Manuale d’uso / di manutenzione del prodotto 91-009-073003B del fabbricante ZyXEL Communications
Vai alla pagina of 944
www .zyxel.com www .zyxel.com ZyW ALL USG 50 Unified Security Gateway Copyright © 2010 ZyXEL Communications Corporation V ersion 2.21 Edition 2, 11/2010 Default Login Details LAN P ort P3, P4 IP Address https://192.
.
About This User's Guide ZyWALL USG 50 User’s Guide 3 About This User's Guide Intended Audience This manual is intended for people who want to want to configure the Z yW AL L using the W eb Configur ator . How T o Use This Guide •R e a d Chapter 1 on page 31 chapter for an overview of features av ailable on the Z yW ALL.
About This User's Guide ZyWALL USG 50 User’s Guide 4 • W eb Configurator On line H elp Click the help icon in an y screen for help in configuring that screen and supplementary information. • Z yXEL W eb Site Please refer to www .zyxel.com for additional support documentation and product certifications.
About This User's Guide ZyWALL USG 50 User’s Guide 5 •F o r u m This contains discussi ons on Z yXEL prod ucts. Learn from others who use ZyXEL products and share y our experiences as well. Customer Support Should problems arise that cannot be solved by the methods listed above, you shou ld con t act yo u r vend or .
Document Conventions ZyWALL USG 50 User’s Guide 6 Document Conventions W arnings and Notes These are how warnings and notes are shown in this User’ s Guide.
Document Conventions ZyWALL USG 50 User’s Guide 7 Icons Used in Figures Figures in this User’s Guide may use the following generic icons. The Z yW ALL icon is not an exact representation of your device.
Safety Warnings ZyWALL USG 50 User’s Guide 8 Safety Warnings • Do NO T use this product near water , for exam ple, in a wet basement or n ear a swimming pool. • Do NO T expose your device to dampness, dust or corrosive liquids. • Do NO T store things on the device.
Contents Overview ZyWALL USG 50 User’s Guide 9 Contents Overview User ’ s Guide ................................................... ..................................................... .......... ......... 29 Introducing the ZyWALL . ............
Contents Overview ZyWALL USG 50 User’s Guide 10 Addresses ....... .................... ................... ................... .................... ................... ............. ........... 599 Services .......... ............. ................ .
Table of Contents ZyWALL USG 50 User’s Guide 11 Table of Contents About This User's Guide ........................................... ..................................................... .......... 3 Document Conventions.......................
Table of Contents ZyWALL USG 50 User’s Guide 12 3.3.3 Main Window ... .... ... ............. ... ... ... .... ... ............. ... ... .... ... ... ............. ... ... .... ... ... ............ .5 2 3.3.4 T ables and List s ..... ... ... .... ...
Table of Contents ZyWALL USG 50 User’s Guide 13 6.4 Packet Flow ........... ............. ... .... ... ... ... ... ............. .... ... ... ... .... ............ .... ... ... ... .... ......... .......... 91 6.4.1 Routing T able Checking Flow . ..
Table of Contents ZyWALL USG 50 User’s Guide 14 7.3 How to Configure Load Balancing ......... ................. ................ ................ ................ ............ 1 15 7.3.1 Set Up Available Bandwidth on Ethernet Interfaces ..... ......
Table of Contents ZyWALL USG 50 User’s Guide 15 8.1 Overview ... ... .... ... ... ... ............. .... ... ... ... ... ............. .... ... ... ... .... ... ............. ... ... ... .... ... .... .......... 157 8.1.1 What Y ou Can Do in this Chapter .
Table of Contents ZyWALL USG 50 User’s Guide 16 10.1.1 What Y o u Can Do in this Chapter ..... .......... ................ ............. ................ ............. . 209 10.1.2 What you Need to Know ......... .......... ...... ............. ....
Table of Contents ZyWALL USG 50 User’s Guide 17 13.2.1 Policy Route Edit Screen ..... ................ ............. ............. ................ ............. ........... 287 13.3 IP S tatic Route Screen ........ ................ ................
Table of Contents ZyWALL USG 50 User’s Guide 18 18.1 Overview ........... ................ ............. ................ ................ ............. ................ ............ ......... 331 18.1.1 What Y o u Can Do in this Chapter ..... .....
Table of Contents ZyWALL USG 50 User’s Guide 19 22.3 The Session Limit Screen ........... ............. ............. ............. ................ ............. ................ . 3 70 22.3.1 The Session Limit Add/Ed it Screen ... ................
Table of Contents ZyWALL USG 50 User’s Guide 20 27.1 The ZyWALL SecuExtender Icon .. ............. ............. ................ ............. ................ ........... 433 27.2 S tatistics .............. ............. ................ .........
Table of Contents ZyWALL USG 50 User’s Guide 21 30.4 The Profile Summary Screen .................. ... .......... ............. ................ ............. ................ . 485 30.5 Creating New Profiles .............. ............ ............
Table of Contents ZyWALL USG 50 User’s Guide 22 32.4 Content Filter Profile Screen ........... ................ ................. ................ ................ .............. 5 40 32.5 Content Filter Categories Screen ....... .......... ........
Table of Contents ZyWALL USG 50 User’s Guide 23 36.1.1 What Y o u Can Do in this Chapter ..... .......... ................ ............. ................ ............. . 599 36.1.2 What Y ou Need T o Know ............... ............. ..............
Table of Contents ZyWALL USG 50 User’s Guide 24 40.1.2 Before Y ou Begin ....... .... ............ ................. ............. ................ ............. ............ ..... 627 40.1.3 Example: Selecting a VPN Authentic ation Method ..... ...
Table of Contents ZyWALL USG 50 User’s Guide 25 Chapter 45 System .................................................................................. ....................................... .......... 675 45.1 Overview ........... ................ ..
Table of Contents ZyWALL USG 50 User’s Guide 26 45.1 1.1 Configuring V antage CNM ............ ... ... ... .... ... ............. ... ... ... .... ... ... ... .... ... ... ........... 720 45.12 Language Screen ................. ............ ........
Table of Contents ZyWALL USG 50 User’s Guide 27 Chapter 51 T roubleshooting ......................................................... ....................................................... .... 759 51.1 Resetting the ZyWALL ............. ..........
Table of Contents ZyWALL USG 50 User’s Guide 28.
29 P ART I User ’ s Guide.
30.
ZyWALL USG 50 User’s Guide 31 C HAPTER 1 Introducing the ZyWALL This chapter gives an overview of t he Z yWALL. It explains the front panel ports, LEDs, introduces the manage ment methods, and lists di fferent w ays to start or stop the Z yWALL. 1.1 Overview and Key Default Settings The Z yWALL is a comprehensive security device.
Chapter 1 Introducing the ZyWALL ZyWALL USG 50 User’s Guide 32 1.2 Rack-mounted Inst allation The Z yWALL can be mounted on an EIA stan dard size, 19-inch r ack or in a wiring closet with other equipment. Follow th e steps below to mount your ZyW ALL on a standard EIA rac k using a r ack -mounting kit.
Chapter 1 Introducin g the ZyWALL ZyWALL USG 50 User’s Guide 33 3 After attaching both mounting br ackets, posi tion the ZyWALL in the r ack by lining up the holes in the br ackets with the a ppropriate hol es on the r ack. Secure the Z yWALL to the rack with the rack -mounting screws.
Chapter 1 Introducing the ZyWALL ZyWALL USG 50 User’s Guide 34 1.4 Management Overview Y ou can use the follow ing ways to manage the Z yWALL. Web Configurator The W eb Configurator allows easy Z yWALL setup and management usi ng an Internet browser .
Chapter 1 Introducin g the ZyWALL ZyWALL USG 50 User’s Guide 35 Console Port Y ou can use the console port to manage the ZyW ALL usin g CLI comman ds. See the Command Reference Guide for more information about the CLI. The default settings for the console port are as follows.
Chapter 1 Introducing the ZyWALL ZyWALL USG 50 User’s Guide 36 The Z yWALL does not stop or start the system processes when y ou apply configuration fi les or run shel l scripts al though you may temporarily lose access t o network resources.
ZyWALL USG 50 User’s Guide 37 C HAPTER 2 Features and Applications This chapter introduces the main features and applications of the Z yWALL. 2.1 Features The Z yWALL ’s security features include VPN, firew all, anti-virus, content filtering, IDP (Intrusion Detection and Prev en tion), ADP (Anomaly Detection and Protection), and certificat es.
Chapter 2 Features and Applications ZyWALL USG 50 User’s Guide 38 Firewall The Z yWALL’ s firew all is a stateful inspection firew all. The Z yWALL rest ricts access by screening data packets against defined access rules. It can also inspect sessions.
Chapter 2 Features an d Applications ZyWALL USG 50 User’s Guide 39 Anti-Virus Scanner With the anti- v irus packet scanner , your Z yWALL scans files transmitt ing through the enabled interfaces into the network. The Z yWALL helps stop threats at the network edge before they reach th e local host computers.
Chapter 2 Features and Applications ZyWALL USG 50 User’s Guide 40 2.2.1 VPN Connectivity Set up VPN tunnels with other companies, branch offices, t elecommuters, and business tr a velers to provide secure access t o y our network. Y ou can also set up additional connections to the Inte rnet to provide better service.
Chapter 2 Features an d Applications ZyWALL USG 50 User’s Guide 41 2.2.2.1 Full T unnel Mode In full tunnel mode, a virtual connection is created for remote users with private IP addresses in the same subn et as t he local network. This allows them t o access network resources in the same wa y as if th ey were part of the internal network.
Chapter 2 Features and Applications ZyWALL USG 50 User’s Guide 42 2.2.3 User-A ware Access Control Set up security policies that restrict access to sensitiv e information and shared resources based on the user who is trying to access it. Figure 7 Applications: User-A ware Access Control 2.
ZyWALL USG 50 User’s Guide 43 C HAPTER 3 Web Configurator The Z yW ALL W eb Configurator allows easy Z yWALL setup and management using an Internet browser . 3.1 W eb Configurator Requirement s In order to use the W eb Configurat or , you must • Use Internet Explorer 7 or la ter , or Firefox 1.
Chapter 3 Web C onfig ur a t or ZyWALL USG 50 User’s Guide 44 2 Open your web browser , and go to http://192.168.1.1 . By default, the Z yWALL automatically routes this req uest to its HT TPS server , and it is recommended to keep this setting. The Login screen appears.
Chapter 3 Web Configurator ZyWALL USG 50 User’s Guide 45 5 The screen above appears every time y ou log in using the default user name and default password. If you chang e the passw ord for the default user account, this screen does not appear anymore.
Chapter 3 Web C onfig ur a t or ZyWALL USG 50 User’s Guide 46 The icons provide the following functions. 3.3.1.1 About Click this to display basic information about the Z y W ALL. Figure 13 Tit l e B a r The following table describes l abels that can appear in this screen.
Chapter 3 Web Configurator ZyWALL USG 50 User’s Guide 47 3.3.2 Navigation Panel Use the menu items on the na vigati on panel to open screens to configure Z yW ALL features. Click the arrow in the middle of the right edge of the navi gation panel to hide the navigation panel menus or drag it to resize them.
Chapter 3 Web C onfig ur a t or ZyWALL USG 50 User’s Guide 48 3.3.2.3 Configuration Menu Use the configurat ion menu screens to configure the ZyW ALL’s features. AppP atrol Statistics Displays bandwidth and protocol statistics. VPN Monitor IPSec Displays and manages the active IPSec SAs.
Chapter 3 Web Configurator ZyWALL USG 50 User’s Guide 49 Interface Por t Ro le Use this screen to set the Z y WALL’ s flexible ports as LAN1 or DMZ. Ethernet Manage Ethernet interfaces and virtual Ethernet interfaces. PPP Create and manage PPPoE and PPTP interfaces.
Chapter 3 Web C onfig ur a t or ZyWALL USG 50 User’s Guide 50 AppPatrol Gener al Enable or disable traffic management by application and see registration and signature information. Common Manage tr affic of the most commonly used web, file transfer and e-mail protocols.
Chapter 3 Web Configurator ZyWALL USG 50 User’s Guide 51 Service Service Create and manage TCP and UDP services. Service Group Create and manage groups of services. Schedule Create one-time and recurring schedules. AAA Server Ac tive Directory- Default Configu re the default Ac tiv e Directory settings.
Chapter 3 Web C onfig ur a t or ZyWALL USG 50 User’s Guide 52 3.3.2.4 Maintenance Menu Use the maintenan ce menu screens to mana ge configuration and firmw are files, run diagnostics, and reb oot or shut down the Z yWALL. 3.3.3 Main Window The main window shows the screen you sele ct in the navigation panel.
Chapter 3 Web Configurator ZyWALL USG 50 User’s Guide 53 3.3.3.2 Site Map Click Site MAP to see an o v erview of links to the W eb Configurator screens. Click a screen’ s link to go to that screen. Figure 16 Site Map 3.3.3.3 Object Reference Click Object Reference to open the Object Reference screen.
Chapter 3 Web C onfig ur a t or ZyWALL USG 50 User’s Guide 54 The fields vary with the t ype of object. The following table describes labels that can appear in this screen. 3.3.3.4 CLI Messages Click CLI to look at the CLI commands sen t by th e Web Configurator .
Chapter 3 Web Configurator ZyWALL USG 50 User’s Guide 55 3.3.4.1 Manipulating T able Display Here are some of the ways you can manipulate the W eb Configurator tables. 1 Click a column heading to sort the tabl e’ s entries according to t hat column’ s criteria.
Chapter 3 Web C onfig ur a t or ZyWALL USG 50 User’s Guide 56 3 Select a column heading cell’ s right border and dr ag to re-size the column. Figure 21 Resizing a T able Column 4 Select a column heading and dr ag and drop it to change the column order .
Chapter 3 Web Configurator ZyWALL USG 50 User’s Guide 57 3.3.4.2 Wo rking with T able Entries The tables have icons for wo rking with tab le ent ries. A sample is shown next. Y ou can often use th e [Shift ] or [C trl] key to sel e c t mu ltiple entr ies to rem ove, activ ate, or deactiv ate.
Chapter 3 Web C onfig ur a t or ZyWALL USG 50 User’s Guide 58 you can also use the [Shift] or [Ct rl] key to select multiple entries, and then use the arrow button to mov e them to the other list.
ZyWALL USG 50 User’s Guide 59 C HAPTER 4 Installation Setup Wizard 4.1 Inst allation Setup Wizard Screens If you lo g into the W eb Configur ator when the Z yWALL is using its default configuration, the firs t Installation Setup Wizard screen displays.
Chapter 4 Ins ta llat ion Setu p Wizard ZyWALL USG 50 User’s Guide 60 The screens v ary depending on the encapsulation type. R efer to information provided by y our ISP to know what to ente r in each field. Leave a field blank if you don’t have that information.
Chapter 4 Installa tion Setup Wizard ZyWALL USG 50 User’s Guide 61 Note: Enter the Internet access in formation exactly as given to you by your ISP . Figure 28 Internet Access: Ethernet Encapsulation • Encapsulation : This displays the type of Internet connection you are configu ring.
Chapter 4 Ins ta llat ion Setu p Wizard ZyWALL USG 50 User’s Guide 62 4.1.3 Internet Access: PPPoE Note: Enter the Internet access in formation exactly as given to you by your ISP . Figure 29 Internet Access: PPPoE Encapsulation 4.1.3.1 ISP Parameters • T ype the PPP oE Service Nam e from your service pr ovider .
Chapter 4 Installa tion Setup Wizard ZyWALL USG 50 User’s Guide 63 4.1.3.2 W AN IP Address Assignment s • WAN Interface : This is the name of the inte rfac e that will conne ct with your ISP . • Zone: This is the se curity zone to wh ic h this interfac e an d Internet co nnection will belong .
Chapter 4 Ins ta llat ion Setu p Wizard ZyWALL USG 50 User’s Guide 64 4.1.5 ISP Parameters • Authentication Type - Select an authentication protocol for outgoing calls. Options are: • CHAP/PAP - Y our ZyW ALL accepts either CHAP or P AP when requested by the remote no de .
Chapter 4 Installa tion Setup Wizard ZyWALL USG 50 User’s Guide 65 4.1.6 Internet Access Se tup - Second W AN Interface If you se lected I have two ISPs , after you configure the First WAN Interface , you can configure the Second WAN Interface . The screens for configuring the second WAN interf ace are simil ar to the first (see Section 4.
Chapter 4 Ins ta llat ion Setu p Wizard ZyWALL USG 50 User’s Guide 66 4.1.7 Internet Access - Finish Y ou have set up your ZyW ALL to access the Intern et. Afte r configuring the WAN interface(s), a screen dis plays with your settings. If they are not correct, click Back .
Chapter 4 Installa tion Setup Wizard ZyWALL USG 50 User’s Guide 67 Use the Registration > Service screen to update your service subscription status. Registration • Select new myZyXEL.com account if you haven ’ t created an account at myZ yXEL.
Chapter 4 Ins ta llat ion Setu p Wizard ZyWALL USG 50 User’s Guide 68 • Trial Service Activation: Y ou can try a trial service subscription. The trial period starts the day y ou activate the trial. After the trial expires, you can buy an iCard and enter the license key in the Registration > Service screen to extend the service.
ZyWALL USG 50 User’s Guide 69 C HAPTER 5 Quick Setup 5.1 Quick Setup Overview The W eb Configur ator's quick setup wizards help you configure Internet and VPN connection settings. This chapt er pro vid es informa t io n on configu ring the qu ic k setup screens in the W eb Configurator .
Chapter 5 Quick Setup ZyWALL USG 50 User’s Guide 70 5.2 W AN Interface Quick Setup Click WAN Interface in the main Quick Setup screen to open the WAN Interface Quick Setup Wizard Welcome screen. Use these screens to configure an interface to co nnect to the internet.
Chapter 5 Quick Setup ZyWALL USG 50 User’s Guide 71 Otherwise, choose PPPoE or PPTP for a dial-up connection according to the information from y our ISP . Figure 37 W AN Interface Setup: S tep 2 The screens v ary depending on what encapsulation type you us e.
Chapter 5 Quick Setup ZyWALL USG 50 User’s Guide 72 • IP Address Assignment : Select Auto If y our ISP did not assign you a fix ed IP address. Select Static If the ISP assigned a fixed IP address. 5.2.4 W AN and ISP Connection Settings Use this screen to configure the ISP an d WAN interface settings.
Chapter 5 Quick Setup ZyWALL USG 50 User’s Guide 73 Authentication Ty p e Use the drop-down list box to select an authentication protocol for outgoing calls. Options are: CHAP/PAP - Y our Z yWALL accepts eith er CHAP or P AP when requested by this remote node.
Chapter 5 Quick Setup ZyWALL USG 50 User’s Guide 74 5.2.5 Quick Setup Interface Wizard: Summary This screen displa ys the WAN i nterface’ s settings. Figure 40 Interface Wizard: Su mmary W AN (PPTP Shown) The following table describes t he labels in this screen.
Chapter 5 Quick Setup ZyWALL USG 50 User’s Guide 75 5.3 VPN Quick Setup Click VPN Setup in the main Quick Setup screen to open the VPN Setup Wizard Welcome screen. The VPN wizard creates corresponding VPN connection and VPN gateway settings and ad dress objects that you can use later in configur ing more VPN con necti ons or other features.
Chapter 5 Quick Setup ZyWALL USG 50 User’s Guide 76 5.4 VPN Setup Wizard: W izard T ype A VPN (Virtual Private Network) tunnel is a secure connecti on to another computer or network. Use this screen to select wh ich type of VPN connection you wan t to configure.
Chapter 5 Quick Setup ZyWALL USG 50 User’s Guide 77 5.5 VPN Express Wizard - Scenario Click the Express radio button as shown in Figure 42 on page 76 to display the following screen. Figure 43 VPN Express Wizard: S tep 2 Rule Name : T ype the name used t o identify this VPN connec tion (and VPN gateway) .
Chapter 5 Quick Setup ZyWALL USG 50 User’s Guide 78 5.5.1 VPN Express Wizard - Configuration Figure 44 VPN Express Wizard: S tep 3 • Secure Gateway : If Any displa ys in this field, it i s not configurable for the chosen scenario.
Chapter 5 Quick Setup ZyWALL USG 50 User’s Guide 79 5.5.2 VPN Express Wizard - Summary This screen provides a read-only summary of the VPN tunnel’ s configuration and also commands that you can copy and paste into another ZLD-based Z yWALL’ s command line interface to configure it.
Chapter 5 Quick Setup ZyWALL USG 50 User’s Guide 80 5.5.3 VPN Express Wizard - Finish Now you can use the VPN tunnel. Figure 46 VPN Express Wizard: S tep 6 Note: If you have not already do ne so, use t he myZyXEL.com link and register you r ZyW ALL with myZyXEL.
Chapter 5 Quick Setup ZyWALL USG 50 User’s Guide 81 5.5.4 VPN Advanced Wizard - Scenario Click the Advanced radio button as shown in Figure 42 on p age 76 to di spla y the following screen. Figure 47 VPN Advanced Wizard: Scenario Rule Name : T ype the name used t o identify this VPN connec tion (and VPN gateway) .
Chapter 5 Quick Setup ZyWALL USG 50 User’s Guide 82 • Remote Access (Client R ole ) - Choose this to connect to an IPSec serv er . This Z yWALL is the cli ent (dial-in user) and can initiate the VPN tunnel.
Chapter 5 Quick Setup ZyWALL USG 50 User’s Guide 83 that uses a 168-bit k ey . As a result, 3DES is more secure than DES. It also requires more processing power , result ing in increased latency and decreased throughput. AES128 uses a 128-bit ke y and is faster than 3DES.
Chapter 5 Quick Setup ZyWALL USG 50 User’s Guide 84 5.5.6 VPN Advanced Wizard - Phase 2 Phase 2 in an IKE uses the SA t hat was established in phase 1 t o negotiate SAs for IPSec. Figure 49 VPN Advanced Wizard: S tep 4 • Active Protocol : ESP is compatible with NA T , AH is not.
Chapter 5 Quick Setup ZyWALL USG 50 User’s Guide 85 5.5.7 VPN Advanced Wizard - Summary This is a read-only summary of the VPN tunnel settings. Figure 50 VPN Advanced Wizard: S tep 5 • Rule Name : Identifies the VPN connection (and the VPN gateway).
Chapter 5 Quick Setup ZyWALL USG 50 User’s Guide 86 5.5.8 VPN Advanced Wizard - Finish Now you can use the VPN tunnel. Figure 51 VPN Wizard: S tep 6: Advanced Note: If you have not already do ne so, you can register your ZyW ALL with myZyXEL.com and activate trials of services like Content Filter .
