System ZyWALL USG 1000 U ser’s Guide 582 From This displays whether the DNS server IP address is assigned by the ISP dynamically through a specified interface or co nfigured manually .
Chapter 43 System ZyWALL USG 1000 User’s Guide 583 43.5.4 Address Record An address record contains the mapping of a fu lly qualified domain na me (FQDN) to an IP address.
Chapter 43 System ZyWALL USG 1000 U ser’s Guide 584 43.5.7 Domain Zone Forwarder A domain zone forwarder contains a DNS serv er ’ s IP address. The ZyW ALL can query the DNS server to resolve domain zones for fe atures like VPN, DDNS and the time server .
Chapter 43 System ZyWALL USG 1000 User’s Guide 585 43.5.9 MX Record A MX (Mail eXchange) record indi cates which host is responsible for the mail for a particular domain, that is, contro ls where mail is se nt for that domain.
Chapter 43 System ZyWALL USG 1000 U ser’s Guide 586 The following table describes the labels in this screen. 43.6 Language Screen Click System > Language to open the following screen. Use this screen to select a display language for the ZyW ALL’ s web configurator screens.
ZyWALL USG 1000 User’s Guide 587 C HAPTER 44 Service Control This chapter covers controllin g access to the ZyW ALL. See Chapter 43 on page 575 for the general system configuration screens. 44.1 Service Control Overview Use this chapter to control wh ich services can access the ZyW ALL.
Chapter 44 Serv ice Control ZyWALL USG 1000 U ser’s Guide 588 44.1.1 Service Access Limit ations A service cannot be used to access the ZyW ALL when: 1 Y ou have disabled that service in the corresponding screen.
Chapter 44 Service Control ZyWALL USG 1000 User’s Guide 589 Figure 427 HTTP/HTTPS Implementation " If you disable HTTP in the WWW screen, then the ZyW ALL blocks all HTTP connection attempts. 44.3 Configuring WWW Click System > WWW to open the WW W screen.
Chapter 44 Serv ice Control ZyWALL USG 1000 U ser’s Guide 590 Figure 428 System > WWW The following table describes the labels in this screen. T able 206 System > WWW LABEL DESCRIPTION HTTPS E.
Chapter 44 Service Control ZyWALL USG 1000 User’s Guide 591 Admin/User Service Control Admin Service Control specifies fro m which zones an administrator can use HTTPS to manage the ZyW ALL (using the w eb configurator). Y ou can also specify the IP addresses from which the administrators ca n manage the ZyWALL.
Chapter 44 Serv ice Control ZyWALL USG 1000 U ser’s Guide 592 44.4 Service Control Rules Click Add or Edit in the Service Control table in a WWW , SSH , Te l n e t , FTP or SNMP screen to add a service control rule. Figure 429 System > Service Control Rule Edit The following table describes the labels in this screen.
Chapter 44 Service Control ZyWALL USG 1000 User’s Guide 593 44.5.1 Internet Explorer W arning Messages When you attempt to access the ZyW ALL HT TPS server , a W indows dialog box pops up asking if you trust the server certificate. Click V iew Cert ificate if you want to verify that the certificate is from the ZyW ALL.
Chapter 44 Serv ice Control ZyWALL USG 1000 U ser’s Guide 594 Figure 431 Security Certificate 1 (Net scape) Figure 432 Security Certificate 2 (Net scape) 44.
Chapter 44 Service Control ZyWALL USG 1000 User’s Guide 595 44.5.4 Login Screen After you accept the certificate, the ZyW ALL lo gin screen appears. The lock displayed in the bottom of the browser status bar denotes a secure conne ction. Figure 433 Login Screen (Internet E xplorer) 44.
Chapter 44 Serv ice Control ZyWALL USG 1000 U ser’s Guide 596 Figure 435 CA Certificate Example 2 Click Install Certificate and follow the wizard as show n earlier in this appendix. 44.5.5.2 Inst alling Y our Personal Certificat e(s) Y ou need a password in advance.
Chapter 44 Service Control ZyWALL USG 1000 User’s Guide 597 2 The file name and path of the certificate y ou double-clicked should automatically appear in the File name text box. Click Br ow se if you wish to import a different certificate. Figure 437 Personal Certificate Import Wizard 2 3 Enter the password give n to you by the CA.
Chapter 44 Serv ice Control ZyWALL USG 1000 U ser’s Guide 598 Figure 439 Personal Certificate Import Wizard 4 5 Click Finish to complete the wizard and begin the import process. Figure 440 Personal Certificate Import Wizard 5 6 Y ou should see the following screen when the ce rtificate is correctly installed on your computer .
Chapter 44 Service Control ZyWALL USG 1000 User’s Guide 599 44.5.6 Using a Certificate When Accessing the ZyW ALL Example Use the following procedure to access the ZyW ALL via HTTPS. 1 Enter ‘https://ZyW ALL IP Address/ in your browser ’ s web address field.
Chapter 44 Serv ice Control ZyWALL USG 1000 U ser’s Guide 600 44.6 SSH Y ou can use SSH (Secure SHell) to securely access the ZyW ALL’ s command line interface.
Chapter 44 Service Control ZyWALL USG 1000 User’s Guide 601 The client automatically saves any new server public keys. In subsequent connections, the server public key is checked ag ainst the saved version on the client computer .
Chapter 44 Serv ice Control ZyWALL USG 1000 U ser’s Guide 602 The following table describes the labels in this screen. 44.7 Secure T elnet Using SSH Examples This section shows two examples using a comm and interface and a graphical interface SSH client program to remotely access the ZyW ALL.
Chapter 44 Service Control ZyWALL USG 1000 User’s Guide 603 Figure 448 SSH Example 1: S tore Host Key Enter the password to log in to the Zy W ALL. The CLI screen displays next. 44.7.2 Example 2: Linux This section describes how to access the ZyW A LL using the OpenSSH client program that comes with most Linux di stributions.
Chapter 44 Serv ice Control ZyWALL USG 1000 U ser’s Guide 604 3 The CLI screen displays next. 44.8 T elnet Y ou can use T e lnet to access the ZyW A LL’ s command line interface. Specify which zones allow T elnet access and from which IP address the ac cess can come.
Chapter 44 Service Control ZyWALL USG 1000 User’s Guide 605 44.9 Configuring FTP Y ou can upload and download the ZyW ALL’ s firm ware and configuration files using FTP . T o use this feature, your computer must have an FTP client. Ple ase see Chapter 45 on page 615 for more information about firm ware and configuration files.
Chapter 44 Serv ice Control ZyWALL USG 1000 U ser’s Guide 606 44.10 SNMP Simple Network Management Protocol is a protocol used for exchanging management information between network devices. Y our ZyW ALL supports SNMP agent functionality , which allows a manager station to manage and monitor the ZyW ALL through the network.