ZyWALL USG 50 User’s Guide 87 C HAPTER 6 Configuration Basics This information is provided to help yo u configure the ZyW ALL effectively . Some of it is helpf u l wh en you are ju st getti ng started . Som e of it is pr ovi d ed fo r your reference when you configure various features in the Z yWALL.
Chapter 6 Con figu ra tio n Bas i cs ZyWALL USG 50 User’s Guide 88 change an Ethernet interf ace’ s IP address, the Z y WALL automatically updates the rules or settings that use the interf ace-based, LAN subnet ad dress object. Y ou can use the Configuration > Objects screens to create objects before y ou configure features that use them.
Chapter 6 Configu ra tio n Bas ics ZyWALL USG 50 User’s Guide 89 6.2.1 Interface T ypes There are man y types of interfaces in th e ZyW ALL. In addition to being used in various features, i nterfaces also describe the network that is direct ly connected to the ZyW AL L.
Chapter 6 Con figu ra tio n Bas i cs ZyWALL USG 50 User’s Guide 90 T able 14 Default Network T opology ZyWALL USG 50 Default Port, Interface, and Zone Configuration • The W AN zone contai ns the wan1 and wan2 interfaces (physical ports P1 and P2 ).
Chapter 6 Configu ra tio n Bas ics ZyWALL USG 50 User’s Guide 91 6.3 T erminology in the ZyW ALL This section highlights some terminolog y or organizati on for ZLD-based Z yWALLs. 6.4 Packet Flow Here is the order in which the Z yWALL applies its features and checks.
Chapter 6 Con figu ra tio n Bas i cs ZyWALL USG 50 User’s Guide 92 Packet Flow The packet flow is as follows: • Automatic SNA T and WAN trunk routing for tr affic going from internal to external interfaces (y ou don’t need to configure anything to all LAN to W AN traffic ).
Chapter 6 Configu ra tio n Bas ics ZyWALL USG 50 User’s Guide 93 of the sections, the Z yWALL stops checking the packets against the routing table and moves on to the other checks, for example the firew all check.
Chapter 6 Con figu ra tio n Bas i cs ZyWALL USG 50 User’s Guide 94 4 Auto VPN Policy : The Z yWALL automatically creates these routing entries for the VPN rules. Disabling the IPS ec VPN feature’ s Use Policy Route to control dynamic IPSec rules option moves the routes for dynamic IPSec rules up abov e the policy routes (see Section 23.
Chapter 6 Configu ra tio n Bas ics ZyWALL USG 50 User’s Guide 95 4 SNA T is also now performed by default and included in the NA T table. 6.5 Feature Configuration Overview This section provi des information about configuring the main features in the Z yW ALL.
Chapter 6 Con figu ra tio n Bas i cs ZyWALL USG 50 User’s Guide 96 6.5.2 Licensing Registration Use these screens to register your Z yWA LL and subscribe to services l ike anti- virus, IDP and application patrol, more SS L VPN tunnels, and co ntent filtering.
Chapter 6 Configu ra tio n Bas ics ZyWALL USG 50 User’s Guide 97 6.5.5 T runks Use trunks to set up load balancing using two or more interfaces. Example: See Chapter 7 on page 109 .
Chapter 6 Con figu ra tio n Bas i cs ZyWALL USG 50 User’s Guide 98 8 For t h e Next Hop fi el ds, sele ct Interface as the Ty pe if you have a single WAN connection or Trunk if you hav e multiple WAN connections. 9 Select the interface th at you are using for your WAN connection ( wan1 and wan2 are the default WAN interfaces).
Chapter 6 Configu ra tio n Bas ics ZyWALL USG 50 User’s Guide 99 6.5.9 DDNS Dynamic DNS maps a domain name to a dynamic IP address. The ZyW ALL helps maintain this mapping. 6.5.10 NA T Use Network Address T ranslation (NA T) to make computers on a priv ate network behind the Z yWALL av ailable outside the priv ate network.
Chapter 6 Con figu ra tio n Bas i cs ZyWALL USG 50 User’s Guide 100 The Z yWALL does not check to-Z yWALL firew all rules for packets that are redirected by HT TP redirect. It does check regular (through-Z yWALL) firewall rules. Example: Suppose you w ant HT TP requests from your LAN to go to a HT TP pro xy server at IP address 192.
Chapter 6 Configu ra tio n Bas ics ZyWALL USG 50 User’s Guide 101 6.5.14 Firewall The firewall controls the tra vel of tr affic between or within zones. Y ou can also configure the firewall to control tr affic for NA T (DNA T) and policy routes (SNA T).
Chapter 6 Con figu ra tio n Bas i cs ZyWALL USG 50 User’s Guide 102 6.5.15 IPSec VPN Use IPSec VPN to provide s ecure commu nication between two sites over the Internet or any insecu re network that uses TCP/IP for communication. The Z yWALL also offers hub-and- spoke VPN.
Chapter 6 Configu ra tio n Bas ics ZyWALL USG 50 User’s Guide 103 2 Click AppPatrol > Peer to Peer to go to the applicati on patrol configur ation screen. Click the BitT orrent application patrol entry’s Edit icon. • Set the default p olicy’ s access to Drop .
Chapter 6 Con figu ra tio n Bas i cs ZyWALL USG 50 User’s Guide 104 6.5.21 Content Filter Use content filtering to block or allow a ccess to spec ific categories of web site content, individual web sites and web feat ures (such as cookies). Y ou can define which user accounts (or g roups) can access what content and at what times.
Chapter 6 Configu ra tio n Bas ics ZyWALL USG 50 User’s Guide 105 6.6 Object s Objects store information and are ref erenced by other features. If you up date this informat ion in re sponse to change s, th e ZyW ALL automa tically propagates the change through the features that use the o bjec t.
Chapter 6 Con figu ra tio n Bas i cs ZyWALL USG 50 User’s Guide 106 6.6.1 User/Group Use these screens to configure the ZyW ALL’s admini strator and user accounts .
Chapter 6 Configu ra tio n Bas ics ZyWALL USG 50 User’s Guide 107 Example: Suppose you want to allow an admini strator to use HT TPS to manage the Z yWALL from the W AN. 1 Create an administr ator account ( Configuration > Object > User/Group ).
Chapter 6 Con figu ra tio n Bas i cs ZyWALL USG 50 User’s Guide 108 6.7.4 Diagnostics The Z yWALL can generate a fil e containing the Z yWALL’ s configuration and diagnostic information. It can also ca pture packets going through the Z yWALL’ s interfaces so you can anal yze them to identify network problems.
ZyWALL USG 50 User’s Guide 109 C HAPTER 7 Tutorials Here are examples of using the W eb Conf igurator to set up features in the Zy WA L L . Note: The tuto rials featu red he re re qu i r e a bas i c u nd e rs t and i ng o f co nn ec ti ng to and using the W eb Configurator , see Chapt er 3 on page 43 for details.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 11 0 •C o n v e r t P5 (lan2) into a dmz interface. This dmz interface is us ed for a protected local network. It uses IP ad dres s 192.168.4.1 and has a DHCP server . Add it to the LAN zone so all of the LAN zone’ s security policies apply to it.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 111 Click Configuration > Network > Interface > Ethernet and double-click t he wan1 interface’ s entry . Select Use Fixed IP Address and configure the IP address, subnet mask, and defa ult gatewa y settings and click OK .
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 11 2 1 Click Configuration > Network > Interface > Ethernet and double-click t he lan2 interfac e’ s entry . The Interface Type should be internal . Set the IP Address to 192.168.4.1 and t he Subnet Mask to 255.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 11 3 2 Enter VPN as the name, select WIZ_VPN_Connection and mo ve it to the Member bo x and click OK . Figure 59 Configura tion > Network > Zone > W AN Edit 7.2 How to Configure a Cellular Interface Use 3G cards for cellular W AN (Internet) connections.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 11 4 4 Enable the interface and add it to a z one. It is highly recommended that you set the Zone to WAN to apply your W AN zone security settings t o this 3G connection. Leaving Zone set to none has the Z yWALL not apply an y security settings to the 3G connection.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 11 5 6 The Z yWALL automatically adds the cellular interface to the system d efault WA N trunk. If the ZyW ALL is using a user-confi gured trunk as its default trunk and you want this cellular interface to be part of it, use the Trunk screens to add it.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 11 6 1 Click Configuration > Network > Interface > Ethernet and double-clic k the wan1 entry .
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 11 7 2 Name the tru n k a nd se t the Load Balancing Algorithm field to Weighted Round Robin . Add wan1 and enter 2 in the Weight column.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 11 8 3 Select the trunk as the defaul t trunk and click Apply . Figure 66 Configura tion > Network > Interface > T runk 7.4 How to Set Up an IPSec VPN T unnel This example shows how to use the IPSec VPN configuration screens to create the following VPN tunnel, see Section 5.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 11 9 In this example, the Z yW ALL is router X (1.2.3.4), and the remote IPSec router is router Y (2.2.2.2). Create the VPN tunnel between Z yW ALL X ’s L A N s u b n e t (192.168.1.0/24 ) and the LAN subnet behind peer IPSec router Y (172 .
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 120 7.4.2 Set Up the VPN Connection The VPN con ne ction mana ges the IPS ec SA. Y ou have to se t up the addres s objects for the local network and remote net work before you can set up th e VPN connection.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 121 4 Enable the VPN connection an d na me it (“VPN_CONN_EXAMPLE” ). Under VPN Gateway select Site-to-site and the VPN gateway ( VPN_GW_EXAMPLE ). Under Policy , select LAN1_SUBNE T for the local network and VPN_REMOTE_SUBNET for the remote.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 122 7.5 How to Configure User-aware Access Control Y ou can configure many policies and security s ettings for specific users or groups of users. This is illustr ated in the following example, where you will set up the following p o li c ies.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 123 2 Enter the same us er name that is us ed in the RADIUS server , and set the User Type to ext-user because this user account is authenticated by an external server .
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 124 2 Enter the name of the group that is used in the example in T able 18 on page 122 . In this example, it is “Finance” . Then, select User/Leo and click the right arro w to move him to the Member list.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 125 1 Click Configuration > Object > AAA Server > RADIUS . Double-click the radius entry . Configure the RADIUS server’s address authentication port (1812 if you were not told otherwise), key , and click Apply .
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 126 Note: The users will have to lo g in using the W eb Configurator login screen befo re they can use HTTP or MSN.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 127 1 Click Configuration > AppPatrol . If application patrol and b andwidth management are not enabled, enable them, and click Apply . Figure 76 Configura tion > AppPatrol > General 2 Click the Common tab and double-clic k the http entry .
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 128 3 Double-click the Defau lt policy . Figure 78 Configura tion > AppPatrol > Common > http 4 Change the access to Dr op because you do n ot want any one except authorized user groups to browse the web.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 129 5 Click the Add icon in the policy list. In the ne w policy , select one of the user groups that is allowed to browse the web and set the corresponding bandwidth restriction in the Inbound and Outbound fiel ds.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 130 2 Give the schedule a descriptive name. Set up the d ays (Monday through Friday) and the times (8:30 - 18:00) when Sal es is allowed to use MSN. Click OK . Figure 81 Configura tion > Object > Schedule > Add (Recur ring) 3 Fol low the steps in Section 7.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 131 2 Click the Add icon again and create a rule for one of the user groups that is allowed to access the DMZ. Figure 83 Configura tion > Firewall > Add 3 Re peat this proc ess to set up firewall rules for the other user groups that are allowed to access the DMZ.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 132 1 Click Configuration > Object > AAA Server > RADIUS . Double-click the radius entry . Besides configuring the RADIUS server’ s address,.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 133 2 Now you add ext -group-user user objects t o identify groups based on the group identifier values. Set up one user account for each group of user accounts in the RADIUS server . Click Configuration > Object > User/Group > User .
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 134 • Select Endpoint must have Personal Firewall installed and move the K asper sk y Internet Se c uri ty en tries t o th e allowed list (you can double-click an entry to move it).
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 135 Repeat as needed to create endpoint secu rity objects for other Windows operating system versions. 7.7.2 Configure the Authentication Policy Click Configuration > Auth. Policy > Add to open the En dpoint Security Edit screen.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 136 4 T u rn on authentication policy and click Apply . Figure 88 Configura tion > Auth. Policy The following figure shows an error me ssage example when a user’ s computer does not meet an endpoint securi ty object’ s requirements.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 137 user access (logging into SSL VPN for example). See Chapter 45 on page 675 for more on service control. The T o-ZyW ALL firewall rules apply to any ki nd of HT TP or HT TPS connection to the Z yWALL .
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 138 4 Select the new rule and click the Add icon. Figure 92 Configura tion > System > WWW (First Example Admin Service Rule Configured) 5 In the Zone field select ALL and set the Action to Deny . Click OK .
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 139 6 Click Apply . Figure 94 Configura tion > System > WWW (Sec ond Example Admin Service Ru le Configured) Now administr ator access to the W eb Config urat or can only come from the LAN1 zone.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 140 for wan1 IP address 10. 0.0.8 to a H.323 de vice located on the LAN and using IP address 192.168.1.56. Figure 95 W AN to LAN H.323 Peer-to-peer Calls Example 7.9.1 T urn On the ALG Click Configuration > Network > ALG .
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 141 1 Use Configuration > Object > Address > Add to create an address object for the public W AN IP address (called WAN_IP-for -H323 here). Then use it again t o create an address object for the H.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 142 2 Click Configuration > Network > NAT > Add. Configure a name for the rule (W AN-LAN_H323 here). Y ou want the LAN H.323 device to receive peer -to-peer calls from the WAN and also be able to initiate calls to t he WAN so you set the Classification to NAT 1:1 .
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 143 1 Click Configuration > Firewall > Add . In the From field select W A N. In the To field select LAN1. Configure a name for the rule (WAN-to-LAN_H323 here). Set the Destination to the H.323 device’ s LAN1 IP address object ( LAN_H323 ).
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 144 7.10.1 Create the Address Object s Use Configuration > Object > Address > Add to create the addr ess obje cts. 1 Create a host address object named DMZ_HT TP for the HT TP server ’s priv ate IP address of 192.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 145 • K eep Enable NAT Loopback selected to allow users connected to other interfaces to ac ce ss the HTTP server (see NA T Loopback on page 327 for details).
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 146 1 Click Configuration > Firewall > Add . Set the From field as WAN and the To field as DMZ . Set the Destination to the HT TP server’s DMZ IP address object ( DMZ_HTTP ). DMZ_HTTP is the destination because the Z yW ALL applies NA T to traffic before applying the firewal l rule.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 147 address 1.1.1.2 that you wi ll use on the wan1 interface and map to the IPPBX’ s privat e IP address of 192.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 148 7.1 1.1 T urn On the ALG Click Configuration > Network > ALG . Select Enable SIP ALG and Enable SIP Transformations and click Apply .
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 149 2 Create a host address object named IPPB X -Pub lic for t hepubli c WAN IP addre ss 1.1.1.2. Figure 108 Creating the Public IP Address Object 7.1 1.3 Setup a NA T Policy for the IPPBX Click Configuration > Network > NAT > Add.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 150 •C l i c k OK . Figure 109 Configu ration > Network > NA T > Add 7.1 1.4 Set Up a W AN to DMZ Firewall Rule for SIP The firewall blocks traffi c from the W AN zone to the DMZ zone by default so you need to create a firew all rule to allow the pu blic to send SIP traffic to the IPPB X.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 151 1 Click Configuration > Firewall > Add . Set the From field as WAN and the To field as DMZ . Set the Destination to the IPPBX’ s DMZ IP address object ( DMZ_SIP ). IPPBX_DMZ is the desti nation be caus e the Z yW ALL applies NA T to traffic before applying the firewal l rule.
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 152 1 Click Configuration > Firewall > Add . Set the From field as DMZ and the To field as LAN . Set the Destination to the IPPBX’ s DMZ IP address object ( DMZ_SIP ). Set the Source to IPPBX_DMZ .
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 153 7.12.2 Configure the Policy Route Now you need to configure a policy r out e that has the ZyW ALL use the range of public IP addresses as the source address for W AN to LAN traffic. Click Configuration > Netw ork > Routing > Add .
Chapter 7 Tutorials ZyWALL USG 50 User’s Guide 154.
155 P ART II Technical Reference.
156.
ZyWALL USG 50 User’s Guide 157 C HAPTER 8 Dashboard 8.1 Overview Use the Dashboard screens to check status information about the Z yWALL. 8.1.1 What Y ou Can Do in this Chapter Use the Dashboard screens for the following. •U s e t h e m a i n Dashboard screen (see Section 8.
Chapter 8 Das hb o ar d ZyWALL USG 50 User’s Guide 158 interface status in widgets that you can re-arrange to suit y our needs. Y ou can also collapse, refresh, and close individual widgets. Figure 1 14 Dashboard The following table describes t he labels in this screen.
Chapter 8 D as hb oa rd ZyWALL USG 50 User’s Guide 159 Device This field displays the name of the device connected to the extension slot (or none if no device is detected). Status This field displays the current status of each interface or device installed in a slot.
Chapter 8 Das hb o ar d ZyWALL USG 50 User’s Guide 160 Flash Usage This field displays what percentage of the Z yWALL’ s onboard flash memory is currently being used. Active Sessions This field displays how many tr a ffic sessions are currently open on the Z yWALL.
Chapter 8 D as hb oa rd ZyWALL USG 50 User’s Guide 161 Status For cellular (3G) interfaces, see Section 9.9 on page 183 for the status that can appear . Syst e m S ta tu s Syst e m Uptime This field displays how long the ZyW ALL has been running since it last restarted or was turned on.
Chapter 8 Das hb o ar d ZyWALL USG 50 User’s Guide 162 8.2.1 The CPU Usage Screen Use this screen to look at a chart of the ZyW ALL’ s recent CPU usage. T o access this screen, click CPU Usage in the dashboard. Figure 1 15 Dashboard > CPU Usage Expiration If the service license is valid, th is shows when it will expire.
Chapter 8 D as hb oa rd ZyWALL USG 50 User’s Guide 163 The following table describes t he labels in this screen. 8.2.2 The Memory Usage Screen Use this screen to look at a chart of the Z yWALL’ s recent memory (RAM) usage. T o access this screen, click Memory Usage in the dashboard.
Chapter 8 Das hb o ar d ZyWALL USG 50 User’s Guide 164 8.2.3 The Active Sessions Screen Use this screen to look at a chart of the Z yWALL’ s recent traff ic ses sion usage. T o access this screen, click Session Usage in the dashboard. Figure 1 17 Dashboard > Session Usage The following table describes t he labels in this screen.
Chapter 8 D as hb oa rd ZyWALL USG 50 User’s Guide 165 8.2.4 The VPN S t atus Screen Use this screen to look at the VPN tunnels that are currently establi shed. T o access this screen, click VPN Status in the das hboard. Figure 1 18 Dashboard > VPN S tatus The following table describes t he labels in this screen.
Chapter 8 Das hb o ar d ZyWALL USG 50 User’s Guide 166 The following table describes t he labels in this screen. 8.2.6 The Number of Login Users Screen Use this screen to look at a list of the users current ly logged into the Z yWALL. T o access this screen, click the dashboard’ s Number of Login Users icon.
Chapter 8 D as hb oa rd ZyWALL USG 50 User’s Guide 167 The following table describes t he labels in this screen. T able 25 Dashboard > Number of Login Users LABEL DESCRIPTION # This field is a sequential v alue and is not associated wi th any entry .
Chapter 8 Das hb o ar d ZyWALL USG 50 User’s Guide 168.
ZyWALL USG 50 User’s Guide 169 C HAPTER 9 Monitor 9.1 Overview Use the Monitor screens to check stat us and st at i sti cs in formation. 9.1.1 What Y ou Can Do in this Chapter Use the Monitor screens for the foll owi ng. •U s e t h e System Status > Port Statistics screen (see Section 9.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 170 •U s e t h e Anti-X Statistics > Anti-Virus screen (see Section 9.13 on page 194 ) to start or stop data collection and view virus statistics. •U s e t h e Anti-X Statistics > IDP screen ( Section 9.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 171 Stop Click this to stop the window from updating automatically . Y ou can start it again by setting the Poll Interval and clicking Set Interval . Swi tc h t o Graphic View Click this to display the port statistics as a line gr aph.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 172 9.2.1 The Port S t atistics Graph Screen Use this screen to look at a line gr aph of packet statistics for each ph ysical port. T o access this screen, click Port Statistics in the Status screen and then the Switch to Graphic View Button .
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 173 9.3 Interface S t atus Screen This screen lists all of the Z yWALL’ s interfaces and gives packet statistics for them.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 174 P ort This field displays the physical port number . Status This field displays the current status of each interface. The possible values depend on what type of interface it is. F or Ethernet interfaces: Inactive - The Ethernet interface is disabled.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 175 9.4 The T raffic St atistics Screen Click Monitor > System Status > T r aff ic Statistics to display the Traffic Statistics screen. This screen provides basic information about the following for example: • Most- visited W eb sites and the number of times each one w a s visited.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 176 Y ou use the Traffic Statistics screen to tell the ZyW ALL when to st art an d wh en to stop collec ting information for these reports. Y ou cannot schedule data collection; you ha ve to start and stop it manually in the Traffic Statistics sc reen.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 177 T raffic T ype Select the type of report to display . Choices are: Host IP Address/User - displays the IP addresses or users with the most traffic and h ow much traffic has been sent to and from each one.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 178 The following table displays the maximum number of records shown in the report, the byt e count limit, and the hit c ount li mit. 9.5 The Session Monitor Screen The Session Mo nitor screen displays information about active ses sions for debugging or statistical analysis.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 179 • Number of bytes tr ansmitted (so far) • Durati on (so far) Y ou can look at all the active sessions b y user , service, source IP address, or destination IP address.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 180 User This field displays when View is set to all sessions . T ype the us er whose sessions you want to view . It is not possible to type part of the user name or use wildcards in this field; you must enter the wh ole user name.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 181 9.6 The DDNS S t atus Screen The DD NS Status screen shows the status of the Z yW ALL’s DDNS domain names.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 182 established a session with the Z yWALL. Devi ces that have never established a session with the Z yWALL do not d isplay in the list. Figure 127 Monitor > System S tatus > IP/MAC Binding The following table describes t he labels in this screen.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 183 The following table describes t he labels in this screen. 9.9 Cellular S t atus Screen This screen displays y our 3G connection status. click Monitor > System Status > Cellular Status to display this scre en.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 184 Connected Device This field displays the model name of the cellular card. Status No device - no 3G device is connected to the ZyW ALL. No Service - no 3G network is av ailable in the area; you cannot connect to the Internet.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 185 9.9.1 More Information This screen displays more informati on on your 3G, such as the signal strength, IMEA/ESN and IMSI that helps identi fy your 3G device and SIM card. Click Monitor > System Status > More Information to display this screen.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 186 The following table describes t he labels in this screen. 9.10 Application Patrol S t atistics This screen displays a bandwi dth usage graph and stati stics for selected protocols. Click Monitor > AppPatrol Statistics to open the following screen.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 187 9.10.1 Application Patrol S t atistics: General Setup Use the top of the Monitor > AppPatrol Statistics screen to configure what to display . Figure 131 Monitor > AppPatrol S tatistics: General Setup The following table describes t he labels in this screen.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 188 9.10.2 Application Patrol S t atistics: Bandwidth S t atistics The middle of the Monitor > AppPatrol Statistics screen displays a bandwidth usage line gr aph for th e selected protocols.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 189 9.10.3 Application Patrol S t atistics: Protocol St atistics The bottom of the Monitor > AppPatrol Statistics screen displays statistics f or each of the selected protocols.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 190 9.10.4 Application Patrol S t atistics: Individual Protocol S t atistics by Rule The bottom of the Monitor > AppPatrol Statistics screen displays statistics f or each of the selected protocols.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 191 The following table describes t he labels in this screen. 9.1 1 The IPSec Monitor Screen Y ou can use the IPSec Monitor screen to display and to manage activ e IPSec SAs. T o access this screen, click Monitor > VPN Monitor > IPSec .
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 192 Each field is desc ribed in the followi ng table. 9.1 1.1 Regular Expressions in Searching IPSec SAs A question mark (?) lets a single char acte r in the VPN connecti on or policy name vary . For example, use “a?c” (without the quot ation marks) to specify abc, acc and so on.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 193 Wildcards (*) let multi ple VPN connection or policy names match the pattern. F or example, use “*abc” (without the quotation marks ) to specify any VPN conn ection or policy name that ends wit h “abc” .
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 194 9.13 The Anti-V irus St atistics Screen Click Monitor > Anti-X Statistics > Anti-Virus to displa y the following screen.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 195 The following table describes t he labels in this screen. The statistics displa y as follows when you display the top entries by source.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 196 The statistics displa y as follows when you display the top entries by destination. Figure 139 Monitor > Anti-X S tatistics > Anti-Virus: Destination IP 9.14 The IDP S t atistics Screen Click Monitor > Anti-X Statistics > IDP to display the followi ng screen.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 197 The statistics displa y as follows when you display the top entries by source. Figure 141 Monitor > Anti-X S tatistics > IDP: Source T o tal Session Scanned This field displays the number of sessions that the ZyW ALL has checked for intrusion characteristics.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 198 The statistics displa y as follows when you display the top entries by destination. Figure 142 Monitor > Anti-X S tatis tics > IDP: Destination 9.15 The Content Filter S t atistics Screen Click Monitor > Anti-X Statistics > Content Filter to displa y the foll owing screen.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 199 The following table describes t he labels in this screen. T able 44 Monitor > Anti-X S tatistics > Content Filter LABEL DESCRIPTION Collect Statistics Select this check box to have the Z yW ALL collect content filtering statistics.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 200 9.16 Content Filter Cache Screen Click Monitor > Anti-X Statistics > Content Filter > Cache to display the Content Filter Cache screen. Use this screen to view and configure your Z yWALL ’s URL caching.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 201 Click a column’ s heading cell to sort the table entries by that column’ s criteria. Click the heading cell again to reverse the sort order . Figure 144 Anti-X > Content Filter > Cache The following table describes t he labels in this screen.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 202 Category This field shows whether access to the web site’s URL was blocked or allowed. Click the column heading to sort the entries. P oint the triangle up to display the blocked URLs before the URLs to which access w as allowed.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 203 9.17 The Anti-S p am S t atistics Screen Click Monitor > Anti-X Statistics > Anti-Spam to disp lay the following screen. This screen displays sp am statistics. Figure 145 Monitor > Anti-X S tatistics > Anti-S pam The following table describes t he labels in this screen.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 204 Spam Mails This is the number of e-mails that the Z yWALL has determined to be spam. Spam Mails Detected by Black List This is the number of e-mails that matched an entry in the Z yW ALL’ s anti- spam black list.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 205 9.18 The Anti-S p am S t atus Screen Click Monitor > Anti-X Statistics > Anti-Spam > Status to display the Anti- Spam Status scre en. Use the Anti-Spam Status screen to see how many e-mail sessions the anti- spam feature is scanning an d statisti cs for the DNSBLs.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 206 9.19 Log Screen Log messages are stored in two separate logs, one for regular log messages and one for debugging messages. In the regu lar log, you can look at all the log messages by selecting All Logs , or you can select a specific category of log messages (for example, firewall or user).
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 207 The following table describes t he labels in this screen. T able 48 Monitor > Log LABEL DESCRIPTION Show Filter / Hide Filter Click this button to show or hide th e filter settings.
Chapter 9 Monitor ZyWALL USG 50 User’s Guide 208 The W eb Configurator sa ves the f ilter settings if you leav e the View Log screen and return to it later . Priority This field displays the priority of the log message. It has the same range of values as the Priority field above.
ZyWALL USG 50 User’s Guide 209 C HAPTER 10 Registration 10.1 Overview Use the Configura tion > Licensing > Reg i stratio n screens to register y our Z yWALL and manage its service subscript ions. 10.1.1 What Y ou Can Do in this Chapter •U s e t h e Registration screen (see Section 10.
Chapter 10 Re g istr at ion ZyWALL USG 50 User’s Guide 210 Subscription Services A vailable on the ZyW ALL Y ou can have the ZyW ALL use anti-virus, IDP/AppP atrol (Intrusion Detection and Prevention and application patrol ), and cont ent filtering subscripti on services.
Chapter 10 Registration ZyWALL USG 50 User’s Guide 21 1 10.2 The Registration Screen Use this screen to regi ster your Z y WALL wi th myZ yXEL.com and activate a service, such as content filtering. Click Configuration > Licensing > Registration in the navigation panel to op en the screen as shown next.
Chapter 10 Re g istr at ion ZyWALL USG 50 User’s Guide 212 Confirm Password Enter the password again for confirmation. E-Mail Address Enter your e-mail address. Y ou can use up to 80 alphanumeric characters (periods and the underscore are also allowed) without spaces.
Chapter 10 Registration ZyWALL USG 50 User’s Guide 213 Note: If the ZyW ALL is registered already , this screen is read-only and indicates whether trial services are activated (if any). Y ou can still select the unchecked trial service(s) to activate it after registra tion.
Chapter 10 Re g istr at ion ZyWALL USG 50 User’s Guide 214 The following table describes t he labels in this screen. T able 50 Configuration > Licensing > Registration > Service LABEL DESCRIPTION License Status # This is the entry’s position in the list.
ZyWALL USG 50 User’s Guide 215 C HAPTER 11 Interfaces 1 1.1 Interface Overview Use the Interface screens to configure the Z yWALL ’ s interfaces. Y ou can also create interfaces on top of other interfaces. • Ports are the physi cal ports to which you connec t cables.
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 216 1 1.1.2 What Y ou Need to Know Interface Characteristics Interfaces generally have the followi ng characteristics (although not all characteristics apply to each type of interface). • An interface is a logical entit y through which (layer -3) packets pass.
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 217 virtual--have a lot of similar characteristics. These characteristics are l isted in the following table and discussed in more d etail below . - * The format of interface names other than the Ether net and ppp interface names is strict.
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 218 * - Y ou cannot set up a PPP interface, virtual Ethernet interface or virtual VLAN interface if the underlying interface is a member of a bridge.
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 219 1 A port's IP address v aries as its role changes, mak e sure your computer's IP address is in the same subnet as the ZyW ALL's lan1 , lan2 or dmz IP address. 2 Use the appropriate lan1 , lan2 or dmz IP address to access the Z yWALL.
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 220 Unlike other types of interfaces, y ou cannot create new Ethernet i nterfaces nor can you delete an y of them. If an Ethernet interface does not have any ph ysical ports assigned to it (see Section 11.
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 221 Each field is described in the following table. 1 1.3.1 Ethernet Edit The Ethernet Edit screen lets you configure IP address assignment, interface parameters, RIP set ti ngs, OSPF settings, DHCP settings, connectivit y check, and MAC address settings.
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 222 • Enable and disable RIP i n the underlying physical port or port group . • Select which direction( s) routing information is exchanged - The Z yWALL can receive routing information, send rout ing information, or do both.
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 223 Figure 153 Configuration > Network > Interface > Ethernet > Edit (W AN).
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 224 Figure 154 Configur ation > Network > Interface > Ethernet > Edit (DMZ) This screen’ s fields are described in the table b elow .
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 225 Interface T ype This field is read-only . Internal is for connecting to a local network. Other corresponding configuration options: DHC P server and DHCP relay . The Z yWALL automatically adds default SNA T settings for traffic flowing from this interface to an external interface.
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 226 Metric This option appears when Interface Properties is Exter nal or General . Enter the priority of the gateway (if any) on this interface. The Z yW ALL decides which gateway to use based on this priority .
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 227 Check P ort This field only displays when you set the Check Method to tcp . Specify the port number to use for a TCP connectivity check . DHCP Setting These fields appear when Interface Prope rties is Internal or General .
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 228 First WINS Server , Second WINS Server T ype the IP address of the WINS (Wind ows Internet Naming Service) server that you w ant to send to the DHCP clients. The WINS server keeps a mapping table of the computer names on your network and the IP addresses that they are currently using.
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 229 V2-Broadcast This field is effective when RIP is enabled. Select this to send RIP-2 packets using subnet broadcasting; otherwise, the Z yWALL uses multicasting. OSPF Setting See Section 14.3 on page 299 for more information about OSPF .
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 230 1 1.3.2 Object References When a configur ation screen includes an Object References icon, select a configur ation object and click Object Referenc es to open the Object References screen. Th is s cre en displays whic h c o nf ig u ration set t in g s ref ere nce the selected object.
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 231 1 1.4 PPP Interfaces Use PPPoE/PPT P interfaces to connect to your ISP . This way , you do not have to install or manage PPP oE/PPTP software on each computer in the network. Figure 156 Example: PPPoE/PP TP Interfaces PPP oE/PPTP interfaces are similar to other interfaces in som e ways.
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 232 1 1.4.1 PPP Interface Summary This screen lists every PPP oE/PPTP inte rface. T o access this screen, click Configuration > Network > Interface > PPP . Configuration > Network > Interface > PPP Each field i s described in the table below .
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 233 1 1.4.2 PPP Interface Add or Edit Note: Y ou have to set up an ISP account bef ore you create a PPPoE/PP TP interface. This screen lets you configure a PPPoE or PPTP interface. T o access this screen, click the Add icon or an Edit icon in the PPP Interface screen.
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 234 Figure 157 Configuration > Network > Interface > PPP > Add Each field is explained in the following table.
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 235 Enable Interface Select this to enable this interface. Clear this to disable this interface. Interface Properties Interface Name Specify a name for the interface. It can use alphanumeric char acters, hyphens, and underscores, and it can be up to 11 characters long.
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 236 Interface Pa ra m e t e r s Egress Bandwidth Enter the maximum amount of tr affi c, in kilobits per second, the Z y WALL can send through the inte rface to the network. Allowed values are 0 - 1048576.
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 237 1 1.5 Cellular Configuration Screen (3G) 3G (Third Generation) i s a digital, pack et -switched wireless te chnology . Bandwidth usage is optimized as mult iple users sh are the same channel and bandwidth is only allocated to users when they send da ta.
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 238 Aside from selecting the 3G network, the 3G card may also select an av ailable 2.5G or 2.75G network automat ically . See the following table for a comparison between 2G, 2.5G, 2.75G and 3G of wireless technologies.
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 239 Figure 158 Configuration > Network > Interface > Cellular The following table describes t he labels in this screen. 1 1.5.1 Cellular Add/Edit Screen T o change your 3G settings, click Configuration > Network > Interface > Cellular > Add (or Edit ).
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 240 Figure 159 Configur ation > Network > Interface > Cellular > Add.
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 241 The following table describes t he labels in this screen. T able 61 Configuration > Network > Interface > Cellular > Add LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greater or lesser number of configur ation fields.
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 242 Dial String Enter the dial string if your ISP provides a string, w hich would include the APN, to initialize the 3G card. Y ou can enter up to 63 ASCII printable char acters. Spaces are allowed.
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 243 Egress Bandwidth Enter the maximum amount of tr affic, in kilobits per second, the Z yWALL can send through the interface to the n etwork. Allowed values are 0 - 1048576. This setting is used in W AN load balancing and bandwidth management.
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 244 Get Automatically Select this option If your ISP did not assign you a fix ed IP address. This is the default selection. Use Fixed IP Address Select this option If the ISP assigned a fixed IP address.
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 245 Time Budget Select this and specify the amount of time (in hours) that the 3G connection can be used within one month. If you change the value after you configure and enable budget con trol, the Z yW ALL resets the statistics.
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 246 1 1.6 VLAN Interfaces A Virtual Local Area Network (VLAN) divides a physical network into multiple logical networks. The standard is defined in IEEE 802.1q. Figure 160 Example: Before VLAN In this examp le, there are two phy s ical networks and three departments A , B , and C .
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 247 Figure 161 Example: Af ter VLAN Each VLAN is a separate network wit h se par a te IP addresses, subnet masks, and gateways . Each VLAN also has a unique iden tification number (ID). The ID is a 12- bit v alue that is stored in the MAC head er .
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 248 • Between the router and VLAN 3. VLAN Interfaces Overview In the Z yWA LL, each VLAN is called a VLAN interface. As a rout er , the Z yWALL routes tr affic between VLAN interfac es, but it does not route tr affic within a VLAN interface.
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 249 1 1.6.2 VLAN Add/Edit This screen lets you configure IP ad dress assignment, interface bandwidth parameters, DHCP setti ngs , and connectivit y check for each VLAN interface.
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 250 Figure 163 Configuration > Network > Interface > VLAN > Edit.
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 251 Each field is explained in the following table. T able 63 Configuration > Network > Interface > VLAN > Edit LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greate r or lesser num ber of configuration fields.
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 252 Metric Enter the priority of the gateway (if any) on this interface. The Z yWALL decides which gatewa y to use based on this priority . The lower the number , the higher the priority . If two or more gateways have the same priority , the Z yW ALL uses the one that was configured first.
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 253 DHCP Select what type of DHCP service the Z yWALL provides to the network. Choices are: None - the ZyW ALL does not provide any DHCP services. There is already a DHCP serv er on the network. DHCP Relay - the Z yWALL ro utes DHCP requests to one or m ore DHCP servers you specify .
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 254 Lease time Specify how long each computer can use the information (especially the IP address) before it has to request the information again. Choices are: infinite - select this if IP addresses never expire days, hours, and minutes - select this to enter how long IP addresses are valid.
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 255 OSPF Setting See Section 14.3 on page 299 for more information about OSPF . Area Select the area in which this interface belongs.
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 256 1 1.7 Bridge Interfaces This section introduces brid ges and bri dge interfaces and then explains the screens for bridge interfaces. Bridge Overview A bridge creates a connection between two or more network segments at the layer-2 (MAC address) level.
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 257 If computer B responds to computer A, bridge X records the source address 0B:0B:0B:0B:0B:0B and port 4 i n the table. It also looks up 0A:0A:0A:0A:0A:0A in the table and sends the pack et to port 2 accordingly .
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 258 1 1.7.1 Bridge Summary This screen lists every bridge interface and vi rtual interface created on top of bridge interfaces. T o access this screen, cl ick Configuration > Network > Interface > Bridge .
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 259 1 1.7.2 Bridge Add/Edit This screen lets you configure IP ad dress assignment, interface bandwidth parameters, DHCP setti ngs , and connectivit y check for each bridge interface.
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 260 Figure 165 Configur ation > Network > Interface > Bridge > Add.
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 261 Each field is desc ribed in the table belo w . T able 68 Configuration > Network > Interface > Bridge > Edit LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greate r or lesser num ber of configuration fields.
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 262 Gateway This field is e nabled if you select Use Fixed IP Address . Enter the IP address of the gateway . The Z yWALL sends packets to the gatewa y when it does not know how to route the packet to its destination.
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 263 IP P ool Start Address Enter the IP address from which the ZyW ALL begins allocating IP addresses. If you want to assign a static IP address to a specific computer , click Add Static DHCP . If this field is blank, the Pool Size must also be blank.
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 264 1 1.7.3 V irtual Interfaces Add/Edit This screen lets yo u configure IP address assi gnment and interface par ameters for virtual interfaces. T o access this screen, click an Add icon next to an Ethernet Add Click this to create a new entry .
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 265 interfac e, V LAN inte rf ace, or brid g e in te rface in the respective interface summary screen. Figure 166 Configuration > Network > Interface > Add Each field is desc ribed in the table belo w .
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 266 1 1.8 Interface T echnical Reference Here is more detailed information about interfaces on the Z yW ALL. IP Address Assignment Most interfaces have an IP address and a subnet mask. This information is used to create an entry in the routi ng table.
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 267 because it is a point -to-point interface. F or these interfaces, yo u c a n on ly enter the IP address. In many interfaces, you can also let the IP address and subnet mask be as signed by an external DHCP server on the networ k.
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 268 If you set the bandwidt h restrictions ve ry high, you effectively remove the restrictions. The Z yWALL also restricts the size of each data packet. The maximum number of bytes in each packet is called the maximum tr ansmission unit (MTU).
Chapter 11 Interfaces ZyWALL USG 50 User’s Guide 269 • IP address - If the DHCP client’s MAC address is in the ZyW ALL’s static DHCP table, the interface assig ns the corresponding IP address. If not, the interface assigns IP addresses from a pool, define d by the starting address of the pool and the pool size.
Chapter 11 In te r fac es ZyWALL USG 50 User’s Guide 270 PPPoE/PPTP Overview P o int -to-Point Protocol ov er Et hernet (PPPoE, RFC 2516) and P oint-to-P oint T u nneling Protocol (PPTP , RFC 2637) are usually used to connect t wo computers over phone lines or broadband connectio ns.
ZyWALL USG 50 User’s Guide 271 C HAPTER 12 Trunks 12.1 Overview Use trunks for W AN traffic load balancing to increase o verall network t hroughput and reliability . Load balancing divides traffi c loads between multiple interfaces. This allows y ou to improve quality of service and maximiz e bandwidth utilization for multiple ISP links.
Chapter 12 T run k s ZyWALL USG 50 User’s Guide 272 12.1.2 What Y ou Need to Know • Add WAN interfaces to trunks to have multiple connections share the traffi c load. • If one W AN interface’ s connection goes down, the ZyW ALL sends tr affic through another member of the trunk.
Chapter 12 Trunks ZyWALL USG 50 User’s Guide 273 2 The Z yWALL is using activ e/active load balanci ng. So when LAN user A tries to access something on the server , th e request goes out through wan2. 3 The server finds that the request comes from wan2’ s IP address instead of w an1’s IP address and rejects the request.
Chapter 12 T run k s ZyWALL USG 50 User’s Guide 274 Since W AN 2 has a smaller load balancing index (meani ng that it is less util ized than WAN 1), the Zy WALL will send the subsequent new session tr affic through WAN 2 .
Chapter 12 Trunks ZyWALL USG 50 User’s Guide 275 interface. This fully utilizes the bandwidth of the first interface to reduce Internet usage fees and avoi d overloading the interface. In this example figure, the upper threshol d of the first int erface is set to 800K.
Chapter 12 T run k s ZyWALL USG 50 User’s Guide 276 12.2 The T runk Summary Screen Click Configuration > Netw ork > Interface > T r un k to open the Trunk screen. This screen lists th e configured trunks and the load balancing al gorithm that each is configur ed to use.
Chapter 12 Trunks ZyWALL USG 50 User’s Guide 277 12.3 Configuring a T runk Click Configuration > Netw ork > Interface > T r un k and then the Add (or Edit ) icon to open the Trunk Edit screen. Use this screen to create or edit a WAN trunk entry .
Chapter 12 T run k s ZyWALL USG 50 User’s Guide 278 Each field is desc ribed in the table belo w . T able 75 Configuration > Network > Interface > T runk > Add (or Edit) LABEL DESCRIPTION Name This is read-only if you are editin g an existing trunk.
Chapter 12 Trunks ZyWALL USG 50 User’s Guide 279 12.4 T runk T echnical Reference Round Robin Load Balancing Algorithm Ro und R obin scheduli ng services qu eues on a rotating basis and i s activated only when an interface has more traffic than i t can handle.
Chapter 12 T run k s ZyWALL USG 50 User’s Guide 280.
ZyWALL USG 50 User’s Guide 281 C HAPTER 13 Policy and Static Routes 13.1 Policy and S t atic Routes Overview Use policy routes and static rout es to ov erride the Z yWALL’ s default routing behavior in order to send packets throug h the appropriate interface or VPN tunnel.
Chapter 13 Policy an d Static Routes ZyWALL USG 50 User’s Guide 282 •U s e t h e Static Route screens (see Section 13.3 on page 291 ) to list and configure static routes . 13.1.2 What Y ou Need to Know Policy Routing T raditionally , routing is based on the destination address only and the Z yWALL takes the sho rtest pa th to forward a pack et.
Chapter 13 Policy and Static Routes ZyWALL USG 50 User’s Guide 283 Policy Routes V ersus St atic Routes • Policy routes are more flexible tha n static routes. Y ou ca n select m o re c ri ter ia for the tr affic to match and can also use schedules , NA T , and bandwidth management.
Chapter 13 Policy an d Static Routes ZyWALL USG 50 User’s Guide 284 Finding Out More • See Section 6.5.6 on page 97 for related information on the policy route screens. • See Section 7.12 on page 152 for an example of creating a policy route for usi n g multiple static public W AN IP addresses for LAN to W AN traffic.
Chapter 13 Policy and Static Routes ZyWALL USG 50 User’s Guide 285 The following table describes t he labels in this screen. T able 76 Configuration > Network > Routing > Policy Route LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greater or lesser number of configur at ion fields.
Chapter 13 Policy an d Static Routes ZyWALL USG 50 User’s Guide 286 DSCP Code This is the DSCP value of incoming packets to which this policy route applies. any means all DSCP v alues or no DSCP marker . default means traffic with a DSCP value of 0.
Chapter 13 Policy and Static Routes ZyWALL USG 50 User’s Guide 287 13.2.1 Policy Route Edit Screen Click Configuration > Netw ork > Routing to open the Policy Route screen. Then click the Add or Edit icon to open the Policy Route Edit screen. Use this screen to configure or e dit a policy route.
Chapter 13 Policy an d Static Routes ZyWALL USG 50 User’s Guide 288 Incoming Select where the pack ets are coming from; any , an interface, a tunnel, an SSL VPN, or the Z yWALL itself . For an interface, a tunnel, or an S SL VPN, you also need to select the indi vidual interface, VPN tunnel, or SSL VPN connection.