Chapter 44 Service Control ZyWALL USG 1000 User’s Guide 607 An agent is a management software module th at resi des in a managed device (the ZyW ALL). An agent translates the local management info rmation from the managed device into a form compatible with SNMP .
Chapter 44 Serv ice Control ZyWALL USG 1000 U ser’s Guide 608 44.10.3 Configuring SN MP T o change your ZyW ALL’ s SNMP settings, click System > SNMP tab. The screen a ppears as shown. Use this screen to configure your SNMP settings, including from which zones SNMP can be used to access the ZyW ALL.
Chapter 44 Service Control ZyWALL USG 1000 User’s Guide 609 44.1 1 Dial-in Management Connect an external serial modem to the AUX port to provide a management connection in case the ZyW ALL’ s other W AN connections are do wn.
Chapter 44 Serv ice Control ZyWALL USG 1000 U ser’s Guide 610 Figure 455 System > Dial-in Mgmt The following table describes the labels in this screen.
Chapter 44 Service Control ZyWALL USG 1000 User’s Guide 61 1 44.14 Configuring V ant age CNM V ant age CNM is disabled on the device by default. Click System > V antage CNM to configure your device’ s V antage CNM settings. Figure 456 System > V antage CNM The following table describes the labels in this screen.
Chapter 44 Serv ice Control ZyWALL USG 1000 U ser’s Guide 612 HTTPS Authentication When you are using HTTP s, select this option to have the ZyWALL authenticate the V antage CNM server ’s ce rtificate. In order to do this you need to import the V antage CNM server ’s public key (certificate) into the ZyW ALL’s trusted certificates.
613 P ART VII Maintenance & T roubleshooting File Manager (615) Logs (625) Reports (637) Diagnostics (647) Reboot (649) T roubleshooting (651).
614.
ZyWALL USG 1000 User’s Guide 615 C HAPTER 45 File Manager This chapter covers how to use the ZyW ALL’ s File Manager screens to handle the ZyW ALL’ s configuration, firm ware and shell script files.
Chapter 45 File Manager ZyWALL USG 1000 U ser’s Guide 616 While configuration files and shell scripts have the same syntax, the ZyW ALL applies configuration files dif ferently than it runs shell scripts.
Chapter 45 File Manager ZyWALL USG 1000 User’s Guide 617 Lines 1 and 2 are comments. Line 5 exits sub command mode. 45.1.2 Errors in Configur ation Files or Shell Script s When you apply a configuration file or run a shell script, the ZyW ALL processes the file line- by-line.
Chapter 45 File Manager ZyWALL USG 1000 U ser’s Guide 618 Y ou can change the way the startup- config.conf file is applied. Include the setenv- startup stop-on-error off command. The ZyW ALL igno res any errors in the startup- config.conf file and applies all of the valid commands.
Chapter 45 File Manager ZyWALL USG 1000 User’s Guide 619 The following table describes the labels in this screen. T able 216 Maintenanc e > File Mana g er > Configuration File LABEL DESCRIPTION Download Click a configura tion file’s row to select it and click Download to save the configuration to your computer .
Chapter 45 File Manager ZyWALL USG 1000 U ser’s Guide 620 45.3 Firmware Package Screen Click Maintenance > File Manager > Firmware Package to open the Firmwar e Package screen. Use the Firmware Package screen to check your current firmware version and upload firmware to the ZyW A LL.
Chapter 45 File Manager ZyWALL USG 1000 User’s Guide 621 The ZyW ALL’ s firmware packag e cannot go throug h the ZyW A LL when you enable the anti- virus Destroy compr essed files that could not be decompressed option. The ZyW ALL classifies the firmware package as not being able to be decompressed and deletes it.
Chapter 45 File Manager ZyWALL USG 1000 U ser’s Guide 622 Figure 462 Firmware Uplo ad In Process The ZyW ALL automatically restarts in this tim e causing a tempora ry network disconne ct. In some operating systems, you may see the following icon on your desktop.
Chapter 45 File Manager ZyWALL USG 1000 User’s Guide 623 Figure 465 Maintenance > File Manager > Shell Scri pt Each field is described in the following table.
Chapter 45 File Manager ZyWALL USG 1000 U ser’s Guide 624 Rename Use this button to change the label of a shell script file on the ZyWALL. Y ou cannot rename a shell script to the name of another shell script in the ZyW ALL. Click a shell script’ s row to select it and click Rename to open the Rename File screen.
ZyWALL USG 1000 User’s Guide 625 C HAPTER 46 Logs This chapter provides gene ral information about the ZyW ALL’ s log feature. See Appendix B on page 663 for individual log descriptions. The following table displays the maximum number of system log messages in the ZyW ALL.
Chapter 46 Logs ZyWALL USG 1000 U ser’s Guide 626 Figure 468 Maintenance > L o g > V iew Log If an event generates log messages and alerts, it is displayed in red. Othe rwise, it is displayed in black. The following table descri bes the labels in this screen.
Chapter 46 Lo gs ZyWALL USG 1000 User’s Guide 627 The W eb configurator saves the filter settings if you leave the Vi e w L o g screen and return to it later .
Chapter 46 Logs ZyWALL USG 1000 U ser’s Guide 628 For alerts, the Log Settings tab controls which events generate alerts and where alerts are e- mailed.
Chapter 46 Lo gs ZyWALL USG 1000 User’s Guide 629 46.3.1 Log Settings Edit E-mail The Log Settings Edit screen controls the detailed settings for each log in the system log (which includes the e-mail profiles). Go to the Log Settings Summary screen (see Section 46.
Chapter 46 Logs ZyWALL USG 1000 U ser’s Guide 630 Figure 470 Maintenance > Log > Log Setting > E-mail > Edit.
Chapter 46 Lo gs ZyWALL USG 1000 User’s Guide 631 The following table describes the labels in this screen. T able 222 Maintenance > Log > Log Setting > E-mail > Edit LABEL DESCRIPTION E-Mail Server 1/2 Active Select this to send log messages and a lerts according to the information in this section.
Chapter 46 Logs ZyWALL USG 1000 U ser’s Guide 632 46.3.2 Log Settings Edit syslog The Log Settings Edit screen controls the detailed settings for each l og in the remote server (syslog). Go to the Log Settings Summary screen (see Section 46 .3 on page 628 ), and click the appropriate Edit icon.
Chapter 46 Lo gs ZyWALL USG 1000 User’s Guide 633 Figure 471 Maintenance > Log > Log Setting > Remo te Server > Edit.