Chapter 13 Policy and Static Routes ZyWALL USG 50 User’s Guide 289 VPN T unnel This fi eld displays when you select VPN Tu nnel in the Type field. Select a VPN tunnel through which the packets are sent to the remote network that is connected to the ZyW ALL directly .
Chapter 13 Policy an d Static Routes ZyWALL USG 50 User’s Guide 290 Source Network Address T ranslation Select none to not use NA T for the route. Select outgoing-interface to use the IP address of the outgoing interface as the source IP address of the packets that matches this route.
Chapter 13 Policy and Static Routes ZyWALL USG 50 User’s Guide 291 13.3 IP S t atic Route Screen Click Configuration > Network > Routing > Static Route to open the Static Route screen.
Chapter 13 Policy an d Static Routes ZyWALL USG 50 User’s Guide 292 The following table describes t he labels in this screen. 13.3.1 S t atic Route Add/Edit Screen Select a static route index number and click Add or Edit . The screen shown next appears.
Chapter 13 Policy and Static Routes ZyWALL USG 50 User’s Guide 293 13.4 Policy Routing T echnical Reference Here is more detailed information about some of the features you can configure in policy routing.
Chapter 13 Policy an d Static Routes ZyWALL USG 50 User’s Guide 294 following twelve DSCP encodi ngs from AF11 through AF43. The decimal equiv alent is listed in br ackets. Port T riggering Some services use a dedicated r ange of ports on the client side and a dedicated rang e of ports on the server side.
Chapter 13 Policy and Static Routes ZyWALL USG 50 User’s Guide 295 3 Computer A and game server 1 are connected to ea ch ot her until the connection is closed or times out.
Chapter 13 Policy an d Static Routes ZyWALL USG 50 User’s Guide 296.
ZyWALL USG 50 User’s Guide 297 C HAPTER 14 Routing Protocols 14.1 Routing Protocols Overview Routing protocols give the Z yWALL rout ing information about the network from other routers. The Z yWALL stores this rout ing information in the routing table it uses to make rout in g decision s.
Chapter 14 Routing Protocols ZyWALL USG 50 User’s Guide 298 14.2 The RIP Screen RIP (R outing Information Protocol, RFC 1058 and RFC 1389) allows a device to exchange routing information with other rout ers. RIP is a vector -space routing protocol, and, like most such protocols, it uses hop count to decide which route is the shortest.
Chapter 14 Routing Protocols ZyWALL USG 50 User’s Guide 299 The following table describes t he labels in this screen. 14.3 The OSPF Screen OSPF (Open Shortest P ath First, RFC 2328) is a link -state.
Chapter 14 Routing Protocols ZyWALL USG 50 User’s Guide 300 System (AS). OSPF offers some adv antag es over v ector-space routing protocols like RIP . • OSPF supports variable-lengt h subnet masks, which can be set up to use av ailable IP addresses more efficiently .
Chapter 14 Routing Protocols ZyWALL USG 50 User’s Guide 301 Each type of area is illust rated in the following figure. Figure 181 OSPF: T ypes of Areas Thi s OS PF AS co nsi sts of fou r a rea s, a rea s 0- 3. Are a 0 i s a lways t he bac kbo ne . In this example, areas 1, 2, and 3 are all conn ected to it.
Chapter 14 Routing Protocols ZyWALL USG 50 User’s Guide 302 • An Autonomous System Bounda ry Router (ASBR) exchanges routing information with routers in network s outside the OSPF AS. This is called redistribut ion in OSPF . • A backbone router (BR) has at least one interface with area 0.
Chapter 14 Routing Protocols ZyWALL USG 50 User’s Guide 303 to logically connect the area to t he backbo ne. This is illustr ated in the following example. Figure 183 OSPF: V irtual Link In this example, area 100 does not hav e a direct connection to the backbone.
Chapter 14 Routing Protocols ZyWALL USG 50 User’s Guide 304 Click Configuration > Network > Routing > OSPF to open the following screen. Figure 184 Configuration > Ne twork > Routi ng > OSPF The following table describes the labels in this screen.
Chapter 14 Routing Protocols ZyWALL USG 50 User’s Guide 305 T ype Select how OSPF calculates the cost associated with routing information from static routes. Choices are: Type 1 and Type 2 . Type 1 - cost = OSPF AS cost + external cost ( Metric ) Type 2 - cost = external cost ( Metric ); th e OSPF A S cost i s ignore d.
Chapter 14 Routing Protocols ZyWALL USG 50 User’s Guide 306 14.3.2 OSPF Area Add/Edit Screen The OSPF Area Add/Edit screen allows you to create a new area or edit an existing one. T o acce ss this screen, go to the OSPF summary screen (see Section 14.
Chapter 14 Routing Protocols ZyWALL USG 50 User’s Guide 307 14.3.3 V irtual Link Add/Edit Screen The Virtual Link Add/Edit screen allows you to create a new virtual link or edit an existing one. When the OS PF add or edit screen (see Section 14.3.2 on page Te x t Authentication Ke y This field is available if the Authenticati on is Text .
Chapter 14 Routing Protocols ZyWALL USG 50 User’s Guide 308 306 ) has the T ype set to Normal, a Virtual Link table displ ays. Click either the Add icon or an entry and the Edit icon to di splay a screen lik e the following.
Chapter 14 Routing Protocols ZyWALL USG 50 User’s Guide 309 Authentication T ypes Authentication is used to guar antee the in tegrity , but not the confidentiality , of routing updates. The tr ansmitting router uses its k ey to encrypt the original message into a smaller messag e, and the smaller message is tr ansmitted with the original message.
Chapter 14 Routing Protocols ZyWALL USG 50 User’s Guide 310.
ZyWALL USG 50 User’s Guide 31 1 C HAPTER 15 Zones 15.1 Zones Overview Set up zones to configure network securit y and network policies in the Z yWALL.
Chapter 15 Z o ne s ZyWALL USG 50 User’s Guide 312 15.1.2 What Y ou Need to Know Effect s of Zones on Different T ypes of T raffic Z ones effectiv ely divide tr affic into three types--intr a-zone tr affic, inter -z one traffic, and extr a-zone tr a ffic--which are affected differen tly by zone-based security and policy settings.
Chapter 15 Zones ZyWALL USG 50 User’s Guide 313 15.2 The Zone Screen The Zone screen provides a summary of all zones. In addition, this screen allows you to add, ed it, and remo v e zones. T o access this screen, click Configuration > Network > Zone .
Chapter 15 Z o ne s ZyWALL USG 50 User’s Guide 314 15.3 Zone Edit The Zone Edit screen allows you to add or edit a z one. T o access this screen, go to the Zone screen (see Section 15.2 on page 313 ), and click the Add icon o r an Edit icon. Figure 188 Network > Zo ne > Add The following table describes t he labels in this screen.
ZyWALL USG 50 User’s Guide 315 C HAPTER 16 DDNS 16.1 DDNS Overview Dynamic DNS (DDNS) services let you use a domain name with a dynamic IP address. 16.1.1 What Y ou Can Do in this Chapter •U s e t h e DDNS screen (see Section 16.2 on page 316 ) to view a list o f the configured DDNS domain names and their details.
Chapter 16 DDNS ZyWALL USG 50 User’s Guide 316 Note: Record your DDNS account’s user name, p assword, and domain name to use to configure the ZyW ALL. After , you configur e th e Z yW ALL, it auto matical ly sends updated IP addresses to the DDNS service provider , which help s redirect traffic accordingly .
Chapter 16 DDNS ZyWALL USG 50 User’s Guide 317 Primary Interface/IP This field displays the interface to use for updating the IP address mapped to the domain name followed by how the Z yWALL determines the IP address for the domain name. from interface - The IP address comes from the specified interface.
Chapter 16 DDNS ZyWALL USG 50 User’s Guide 318 16.2.1 The Dynamic DNS Add/Edit Screen The DDNS Add/Edit screen allows you to add a domain name to the ZyW ALL or to edit the configuration of an existing domain name. Click Configuratio n > Network > DDNS and then an Add or Edit icon to open this screen.
Chapter 16 DDNS ZyWALL USG 50 User’s Guide 319 Username T ype the user name used when y ou registered your domain name. Y ou can use up to 31 alphanumeric characters and the u nderscore.
Chapter 16 DDNS ZyWALL USG 50 User’s Guide 320 IP Address The options av ailable in this field vary by DDNS provider . Interface - The ZyW ALL uses the IP add ress of the spe cified interface. This option appears when y ou sele ct a specific interface in the Backup Binding Address Interface field.
ZyWALL USG 50 User’s Guide 321 C HAPTER 17 NAT 17.1 NA T Overview NA T (Network Address T ranslation - NA T , RFC 1631) is the transl ation of the IP address of a host in a packet. For exampl e, the source address of an out going packet, used within one network is change d to a different IP address known within another network.
Chapter 17 NA T ZyWALL USG 50 User’s Guide 322 17.1.2 What Y ou Need to Know NA T is also known as virtual server , port forwarding, or port translation. Finding Out More • See Section 6.5.10 on page 99 for related information on the se screens. • See Section 17.
Chapter 17 NAT ZyWALL USG 50 User’s Guide 323 Rem o v e T o remove an entry , select it and click Remove . The Z yW ALL confirms you w ant to remove it before doing so. Activate T o turn on an entry , select it and click Activate . Inactivate T o turn off an entry , select it and click Inactivate .
Chapter 17 NA T ZyWALL USG 50 User’s Guide 324 17.2.1 The NA T Add/Edit Screen The NAT Add/Edit screen lets you create new NA T rules and edit existing ones. T o open this window, open the NAT summary screen. (See Section 17.2 on page 322 .) Then, click on an Add icon or Edit icon to open the following screen.
Chapter 17 NAT ZyWALL USG 50 User’s Guide 325 Classification Select what kind of NA T this rule is to perform. Virtual Server - This mak es computer s on a priv ate netw ork behind the Z yWALL a vailable to a public network outside the ZyW ALL (like the Internet).
Chapter 17 NA T ZyWALL USG 50 User’s Guide 326 Mapped IP Subnet/Range This field displays for Many 1:1 NAT . Select to which translated destination IP address subnet or IP address range this NA T rule forwards packets. The original and mapped IP address subnets or ranges must have the same number of IP addresses.
Chapter 17 NAT ZyWALL USG 50 User’s Guide 327 17.3 NA T T echnical Reference Here is more detailed information about NA T on the Z yWALL. NA T Loopback Suppose a NA T 1:1 rule maps a public IP add ress to the priv ate IP address of a LAN SMTP e-mail server to g ive W AN users access.
Chapter 17 NA T ZyWALL USG 50 User’s Guide 328 For examp le, a LAN user’ s computer at IP address 192.168.1. 89 queries a public DNS server to resolve the SMTP server ’s domain name (xxx.LAN-SMTP .com in this example) and gets the SMTP serv er’s mapped public IP address of 1.
Chapter 17 NAT ZyWALL USG 50 User’s Guide 329 SMTP server replied directly to the LAN us er without the tr affic going through NA T , the source would not match the original destination address whi ch would cause the LAN user’s comput er to shut down the session.
Chapter 17 NA T ZyWALL USG 50 User’s Guide 330.
ZyWALL USG 50 User’s Guide 331 C HAPTER 18 HTTP Redirect 18.1 Overview HT TP redirect forwards the client’ s HTTP request (except HT TP traffic destined for the Z yWALL) to a web pro xy server . In the following example, proxy server A is connecte d to the DMZ interface.
Chapter 18 HTT P Red ire ct ZyWALL USG 50 User’s Guide 332 18.1.2 What Y ou Need to Know Web Proxy Server A proxy serv er helps client devices make in direct requests to access the Internet or outside network resources/services.
Chapter 18 HTTP Redirect ZyWALL USG 50 User’s Guide 333 • a application patrol rule to al low HT TP traf fic between dmz and wan1 . • a policy route to forw ard HT TP traffi c from proxy serv er A to the Internet. Finding Out More See Section 6.
Chapter 18 HTT P Red ire ct ZyWALL USG 50 User’s Guide 334 18.2.1 The HTTP Redirect Edit Screen Click Networ k > HTTP Redi rect to open the HTTP Redirect screen. Then click the Add or Edit icon to open the HTTP Redirect Edit screen where you can configure the rule.
ZyWALL USG 50 User’s Guide 335 C HAPTER 19 ALG 19.1 ALG Overview Application Laye r Gateway (ALG) al lows the following applications to oper ate properly through the Z y WALL’ s NA T . • SIP - Session Initiation Protocol (SIP) - An application-la yer protocol that can be used to create voice and multimedia sessions over Internet.
Chapter 19 ALG ZyWALL USG 50 User’s Guide 336 19.1.2 What Y ou Need to Know Application Layer Gateway (ALG), NA T and Firewall The Z yWALL can function as an Applicat ion Layer Gatew ay (ALG) to all ow certain NA T un-friendly applications (such as SIP) to operate properly through the Z yWALL ’s NA T and firewall.
Chapter 19 ALG ZyWALL USG 50 User’s Guide 337 • There should be only one SIP serv er (t otal) on the ZyW ALL’s private networks. Any other SIP servers must be on the WAN. So for example y ou could hav e a Back -to-Back User Agent such as the IPPBX x6004 or an asterisk PBX on the DMZ or on the LAN bu t no t on both.
Chapter 19 ALG ZyWALL USG 50 User’s Guide 338 can receive incoming calls from t he Internet, LAN IP addresses B and C can still make calls out to t he Internet.
Chapter 19 ALG ZyWALL USG 50 User’s Guide 339 • See Section 19.3 on page 341 for ALG background/technical information. 19.1.3 Before Y ou Begin Y ou must also configure the firewall and enable NA T in the Z yWALL to allow sessions initiated from the W AN.
Chapter 19 ALG ZyWALL USG 50 User’s Guide 340 The following table describes t he labels in this screen. T able 96 Configuration > Network > ALG LABEL DESCRIPTION Enable SI P ALG T urn on the SIP ALG to detect SIP traffic and help build SIP sessions through the Z yWALL’ s NA T .
Chapter 19 ALG ZyWALL USG 50 User’s Guide 341 19.3 ALG T echnical Reference Here is more detailed information about t he Application Layer Gatew ay . ALG Some applications cannot operate through NA T (are NA T un-friendly) becau se they embed IP addres ses and port number s in their packets’ data payload.
Chapter 19 ALG ZyWALL USG 50 User’s Guide 342 connections to the second (passive) int erf ace when the acti ve interface’ s connection goes down. When the active in terface’ s connection fails, .
ZyWALL USG 50 User’s Guide 343 C HAPTER 20 IP/MAC Binding 20.1 IP/MAC Binding Overview IP address to MAC address binding helps en sure that only the i ntended devices get to use privileg ed IP addresses. The Z yWALL uses DHCP to assign IP addresses and records to MAC address it assigned each IP address.
Chapter 20 IP/MAC Binding ZyWALL USG 50 User’s Guide 344 20.1.2 What Y ou Need to Know DHCP IP/MAC address bindings are based on the ZyW ALL’s d ynamic and static DHCP entries. Interfaces Used With IP/MAC Binding IP/MAC address bindings are grouped by inter face.
Chapter 20 IP/MAC Binding ZyWALL USG 50 User’s Guide 345 20.2.1 IP/MAC Binding Edit Click Configuration > Network > IP/MAC Binding > Edit to open the IP/ MAC Binding Edit screen. Use this screen to configure an interface’ s IP to MAC address binding settings.
Chapter 20 IP/MAC Binding ZyWALL USG 50 User’s Guide 346 20.2.2 S t atic DHCP Edit Click Configuration > Network > IP/MAC Binding > Edit to open the IP/ MAC Binding Edit screen. Click the A dd or Edit icon to open the foll owing screen. Use this screen to configure an interface’ s IP to MAC address binding settings.
Chapter 20 IP/MAC Binding ZyWALL USG 50 User’s Guide 347 20.3 IP/MAC Binding Exempt List Click Configuration > Network > IP /MAC Binding > Exempt List t o o p e n t h e IP/MAC Binding Exempt List screen. Use this scree n to configure ranges of IP addresses to which the Z yWALL does not apply IP/MAC binding.
Chapter 20 IP/MAC Binding ZyWALL USG 50 User’s Guide 348.
ZyWALL USG 50 User’s Guide 349 C HAPTER 21 Authentication Policy 21.1 Overview Use authentication polic ies to contro l who can access the network. Y ou can authenticate users (require them to lo g .
Chapter 21 Auth en tic at ion Policy ZyWALL USG 50 User’s Guide 350 21.1.2 What Y ou Need to Know Authentication Policy and VPN Authentication polici es are applied based on a tr affic flow’ s source and destination IP addresses.
Chapter 21 Authentication Policy ZyWALL USG 50 User’s Guide 351 Click Configuration > Auth. Policy to display the screen. Figure 21 1 Configuration > Auth.
Chapter 21 Auth en tic at ion Policy ZyWALL USG 50 User’s Guide 352 The following table giv es an overview of the objects you can configure. T able 101 Configuration > Auth. Policy LABEL DESCRIPTION Enable Authentication P olicy Select this to turn on the authentication policy feature.
Chapter 21 Authentication Policy ZyWALL USG 50 User’s Guide 353 21.2.1 Creating/Editing an Authentication Policy Click Configuration > Auth. Policy and then the Add (or Edit ) icon to open the Endpoint Security Edit screen. Use this screen to configure an authentication policy .
Chapter 21 Auth en tic at ion Policy ZyWALL USG 50 User’s Guide 354 Figure 213 Configuration > Aut h . Policy > Add The following table giv es an overview of the objects you can configure.
Chapter 21 Authentication Policy ZyWALL USG 50 User’s Guide 355 Schedule Select a schedule that defines when the policy applies. Otherwise, select none and the rule is always effective.
Chapter 21 Auth en tic at ion Policy ZyWALL USG 50 User’s Guide 356.
ZyWALL USG 50 User’s Guide 357 C HAPTER 22 Firewall 22.1 Overview Use the firewall t o block or allow servic es that use static port numbers. Use application patrol (see Chapter 28 on page 437 ) to control services using flexible/ dynamic port numbers.
Chapter 22 Firewall ZyWALL USG 50 User’s Guide 358 22.1.2 What Y ou Need to Know St ateful Inspection The Z yWALL has a stateful inspection fi rewall. The Z yWALL restricts ac cess by screening data pack ets ag ainst defined acce ss rules. It al so i nspec ts sessions.
Chapter 22 Firewall ZyWALL USG 50 User’s Guide 359 • The Z yWALL drops most pac kets from the W AN zone to the Z yWALL itself , except for ESP/AH/IKE/NA TT/HT TPS servic es for VPN tunnels, and gener ates a log.
Chapter 22 Firewall ZyWALL USG 50 User’s Guide 360 Firewall and VPN T raffic After you creat e a VPN tunnel and add it to a z one, you can set the firewall rules applied to VPN tr affi c.
Chapter 22 Firewall ZyWALL USG 50 User’s Guide 361 the firewall rule to alwa ys be in effect. The following figure shows the results of this rule. Figure 215 Blocking All LAN to W AN IRC Traf fic Example Y our fir ewall would have the following rules.
Chapter 22 Firewall ZyWALL USG 50 User’s Guide 362 Now you configure a LAN1 to WAN f irewall rule that allows IRC t raffic f rom the IP address of the CEO’ s computer (192.168.1.7 for example) to go to any destination address. Y ou do not need to specify a sch edule since you want the firewall rule to always be in effect.
Chapter 22 Firewall ZyWALL USG 50 User’s Guide 363 • The first row al lows any LAN1 computer to access the IRC service on the W AN by logging into the Z yWALL with the CEO’ s user name. • The second row blocks LAN1 access to the IRC service on the WAN.
Chapter 22 Firewall ZyWALL USG 50 User’s Guide 364 5 The screen for configuring a se rvice object opens. Configure it as follows and click OK . Figure 219 Firewall Example: Create a Service Obje ct 6 Select From WAN and To LAN1 . 7 Enter the name of the firewall rule.
Chapter 22 Firewall ZyWALL USG 50 User’s Guide 365 9 The firewall rule appears in the firewall rule summary . Figure 221 Firewall Example: Doom Rule in Summary 22.
Chapter 22 Firewall ZyWALL USG 50 User’s Guide 366 4 The Z yWALL then sends it to the compu te r on the LAN 1 in Subnet 1 . Figure 222 Using V irtual Interfaces to Avoid Asymmetrical Routes 22.2.1 Configuring the Firewall Screen Click Configuration > Firewall to open the Firewall screen.
Chapter 22 Firewall ZyWALL USG 50 User’s Guide 367 • The ordering of your rules is v ery im portant as rules are applied in sequence. Figure 223 Configuratio n > F irewall The following table describes t he labels in this screen.
Chapter 22 Firewall ZyWALL USG 50 User’s Guide 368 From Z one / To Z o n e This is the dire ction of travel of packets. Select from which zone the packets come and to which zone they go. Firewall rules are grouped based on the direction of travel of pack ets to which they apply .
Chapter 22 Firewall ZyWALL USG 50 User’s Guide 369 22.2.2 The Firewall Add/Edit Screen In the Firewall screen, click the Edit or Add icon to dis p lay the Firewall Rule Edit screen. Figure 224 Configuration > Fi rewall > Add The following table descri bes the labels in this screen.
Chapter 22 Firewall ZyWALL USG 50 User’s Guide 370 22.3 The Session Limit Screen Click Configuration > Firewall > Session Limit to displa y the Firewall Session Limit screen. Use this screen to limit th e number of concurrent NA T/ firewall sessions a client can use.
Chapter 22 Firewall ZyWALL USG 50 User’s Guide 371 individual limi ts for specific users, addres ses, or both. The individual li mit takes priority if you apply both. Figure 225 Configuration > Firewall > Session Limit The following table descri bes the labels in this screen.
Chapter 22 Firewall ZyWALL USG 50 User’s Guide 372 22.3.1 The Session Limit Add/Edit Screen Click Configuration > Firewall > Session Limit and the Add or Edit icon to display t he Firewall Session Limit Edit screen. Use this screen to configure rules that define a session li mit for specific users or addresses.
Chapter 22 Firewall ZyWALL USG 50 User’s Guide 373 User Select a user name or user group to which to apply the rule. The rule is activated only when the specified user logs into the system and the rule will be disabled when the user logs out. Otherwise, select any and there is no need for user logging.
Chapter 22 Firewall ZyWALL USG 50 User’s Guide 374.
ZyWALL USG 50 User’s Guide 375 C HAPTER 23 IPSec VPN 23.1 IPSec VPN Overview A virtual priv ate network (VPN) provides secure communications b etween sites without the expense of leased site-to-site lines. A s ecure VPN is a combination of tunneling, encryption, aut hentication, access control and auditing.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 376 •U s e t h e VPN Gateway screens (see Section 23.2.1 on page 380 ) to manage the ZyW AL L ’s VPN gateways. A VPN gate way specifies the IPSec rout ers at either end of a VPN tunnel and the IKE SA settings (phase 1 settings).
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 377 Application Scenarios The Z yW ALL’ s application scenarios make it easier to configure your VPN connection settings. Finding Out More • See Section 6.5.15 on page 102 for related information on the se screens.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 378 • See Section 23.4 on page 399 for IPSec VPN background information. • See Section 5.4 on page 76 for the IPSec VPN quick setup wizard. • See Section 7.4 on page 118 for an exampl e of configuring IPSec VPN.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 379 SA). Click a column’ s heading cell to so rt the table entries by that column’ s criteria. Click the heading cell again to reverse the sort order . Figure 229 Configuration > VPN > IPSec VPN > VPN Connection Each field is discussed in the following tabl e.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 380 23.2.1 The VPN Connection Add/Edit (IKE) Screen The VPN Connection Add/Edit Gateway screen allows you to create a new VPN connection policy or edit an existing one. T o access this screen, go to the Configuration > VPN Connection screen (see Section 23.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 381 Figure 230 Configuration > VPN > IPSec VPN > VPN Connection > Edit (IKE).
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 382 Each field is desc ribed in the followi ng table. T able 1 13 Configuration > VPN > IPSec VPN > VPN Connection > Edit LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greater or lesser number of configuration fields.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 383 Manual K ey Select this option to configure a VPN connection po licy that uses a manual key instead of IKE k ey management. This may be useful if you hav e problems with IKE key management. See Section 23.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 384 Re move Select an entry and click this to delete it. # This field is a sequential value, and it is not associated with a specific proposal. The sequence of proposals should not affect performance significantly .
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 385 Check Method Select how the Z yWALL checks the connection. The peer must be configured to respond to the method you select. Select icmp to have the ZyW ALL regularly ping the address you specify to make sure traffic can still go through the connection.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 386 Inbound T raffic Source NA T This translation hides the source address of computers in the remote network. Source Select the address object that re presents the original source address (or select Create Object to configure a new one).
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 387 23.2.2 The VPN Connection Add/Edit Manual Key Screen The VPN Connection Add/Edit Manual Key screen allows you to create a new VPN connection or edit an existing one us ing a manual key . This is useful if you have problems wi th IKE key management .
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 388 Secure Gateway Address T ype the IP address of the remote IPSec router in the IPSec SA. SPI T ype a unique SPI (Security P arameter Index) between 256 and 4095. The SPI is used to identify the Z yWALL during authentication.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 389 Encryption K e y This field is applicable when you select an Encryp tion Algorith m . Enter the encryption key , which depends on the encryption algorithm.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 390 23.3 The VPN Gateway Screen The VPN Gateway sum m ary screen disp l ays the IPSec VPN gateway polici es in the Z yWALL, as wel l as the Z yWALL’ s addr ess, remote IPSec router’s address, and associated VPN connections for each one.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 391 23.3.1 The VPN Gateway Add/Edit Screen The VPN Gateway Add/Edit scre en allo ws you to create a new VPN gateway policy or edit an existing one. T o access this screen, go to the VPN Gateway summary screen (see Section 23.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 392 Figure 233 Configuration > VPN > IPSec VPN > VPN Gateway > Edit Each field is desc ribed in the followi ng table.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 393 My Address Select how the IP ad dress of the Z yWAL L in the IKE S A is defined. If you select Interface , select the Ethernet interface, VLAN interface, virtual Ethernet interfac e, virtual VLAN interface or PPPoE/ PPTP interface.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 394 Certificate Select this to have the Z yWALL and remote IPSec ro uter use certificates to authenticate each other when they negotiate the IKE SA. Then select the certificate the Z yWALL uses to identify itself to the remote IPsec router .
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 395 P eer ID T ype Select which type of identifi cation is used to identify the remote IPSec router during authentication.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 396 Content This field is disabled if the Peer ID Ty pe is Any . T ype the identity of the remote IPSec router during au thentication.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 397 Negotiation Mode Select the negotiation mode to use to nego tiate the IKE S A. Choices are Main - this encrypts the Z yWALL’ s and remote IPSec .
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 398 NA T T raversal Select this if any of these conditions are satisfied. • This IKE SA might be used to negotiate IPSec SAs that use ESP as the active protocol.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 399 23.4 IPSec VPN Background Information Here is some more detailed IP Sec VPN background information. IKE SA Overview The IKE SA provides a se cure connec ti on between the ZyW ALL and remote IPSec router .
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 400 The Z yWALL sends one or more proposals to the remote IPSec router . (In some devices, you can only set up one propos al.) Each proposal consists of an encryption al gorithm, au thentication algorithm, and DH key group that the Z yWALL wants to use in the IKE SA.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 401 keys for the IKE SA and IPSec SA. In main mode, this is done in steps 3 and 4, as illustr a ted next . Figure 235 IKE SA: Main Ne gotiation Mode, S teps 3 - 4: DH Ke y Exchange DH public-k ey cryptogr aph y is b ased on DH k ey groups.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 402 Router identity cons ists of ID typ e and content. The ID type can be domain name, IP address, or e-mail address, and the content i s a (properly-formatted) domai n name, IP address, or e-mail address.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 403 the identity of the remote IP Sec router (f or example , extended authentication) or if you are troub leshooting a VPN tunnel. Additional T opics for IKE SA This section provi des more information about IKE SA.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 404 If router A does NA T , it might change t he IP a ddresses, port numbers, or both. If router X and router Y try to establish a VPN tunnel, the authentication fails because it depends on this information.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 405 Certificates It is possible for the Z yWALL and remote IP Sec rout er to authenticate each other with certificates. In this case, you do not ha ve to set up the pre-shared k e y , local identity , or remote identity because th e certificates provide this information inste ad.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 406 Encap sulation There are two ways to encapsul ate packets. Usually , you should use tunnel mode because it is more secure.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 407 If you enable PFS , the Z yWALL and remote IPSec router perform a DH key exchange every time an IPSec S A is establ ished, changing the root key from which encryption ke ys are gener ated. As a result , if one encryption k ey is compromised, other encryption keys remain secure.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 408 NA T for Inbound a nd Outbound T raffic The Z yWALL can tr anslate the following types of network addresses in IPSec S A.
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 409 • Destination - the original destinat ion address; the remote network ( B ). • SNA T - the translated sourc e address; the local ne twork ( A ).
Chapter 23 IPSec VPN ZyWALL USG 50 User’s Guide 410.
ZyWALL USG 50 User’s Guide 41 1 C HAPTER 24 SSL VPN 24.1 Overview Use SSL VPN to allow users to use a web browser for secure remote user login (the remote users do not need a VP N router or VPN client software. 24.1.1 What Y ou Can Do in this Chapter •U s e t h e VPN > SSL VPN > Access Privilege screens (see Section 24.
Chapter 24 SSL VPN ZyWALL USG 50 User’s Guide 412 • apply Endpoint Security (EPS) checking to require users’ computers t o comply with defined corpor ate policies before they can access the S SL VPN tunnel. • limit user access t o specific applications or fi les on the network.
Chapter 24 SSL VPN ZyWALL USG 50 User’s Guide 413 24.2 The SSL Access Privilege Screen Click VPN > SSL VPN to open the Access Privilege screen. This screen lists the configured SSL access policies. Figure 241 VPN > SSL VPN > Access Privilege The following table describes t he labels in this screen.
Chapter 24 SSL VPN ZyWALL USG 50 User’s Guide 414 24.2.1 The SSL Access Policy Add/Edit Screen T o create a new or edit an existing SSL access policy , click the Add or Edit icon in the Access Privilege screen. Figure 242 VPN > SSL VPN > Access Privilege > Add/Edit Apply Click Apply to save the settings.
Chapter 24 SSL VPN ZyWALL USG 50 User’s Guide 415 The following table describes t he labels in this screen. T able 121 VPN > SSL VPN > Access Privilege > Add/Edit LABEL DESCRIPTION Create new Object Use to configure any new settings objects that you need to use in this screen.
Chapter 24 SSL VPN ZyWALL USG 50 User’s Guide 416 24.3 The SSL Global Setting Screen Click VPN > SSL V PN and click the Global Setting tab to display the foll owing screen.
Chapter 24 SSL VPN ZyWALL USG 50 User’s Guide 417 on your network f or full tunnel mode ac cess, enter access messages or upl oad a custom logo to be displ ayed on the remote user screen. Figure 243 VPN > SSL VPN > Global Setting The following table describes t he labels in this screen.
Chapter 24 SSL VPN ZyWALL USG 50 User’s Guide 418 24.3.1 How to Upload a Custom Logo Fol low the steps below to upload a custom logo to displa y on the remote user SSL VPN screens. 1 Click VPN > SSL VPN and click the Global Setting tab to di splay the configur ati on screen.
Chapter 24 SSL VPN ZyWALL USG 50 User’s Guide 419 The following shows an example logo on the remote user screen. Figure 244 Example Logo Graphic Display 24.4 Est ablishing an SSL VPN Connection After you hav e configured the S SL VPN settings on the Z yWALL, us e the Z yWA LL login screen’ s SSL VPN button to establish an S SL VPN connection.
Chapter 24 SSL VPN ZyWALL USG 50 User’s Guide 420 2 SSL VPN connection starts. This may take sever al minutes depending on yo ur network connection. Once the connection is up , you should see the client portal screen. The following shows an example.
ZyWALL USG 50 User’s Guide 421 C HAPTER 25 SSL User Screens 25.1 Overview This chapter introduces the remote user S SL VPN screens. The following figure shows a network example where a remote user ( A ) logs into the Z yW ALL from the Internet to access the web serv er ( WWW ) on the local network.
Chapter 25 SSL User Screen s ZyWALL USG 50 User’s Guide 422 System Requirement s Here are the browser and computer system requirements for remote user access. • Windows 7 (32 or 64-bit), Vista (32 or 64-bit), 2003 (32-bit), XP (32-bit), or 2000 (32-bit) • Internet Explorer 7 and above or Firefox 1.
Chapter 25 SSL User Screens ZyWALL USG 50 User’s Guide 423 1 Open a web browser and enter the web site address or IP address of the Z yW ALL. For examp le, “http://sslvpn.myc ompany .com” . Figure 248 Enter the Address in a We b Browser 2 Click OK or Yes if a security screen displays.
Chapter 25 SSL User Screen s ZyWALL USG 50 User’s Guide 424 5 Y our computer sta rts establishing a se cure connection to the Z yWALL after a successful login. Thi s may take up to two minutes. If you get a message about needing Jav a, download and install it and restart y our browser and re-login.
Chapter 25 SSL User Screens ZyWALL USG 50 User’s Guide 425 7 The Z yW ALL tries to install the SecuExtend er client. Y ou may need to c lick a pop- up to get your browser to allow this. In Internet Explorer , click Install . Figure 253 SecuExtender Blocked by Internet Exp lorer 8 The Z yW ALL tries to run the “ss ltun” applic ation.
Chapter 25 SSL User Screen s ZyWALL USG 50 User’s Guide 426 10 If a screen like t he following displays, click Continue Anyway to finish installing the SecuExtender client on y our computer . Figure 256 Hardware Inst allation W arning 11 The Application screen displays showing the list of resources av ailable to you.
Chapter 25 SSL User Screens ZyWALL USG 50 User’s Guide 427 25.3 The SSL VPN User Screens This section describes the main elem ents in the remote us er screens. Figure 257 Remote User Screen The following table describes t he various parts of a remot e user screen.
Chapter 25 SSL User Screen s ZyWALL USG 50 User’s Guide 428 25.4 Bookmarking the ZyW ALL Y ou can create a boo kmark of the Z yWALL by clicking the Add to Favorite icon. This allows you to access the Z yW ALL using the bookmark without having to enter the address every time.
Chapter 25 SSL User Screens ZyWALL USG 50 User’s Guide 429 3 An information screen displays to indicate that t he SSL VPN connection is about to terminate.
Chapter 25 SSL User Screen s ZyWALL USG 50 User’s Guide 430.
ZyWALL USG 50 User’s Guide 431 C HAPTER 26 SSL User Application Screens 26.1 SSL User Application Screens Overview Use the Application screen to access web-based applic ations (such as web sites and e-mail) on the network through the SSL VPN conne ct i on.
Chapter 26 SSL User Application Screens ZyWALL USG 50 User’s Guide 432.
ZyWALL USG 50 User’s Guide 433 C HAPTER 27 ZyWALL SecuExtender The Z yWALL aut omatically loads the Z yW ALL SecuExtender client program to your computer after a successful logi n. The Z yWALL SecuExtender lets you: • Access servers , remote desktops and mana ge files as if you were on the local network.
Chapter 27 ZyW ALL SecuExtende r ZyWALL USG 50 User’s Guide 434 27.2 S t atistics Right- click the Z yW ALL SecuExtender ic on in the system tr ay and s elect Status to open the Status screen. Use this screen to view the ZyW ALL SecuExtender’s statistics.
Chapter 27 ZyWALL SecuExtender ZyWALL USG 50 User’s Guide 435 27.3 V iew Log If you h ave pro b lems w i th th e ZyWALL SecuExtender , customer support may request you to pro vide information from the log. Right -click the Zy WALL SecuExtender icon in the sys tem tr a y and select Log to open a notepad file of the Z yWALL SecuExtender’s log.
Chapter 27 ZyW ALL SecuExtende r ZyWALL USG 50 User’s Guide 436 connected but not send any traffi c throug h it until y ou right-click the icon and resume the connection. 27.5 S top the Connection Right- click the icon and select Stop Connection to disconnect t he SSL VPN tunnel.
ZyWALL USG 50 User’s Guide 437 C HAPTER 28 Application Patrol 28.1 Overview Application patrol provides a convenie nt w ay to manage the use of v arious applications on the network. It manages general protocols (for example, HTTP and FTP) and instant messenger (IM), peer-to- peer (P2P), V o ice over IP (V oIP), and streaming (RSTP) appl ications.
Chapter 28 App licat ion Patr ol ZyWALL USG 50 User’s Guide 438 28.1.2 What Y ou Need to Know If you w ant to use a service, mak e sure both the firewall and application patrol allow the service’ s packets to go through the ZyW ALL.
Chapter 28 Application Patrol ZyWALL USG 50 User’s Guide 439 numbers for SIP tr affic. Likewise, configuring the SIP ALG to use custom port numbers for SIP tr affic also configures applicati on patrol to use the same port numbers for SIP tr affic. DiffServ and DSCP Marking QoS is used to prioritize s o urce-to-destinat i on traffic flows.
Chapter 28 App licat ion Patr ol ZyWALL USG 50 User’s Guide 440 • The outbound tr affic flows from the connection initiator to the connection responder . • The inbound tr affic flows from the connecti on responder to the connection initiator . For example, a LAN1 to WAN connection is initiated from LAN1 and goes to the WAN .
Chapter 28 Application Patrol ZyWALL USG 50 User’s Guide 441 • Inbound tr affic is limited to 500 kbs. The connection initiator i s on the LAN1 so inbound means the traffi c trav eling from the WAN to the LAN1.
Chapter 28 App licat ion Patr ol ZyWALL USG 50 User’s Guide 442 outgoing speed of 1000 kbps. Y ou co nfigure policy A for server A ’s tr affic and policy B for server B ’ s traffi c.
Chapter 28 Application Patrol ZyWALL USG 50 User’s Guide 443 So server A gets its c onfigured rate of 300 kbps plus 250 kbps for a total of 550 kbps.
Chapter 28 App licat ion Patr ol ZyWALL USG 50 User’s Guide 444 • HT T P traffic needs to be giv en priority over FTP tr affic. • FTP traffic from the W AN to the DMZ must be limited so i t does not interfere with SIP and HT TP traffic.
Chapter 28 Application Patrol ZyWALL USG 50 User’s Guide 445 • Enable maximi ze bandwidth usage so the SIP tr affic can borrow unus ed bandwidth. Figure 271 SIP Any to W AN Bandwidth Management Example 28.1.3.3 SIP W AN to Any Ba ndwid th Management Example Y ou also create a policy for calls coming in from the SIP server on the WAN.
Chapter 28 App licat ion Patr ol ZyWALL USG 50 User’s Guide 446 28.1.3.5 FTP W AN to DMZ Ba ndwid t h Management Example • ADSL supports more downstream than upstream so you al low remote users 300 kbps for uploads to the DMZ F TP serv er (outbound) but only 100 kbps for downloads (inbound).
Chapter 28 Application Patrol ZyWALL USG 50 User’s Guide 447 28.2 Application Patrol General Screen Use this screen to enable and d isable applicati on patrol. It also lists the registration st atus and details about the sig nature set the Z y WALL is using.
Chapter 28 App licat ion Patr ol ZyWALL USG 50 User’s Guide 448 28.3 Application Patrol Applications Use the application patrol Common , Instant Messenger , Peer to Peer , VoIP , or Streaming screen to manage traf fic of individual applications.
Chapter 28 Application Patrol ZyWALL USG 50 User’s Guide 449 Click Configuration > App Patro l > Co mmon to open the following screen. Figure 276 Configur ation > App Patrol > Common The following table describes the labels in this screen.
Chapter 28 App licat ion Patr ol ZyWALL USG 50 User’s Guide 450 Streaming screen and click an application’ s Edit icon. The screen displayed here is for the MSN instant messenger service. Figure 277 Application Edit The following table describes t he labels in this screen.
Chapter 28 Application Patrol ZyWALL USG 50 User’s Guide 451 # This field is a sequential v alue, and it is not associated with a specific entry . Note: The ZyW ALL checks ports in the order they appear in the list.
Chapter 28 App licat ion Patr ol ZyWALL USG 50 User’s Guide 452 Access This field displays what the Z yWALL does with packets for this application that match this policy .
Chapter 28 Application Patrol ZyWALL USG 50 User’s Guide 453 28.3.2 The Application Patrol Policy Edit Screen The Application Policy Edit screen allows you to edit a group of settings f or an application.
Chapter 28 App licat ion Patr ol ZyWALL USG 50 User’s Guide 454 Schedule Select a schedule that defines when the policy applies or select Create Object to configure a new one (see Ch a p t e r 3 8 o n p a g e 6 1 1 for details). Otherwise, select none to mak e the policy always effective.
Chapter 28 Application Patrol ZyWALL USG 50 User’s Guide 455 Action Block For som e applications, you can select individual uses of the application that the policy will have the Z yWALL block. These fields only apply when Access is set to forwar d .
Chapter 28 App licat ion Patr ol ZyWALL USG 50 User’s Guide 456 28.4 The Other Applications Screen Sometimes, the Z yWALL cannot identify the application. For example, the application might be a new application, or the pack ets might arriv e out of sequence.
Chapter 28 Application Patrol ZyWALL USG 50 User’s Guide 457 Click AppPatrol > Other to open the Other ( applicatio ns) screen. Figure 279 AppPatrol > Other The following table describes the labels in this screen. See Secti on 28.4.1 on page 459 for more information as well.
Chapter 28 App licat ion Patr ol ZyWALL USG 50 User’s Guide 458 Destination This is the destination address or address group for whom this policy applies. If any displays, the policy is effective for every destination. Protocol This is the protocol of the traffic to which this policy applies.
Chapter 28 Application Patrol ZyWALL USG 50 User’s Guide 459 28.4.1 The Other Applications Add/Edit Screen The Other Configuration Add/Edit screen allows you to create a new condition or edit an existing one. T o access this screen, go to the Other Protocol screen (see Section 28.
Chapter 28 App licat ion Patr ol ZyWALL USG 50 User’s Guide 460 Schedule Select a schedule that defines when the policy applies or select Create Object to configure a new one (see Ch a p t e r 3 8 o n p a g e 6 1 1 for details). Otherwise, select any to make the policy always effective.
Chapter 28 Application Patrol ZyWALL USG 50 User’s Guide 461 Inbound kbps T ype how much inbound bandwidth , in kilobits per second, this policy allows the traffic to use. Inbound refers to the traffic the Z yWALL sends to a connection’ s initiator .
Chapter 28 App licat ion Patr ol ZyWALL USG 50 User’s Guide 462 OK Click OK to save your changes back to the Z yWALL. Cancel Click Cancel to exit this screen without saving your changes.
ZyWALL USG 50 User’s Guide 463 C HAPTER 29 Anti-Virus 29.1 Overview Use the Z yWALL’ s anti-virus feature to pr otect your connect ed network from virus/ spyware infect ion. The Z yWALL checks tr affic going in the direction(s) you specify for signature matches.
Chapter 29 Anti- Viru s ZyWALL USG 50 User’s Guide 464 29.1.2 What Y ou Need to Know Anti-Virus Engines Subscribe to signature files for K aspersky’ s anti-virus engine. After the trial expires, you need to purchase an iCard for the a nti-virus engine you want to use and register it in the Regis tration > Service screen.
Chapter 29 Anti- Viru s ZyWALL USG 50 User’s Guide 465 3 The scanning engine ch ecks the contents of the packets for virus. 4 If a virus pattern is matched, the Z yWALL removes the infect ed portion of the file along with the rest of the file. The un-infe cted portion of the file before a virus pattern was matched still goes through.
Chapter 29 Anti- Viru s ZyWALL USG 50 User’s Guide 466 29.2 Anti-V irus Summary Screen Click Configuration > Anti-X > Anti-Virus t o display the configur ation screen as shown next. Figure 282 Configur ation > Anti-X > Anti-Viru s > General The following table describes t he labels in this screen.
Chapter 29 Anti- Viru s ZyWALL USG 50 User’s Guide 467 Scan EICAR Select this option to have the Z yWALL check for the EICAR test file and treat it in the same way as a real virus file. The EICAR test file is a standardized test file for signature based anti-virus scanners.
Chapter 29 Anti- Viru s ZyWALL USG 50 User’s Guide 468 License T ype This field displays whether you applied for a trial application ( Trial ) or registered a service with your iCard’ s PIN number ( Stand ard ). None displays when the service is not activ ated.
Chapter 29 Anti- Viru s ZyWALL USG 50 User’s Guide 469 29.2.1 Anti-V irus Policy Add or Edit Screen Click the Add or Edit icon in the Configuration > Anti-X > Anti-Virus > General screen to displa y the configur ation screen as shown next.
Chapter 29 Anti- Viru s ZyWALL USG 50 User’s Guide 470 Actions When Matched Destroy infected file When you select this check bo x, if a virus pattern is matched, the Z yW ALL overwrites the infected portion of the file (and the rest of the file) with zeros.