Chapter 46 Logs ZyWALL USG 1000 U ser’s Guide 634 The following table describes the labels in this screen. 46.3.3 Active Log Summary The Active Lo g Summary screen allows you to v iew and to edit what information is included in the system log, e-mail profiles, and remote servers at the same time.
Chapter 46 Lo gs ZyWALL USG 1000 User’s Guide 635 Figure 472 Active Log Summary This screen provides a different view and a dif ferent way of indicating which mes sages are included in each log and each ale rt. Please see Section 46.3.1 on page 629 , where this process is discussed.
Chapter 46 Logs ZyWALL USG 1000 U ser’s Guide 636 Selection Select what information you want to log from each Log Category (except All Logs ; see below).
ZyWALL USG 1000 User’s Guide 637 C HAPTER 47 Reports This chapter provides informa tion about the report sc reens. 47.1 T raffic Screen Click Maintenance > Report > T r affic to display the T raffic screen.
Chapter 47 Repor ts ZyWALL USG 1000 U ser’s Guide 638 Figure 473 Maintenance > Report > T raffic There is a limit on the number of re cords shown in the report. Please see T able 226 on page 640 for more information. The following tabl e describes the labe ls in this screen.
Chapter 47 Reports ZyWALL USG 1000 User’s Guide 639 T raffic T ype Select the type of report to display . Choices are: Host IP Address/User - displays the IP addresses or users with the most traffic and how much traffic has been sent to and from each one.
Chapter 47 Repor ts ZyWALL USG 1000 U ser’s Guide 640 The following table disp lays the maximum number of records shown in the report, the byte count limit, and the hit count limit. 47.2 Session Screen The Session screen displays informa tion about active sessions for debugging or statistical analysis.
Chapter 47 Reports ZyWALL USG 1000 User’s Guide 641 Figure 474 Maintenance > Report > Sessio n The following table describes the labels in this screen. T able 227 Maintenanc e > Report > Session LABEL DESCRIPTION View Select how you want the information to be displayed.
Chapter 47 Repor ts ZyWALL USG 1000 U ser’s Guide 642 47.3 Anti-V irus Report Screen Click Maintenance > Report > Anti-V irus to display the following screen. This screen displays anti-virus statistics. Figure 475 Maintenance > Report > Anti-V irus: Virus Name The following table describes the labels in this screen.
Chapter 47 Reports ZyWALL USG 1000 User’s Guide 643 The statistics display as follows when yo u display the top entries by source. Figure 476 Maintenance > Report > Anti-V irus: Source The statistics display as follows when you display the top entr ies by destination.
Chapter 47 Repor ts ZyWALL USG 1000 U ser’s Guide 644 Figure 478 Maintenance > Report > IDP: Signature Name The following table describes the labels in this screen. T able 229 Maintenanc e > Report > IDP LABEL DESCRIPTI ON Collect St a t i s t i c s Select this check box to have the ZyW ALL collect IDP statistics.
Chapter 47 Reports ZyWALL USG 1000 User’s Guide 645 The statistics display as follows when yo u display the top entries by source. Figure 479 Maintenance > Report > IDP: Source The statistics display as follows when you display the top entr ies by destination.
Chapter 47 Repor ts ZyWALL USG 1000 U ser’s Guide 646.
ZyWALL USG 1000 User’s Guide 647 C HAPTER 48 Diagnostics This chapter covers how to use the Diagnostics screen. 48.1 Diagnostics The Diagnostics s creen provides an easy way for you to generate a file containing the ZyW ALL’ s configuration and di agnostic information.
Chapter 48 Diagnostics ZyWALL USG 1000 U ser’s Guide 648.
ZyWALL USG 1000 User’s Guide 649 C HAPTER 49 Reboot Use this to restart the device (for example, if th e device begins behaving erratically ). See also Section 1.
Chapter 49 Reboot ZyWALL USG 1000 U ser’s Guide 650.
ZyWALL USG 1000 User’s Guide 651 C HAPTER 50 Troubleshooting This chapter offers some suggestions to so lve problems you might encounter . V I cannot set up an IPSec VPN tunnel to another device. If the IPSec tunnel does not build properly , the pr oblem is likely a configuration error at one of the IPSec routers.
Chapter 50 Trou bleshooting ZyWALL USG 1000 U ser’s Guide 652 Routing policies define how the ZyW ALL forwards packets to the ir d estinations. Y ou must create a policy route for the ZyW ALL to rout e VPN traf fic through a VPN tunnel to the remote network.
Chapter 50 Trou bleshooting ZyWALL USG 1000 User’s Guide 653 If you want to reboot the device without changing the current configuration, see Chapter 49 on page 649 . 1 Make sure the SYS LED is on and not bli nking. 2 Press the RESET button and hold it until the SYS LED begins to blink.
Chapter 50 Trou bleshooting ZyWALL USG 1000 U ser’s Guide 654.
655 P ART VIII Appendices and Index Product Specification s (657) Common Services (703) Displaying Anti-V irus Alert Messages in W indows (707) Open Software Announcements (719) Legal Information (755.
656.
ZyWALL USG 1000 User’s Guide 657 A PPENDIX A Product S pecifications The following specificatio ns are subject to change without notice. See Chapter 2 on page 57 for a general overview of key features. This table provides basic device specifications.
Appendix A Product Specifications ZyWALL USG 1000 U ser’s Guide 658 T able 233 Feature Specifications V ERSION # FEATURE V2.00 # of MAC 5 Flash Siz e 256 DRAM Size 1024 INTERFACE VLAN 32 Virtual (al.
Appendix A Product Specifications ZyWALL USG 1000 User’s Guide 659 Service Groups 1000 Schedule Objects 512 ISP Accounts 128 Maximum Number of LDAP Gro ups 16 Maximum Number of LDAP Servers fo r Eac.
Appendix A Product Specifications ZyWALL USG 1000 U ser’s Guide 660 The following table, which is not exhaustive, lists standards referenced by ZyW ALL features.
Appendix A Product Specifications ZyWALL USG 1000 User’s Guide 661 Built-in service, SNMP agent RFCs 1067, 1 213, 2576, 2578, 2579, 2580, 2741 , 2667, 2981, 3371 Login, LDAP support.
Appendix A Product Specifications ZyWALL USG 1000 U ser’s Guide 662.
ZyWALL USG 1000 User’s Guide 663 A PPENDIX B Log Descriptions This appendix provides descripti ons of example log messages. T able 235 Content Filter Logs LOG MESSAGE DESCRIPTION Content filter has been enabled An administrator turned the content filter on.
Appendix B Log Descrip tions ZyWALL USG 1000 U ser’s Guide 664 %s: Service is unavailable Content filter rating service is te mporarily un available and access to the web site was blocked due to: 1. Can't resolve rating server IP (No DNS) 2. Invalid service license 4.