Chapter 29 Anti- Viru s ZyWALL USG 50 User’s Guide 471 29.3 Anti-V irus Black List Click Configuration > Anti-X > Anti-Virus > Black/White List to displa y the screen shown next. Use the Black List screen to set up the Anti-Virus black (blocked) list of virus file patterns.
Chapter 29 Anti- Viru s ZyWALL USG 50 User’s Guide 472 The following table describes t he labels in this screen. 29.4 Anti-V irus Black List or White List Add/Edit From the Configuration > Anti-X > Anti-Virus > Black/White List > Black List (or White List ) screen, click the Add icon or an Ed it icon to display the following screen.
Chapter 29 Anti- Viru s ZyWALL USG 50 User’s Guide 473 The following table describes t he labels in this screen. 29.5 Anti-V irus White List Click Configuration > Anti-X > Anti-Virus > Black/White List > White List to display the screen shown next.
Chapter 29 Anti- Viru s ZyWALL USG 50 User’s Guide 474 column’ s heading cell to sort t he table en tries by that col umn’s criteria. Click the heading cell again to reverse the sort order . Figure 286 Configuration > Anti-X > Anti-Viru s > Black/White List > White List The following table describes t he labels in this screen.
Chapter 29 Anti- Viru s ZyWALL USG 50 User’s Guide 475 If Internet Explorer op en s a warning screen ab out a scri pt making Internet Explorer run slowly and the computer ma ybe becoming unresponsiv e, just click No to continue. Cl ick a column’ s heading ce ll to sort the table entries by that column’s criteria.
Chapter 29 Anti- Viru s ZyWALL USG 50 User’s Guide 476 The following table describes t he labels in this screen. T able 140 Configuration > Anti-X > Anti-V irus > Signature LABEL DESCRIPTION Signatures Search Select the criteria on which to perform the search.
Chapter 29 Anti- Viru s ZyWALL USG 50 User’s Guide 477 29.7 Anti-V irus T echnical Reference T ypes of Computer V iruses The following table describes some of the common computer vi ruses. Computer Virus Inf ection and Prevention The following describes a simpl e life cycle of a computer virus.
Chapter 29 Anti- Viru s ZyWALL USG 50 User’s Guide 478 A host-b ased anti- virus (HAV) scanner is often software installed on computers and/or servers in the network. It i nspects files for virus patterns as they are moved i n and out of the hard driv e.
ZyWALL USG 50 User’s Guide 479 C HAPTER 30 IDP 30.1 Overview This chapter introduces pack et inspection IDP (Intrusi on, Detection and Prevention), IDP profiles, binding an IDP prof ile to a tr affic flow , custom signatures and updating signatures.
Chapter 30 ID P ZyWALL USG 50 User’s Guide 480 IDP Profiles An IDP profile is a set of related IDP sign atures that y o u can activ ate as a set and configure common log and action s ettings. Y ou can apply IDP profiles to traff ic flowing from one zone to another .
Chapter 30 IDP ZyWALL USG 50 User’s Guide 481 30.2 The IDP General Screen Click Configuration > Anti-X > IDP > Ge neral to open this scree n. Use this screen to turn IDP on or off , bind IDP profiles to t raffic direct ions, and view registra tion and signature information.
Chapter 30 ID P ZyWALL USG 50 User’s Guide 482 Add Click this to cr eate a new entry . Select an entry and click Add to create a new entry after the selected entry . Edit Select an entry and click this to be able to modify it. Re move Select an entry and click this to delete it.
Chapter 30 IDP ZyWALL USG 50 User’s Guide 483 30.3 Introducing IDP Profiles An IDP profile is a set of packet inspection signatures. P acket inspection si gnatures examine packet content for malicious data. Pack et inspection applies t o OSI (Open System Int erconnection) layer -4 to lay er-7 contents.
Chapter 30 ID P ZyWALL USG 50 User’s Guide 484 30.3.1 Base Profiles The Z yW ALL comes with sever al base profiles. Y ou use base profiles to create new profiles. In the Configuration > Anti-X > IDP > Profile screen, cli c k Add to display the following screen.
Chapter 30 IDP ZyWALL USG 50 User’s Guide 485 30.4 The Profile Summary Screen Select Anti-X > IDP > Profile . Use this screen to: • Add a new profile • Edit an existing prof ile • Delete an existing profile. Click a column’ s heading cell to sort the table entries by that column’ s criteria.
Chapter 30 ID P ZyWALL USG 50 User’s Guide 486 30.5 Creating New Profiles Y ou may want to create a new profile if not all signatures in a base profile are applicable to your network. In this case y ou should disable non-applicable signatures so as t o improve Z yWALL IDP p rocessing efficiency .
Chapter 30 IDP ZyWALL USG 50 User’s Guide 487 30.6 Profiles: Packet Inspection Select Configuration > Anti -X > IDP > Pr ofile and then add a new or edit an existing profile select. P acket inspection signatures examine the contents of a packet for mal icious data.
Chapter 30 ID P ZyWALL USG 50 User’s Guide 488 The following table describes t he fields in this screen. T able 145 Configuration > Anti-X > IDP > Profile > Group View LABEL DESCRIPTION Name This is the name of the profile.
Chapter 30 IDP ZyWALL USG 50 User’s Guide 489 Action T o edit what action the Z yW ALL takes when a packet matches a signature, select the signature and use the Action icon. none : Select this action on an individual signature or a complete service group to have the Z yWALL tak e no action when a packet matches the signature(s).
Chapter 30 ID P ZyWALL USG 50 User’s Guide 490 30.6.2 Policy T ypes This section describes IDP poli cy types, also known as attack types, as c a tegorized in the ZyW ALL. Y ou may refer to these types when categorizing your own custom rules. Log These are the log options.
Chapter 30 IDP ZyWALL USG 50 User’s Guide 491 30.6.3 IDP Service Group s An IDP service group is a set of re lated packet i nspection signatures. Scan A scan describes the action of searching a network for an exposed service. An attack may then occur once a vulnerability has been found.
Chapter 30 ID P ZyWALL USG 50 User’s Guide 492 The following figure shows the WEB_PHP se rvice group that contains signatures related to attacks on web servers us ing PHP exploits . PH P (PHP: Hypertext Preprocessor) is a serv er-side HTML embedd ed scripting language that allows web developers to build dynamic websites.
Chapter 30 IDP ZyWALL USG 50 User’s Guide 493 30.6.4 Profile > Query V iew Screen Click Switch to query view in the screen as shown in Figure 291 on page 487 to go to a signature query screen.
Chapter 30 ID P ZyWALL USG 50 User’s Guide 494 Severity Search for signatures by severit y level(s). Hold down the [Ctrl] key if you want to make multiple selections. These ar e the sev erities as defi ned in the Z yWALL. The number in brackets is the number you use if using comman d s .
Chapter 30 IDP ZyWALL USG 50 User’s Guide 495 30.6.5 Query Example This example shows a search with these criteria: • Severity: severe and high • Attac k T ype: DDoS • Platform: Windows 2000 a.
Chapter 30 ID P ZyWALL USG 50 User’s Guide 496 •A c t i o n s : A n y Figure 294 Query Example Search Criteria Figure 295 Query Example Search Result s.
Chapter 30 IDP ZyWALL USG 50 User’s Guide 497 30.7 Introducing IDP Custom Signatures Create custom signatures for new attack s or attacks peculiar to y our network. Custom signatures c an also be sav ed to/f rom y our computer so as to s hare with others.
Chapter 30 ID P ZyWALL USG 50 User’s Guide 498 30.8 Configuring Custom Signatures Select Configuration > Anti-X > IDP > Cu stom Signature s. The first screen shows a summary of all custom signatures created. Click the SID or Name heading to sort.
Chapter 30 IDP ZyWALL USG 50 User’s Guide 499 Note: The ZyW A LL checks all signatures and contin ues searching even af ter a match is found. If two or more rules have conflicting actions fo r the sa me p acket, then the ZyW ALL applies the more restrictive action ( reject-both, reject-receiver or reject-sender , drop, none in this order).
Chapter 30 ID P ZyWALL USG 50 User’s Guide 500 30.8.1 Creating or Editing a Custom Signature Click the Add icon to c reate a new signature or c lick the Edit icon to edit an existing signature in the screen as shown in Figure 297 on page 499 . A packet must match all items you configur e in this screen before it matches the signature.
Chapter 30 IDP ZyWALL USG 50 User’s Guide 501 T ry to write signatures that target a vulnerabil ity , for example a certain t ype of traffic on certain operating s ystems, instead of a specific exploit.
Chapter 30 ID P ZyWALL USG 50 User’s Guide 502 The following table describes the fields in this screen. T able 151 Configuration > Anti-X > IDP > Custom Signatures > Add/Edit LABEL DESCRIPTION Name T ype the name of y our custom signature.
Chapter 30 IDP ZyWALL USG 50 User’s Guide 503 Fragmentation A fragm entation flag identifies whether the IP datagram should be fragmented, not fr agmented or is a reserved bit. Some intrusions can be identified by this flag. Select the check box and then select the flag that the intrusion uses.
Chapter 30 ID P ZyWALL USG 50 User’s Guide 504 Flow If selected, the signature only ap plies to certain directions of the traffic flow and only to c lients or servers.
Chapter 30 IDP ZyWALL USG 50 User’s Guide 505 P ayload Size This field may be used to check for abn ormally sized packets or for detecting buffer overflows . Select the check box, then select Equal , Smalle r or Greater and then type the payload size.
Chapter 30 ID P ZyWALL USG 50 User’s Guide 506 30.8.2 Custom Signature Example Before creating a custom signature, you must first clearly understand the vulnerabilit y . 30.8.2.1 Underst a nd the V ulnerability Check the ZyW ALL logs when the attack oc curs.
Chapter 30 IDP ZyWALL USG 50 User’s Guide 507 30.8.2.2 Analyze Packet s Use the packet capture screen (se e Section 48.3 on page 750 ) and a packet analyzer (also known as a network or pr otocol analyzer) such as Wireshark or Ethereal to inv estigate some more.
Chapter 30 ID P ZyWALL USG 50 User’s Guide 508 The final custom signature should look like as shown in the following figure. Figure 300 Example Custom Signatu re 30.
Chapter 30 IDP ZyWALL USG 50 User’s Guide 509 Y ou can activate the signature, configu r e what action to take when a packet matches it and if it should gener ate a log or alert i n a profil e. Then bind the profil e to a zone. Figure 301 Example: Custom Signat ure in IDP Profile 30.
Chapter 30 ID P ZyWALL USG 50 User’s Guide 510 destination port is the service port (53 for DNS in this case) that the attack tries to exploit. Figure 302 Custom Signature Log 30.9 IDP T echnical Reference This section contains some background information on IDP .
Chapter 30 IDP ZyWALL USG 50 User’s Guide 51 1 Network Intrusions Network -based intrusions have the goal of bringi ng down a ne twork or networks by attacking computer(s), switch(es), rout er(s) or modem(s). If a LAN switch is compromised for example, then the wh ole LA N is com promised.
Chapter 30 ID P ZyWALL USG 50 User’s Guide 512 Note: Not all Snort functionality is supported in the ZyW ALL. Same IP sameip T r ansport Protocol T r ansport Protocol: T CP P ort (In Snort rule head.
ZyWALL USG 50 User’s Guide 513 C HAPTER 31 ADP 31.1 Overview This chapter introduces ADP (Anomaly De tection and Prev ention), a nomaly profiles and applying an ADP profile to a traffic direction.
Chapter 31 AD P ZyWALL USG 50 User’s Guide 514 Protocol Anomalies Protocol anomalies are packets t hat do not comply with the relevant RFC (R equest For Comments). Protocol anomaly detect ion includes HT TP Inspection, TCP Decoder , UDP Decoder and ICMP Decoder .
Chapter 31 ADP ZyWALL USG 50 User’s Guide 515 31.2 The ADP General Screen Click Configuration > Anti-X > ADP > General . Use this screen to turn anomaly detection on or off and apply an omaly profiles to tr affic directions.
Chapter 31 AD P ZyWALL USG 50 User’s Guide 516 31.3 The Profile Summary Screen Use this screen to: • Create a new profile using an existing base profile • Edit an existing prof ile • Delete an existing profile Status The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive.
Chapter 31 ADP ZyWALL USG 50 User’s Guide 517 31.3.1 Base Profiles The Z yWALL comes with base profiles. Y ou use base profiles to crea te new profiles. In the Configuration > Anti-X > ADP > Profile screen, click Add to display the following screen.
Chapter 31 AD P ZyWALL USG 50 User’s Guide 518 The following table describes t he fields in this screen. 31.3.3 Creating New ADP Profiles Y o u may want to create a new profile if not all rules in a base profile are app licable to your networ k.
Chapter 31 ADP ZyWALL USG 50 User’s Guide 519 belonging to this profile, mak e sure you hav e clicked OK or Save to save the changes before selecting the Traffic Anomaly tab.
Chapter 31 AD P ZyWALL USG 50 User’s Guide 520 The following table describes t he fields in this screen. T able 156 Configuration > ADP > Prof ile > T raffic Anomaly LABEL DESCRIPTION Name This is the name of the ADP profile.
Chapter 31 ADP ZyWALL USG 50 User’s Guide 521 31.3.5 Protocol Anomaly Profiles Protocol anomaly is the third screen in an ADP profile. Protocol anomaly (PA) rules check for protocol compliance against th e relev ant RFC (Request for Comments).
Chapter 31 AD P ZyWALL USG 50 User’s Guide 522 Figure 307 Profile s: Protocol Anomaly.
Chapter 31 ADP ZyWALL USG 50 User’s Guide 523 The following table describes t he fields in this screen. T able 157 Configuration > ADP > Prof ile > Protocol Anomaly LABEL DESCRIPTION Name This is the name of the profil e.
Chapter 31 AD P ZyWALL USG 50 User’s Guide 524 Action T o edit what action the ZyW ALL takes when a packet matches a signature, select the signature and use the Act ion icon. original se tting : Select this action to return each signature in a service group to its previously saved configuration.
Chapter 31 ADP ZyWALL USG 50 User’s Guide 525 31.4 ADP T echnical Reference This section is divided i nto traff ic anomaly background information and protocol anomaly background information. T raffic Anomaly Background Information The following sections may help you conf igure the traffic anomaly profile screen ( Section 31.
Chapter 31 AD P ZyWALL USG 50 User’s Guide 526 Decoy Port Scans Decoy port scans are scans where the atta cker has spoofed the source address . These are some decoy scan types: •T C P D e c o y P o r t s c a n • UDP Decoy P ortscan • IP Decoy P ortscan Distributed Port Scans Distributed port scans are many -to-one port scans.
Chapter 31 ADP ZyWALL USG 50 User’s Guide 527 Flood Detection Flood attacks satur ate a network with useless data, use up all a vailabl e bandwidth, and therefore mak e communi cati ons in the network impossible.
Chapter 31 AD P ZyWALL USG 50 User’s Guide 528 the initiator responds with an ACK (ack nowledgment). After this handshak e, a connection is established. Figure 309 TCP Three-W ay Handshake A SYN flood attack is when an attacker sends a series of SYN packets.
Chapter 31 ADP ZyWALL USG 50 User’s Guide 529 UDP Flood Attack UDP is a connection-less protocol and it does not require any connection setup procedure to tr ansfer d ata. A UDP flood at tack is p ossible when an at tack er s ends a UDP packet to a random port on the victim system.
Chapter 31 AD P ZyWALL USG 50 User’s Guide 530 DOUBLE-ENCODING ATT A C K This rule is IIS specific. IIS does two passes through the request URI, doing decodes in each one. In the first pass, IIS encoding (UTF-8 unicode, ASCII, bare byte, and %u) is done.
Chapter 31 ADP ZyWALL USG 50 User’s Guide 531 WEBROO T -DIRECTOR Y - TRAV ERSAL A TT ACK This is when a directory traversal tr averses past the web server root directory . This generates much fewer false positives than the directory option, because it doesn’t alert on directory tra versals that stay within the web serv er directory structure.
Chapter 31 AD P ZyWALL USG 50 User’s Guide 532 TRUNCA TED-HEADER ATT A C K This is when an ICMP packet is sent which has an ICMP datagram length of less than the ICMP header length.
ZyWALL USG 50 User’s Guide 533 C HAPTER 32 Content Filtering 32.1 Overview Use the content filtering feature to cont rol access to specific web sites or web content. 32.1.1 What Y ou Can Do in this Chapter •U s e t h e General screens ( Section 32.
Chapter 32 Content Filtering ZyWALL USG 50 User’s Guide 534 Content Filtering Profiles A content filtering profile convenient ly stores your custom set tings for the following featur es .
Chapter 32 Co n te nt F ilt ering ZyWALL USG 50 User’s Guide 535 Since the Z y WALL checks the URL ’ s domain name (or IP addres s) and fil e path separately , it will not find items that go across the t wo. F or example, wi th the URL www .zyxel.
Chapter 32 Content Filtering ZyWALL USG 50 User’s Guide 536 your list of content filter policies , create a denial of access message or specify a redirect URL and check your external we b filtering service regis tration status.
Chapter 32 Co n te nt F ilt ering ZyWALL USG 50 User’s Guide 537 Move T o change an entry’ s position in the numbered list, select it and click Move to display a field to type a number for where y ou want to put that entry and press [ENTER] to move the entry to the number that you typed.
Chapter 32 Content Filtering ZyWALL USG 50 User’s Guide 538 32.3 Content Filter Policy Add or Edit Screen Click Configuration > Anti-X > Content Filter > General > Add or Edit to open the Content Filter Policy screen.
Chapter 32 Co n te nt F ilt ering ZyWALL USG 50 User’s Guide 539 filter policy . A content filter policy defi nes which content filt er profile should be applied, when it should be app lied, and to whose web access it shoul d be applied.
Chapter 32 Content Filtering ZyWALL USG 50 User’s Guide 540 32.4 Content Filter Profile Screen Click Configuration > Anti-X > Content Filter > Filter Profile to open the Filter Profile screen. A content filter profile de fines to which web se rvices, web sites or web site categories acce ss is to be all owed or denied.
Chapter 32 Co n te nt F ilt ering ZyWALL USG 50 User’s Guide 541 See Chapter 33 on page 557 for how to view content filtering reports. Figure 314 Configur ation > Anti-X > Content Filter > .
Chapter 32 Content Filtering ZyWALL USG 50 User’s Guide 542 The following table describes t he labels in this screen. T able 162 Configuration > Anti-X > Cont ent Filter > Filter Profile > Add LABEL DESCRIPTION License Status This read-only field displays the status of y our content-filtering database service registration.
Chapter 32 Co n te nt F ilt ering ZyWALL USG 50 User’s Guide 543 Action for Unsafe W eb Pa g e s Select Pass to allow users to access web pages that match the unsafe categories that you select below . Select Block to prevent users from accessing web pages that match the unsafe categories that you select below .
Chapter 32 Content Filtering ZyWALL USG 50 User’s Guide 544 Action When Category Server Is Unav ailable Sele ct Pass to allow users to access any requested web page if the external content filtering database is unav ailable. Select Block to block access to any requested web page if the external content filtering database is unavailable.
Chapter 32 Co n te nt F ilt ering ZyWALL USG 50 User’s Guide 545 Spyware/Malware Sources This category includes pages which distribute spyware and other malware.
Chapter 32 Content Filtering ZyWALL USG 50 User’s Guide 546 Nudity This category includes pages containing nude or seminude depictions of the human body . These depictions are not necessarily sexual in intent or effect, but may include pages containing nude paintings or photo galleries of artistic nature.
Chapter 32 Co n te nt F ilt ering ZyWALL USG 50 User’s Guide 547 Arts/Entertainment This category incl udes pages that promote and provide information about motion pictures, videos, television, music and programming guides, books, comics, movie theatres, galleries, artists or reviews on entertainment.
Chapter 32 Content Filtering ZyWALL USG 50 User’s Guide 548 Government/Legal This category includes pages sponsored by or which provide information on government, government agencies and government services such as taxation and emergency services. It also includes pages that discuss or explain laws of various governmental entities.
Chapter 32 Co n te nt F ilt ering ZyWALL USG 50 User’s Guide 549 Re ligion This category includes pages that promote and provide information on conventional or unconventional religious or quasi-religious subjects, as well as churches, synagogues, or other houses of worship.
Chapter 32 Content Filtering ZyWALL USG 50 User’s Guide 550 Sports/Recreation/ Hobbies This category includes pages that promote or provide information about spectator sports, recreational activities, or hobbies. This includes pages that discuss or promote camping, gardening, and collecting.
Chapter 32 Co n te nt F ilt ering ZyWALL USG 50 User’s Guide 551 Alcohol Sites that promote, offer for sale, glorify , review , or in any wa y advocate the use or creation of alcoholic bever ages, including but not limited to beer , wine , and hard liquors.
Chapter 32 Content Filtering ZyWALL USG 50 User’s Guide 552 32.5.1 Content Filter Blocked and W arning Messages These are the content filtering warnin g messages.
Chapter 32 Co n te nt F ilt ering ZyWALL USG 50 User’s Guide 553 32.6 Content Filter Customization Screen Click Configuration > Anti-X > Content Filter > Filter Profile > Add or Edit > Customization to open the Customization screen.
Chapter 32 Content Filtering ZyWALL USG 50 User’s Guide 554 Allow W eb traffic for trusted web sites only When this box is selected, the Z yWALL blocks W eb access to sites that are not on the Trusted Web Sites list. If they are chosen carefully , this is the most effective w ay to block objectionable material.
Chapter 32 Co n te nt F ilt ering ZyWALL USG 50 User’s Guide 555 32.7 Content Filter T echnical Reference This section provi des content filtering background informati on. Forbidden W eb Sites This list displays the forbidden web sites already added.
Chapter 32 Content Filtering ZyWALL USG 50 User’s Guide 556 External Content Filter Server Lookup Procedure The content filter lookup process is described below . Figure 317 Content Filter Lookup Procedure 1 A computer behind the Z yWALL tries to access a web site.
ZyWALL USG 50 User’s Guide 557 C HAPTER 33 Content Filter Reports 33.1 Overview Y ou can view content filtering reports afte r you ha ve activ ated the category-based content filtering sub scription service. See Section 10.1 on page 209 on how to create a myZ yXEL.
Chapter 33 Content Filter Reports ZyWALL USG 50 User’s Guide 558 2 Fill in your myZ yXEL.com account information and click Login . Figure 318 myZyXEL.
Chapter 3 3 Content Filt er Reports ZyWALL USG 50 User’s Guide 559 3 A welcome screen displays. Cl ick your Z yWALL’ s model name and/or MAC address under Registered ZyXEL Products (the ZyW ALL 70 is shown as an exa m ple here).
Chapter 33 Content Filter Reports ZyWALL USG 50 User’s Guide 560 4 In the Service Management screen click Content Filter in the Service Name column to open the content filter reports screens. Figure 320 myZyXEL.com: Service Ma nagement 5 In the Web Filter Home screen, click the Reports tab.
Chapter 3 3 Content Filt er Reports ZyWALL USG 50 User’s Guide 561 6 Select items under Global Reports to view the corresponding reports. Figure 322 Content Filter Reports: Report Home 7 Select a ti.
Chapter 33 Content Filter Reports ZyWALL USG 50 User’s Guide 562 8 A chart and/or list of requeste d web site categories disp lay in the lower half of the screen.
Chapter 3 3 Content Filt er Reports ZyWALL USG 50 User’s Guide 563 9 Y ou can click a category in the Categ ories report or click URLs in the Report Home screen to see the URLs that were requ es te d.
Chapter 33 Content Filter Reports ZyWALL USG 50 User’s Guide 564.
ZyWALL USG 50 User’s Guide 565 C HAPTER 34 Anti-Spam 34.1 Overview The anti-spam feature can mark or disc ard spam (unsolicited commercial or junk e-mail). Use the white list to identify legitimate e-mail. Use t he black list to identify spam e- mail.
Chapter 34 Anti- S pa m ZyWALL USG 50 User’s Guide 566 Black List Configure black list entri es to identify spam. The black list entries ha ve the Z yWALL classify an y e-mail that is from or forwarded by a specified IP address or uses a specified header field and header v alue as being spam.
Chapter 34 Anti-Spam ZyWALL USG 50 User’s Guide 567 E-mail Header Buffer Size The Z yW ALL has a 5 K buffer for an individu al e-mail header . If an e-mail’ s header is longer than 5 K, the Z yWALL only checks up to the fi rst 5 K.
Chapter 34 Anti- S pa m ZyWALL USG 50 User’s Guide 568 spam policies. Y ou can also select t he action the Z yWALL takes when the mail sessions threshold is reached. Figure 325 Configu ration > Anti-X > Anti-S pam > General The following table describes t he labels in this screen.
Chapter 34 Anti-Spam ZyWALL USG 50 User’s Guide 569 34.3.1 The Anti-S p am Policy Add or Edit Screen Click the Add or Edit icon in the Configuration > Anti-X > Anti-Spam > General screen to display the configuration sc reen as shown next.
Chapter 34 Anti- S pa m ZyWALL USG 50 User’s Guide 570 check, which e-mail protocols to scan, the scanning options, and the action to t ake on spam tr affic. Figure 326 Configu ration > Anti-X > Anti-S pam > General > Add The following table describes t he labels in this screen.
Chapter 34 Anti-Spam ZyWALL USG 50 User’s Guide 571 34.4 The Anti-S p am Black List Screen Click Configuration > Anti-X > Anti-Spam > Black / White L ist to display the Anti-Spam Black List screen. Configure the black li st to identify spam e-mail.
Chapter 34 Anti- S pa m ZyWALL USG 50 User’s Guide 572 specific subject t ext. Click a column’ s heading cell to s ort the tabl e entries by that column’s criteria.
Chapter 34 Anti-Spam ZyWALL USG 50 User’s Guide 573 34.4.1 The Anti-S p am Black or White List Add/Edit Screen In the anti-spam Black List or White List screen, click the Add icon or an Edit icon to displa y the following screen. Use this screen to configure an anti-spam bl ack list entry to identify spam e-mail.
Chapter 34 Anti- S pa m ZyWALL USG 50 User’s Guide 574 34.4.2 Regular Expressions in Black or White List Entries The following applies for a black or white li st entry based on an e-mail subj ect, e- mail address, or e-mail header v alue. • Use a question mark (?) to let a single char acter vary .
Chapter 34 Anti-Spam ZyWALL USG 50 User’s Guide 575 34.5 The Anti-S p am White List Screen Click Configuration > Anti-X > Anti-Spam > Black/White List and then the White List tab to displa y the Anti-Spam White List screen. Configure the white list to identify legi timate e-mail.
Chapter 34 Anti- S pa m ZyWALL USG 50 User’s Guide 576 34.6 The DNSBL Screen Click Configuration > Anti-X > Anti-Spam > DNSBL to display the anti-spam DNSBL screen. Use this screen to co nfigure the Z yWALL to chec k the sender and relay IP addresses in e-mail headers ag ainst DNS (Domain Name Service)-based spam Black Lists (DNSBLs).
Chapter 34 Anti-Spam ZyWALL USG 50 User’s Guide 577 The following table describes t he labels in this screen. T able 169 Configuration > Anti-X > Anti-S pam > DNSBL LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greate r or lesser num ber of configuration fields.
Chapter 34 Anti- S pa m ZyWALL USG 50 User’s Guide 578 34.7 Anti-S p am T echnical Reference Here is more detailed anti-spam information. DNSBL • T h e Zy W A L L c h e c k s o n l y p u b l i c s e n d e r a n d relay IP addresses, it does not check private IP addresses.
Chapter 34 Anti-Spam ZyWALL USG 50 User’s Guide 579 Here is an example of an e- mail classified as spam based on DNSBL repl ies. Figure 331 DNSBL S pam Detection Example 1 The Z yW ALL receives an e- mail that was se nt from IP address a.a.a.a and relay ed by a n e -ma il ser ver at IP add re ss b.
Chapter 34 Anti- S pa m ZyWALL USG 50 User’s Guide 580 Here is an example of an e-mail classifi ed as legitimate based on DNSBL replies. Figure 332 DNSBL Legitimate E-mail Detection Example 1 The Z yWALL receives an e-mail that was sent f rom IP address c.
Chapter 34 Anti-Spam ZyWALL USG 50 User’s Guide 581 If the Z yWALL receiv es conf licting DNSBL replies for an e-mail routing IP address, the Z yWALL classifies the e-mail as spam. Here is an example. Figure 333 Conflicting DN SBL Replies Ex ample 1 The Z yW ALL receives an e-mail that was sent from IP addres s a.
Chapter 34 Anti- S pa m ZyWALL USG 50 User’s Guide 582.
ZyWALL USG 50 User’s Guide 583 C HAPTER 35 User/Group 35.1 Overview This chapter describes how t o set up user accounts, user groups, and user settings for the Z yWAL L. Y ou can also set up rules that c ontrol when users have to log in to the Z yWALL before the Zy WALL routes traffic for them.
Chapter 35 Us er /G ro up ZyWALL USG 50 User’s Guide 584 Note: The default admin account is alwa ys authenticated locally , regardless of the authentication method setting. (See Chapter 39 on page 617 for more information about authenticat ion methods.
Chapter 35 User/Group ZyWALL USG 50 User’s Guide 585 See Setting up User Attr ibutes in an External Server on page 5 97 for a lis t of attributes and how to set up the at tributes in an external server .
Chapter 35 Us er /G ro up ZyWALL USG 50 User’s Guide 586 35.2 User Summary Screen The User screen provides a summary of all us er accounts. T o access this screen, login to th e W eb Con figurator , an d click Co nfiguration > Object > User/Group .
Chapter 35 User/Group ZyWALL USG 50 User’s Guide 587 •- [ d a s h e s ] The first character must be alphabetical (A -Z a-z), an underscore (_), or a dash (- ).
Chapter 35 Us er /G ro up ZyWALL USG 50 User’s Guide 588 The following table describes t he labels in this screen. T able 172 Configuration > User/Group > User > Add LABEL DESCRIPTION User Name T ype the user name for this user account.
Chapter 35 User/Group ZyWALL USG 50 User’s Guide 589 35.3 User Group Summary Screen User groups consist of access users and other user groups. Y ou cannot put admin users in user groups. The Gr oup screen provides a summar y of all user groups. In addition, this screen allows y o u to add, edi t, and remove user groups.
Chapter 35 Us er /G ro up ZyWALL USG 50 User’s Guide 590 35.3.1 Group Add/Edit Screen The Group Add/Edit screen allows you to create a new user group or edit an existing one. T o access this screen, go to the Group screen (see Section 35.3 on page 589 ), and click either the Ad d icon or an Edit icon.
Chapter 35 User/Group ZyWALL USG 50 User’s Guide 591 35.4 Setting Screen The Setting screen controls default settings, login settings, loc kout settings, and other user settings for the Z yWALL. Y ou ca n also use this screen to specify when users must log in to the Z yWALL before it rout es traffic for t hem.
Chapter 35 Us er /G ro up ZyWALL USG 50 User’s Guide 592 T o access this screen, login to the W eb Configurator , and click Configuration > Object > User/Group > Setting . Figure 338 Configuration > Obje ct > User/Group > Sett i ng The following table descri bes the labels in this screen.
Chapter 35 User/Group ZyWALL USG 50 User’s Guide 593 User T ype These are the kinds of user account the Z yWALL supports. • admin - this user can look at and change the configuration of the Z yWAL.
Chapter 35 Us er /G ro up ZyWALL USG 50 User’s Guide 594 35.4.1 Default User Authenti cation T imeout Settings Edit Screens The Default Authentication Timeout Settings Edit screen allows you to set the default au th ent ication tim e out settin g s fo r th e selected typ e of us er account.
Chapter 35 User/Group ZyWALL USG 50 User’s Guide 595 T o access this screen, go to the Configuration > Obje ct > User/Group > Setting screen (see Section 35.4 on page 591 ), and click one of the Default Authentication Timeout Settings section’s Edit icons.
Chapter 35 Us er /G ro up ZyWALL USG 50 User’s Guide 596 35.4.2 User A ware Login Example Access users cannot use the W eb Configurator to browse the configuration of the Z yWALL . Instead, after access users lo g into the Z yWALL, the following screen appears.
Chapter 35 User/Group ZyWALL USG 50 User’s Guide 597 35.5 User /Group T echnical Reference This section provi des some informat ion on us e rs who use an exte rn al authentication server in order to log in.
Chapter 35 Us er /G ro up ZyWALL USG 50 User’s Guide 598.
ZyWALL USG 50 User’s Guide 599 C HAPTER 36 Addresses 36.1 Overview Address objects can represent a single IP address or a r ange of IP addresses. Address groups are composed of addr ess objects and other address groups. 36.1.1 What Y ou Can Do in this Chapter •T h e Address screen ( Section 36.
Chapter 36 Add re sse s ZyWALL USG 50 User’s Guide 600 • RANGE - a range address is defined by a Starting IP Address and an Ending IP Address . • SUBNET - a network address is defined by a Network IP address and Netmask subnet mask. The Address screen provides a summary of all addresses in the Z yWALL.
Chapter 36 Addresses ZyWALL USG 50 User’s Guide 601 36.2.1 Address Add/Edit Screen The Configuration > Address Add/Edit screen allows you to create a new address or edit an existing one. T o access this screen, go to the Address screen (see Section 36.
Chapter 36 Add re sse s ZyWALL USG 50 User’s Guide 602 36.3 Address Group Summary Screen The Address Group screen provides a summary of all address groups. T o access this screen, click C onfiguration > Object > Address > Address Group . Click a column’ s heading cell to sort t he table en tries by that col umn’s criteria.
Chapter 36 Addresses ZyWALL USG 50 User’s Guide 603 36.3.1 Address Group Add/Edit Screen The Address Group Add/Edit screen allows you to create a new addres s group or edit an existing one. T o access this screen, go to the Address Group screen (see Section 36.
Chapter 36 Add re sse s ZyWALL USG 50 User’s Guide 604.
ZyWALL USG 50 User’s Guide 605 C HAPTER 37 Services 37.1 Overview Use service objects to define T CP applications, UDP applications, and ICMP messages. Y ou can also create service groups to refer to multip le service objects in other features. 37.1.
Chapter 37 Serv ice s ZyWALL USG 50 User’s Guide 606 Both TCP and UDP use ports to identify the source and destination. Each port is a 16-bit number . Some port numbers hav e b een standardized and are used by low- level system processes; man y othe rs have no particular meaning.
Chapter 37 Services ZyWALL USG 50 User’s Guide 607 entries by that col umn’s criteria. Click the heading cell again to reverse the sort order . Figure 347 Configu ration > Object > Service > Service The following table describes t he labels in this screen.
Chapter 37 Serv ice s ZyWALL USG 50 User’s Guide 608 37.2.1 The Service Add/Edit Screen The Service Add/Edit screen allows you to create a new service or edit an existing one. T o access this screen, go to the Service screen (see Section 37.2 on page 606 ), and click either the Ad d icon or an Edit icon.
Chapter 37 Services ZyWALL USG 50 User’s Guide 609 T o access this screen, log in to the W eb Configurator , and cli ck Configuration > Object > Service > Service Group . Figure 349 Configu ration > Object > Service > Service Group The following table describes the labels in this screen.
Chapter 37 Serv ice s ZyWALL USG 50 User’s Guide 610 37.3.1 The Service Group Add/Edit Screen The Service Group Add/Edit screen allows you to create a new service group or edit an existing one. T o access this screen, go to the Service Gro up screen (see Section 37.
ZyWALL USG 50 User’s Guide 61 1 C HAPTER 38 Schedules 38.1 Overview Use schedules to set up one-time and recurring schedules for policy routes, firewall rules, application patrol, and content f iltering. The Z yWALL supports one- time and recurring schedules.
Chapter 38 Sc he du le s ZyWALL USG 50 User’s Guide 612 Finding Out More • See Section 6.6 on page 105 for rel ated informat ion on these screens. • See Section 45.
Chapter 38 Sc hedules ZyWALL USG 50 User’s Guide 613 38.2.1 The One-T ime Schedule Add/Edit Screen The One-Time Schedule Add/Edit screen allows you to define a one-ti me schedule or edit an existing one. T o access this screen, go to the Schedule screen (see Section 38.
Chapter 38 Sc he du le s ZyWALL USG 50 User’s Guide 614 38.2.2 The Recurring Schedule Add/Edit Screen The Recurring Schedule Add/Edit screen allows you to defi ne a recurring schedule or edit an existing one. T o access this screen, go to the Schedule screen Date Time StartDate Specify the year , month, and day when the schedule be gins.
Chapter 38 Sc hedules ZyWALL USG 50 User’s Guide 615 (see Section 38.2 on page 612 ), and click either the Add icon or an Edit icon i n the Recurring se ct ion. Figure 353 Configu ration > Object > Schedule > Edit (Recurring) The Year , Month , and Day columns are not used in recurring sched ules and are disabled in this screen.
Chapter 38 Sc he du le s ZyWALL USG 50 User’s Guide 616.
ZyWALL USG 50 User’s Guide 617 C HAPTER 39 AAA Server 39.1 Overview Y ou can use a AAA (Authentication, Authorization, Accounting) server to pro vide access control to your network. The AAA serv er can be a Acti ve Directory , LDAP , or RADIUS server .
Chapter 39 AAA Server ZyWALL USG 50 User’s Guide 618 39.1.2 RADIUS Server RADIUS (Remote Authentication Dial- In User Service) authentication is a popular protocol used to au thenticate users by me ans of an external server instead of (or in addition to) an internal device user database that is l imited to the memory capacity of the d evice.
Chapter 39 AAA Server ZyWALL USG 50 User’s Guide 619 •U s e t h e Configuration > Object > AAA Serv er > RADIUS screen ( Section 39.3 on page 623 ) to configure the default extern al RADIUS server to use for user authentication.
Chapter 39 AAA Server ZyWALL USG 50 User’s Guide 620 organizational boundaries. The following figure shows a basic directory structure branchi ng from countries to organizations to organization al units to individuals. Figure 356 Basic Direc tory S tructure Distinguished Name (DN) A DN uniquely identifies an entry in a directory .
Chapter 39 AAA Server ZyWALL USG 50 User’s Guide 621 • See Section 7.6 on page 131 for an example of how to use a RADIUS server to authenticate user acco unts based on groups.
Chapter 39 AAA Server ZyWALL USG 50 User’s Guide 622 following screen. Use this screen to create a new AD or LDAP entry or edit an existing one. Figure 358 Configura tion > Object > AAA Server > Active Directory (or LDAP) > Ad d The following table describes t he labels in this screen.
Chapter 39 AAA Server ZyWALL USG 50 User’s Guide 623 39.3 RADIUS Server Summary Use the RADIUS screen to manage the list of RADIUS servers the Z yWALL can use in authenticating users. Base DN S pecify the directory (up to 127 alphanumerical characters).
Chapter 39 AAA Server ZyWALL USG 50 User’s Guide 624 Click Configuratio n > Object > AAA Server > RADIUS to display the RADIUS screen. Figure 359 Configuration > Object > AAA Server > RADIUS The following table describes t he labels in this screen.
Chapter 39 AAA Server ZyWALL USG 50 User’s Guide 625 39.3.1 Adding a RADIUS Server Click Configuratio n > Object > AAA Server > RADIUS to display the RADIUS screen. Click the Add icon or an Edit icon to disp lay the followi ng scree n. Use th is screen to create a new AD or LDAP entry or edit an existing one.
Chapter 39 AAA Server ZyWALL USG 50 User’s Guide 626 Timeout S pecify the timeout period (betwee n 1 and 300 seconds) before the Z yWALL disconn ects from the RADIUS server . In this case, user authentication fails. Search timeout occurs when either the user information is not in the RADIUS server or the RADIUS server is down.
ZyWALL USG 50 User’s Guide 627 C HAPTER 40 Authentication Method 40.1 Overview Authentication method objects set how the ZyW ALL authenticates wireless, HTTP/ HT TPS clients, and peer IPSec routers (ext ended authentication) clients.
Chapter 40 Auth en tic ation Method ZyWALL USG 50 User’s Guide 628 3 Select Server Mode and select an auth entication method object from the drop- down list box. 4 Click OK to sav e the settings. Figure 361 Example: Using Authentication Method in VPN 40.
Chapter 40 Authentication Method ZyWALL USG 50 User’s Guide 629 40.2.1 Creating an Authentication Method Object Follow the steps below to create an au thentica ti on me thod object. 1 Click Configuration > Object > Auth. Method . 2 Click Add .
Chapter 40 Auth en tic ation Method ZyWALL USG 50 User’s Guide 630 7 Click OK to sav e the settings or click Ca ncel to discard all changes and return to the previous screen. Figure 363 Configuration > O bj e ct > Auth. Meth od > Add The following table describes t he labels in this screen.
Chapter 40 Authentication Method ZyWALL USG 50 User’s Guide 631 Add icon Click Ad d to add a new entry . Click Edit to edit the settings of an entry . Click Delete to delete an entry . OK Click OK to save the changes. Cancel Click Cancel to discard the changes.
Chapter 40 Auth en tic ation Method ZyWALL USG 50 User’s Guide 632.
ZyWALL USG 50 User’s Guide 633 C HAPTER 41 Certificates 41.1 Overview The Z yWALL can use certificates (also call ed digital IDs) to authentic ate users. Certificates are based on public-priv ate key pairs. A certifi cate contains the certificate owner’ s identity and public k e y .
Chapter 41 Certificates ZyWALL USG 50 User’s Guide 634 2 Tim keeps the private key and makes the pu blic key op enly av ailable. This means that anyone who receives a message seeming to come from Tim c an read it and verify whether it is really from him or not.
Chapter 41 Certificates ZyWALL USG 50 User’s Guide 635 Factory Default Certificate The Zy W ALL gener ates its own unique self -s igned certific ate when you first turn it on. This cert if i cat e is referred to in the GUI as the fa ctory defa u lt certific a t e.
Chapter 41 Certificates ZyWALL USG 50 User’s Guide 636 2 Make sure that the certificat e has a “. cer” or “.crt” file name extension. Figure 364 Remote Ho st Certi fica tes 3 Double-click the certificate’ s icon to open the Certificate window .
Chapter 41 Certificates ZyWALL USG 50 User’s Guide 637 41.2 The My Certificates Screen Click Configuration > Object > Ce rtificate > My Certificates to open the My Certificates screen. This is th e ZyW AL L’s summary l ist of ce rtificat es a nd certification requests.
Chapter 41 Certificates ZyWALL USG 50 User’s Guide 638 41.2.1 The My Certificates Add Screen Click Configuration > Object > Cert ificate > My Certificates and then the Add icon to open the My Certificates Add screen. Use this screen to have the T ype This field displays what kind of certificate this is.
Chapter 41 Certificates ZyWALL USG 50 User’s Guide 639 Z yWALL create a self-si gned certificate, enroll a certificate with a certification authority or gener ate a certification request.
Chapter 41 Certificates ZyWALL USG 50 User’s Guide 640 The following table describes t he labels in this screen. T able 197 Configuration > Object > Certificate > My Certificates > Add LABEL DESCRIPTION Name T ype a name to identify this certificate.
Chapter 41 Certificates ZyWALL USG 50 User’s Guide 641 Create a certification request and save it locally for later manual enrollment Select this to have the Z yWALL gener ate and store a request for a certificate. Use the My Certificate Details screen to view the certification request and copy it to send to the certification authority .
Chapter 41 Certificates ZyWALL USG 50 User’s Guide 642 If you confi gu red the My Certificate Create screen to hav e the Zy WALL enroll a certificate and the certificate enrol lment is not successful, y ou see a screen with a Return button that take s you back to the My Certificate Create screen.
Chapter 41 Certificates ZyWALL USG 50 User’s Guide 643 41.2.2 The My Certificates Edit Screen Click Configuration > Object > Cert ificate > My Certificates and then the Edit icon to open the My Certificate Edit screen. Y ou can use this screen to view in-depth certificate information an d change the certificate’ s name.
Chapter 41 Certificates ZyWALL USG 50 User’s Guide 644 The following table describes t he labels in this screen. T able 198 Configuration > Object > Certificate > My Certificates > Edit LABEL DESCRIPTION Name This fi eld displays the identifying name of this certificate.
Chapter 41 Certificates ZyWALL USG 50 User’s Guide 645 K ey Algorithm This field displays the type of algorithm that was used to generate the certificate’s k ey pair (the Z yWALL uses RS A encryption) and the length of the key set in bits (1024 bits for example).
Chapter 41 Certificates ZyWALL USG 50 User’s Guide 646 41.2.3 The My Certificates Import Screen Click Configuration > Object > Certific ate > My Certificates > Import to open the My Certificate Import screen. F ollow the instructions in this screen to save an exi sting certificate to t he Z yWALL.
Chapter 41 Certificates ZyWALL USG 50 User’s Guide 647 41.3 The T rusted Certificates Screen Click C onfiguration > O bject > Cert ificate > Truste d Certificates to open the Trusted Certificates screen. This screen d isplays a summary list of certificates that yo u have set t he ZyWALL to ac cept as trusted.