Appendix B Log Descriptions ZyWALL USG 1000 User’s Guide 665 T able 238 User Logs LOG MESSAGE DESCRIPTION %s %s has logged in from %s The specified user signed in. 1st %s: Administrator|Limited-Admin|User|Ext-User|Guest 2nd %s: username 3rd %s: service name (HTTP/HTTPS, FTP , telnet, SSH, console) NOTE field: %s means u sername.
Appendix B Log Descrip tions ZyWALL USG 1000 U ser’s Guide 666 T able 239 myZyXEL.com Logs LOG MESSAGE DESCRIPTION Send registration message to MyZyXEL.com server has failed. The device was not able to send a registration message to MyZyXEL.com. Get server response has failed.
Appendix B Log Descriptions ZyWALL USG 1000 User’s Guide 667 Service expiration check has succeeded. The servic e expiration da y check was successful. Service expiration check has failed. Because of lack must fields. The device received an incomplete response from the myZyXEL.
Appendix B Log Descrip tions ZyWALL USG 1000 U ser’s Guide 668 Update server is b usy now. File download after %d seconds. The update server was busy so the device will wait for the specified number of seconds and send the dow nload request to the update server again.
Appendix B Log Descriptions ZyWALL USG 1000 User’s Guide 669 Do expiration daily- check has failed. Because of lack must fields. The device received an incomplete response to the daily se rvice expiration check and the packets caused a parsing error for the device.
Appendix B Log Descrip tions ZyWALL USG 1000 U ser’s Guide 670 Certification verification failed: Depth: %d, Error Number(%d):%s. V e rificati on of a server ’s certificat e faile d while processing an HTTPS connection. This log identifie s the reason for the failu re.
Appendix B Log Descriptions ZyWALL USG 1000 User’s Guide 671 IDP service standard license is expired. Update signature failed. IDP service standard license is ex pired. IDP signature canno t update. IDP service standard license is not registered. Update signature failed.
Appendix B Log Descrip tions ZyWALL USG 1000 U ser’s Guide 672 IDP off-line update failed. File damaged. IDP signature off-line update faile d. Signature file maybe corrupt. IDP signature update failed. File crashed. IDP signature update failed. Decrypt signature file fail ed.
Appendix B Log Descriptions ZyWALL USG 1000 User’s Guide 673 IDP signature update failed. Invalid signature content. IDP signature update failed. Sigquery check signature content fail ed. System internal error. Create IDP traffic anomaly entry failed.
Appendix B Log Descrip tions ZyWALL USG 1000 U ser’s Guide 674 System fatal error: 60018009. Error when do ioctl L7_ACTION_IOCTL_ADDR_USAGE. System fatal error: 60018010. Error when do ioctl L7_ACTION_IOCTL_PROTO_ADDR_NUMS. System fatal error: 60018011.
Appendix B Log Descriptions ZyWALL USG 1000 User’s Guide 675 App Patrol Name=%s Type=%s %s=%d Protocol=%s Action=%s Packets logging. 1st %s: Protocol Name, 2nd %s: Category Name, 3rd %s: Default Rule or Exception Rule , 1st %d: Rule Index, 4th %s: TCP or UDP , 5th %s: Action.
Appendix B Log Descrip tions ZyWALL USG 1000 U ser’s Guide 676 [SA] : Tunnel [%s] Phase 1 authentication algorithm mismatch %s is the tunnel name. When negoti ating Phase -1, the authentication algorithm did not match. [SA] : Tunnel [%s] Phase 1 authentication method mismatch %s is the tunnel name.
Appendix B Log Descriptions ZyWALL USG 1000 User’s Guide 677 Cannot resolve My IP Addr %s for Tunnel [%s] 1st %s is my ip address. 2nd %s is the tunnel name. When selecting a matched proposal in phase-1, the engin e could not get My-IP address. Cannot resolve Secure Gateway Addr %s for Tunnel [%s] 1st %s is my ip address.
Appendix B Log Descrip tions ZyWALL USG 1000 U ser’s Guide 678 The cookie pair is : 0x%08x%08x / 0x%08x%08x Indicates the initiator/ responder cookie pair . The IPSec tunnel "%s" is already established %s is the tunnel name. When diali ng a tunnel, the tunnel is already dialed.
Appendix B Log Descriptions ZyWALL USG 1000 User’s Guide 679 Tunnel [%s:%s] Sending IKE request The variables represent the phase 1 name and tunnel name. The device sent an IKE request. Tunnel [%s:0x%x] is disconnected The variables represent the tun nel name and the SPI of a tunnel that was disconnected.
Appendix B Log Descrip tions ZyWALL USG 1000 U ser’s Guide 680 T able 244 Firewall Logs LOG MESSAGE DESCRIPTION priority:%lu, from %s to %s, service %s, %s 1st variable is the global index of rule, 2nd is the from zone, 3rd is the to zone, 4th is the service name, 5th i s ACCEPT/DROP/ REJECT .
Appendix B Log Descriptions ZyWALL USG 1000 User’s Guide 681 Cannot get handle from UAM, user-aware PR is disabled User-aware policy routing is disabled due to some reason. mblock: allocate memory failed! Allocating policy routing rule fails: insufficient memory .
Appendix B Log Descrip tions ZyWALL USG 1000 U ser’s Guide 682 T able 247 Built-in Services Logs LOG MESSAGE DESCRIPTION User on %u.%u.%u.%u has been denied access from %s HTTP/HTTPS/TELNET/SSH/FT P/SNMP access to the device was denied. %u.%u.%u.%u is IP address %s is HTTP/HTTPS/SSH/SNMP/FTP/TELNET HTTPS certificate:%s does not exist.
Appendix B Log Descriptions ZyWALL USG 1000 User’s Guide 683 Console baud has b een changed to %s. An administrator changed the console port baud rate. %s is baud rate assigned by user Console baud has b een reset to %d. An administrator changed the console port baud rate back to the default (1 15200).
Appendix B Log Descrip tions ZyWALL USG 1000 U ser’s Guide 684 The default record of Zone Forwarder have reached the maximum number of 128 DNS servers. The default record DNS servers is more than 128. Interface %s ping check is successful. Zone Forwarder adds DNS servers in records.
Appendix B Log Descriptions ZyWALL USG 1000 User’s Guide 685 Access control rule %d of %s was moved to %d. An access control rule was moved successfully . 1st %d is the previous index . %s is HTTP/HTTPS/SSH/SNMP/FTP/TELNET . 2nd %d is current previous index.
Appendix B Log Descrip tions ZyWALL USG 1000 U ser’s Guide 686 Receive an ARP response from an unknown client The device received an ARP response from an unknown client. In total, received %d arp response packets for the requested IP address The device received the specified total number of ARP response packets for th e requested IP address.
Appendix B Log Descriptions ZyWALL USG 1000 User’s Guide 687 Update the profile %s has failed because the FQDN %s is not under your control. The owner of this FQDN is not the user , 1s t %s is the profile name, 2nd %s is the FQDN of the profile. Update the profile %s has failed because the FQDN %s was blocked for abuse.
Appendix B Log Descrip tions ZyWALL USG 1000 U ser’s Guide 688 Update the profile %s has failed because Custom IP was empty. The DDNS profile' s IP select type i s custom, and a custo m IP was not defined, %s is the profile name. Update the profile %s has failed because WAN interface was empty.
Appendix B Log Descriptions ZyWALL USG 1000 User’s Guide 689 DDNS has been enabled by Device-HA. DDNS is enabled by Device-HA, because one of VRRP groups is active. Disable DDNS has succeeded. Disable DDNS. Enable DDNS has succeeded. Enable DDNS. DDNS profile %s has been renamed as %s.
Appendix B Log Descrip tions ZyWALL USG 1000 U ser’s Guide 690 Can't get remote address of %s interface The connectivity check process can't get remote address of PPP interface %s: interface name Can't get NETMASK address of %s interface The connectivity check p rocess can't get netmask address of i nterface.
Appendix B Log Descriptions ZyWALL USG 1000 User’s Guide 691 Master configuration is the same with Backup. Skip updating it. The System S tartup config u ration file synchronized from the Master is the same with the one in the Back up, so the configuration does not have to be updated.
Appendix B Log Descrip tions ZyWALL USG 1000 U ser’s Guide 692 Device HA authentication type for VRRP group %s maybe wrong. A VRRP group’s Authentication T ype (Md5 or IPSec AH) configuration may not match between the Backup and the Master . %s: The name of the VRRP group.
Appendix B Log Descriptions ZyWALL USG 1000 User’s Guide 693 T able 251 Routing Protocol Logs LOG MESSAGE DESCRIPTION RIP on interface %s has been stopped because Device-HA binds this interface. Device-HA is currently running on t he interface %s, so all the local service have to be stopped including RIP .
Appendix B Log Descrip tions ZyWALL USG 1000 U ser’s Guide 694 RIP md5 authentication id and key have been deleted. RIP md5 authentication id and key have been del eted. RIP global version has been deleted. RIP global version has been deleted. RIP redistribute OSPF routes has been disabled.
Appendix B Log Descriptions ZyWALL USG 1000 User’s Guide 695 Invalid OSPF virtual- link %s authentication of area %s. Virtual-link %s authentication has been set to same-as-area but the area has invalid authenticatio n co nfigurati on. %s: Virtual-Link ID Invalid OSPF md5 authentication on interface %s.
Appendix B Log Descrip tions ZyWALL USG 1000 U ser’s Guide 696 Register H.323 ALG extra port=%d failed. H323 ALG apply additional signal port failed . %d: Port number Register H.323 ALG signal port=%d failed. H323 ALG apply signal port failed. %d: Port number Register FTP ALG extra port=%d failed.
Appendix B Log Descriptions ZyWALL USG 1000 User’s Guide 697 Import X509 certificate "%s" into My Certificate successfully The device imp orted a x509 format certificat e into My Certificates.
Appendix B Log Descrip tions ZyWALL USG 1000 U ser’s Guide 698 Export X509 certificate "%s" from "My Certificate" failed The device was not able to export a x509 format certificate from My Certificates. %s is the certificate request name.
Appendix B Log Descriptions ZyWALL USG 1000 User’s Guide 699 27 Path was not verified. 28 Maximum path length reached. T able 254 Interface Logs LOG MESSAGE DESCRIPTION Interface %s has b een deleted. An administrator deleted an interfac e. %s i s the interface name.
Appendix B Log Descrip tions ZyWALL USG 1000 U ser’s Guide 700 %s MTU > (%s MTU - 8), %s may not work correctly. An administrator configured a PPP interface, PPP interface MTU > (base interfac.
Appendix B Log Descriptions ZyWALL USG 1000 User’s Guide 701 Interface %s is disconnected. A PPP or AUX interface disconnected successf ully . %s: interface name. Interface %s connect failed: Peer not responding. The interface’s connection will be te rmi nated because the server did not send any LCP packet s.
Appendix B Log Descrip tions ZyWALL USG 1000 U ser’s Guide 702 T able 257 Force Authentication Logs LOG MESSAGE DESCRIPTION Force User Authentication will be enabled due to http server is enabled. Force user authentication will be tu rn ed on because HTTP server was turned on.
ZyWALL USG 1000 User’s Guide 703 A PPENDIX C Common Services The following table l ists some commonly-used se rvices and their associated protocols and port numbers. For a comprehensive list of port numbers, ICMP type/code numbers and services, visit the IANA (Internet Assigned Number Authority) web site.
Appendix C Common Services ZyWALL USG 1000 U ser’s Guide 704 FTP TCP TCP 20 21 File T ra nsfer Program, a program to enable fast transfe r of files, i ncluding large files that may not be possible by e-mail. H.323 TCP 1720 NetMeeting uses this protoco l.
Appendix C Common Services ZyWALL USG 1000 User’s Guide 705 RTS P TCP/UDP 554 The Real Time S treaming (media contro l) Protocol (R TSP) is a remote control for multimedia on the Internet. SFTP TCP 11 5 Simple File Transfer Protocol. SMTP TCP 25 Simple Mail Transfer Protocol is the message-exchange standard for the Internet.
Appendix C Common Services ZyWALL USG 1000 U ser’s Guide 706.
ZyWALL USG 1000 User’s Guide 707 A PPENDIX D Displaying Anti-V irus Alert Messages in Windows W ith the anti-virus packet scan , when a virus is detected, you can have the ZyW ALL display an alert message on Misc rosoft W indows-based compute rs.
Appendix D Dis playing Anti-Virus Alert Messages in Windows ZyWALL USG 1000 U ser’s Guide 708 Figure 484 Windows XP: S tarting the Messenger Service 3 Close the window when you are done. Windows 2000 1 Click S tart > Settings > Control Panel > Administrative T ools > Services .
Appendix D Displaying Anti-Virus Alert Messages in Windows ZyWALL USG 1000 User’s Guide 709 Figure 486 Windows 2000: S tarting the Me ssenger Service 3 Close the window when you are done. Windows 98 SE/Me For W indows 98 SE/Me, you must open the W inPopup window in order to view real-time alert messages.
Appendix D Dis playing Anti-Virus Alert Messages in Windows ZyWALL USG 1000 U ser’s Guide 710 Figure 489 Windows 98 SE: T ask Bar Propertie s 3 Double-click Programs and click St a r t U p . 4 Right-click in the St a r t U p pane and click New , Shortcut .
Appendix D Displaying Anti-Virus Alert Messages in Windows ZyWALL USG 1000 User’s Guide 71 1 Figure 491 Windows 98 SE: S tartup: Create Shortcut 6 Specify a name for the shortcut or accept the default and click Finish . Figure 492 Windows 98 SE: S tartup: Select a T itle for the Program 7 A shortcut is created in the St a r t U p pane.
Appendix D Dis playing Anti-Virus Alert Messages in Windows ZyWALL USG 1000 U ser’s Guide 712 Figure 493 Windows 98 SE: S tartup: Shortcut " The WinPopup window displays after t he computer finishes the st artup process (see Figure 487 on page 709 ).
ZyWALL USG 1000 User’s Guide 713 A PPENDIX E Importing Certificates This appendix shows importing certificates ex amples using Netscape Na vigator and Internet Explorer 5. This appe ndix uses the ZyW ALL 70 as an example. Other models should be similiar .
Appendix E Importin g Certificates ZyWALL USG 1000 U ser’s Guide 714 Figure 495 Login Screen 2 Click Install Certificate to open the Install Certificate wizard. Figure 496 Certificate General Information befor e Import 3 Click Next to begin the Install Certificate wizard.
Appendix E Importi ng Certificates ZyWALL USG 1000 User’s Guide 715 Figure 497 Certificate Import Wizard 1 4 Select where you would like to store the certificate and then click Next . Figure 498 Certificate Import Wizard 2 5 Click Finish to complete the Import Certificate wizard.
Appendix E Importin g Certificates ZyWALL USG 1000 U ser’s Guide 716 Figure 499 Certificate Import Wizard 3 6 Click Ye s to add the ZyW ALL certifi cate to the root store.
Appendix E Importi ng Certificates ZyWALL USG 1000 User’s Guide 717 Figure 501 Certificate General Information af ter Import.
Appendix E Importin g Certificates ZyWALL USG 1000 U ser’s Guide 718.
ZyWALL USG 1000 User’s Guide 719 A PPENDIX F Open Sof tware Announcement s Notice Information herein is subject to change withou t notice. Companies, name s, and data used in examples herein are fictitious unless otherwise noted.
Appendix F Op en Software An nouncement s ZyWALL USG 1000 U ser’s Guide 720 " This Product includes Netkit T elnet -0 .17 software under the Netkit T elnet License Netkit T elnet License Copyright (c) 1989 Regents of th e University of California.
Appendix F Open Software Anno uncements ZyWALL USG 1000 User’s Guide 721 " This Product includes expat-1.95.6 sof tware under the Expat License Exp at License Copyright (c) 1998, 1999, 2000 Tha.
Appendix F Op en Software An nouncement s ZyWALL USG 1000 U ser’s Guide 722 " This Product includes openssl-0.9. 8d-ocf software under the OpenSSL License OpenSSL The OpenSSL toolkit stays unde r a dual license, i.e. both the conditions of the OpenSSL License and the original SSLeay license apply to the toolkit.
Appendix F Open Software Anno uncements ZyWALL USG 1000 User’s Guide 723 OTHER WISE) ARISING IN ANY W A Y OUT OF THE USE OF THIS SOFTW ARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. This product includes cryptographic software written by Eric Y oung (eay@cryptsoft.
Appendix F Op en Software An nouncement s ZyWALL USG 1000 U ser’s Guide 724 " This Product includes libevent-1.1a an d xinetd-2.3.14 soft ware under the a 3- clause BSD License a 3-clause BS D-.
Appendix F Open Software Anno uncements ZyWALL USG 1000 User’s Guide 725 The ISC license for bind is: Copyright (c) 1993 -1999 by In ternet Software Consortium.
Appendix F Op en Software An nouncement s ZyWALL USG 1000 U ser’s Guide 726 Ap ache License V ersion 2.0, January 2004 http://www .apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIB UTION 1.
Appendix F Open Software Anno uncements ZyWALL USG 1000 User’s Guide 727 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to Y ou a .
Appendix F Op en Software An nouncement s ZyWALL USG 1000 U ser’s Guide 728 6. T rademarks. This License does not grant perm ission to use the trade names, trademarks, service marks, or product name.
Appendix F Open Software Anno uncements ZyWALL USG 1000 User’s Guide 729 Products derived from this softwa re may not be called "Apache", nor may "Apache" appear in their name, without prior wr itten permission of the Apache Software Foundatio n.
Appendix F Op en Software An nouncement s ZyWALL USG 1000 U ser’s Guide 730 This license, the Lesser General Public License, applies to some specially designated software packages--typically libraries--of the Free Soft ware Found a tion and other aut hors who decide to use it.
Appendix F Open Software Anno uncements ZyWALL USG 1000 User’s Guide 731 For example, on rare occasions, there may be a special need to encourage the widest possible use of a certain library , so that it becomes a de-facto standard. T o achieve this, non-free programs must be allowed to use the library .
Appendix F Op en Software An nouncement s ZyWALL USG 1000 U ser’s Guide 732 2. Y ou may modify you r copy or copies of the Library or any portio n of it, thus forming a work based on the Libra ry , .
Appendix F Open Software Anno uncements ZyWALL USG 1000 User’s Guide 733 However , linking a "work that uses the Library" with the Library creates an executable that is a derivative of the Library (because it contains portions of the Library), rather than a "work that uses the library".
Appendix F Op en Software An nouncement s ZyWALL USG 1000 U ser’s Guide 734 It may happen that this requirement co ntradicts the license restrictions of other proprietary libraries that do not normally accompany the operating system .
Appendix F Open Software Anno uncements ZyWALL USG 1000 User’s Guide 735 12. If the distribution and/or use of the Librar y is restricted in certain countries either by patents or by copyrighted int.
Appendix F Op en Software An nouncement s ZyWALL USG 1000 U ser’s Guide 736 " This Product includes bridge-utils, dhcpc d-1.3.22-pl4, rp-pppoe-3.5, vlan-1.8, keepalived-1.1.1 1-p1, quag ga-0.99.2, ez-ipupdate-3.0. 1 1b7, proftpd-1.2.10, libol-0.
Appendix F Open Software Anno uncements ZyWALL USG 1000 User’s Guide 737 TERMS AND CONDITIONS FOR COPYING , DISTRIBUTION AND MODIFICA TION 0. This License ap plies to any program or othe r work which contains a notice pla ced by the copyright holder saying it may be distributed under the terms of this Ge neral Public License.
Appendix F Op en Software An nouncement s ZyWALL USG 1000 U ser’s Guide 738 right to control the distribution of derivative or colle ctive works based on the Program.
Appendix F Open Software Anno uncements ZyWALL USG 1000 User’s Guide 739 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to pate.
Appendix F Op en Software An nouncement s ZyWALL USG 1000 U ser’s Guide 740 FITNESS FOR A P AR TICULAR PURPOSE. THE ENTIRE RISK AS T O THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSAR Y SER VICING , REP AIR OR CORRECTION.
Appendix F Open Software Anno uncements ZyWALL USG 1000 User’s Guide 741 AND ON ANY THEOR Y OF LIABILITY , WHETHER IN CONTRAC T , STRICT LIABILITY , OR TOR T (INCLUDING NEGLIGENCE OR OTHER WISE) ARISIN G IN ANY W A Y OUT OF THE USE OF THIS SOFTW ARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Appendix F Op en Software An nouncement s ZyWALL USG 1000 U ser’s Guide 742 THIS SOFTW ARE IS PROVIDED BY THE OPENLDAP FOUNDA TION AN D ITS CONTRIBUTORS ``AS IS'' AND ANY EXPRESSED OR IMPLIED W ARRANTIES, INCLUDING , BUT NOT LIMITED T O, THE IMPLIED W ARRANTIES OF MERCHANT ABILITY AND FITNESS FOR A P AR TICULAR PURPOSE ARE DISCLAIMED.
Appendix F Open Software Anno uncements ZyWALL USG 1000 User’s Guide 743 2.1 GUBUSOFT hereby grants Customer the following non-exclusive, n on-transferable right to use the SOFTW ARE. 2.1.3 LIMIT A TIONS Customer may not rent, lease, or transfer the rights to the SOFTW ARE to someone else.
Appendix F Op en Software An nouncement s ZyWALL USG 1000 U ser’s Guide 744 Defensive Suspension. If Customer commences or participates in any legal proceeding against GUBUSOFT , then GUBUSOFT may ,.
Appendix F Open Software Anno uncements ZyWALL USG 1000 User’s Guide 745 " This Product includes over LIB software under the ov erLIB License (Artistic) License (Artistic) Preamble The intent o.
Appendix F Op en Software An nouncement s ZyWALL USG 1000 U ser’s Guide 746 make other distribution arrangements with the Copyright Holder . Y ou may distribute the programs of this Package in objec.
Appendix F Open Software Anno uncements ZyWALL USG 1000 User’s Guide 747 BY EXERCISING ANY RIGHTS TO THE WORK PROVIDED HERE, YOU ACCEP T AND AGREE TO BE BOUND BY THE TERMS OF THIS LICENSE. THE LICENSOR GRANTS YOU THE RIGHTS CONT AINED HERE IN CONSIDERA TION OF YOUR ACCEP T ANCE OF SUCH TERMS AND CONDITIONS.
Appendix F Op en Software An nouncement s ZyWALL USG 1000 U ser’s Guide 748 ii.Mechanical Ri ghts and Statuto ry Royalties. Li censor waives the exclusive right to collect, whether individually or via a m usic rights ag ency or designated agent (e.g.
Appendix F Open Software Anno uncements ZyWALL USG 1000 User’s Guide 749 5. Representations, W arranties and Disclaimer UNLESS OTHER WISE MUTUALL Y AGREED TO BY THE P AR TIES IN WRITING , LICENSOR O.
Appendix F Op en Software An nouncement s ZyWALL USG 1000 U ser’s Guide 750 e.This License constitutes the en tire agreement between the parti es with respect to the W ork licensed here. There are no under standings, agreements or repr esentations with respect to the W ork not specified here.
Appendix F Open Software Anno uncements ZyWALL USG 1000 User’s Guide 751 Y ou have no ownership rights in the Sof tware. Rather , you have a license to use the Software as long as this License Agre ement remains in fu ll force and effect.
Appendix F Op en Software An nouncement s ZyWALL USG 1000 U ser’s Guide 752 THE W AIVER OR EXCLUSION OF IMPLIED W A RRANTIES SO THEY MA Y NOT APPL Y TO YOU.
Appendix F Open Software Anno uncements ZyWALL USG 1000 User’s Guide 753 This License Agreement is eff ective until it is terminated. Y ou may terminate this License Agreement at any time by destro ying or returning to ZyXEL all copies of the Software and Documentation in your possession or under your control.
Appendix F Op en Software An nouncement s ZyWALL USG 1000 U ser’s Guide 754.
ZyWALL USG 1000 User’s Guide 755 A PPENDIX G Legal Information Copyright Copyright © 2007 by ZyXEL Communications Corporation. The contents of this publication may not be reprod uced in any part or.
Appendix G Legal Information ZyWALL USG 1000 U ser’s Guide 756 FCC W arning This device has been tested and foun d to comply with the limits for a Class A digital switch, pursuant to Part 15 of the FCC Rules. Thes e limits are designed to provide reasonable protection against harmful interference in a co mmercial environment.
Appendix G Legal Information ZyWALL USG 1000 User’s Guide 757 Note Repair or replacement, as provided under this warranty , is the exclusive remedy of the purchaser . This warranty is in lieu of all other warranties, express or implied, including any implied warranty of merchantability or fitness fo r a particular use or purpose.
Appendix G Legal Information ZyWALL USG 1000 U ser’s Guide 758.
ZyWALL USG 1000 User’s Guide 759 A PPENDIX H Customer Support Please have the following information r eady when you contact customer support. Required Information • Product model and serial number . • W arranty Information. • Date that you received your de vice.
Appendix H Custo mer Support ZyWALL USG 1000 U ser’s Guide 760 • Re g u la r M ai l : ZyXEL Communications, Czech s.r .o., Modranská 621, 143 01 Praha 4 - Modrany , Ceská Republika Denmark • Support E-mail: support@zyxel.dk • Sales E-mail: sales@zyxel.
Appendix H Customer Support ZyWALL USG 1000 User’s Guide 761 India • Support E-mail: support@zyxel.in • Sales E-mail: sales@zyxel.in • T elephone: +91-1 1-30888144 to +91-1 1-30888153 • Fax: +91-1 1-30888149, +91-1 1-26810715 • W eb: http://www .
Appendix H Custo mer Support ZyWALL USG 1000 U ser’s Guide 762 • Regular Mail: ZyXEL Communications Inc., 1 130 N. Miller St., Anaheim, CA 92806- 2001, U.S.A. Norway • Support E-mail: support@zyxel.no • Sales E-mail: sales@zyxel.no • T elephone: +47-22-80-61-80 • Fax: +47-22-80-61-81 • W eb: www .
Appendix H Customer Support ZyWALL USG 1000 User’s Guide 763 Sweden • Support E-mail: support@zyxel.se • Sales E-mail: sales@zyxel.se • T elephone: +46-31-744-7700 • Fax: +46-31-744-77 0 1 • W eb: www .
Appendix H Custo mer Support ZyWALL USG 1000 U ser’s Guide 764.
Index ZyWALL USG 1000 User’s Guide 765 Index Numerics 3DES 308 A AAA servers 531 and authentication me thods 541 and users 504 LDAP Default 533 LDAP Group 534 LDAP group members 536 RADIUS default 537 RADIUS group 538 RADIUS group members 539 RADIUS.
Index ZyWALL USG 1000 U ser’s Guide 766 and virtual servers 268 FTP 265 H.323 265 , 266 peer-to-peer calls 268 RTP 266 See also V oIP pass through. 265 SIP 265 , 267 SIP timeout 268 answer rings 610.
Index ZyWALL USG 1000 User’s Guide 767 and policy routes 232 behavior 382 configured rate effect 383 examples 384 in application patrol 380 interface, outbound. See interfaces. interface’s bandwidth 385 maximize bandwidth usage 227 , 232 , 382 , 383 , 384 , 395 , 39 9 OSI level-7.
Index ZyWALL USG 1000 U ser’s Guide 768 SSL 326 console port 55 speed 579 content (pattern) 439 content filtering 463 , 464 and address groups 463 , 464 , 467 and address objects 463 , 46 4 , 467 an.
Index ZyWALL USG 1000 User’s Guide 769 and interfaces 183 Domain Name System. See DNS. double-encoding 457 DTR 609 Dynamic Domain Name System. See DDNS.
Index ZyWALL USG 1000 U ser’s Guide 770 and address objects 513 and schedules 513 prerequisites 123 fragmentation flag 437 fragmentation offset 437 FTP 605 additional signaling port 270 and address .
Index ZyWALL USG 1000 User’s Guide 771 IDP 418 Snort signatures 443 statistics 643 traffic directions 418 updating signatures 173 verifying custom signatures 442 IDP (Intrusion, Detection an d Preve.
Index ZyWALL USG 1000 U ser’s Guide 772 IP st atic routes. See st atic routes. IP stream identifier 434 IP v4 packet headers 433 IPSec 291 basic troubleshooting 297 connections 296 Default_L2TP_VPN_.
Index ZyWALL USG 1000 User’s Guide 773 types of 625 log optio ns 409 log option s (IDP) 426 logged in us ers 163 login default settings 657 SSL user 332 logo 328 logout SSL user 335 logs and firewal.
Index ZyWALL USG 1000 U ser’s Guide 774 and RIP 239 and static routes 239 and to-ZyW AL L firewall 238 area 0 239 areas. See OSPF areas. authentication method 185 autonomous system (AS) 237 backbone 239 Configuration steps 240 direction 185 link cost 185 priority 185 redistribute 239 redistribute type (cost) 242 routers.
Index ZyWALL USG 1000 User’s Guide 775 as VPN 21 1 product registration 757 profiles ADP 448 packet inspection 424 protocol usage statistics 400 protocol anomaly 448 , 457 protocol anomaly dete ction 457 proxy servers 261 web. See web proxy servers.
Index ZyWALL USG 1000 U ser’s Guide 776 and authentication algo rithms 236 and Ethernet interfaces 185 RTP 266 See also ALG . 266 S safety warnings 7 same IP 438 scanner types 404 schedules 527 and .
Index ZyWALL USG 1000 User’s Guide 777 SSH 600 and address groups 602 and address objects 602 and certificates 602 and zones 602 client requirements 601 encryption methods 601 for secure T elnet 602.
Index ZyWALL USG 1000 U ser’s Guide 778 T T/TCP 458 task bar properties 710 TCP 521 ACK (acknowledgment) 453 ACK number 438 connections 521 port numbers 521 SYN (synchronize) 453 window size 438 TCP.
Index ZyWALL USG 1000 User’s Guide 779 and content filtering 463 and firewall 287 and policy routes 230 , 392 , 394 , 396 , 398 configuration overview 122 user names rules 508 user portal See SSL user screens. 331 , 334 user portal links 567 user portal logo 328 user sessions.
Index ZyWALL USG 1000 U ser’s Guide 780 advantages 318 and IPSec SA policy enforcement 320 disadvantages 318 VPN connections and address objects 296 and policy routes 230 , 231 , 296 VPN gateways and certificates 296 and extended a uthentication 296 and interfaces 296 and to-ZyW AL L firewall 297 VPN.
Un point important après l'achat de l'appareil (ou même avant l'achat) est de lire le manuel d'utilisation. Nous devons le faire pour quelques raisons simples:
Si vous n'avez pas encore acheté ZyXEL Communications Unified Security Gateway ZyWALL 1000 c'est un bon moment pour vous familiariser avec les données de base sur le produit. Consulter d'abord les pages initiales du manuel d'utilisation, que vous trouverez ci-dessus. Vous devriez y trouver les données techniques les plus importants du ZyXEL Communications Unified Security Gateway ZyWALL 1000 - de cette manière, vous pouvez vérifier si l'équipement répond à vos besoins. Explorant les pages suivantes du manuel d'utilisation ZyXEL Communications Unified Security Gateway ZyWALL 1000, vous apprendrez toutes les caractéristiques du produit et des informations sur son fonctionnement. Les informations sur le ZyXEL Communications Unified Security Gateway ZyWALL 1000 va certainement vous aider à prendre une décision concernant l'achat.
Dans une situation où vous avez déjà le ZyXEL Communications Unified Security Gateway ZyWALL 1000, mais vous avez pas encore lu le manuel d'utilisation, vous devez le faire pour les raisons décrites ci-dessus,. Vous saurez alors si vous avez correctement utilisé les fonctions disponibles, et si vous avez commis des erreurs qui peuvent réduire la durée de vie du ZyXEL Communications Unified Security Gateway ZyWALL 1000.
Cependant, l'un des rôles les plus importants pour l'utilisateur joués par les manuels d'utilisateur est d'aider à résoudre les problèmes concernant le ZyXEL Communications Unified Security Gateway ZyWALL 1000. Presque toujours, vous y trouverez Troubleshooting, soit les pannes et les défaillances les plus fréquentes de l'apparei ZyXEL Communications Unified Security Gateway ZyWALL 1000 ainsi que les instructions sur la façon de les résoudre. Même si vous ne parvenez pas à résoudre le problème, le manuel d‘utilisation va vous montrer le chemin d'une nouvelle procédure – le contact avec le centre de service à la clientèle ou le service le plus proche.