Chapter 41 Certificates ZyWALL USG 50 User’s Guide 648 41.3.1 The T rusted Certificates Edit Screen Click Configuration > Object > Cert ificate > Trusted Certificates and then a certificate’ s Edit icon to open the Trusted Certificates Edit screen.
Chapter 41 Certificates ZyWALL USG 50 User’s Guide 649 authority’ s list of revoked certifi cates befo re trusting a certificate issued by the certification authority .
Chapter 41 Certificates ZyWALL USG 50 User’s Guide 650 The following table describes t he labels in this screen. T able 201 Configuration > Object > Certificate > T rusted Certificates > Edit LABEL DESCRIPTION Name This fie ld displays the identifyin g name of this certificate.
Chapter 41 Certificates ZyWALL USG 50 User’s Guide 651 T ype This field displays general inform ation about the certificate. CA-signed means that a Certification Authority signed the certificate. Self-signed means that the certificate’ s owne r signed the certificate (not a certification authority).
Chapter 41 Certificates ZyWALL USG 50 User’s Guide 652 41.3.2 The T rusted Certificates Import Screen Click Configuration > Object > Certificat e > Trusted Certificates > Import to open the Trusted Certifica tes Import screen. Follow the inst ructions in this screen to save a trusted certificate to the Z yWALL.
Chapter 41 Certificates ZyWALL USG 50 User’s Guide 653 The following table describes t he labels in this screen. 41.4 Certificates T echnical Reference OCSP OCSP (Online Certificate Stat us Protocol) allows an application or device to check whether a certificate is v alid.
Chapter 41 Certificates ZyWALL USG 50 User’s Guide 654.
ZyWALL USG 50 User’s Guide 655 C HAPTER 42 ISP Accounts 42.1 Overview Use ISP accounts to manage Internet Se rvice Prov ider (ISP) account information for PPPoE/PPTP interfaces. An ISP account is a profile of settings for Internet access using PPP oE or PPTP .
Chapter 42 IS P Accoun ts ZyWALL USG 50 User’s Guide 656 The following table describes t he labels in this screen. See the ISP Accou nt Ed it section below for more information as well. 42.2.1 ISP Account Edit The ISP Account Edit screen lets you add i nformation about new accounts and edit inform ation about existing accoun ts.
Chapter 42 IS P Accoun ts ZyWALL USG 50 User’s Guide 657 The following table describes t he labels in this screen. T able 204 Configuration > Object > ISP Account > Edit LABEL DESCRIPTION Profile Name This field is read-only if you ar e editing an existing account.
Chapter 42 IS P Accoun ts ZyWALL USG 50 User’s Guide 658 Compression Select On button to turn on stac compression, and select Off to turn off stac compression. Stac compression is a data compression technique capable of compressing data by a factor of about fou r .
ZyWALL USG 50 User’s Guide 659 C HAPTER 43 SSL Application 43.1 Overview Y ou use S S L application objects in S SL VPN. Configure an SSL application object to specify the t ype of application and the address of t he local computer , server , or web site SSL us ers are to be able to access.
Chapter 43 SSL Application ZyWALL USG 50 User’s Guide 660 Remote Desktop Connections Use SSL VPN to allow remote users to ma nage LAN computers. Depending on the functions supported by the remote deskto p softw are, they can install or remove software, run progr ams, change set tings, an d open, copy , create, and delete files.
Chapter 43 SSL Application ZyWALL USG 50 User’s Guide 661 2 Click the Add button and select Web Application in the Ty pe field. In the Server Type field, select Web Server . Enter a descriptive name in t he Display Name field. For example, “CompanyIntranet” .
Chapter 43 SSL Application ZyWALL USG 50 User’s Guide 662 The following table describes t he labels in this screen. 43.2.1 Creating/Editing a W eb-based SSL Application Object A web-based application all ows remote user s to access an application via standard web browsers.
Chapter 43 SSL Application ZyWALL USG 50 User’s Guide 663 The following table describes t he labels in this screen. T able 206 Configuration > Object > SSL Application > Add/Edit: Web Application LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings This displays for VNC or RDP type web application objects.
Chapter 43 SSL Application ZyWALL USG 50 User’s Guide 664 Server Address(es) This field displays if the Serve r Type is s et to RDP or VNC . Specify the IP address or Fully-Qua lifi ed Domain Name (FQDN) of the computer(s) that you want to allow the remote users to manage.
ZyWALL USG 50 User’s Guide 665 C HAPTER 44 Endpoint Security 44.1 Overview Use Endpoint Security (EPS), also known as endpoi nt control, to make sure users’ computers comply with defined corpor ate policies before they can access the network or an SSL VPN tunnel.
Chapter 44 End po int Secu rity ZyWALL USG 50 User’s Guide 666 44.1.1 What Y ou Can Do in this Chapter Use the Configuration > Object > Endpoint Security screens ( Sect ion 44.2 on page 667 ) to create and manage endpoint securit y objects. 44.
Chapter 44 Endpoint Security ZyWALL USG 50 User’s Guide 667 44.2 End point Security Screen The Endpoint Security screen displays the endpoi nt security objects you have configured on the Z y WALL. Click Configuration > Obje ct > E nd point Security to display the screen.
Chapter 44 End po int Secu rity ZyWALL USG 50 User’s Guide 668 Apply Click this button to save your changes to the Z yWALL. R eset C lick this button to return the screen to its last -saved settings.
Chapter 44 Endpoint Security ZyWALL USG 50 User’s Guide 669 44.3 End point Security Add/Edit Click Configuration > Object > Endpo int Security and then the Add (or Edit ) icon to open the Endpoint Security Edit screen. Use this screen to configure an endpoint secu rity object.
Chapter 44 End po int Secu rity ZyWALL USG 50 User’s Guide 670 Figure 381 Configuration > O bject > Endpoint Sec u rity > Add.
Chapter 44 Endpoint Security ZyWALL USG 50 User’s Guide 671 The following table giv es an overview of the objects you can configure. T able 208 Configuration > Object > Endpoint Se curity > Add LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greater or lesser number of configuration fields.
Chapter 44 End po int Secu rity ZyWALL USG 50 User’s Guide 672 Checking Item - Personal Firewall If you selected Windows as the operating system, you can select whether or not the user’s computer is required to have personal firew all softw are installed.
Chapter 44 Endpoint Security ZyWALL USG 50 User’s Guide 673 Checking Item - File Information If you selected Windows or Linux as the oper ating system, you can use this table to check details of specific files on the user’s computer .
Chapter 44 End po int Secu rity ZyWALL USG 50 User’s Guide 674.
ZyWALL USG 50 User’s Guide 675 C HAPTER 45 System 45.1 Overview Use the system screens to configure general Z yWALL settings. 45.1.1 What Y ou Can Do in this Chapter •U s e t h e System > Host Name screen (see Section 45.2 on page 676 ) to configure a unique name for the ZyW ALL in your network.
Chapter 45 Sy stem ZyWALL USG 50 User’s Guide 676 • V antage CNM (Centralized Network Ma nagement) is a browser -based global management tool that allows an admini str ator to manage ZyXEL devices. Use the System > Vantage CNM screen (see Section 45.
Chapter 45 System ZyWALL USG 50 User’s Guide 677 a software mechan is m to set the time m anu ally or get the current time and date from an ex ternal server . T o change your Z yWALL’ s time based on your local time zone and date, click Configuration > System > Date/Time .
Chapter 45 Sy stem ZyWALL USG 50 User’s Guide 678 New Time (hh- mm-ss) This field displays the last updated time from the time server or the last time configured manually . When you set Time and Date Setu p to Manual , enter the new time in this field and then click Apply .
Chapter 45 System ZyWALL USG 50 User’s Guide 679 45.3.1 Pre-defined NTP T ime Servers List When you turn on the Z yWALL for the firs t time, the date and time start at 2003- 01-01 00:00:00. The Z yWALL then atte mpts to synchronize with one of the following pre-defined list of Netw ork Time Protocol (NTP) time servers.
Chapter 45 Sy stem ZyWALL USG 50 User’s Guide 680 45.3.2 T ime Server Synchronization Click the Synchronize Now button to get the time and date from the t ime server you specified in the Time Server Address field. When the Please Wait... screen a ppears, you may have to wait up to one minute.
Chapter 45 System ZyWALL USG 50 User’s Guide 681 5 Under Time and Date Setup , enter a Time Server A ddress ( T able 211 on page 679 ). 6 Click Apply . 45.4 Console Port S peed This section shows you how to set the cons ole port speed when you connect to the Z yWALL via the console port using a terminal emulation program.
Chapter 45 Sy stem ZyWALL USG 50 User’s Guide 682 45.5.1 DNS Server Address Assignment The Z yWALL can get the DNS server ad dresses in the following w ays. • The ISP tells you the DNS serv er addresses, usually in the form of an info r mat io n sh e et, wh en yo u sig n u p.
Chapter 45 System ZyWALL USG 50 User’s Guide 683 The following table describes t he labels in this screen. T able 213 Configuration > Syste m > DNS LABEL DESCRIPTION Address/PTR Rec o r d This record specifies the mapping of a Fully-Qualified Domain Name (FQDN) to an IP address.
Chapter 45 Sy stem ZyWALL USG 50 User’s Guide 684 DNS Serv er This is the IP address of a DN S server . This field displays N/A if you have the Z yWALL get a DNS server IP address from the ISP dynamically but the specified interface is not active.
Chapter 45 System ZyWALL USG 50 User’s Guide 685 45.5.3 Address Record An address record contains the mapping of a Fully-Qua lified Domain Name (FQDN) to an IP address.
Chapter 45 Sy stem ZyWALL USG 50 User’s Guide 686 The following table describes t he labels in this screen. 45.5.6 Domain Zone Forwarder A domain zone forwarder contains a DNS server’s IP address. The Z yWALL can query the DNS server to resolve domain zones for features like VPN, DDNS and the time server .
Chapter 45 System ZyWALL USG 50 User’s Guide 687 The following table describes t he labels in this screen. 45.5.8 MX Record A MX (Mail eXchange) record indicat es whic h host is respons ibl e for the mail for a particular domain, that is, c ontrols where mail is sent for that domain.
Chapter 45 Sy stem ZyWALL USG 50 User’s Guide 688 45.5.9 Adding a MX Record Click the Add icon in the MX Record table to add a MX record. Figure 389 Configuration > Syste m > DNS > MX Record Add The following table describes t he labels in this screen.
Chapter 45 System ZyWALL USG 50 User’s Guide 689 The following table describes t he labels in this screen. 45.6 WWW Overview The following figure shows secure and insecure management of the Z yWALL coming in from the W AN. HT TPS and SSH access are secure.
Chapter 45 Sy stem ZyWALL USG 50 User’s Guide 690 1 Y ou have disabled that service in the corres ponding screen. 2 The allowed IP address (a ddress object) i n th e Service Control table does not match the client IP address (the Z yWALL disallows the session).
Chapter 45 System ZyWALL USG 50 User’s Guide 691 Please refer to the following figure. 1 HT TPS connection requests from an SSL - aw are web browser go to port 443 (by default) on the Z yWALL’ s web server . 2 HT TP connection requests from a web brow ser go to port 80 (by default) on the Zy W A L L ’s w e b s e r v e r .
Chapter 45 Sy stem ZyWALL USG 50 User’s Guide 692 Note: Admin Service Contro l deals with management access (to the W eb Configurator). User Service Control deals with user access to the ZyW A LL (logging into SSL VPN for example).
Chapter 45 System ZyWALL USG 50 User’s Guide 693 Server P ort The HTTPS server listens on port 443 by default. If you change the HT TPS server port to a different number on the ZyW ALL, for example 8443, then you must notify people who need to acce ss the ZyW ALL W eb Configurator to use “https://Z yWALL IP Address: 8443 ” as the URL.
Chapter 45 Sy stem ZyWALL USG 50 User’s Guide 694 HT TP Enable Select the check box to allow or disallo w the computer with the IP address that matches the IP address(es) in the Serv ice Con trol table to access the Z y WALL W eb Configurator using HT TP connections.
Chapter 45 System ZyWALL USG 50 User’s Guide 695 45.6.5 Service Control Rules Click Add or Edit in the Service Cont rol table in a WWW , SSH , Telnet , FTP or SNMP screen to add a service control rule. Figure 393 Configur ation > System > Service Control Rule > Edit The following table describes t he labels in this screen.
Chapter 45 Sy stem ZyWALL USG 50 User’s Guide 696 also customize the page that di splays after an access user l ogs into the W eb Configurator to access network serv ices like th e Internet. S ee Chapter 35 on page 583 for more on access user accounts.
Chapter 45 System ZyWALL USG 50 User’s Guide 697 The following figures identify the p arts you can customize in the login and access pages. Figure 395 Login Page Customization Figure 396 Access Page.
Chapter 45 Sy stem ZyWALL USG 50 User’s Guide 698 •C l i c k Color to displa y a screen of web-safe colors from which to choose. • Enter the name of the desired color . • Enter a pound sig n (#) followed by the six -digit hexadecimal number that represents the desired color .
Chapter 45 System ZyWALL USG 50 User’s Guide 699 45.6.7 HTTPS Example If you hav e n’t changed the default HT TP S port on the ZyW A L L, th en in your browser enter “https://Z yWALL IP Address/” as the web site address where “Z yWALL IP Address” is the IP address or domain name of the Z yWALL y ou wish to access.
Chapter 45 Sy stem ZyWALL USG 50 User’s Guide 700 45.6.7.2 Net scape Na vigator W arning Messages When you attempt to access the Z yWALL HT TPS server , a Website Certified by an Unknown Authority scre en p op s up a ski ng if yo u trust the server certificate.
Chapter 45 System ZyWALL USG 50 User’s Guide 701 • The issuing certificat e authority of the Z yWALL’ s HT TPS server certificate is not one of the browser’s trusted certificate authorities.
Chapter 45 Sy stem ZyWALL USG 50 User’s Guide 702 Apply for a certificate from a Certificatio n Au thority (CA) that is trusted by the Z yWALL (see the Z yWALL’ s Trusted CA We b C o n f i g u r a t o r s c r e e n ) .
Chapter 45 System ZyWALL USG 50 User’s Guide 703 45.6.7.5.2 Installing Y our Personal Certificate(s) Y ou need a password in advance. The CA may issue the password or you may have to specify it during th e enrollment.
Chapter 45 Sy stem ZyWALL USG 50 User’s Guide 704 3 Enter the password g iven to yo u by the CA. Figure 405 Persona l Certificate Import Wizard 3 4 Have the wizard determine where the ce rtificate should be sav ed on your computer or se le ct Place all certificates in the following store and choose a different location.
Chapter 45 System ZyWALL USG 50 User’s Guide 705 5 Click Finish to complet e the wi zard and begin the import process. Figure 407 Persona l Certificate Import Wizard 5 6 Y ou should see the fo llowing screen when the certificate is correctly installed on your com pu ter .
Chapter 45 Sy stem ZyWALL USG 50 User’s Guide 706 2 When Authenticate Client Certificates is selected on the Z yW ALL, the following screen asks you t o select a personal cert ificate to send to th e ZyW ALL. This screen displays ev en if you only have a si ngle certificate as in the example.
Chapter 45 System ZyWALL USG 50 User’s Guide 707 SSH is a secure communication protocol t hat combines authentication and data encryption to provide secure encryp ted communication between two hosts over an unsecured network.
Chapter 45 Sy stem ZyWALL USG 50 User’s Guide 708 2 Encryption Method Once the identification is v erified, both the client and server must agree on the type of encryption method t o use.
Chapter 45 System ZyWALL USG 50 User’s Guide 709 Note: It is recommended that you disable T elnet and FTP when you configure SSH for secure connections. Figure 414 Configuration > Syst em > SSH The following table describes t he labels in this screen.
Chapter 45 Sy stem ZyWALL USG 50 User’s Guide 710 45.7.5 Secure T elnet Using SSH Examples This section shows two examples usin g a command interface and a gr aphical interface SSH client progr am to remotely access the Z yWALL. The configur ation and connection steps are similar for most S SH client prog r ams.
Chapter 45 System ZyWALL USG 50 User’s Guide 71 1 Enter the password to log in to the Z yWALL. The CLI screen displays next. 45.7.5.2 Example 2: Linux This section describes how to access the Z yWALL using the OpenSSH client program t hat comes with most Linux dis tributions.
Chapter 45 Sy stem ZyWALL USG 50 User’s Guide 712 45.8.1 Configuring T elnet Click Configuration > System > TELNET to configure your Z yWALL for remote T elnet access. Use this screen to speci fy from which zones T elnet can be used to manage the Z yW ALL.
Chapter 45 System ZyWALL USG 50 User’s Guide 713 45.9 FTP Y ou ca n upload and download the Z yWALL’ s firmware and configur ation files using FTP . T o use this feature, your computer must have an FTP client. Please see Chapter 47 on page 737 for more information about firmw are and configuration files.
Chapter 45 Sy stem ZyWALL USG 50 User’s Guide 714 be used to access the Z yWALL. Y ou can also specify from which IP addresses the access can come. Figure 419 Configu ration > System > FTP The following table describes t he labels in this screen.
Chapter 45 System ZyWALL USG 50 User’s Guide 715 45.10 SNMP Simple Network Manageme nt Protocol is a protocol used for ex changing management information between network de vices. Y our Z yWALL supports SNMP agent functionality , which allows a manager station to manage and moni tor the Z yW ALL through the network.
Chapter 45 Sy stem ZyWALL USG 50 User’s Guide 716 and version two (SNMPv2c). The next fi gure illustrates an SNMP management operation. Figure 420 SNMP Manageme nt Model An SNMP managed network consists of two main types of component: agents and a manager .
Chapter 45 System ZyWALL USG 50 User’s Guide 717 • GetNext - Allows the manager to retriev e the next object variable from a tabl e or list within an agent. In SNMPv1, when a mana ger wants to retriev e all elements of a table from an agent, it initiates a Get operat ion, followed by a series of GetNext oper ations.
Chapter 45 Sy stem ZyWALL USG 50 User’s Guide 718 settings, including from which z ones SNMP can be used to access the Z y W ALL. Y ou can also specify from whi ch IP addresses the access can come. Figure 421 Configuration > Sy st em > SNMP The following table describes t he labels in this screen.
Chapter 45 System ZyWALL USG 50 User’s Guide 719 45.1 1 V ant age CNM V antage CNM (Centralized Network Management ) is a browser-based global management solution that allows an admi nistr ator from any location to easily configure, manage, monitor and troubleshoot Z yXEL devices located worldwide.
Chapter 45 Sy stem ZyWALL USG 50 User’s Guide 720 45.1 1.1 Configuring V ant age CNM V antage CNM is disabled on th e devi ce by default. Click Configuration > System > Vantage CNM to configure your device’ s V antage CNM settings.
Chapter 45 System ZyWALL USG 50 User’s Guide 721 Tr a n s f e r Protocol Select whether the V antage CNM sessions should use regular HT TP connections or secure HT TPS connections. Note: HTTPS is recommended. The V antage CNM server must use the same setting.
Chapter 45 Sy stem ZyWALL USG 50 User’s Guide 722 45.12 Language Screen Click Configuration > Sys tem > Language to open the following screen. Use this screen to select a d isplay language for the Z yWALL’ s W eb Configurator screens.
ZyWALL USG 50 User’s Guide 723 C HAPTER 46 Log and Report 46.1 Overview Use these screens to configure da ily reportin g an d log sett in gs. 46.1.1 What Y ou Can Do In this Chapter •U s e t h e Email Daily Report screen ( Section 46.2 on page 723 ) to config ure where and how to send daily reports and what reports to s end.
Chapter 46 Log and Report ZyWALL USG 50 User’s Guide 724 Click Configuration > Log & Report > Email Daily Report to displa y the following screen.
Chapter 46 Log and Report ZyWALL USG 50 User’s Guide 725 The following table describes t he labels in this screen. 46.3 Log Setting Screens The Log Setting screens control log messages and alerts.
Chapter 46 Log and Report ZyWALL USG 50 User’s Guide 726 The Log Setting tab also controls what information is saved in each log. Fo r the system log, you can also specify whic h log messages are e-mailed, where they are e-mailed, and how often they are e-mailed.
Chapter 46 Log and Report ZyWALL USG 50 User’s Guide 727 46.3.2 Edit System Log Settings The Log Settings Edit screen controls the detailed settings for each log in the system log (which includes th e e-mail profiles). Go to the Log Settings Summary screen (see Section 46.
Chapter 46 Log and Report ZyWALL USG 50 User’s Guide 728 Figure 426 Configu ration > Log & Report > Log Setting > Edit (Syste m Log).
Chapter 46 Log and Report ZyWALL USG 50 User’s Guide 729 The following table describes t he labels in this screen. T able 230 Configuration > Log & Repo rt > Log Setting > Edit (System Log) LABEL DESCRIPTION E-Mail Se rv er 1/2 Active Sele ct this to send log messages and alerts according to the information in this section.
Chapter 46 Log and Report ZyWALL USG 50 User’s Guide 730 E-mail Server 1 Use the E-Mail Server 1 drop-down list to change the settings for e-mailing logs to e-mail server 1 for all log categories. Using the System Log drop-down list to disable all logs overrides your e-mail server 1 settings.
Chapter 46 Log and Report ZyWALL USG 50 User’s Guide 731 Active Sele ct this to activate log consolidation. Log consolidation aggregates multiple log messages th at arrive within the specified Log Consolidation Interval .
Chapter 46 Log and Report ZyWALL USG 50 User’s Guide 732 46.3.3 Edit Remote Server Log Settings The Log Settings Edit screen controls the detailed settings for each log in the remote server (syslog). Go to the Log Settings Summary screen (see Section 46.
Chapter 46 Log and Report ZyWALL USG 50 User’s Guide 733 The following table describes t he labels in this screen. T able 231 Configuration > Log & Repo rt > Log Setting > Edit (Remote .
Chapter 46 Log and Report ZyWALL USG 50 User’s Guide 734 46.3.4 Active Log Summary Screen The Active Log Summar y screen allows you to view and to edit what information is included in the system log, e-mail profiles, and remote servers at the same time.
Chapter 46 Log and Report ZyWALL USG 50 User’s Guide 735 The following table describes t he fields in this screen. T able 232 Configuration > Log & Repo rt > Log Setting > Active Log Summary LABEL DESCRIPTION System log Use the System Log drop-down list to change the log settings for all of the log categories.
Chapter 46 Log and Report ZyWALL USG 50 User’s Guide 736 Syst em log Select whi ch events y ou want to log by Log Category . There are three choices: disable all logs (red X) - do not log any inform.
ZyWALL USG 50 User’s Guide 737 C HAPTER 47 File Manager 47.1 Overview Configuration files d efine the Z y WALL’ s settings. Shell scripts are files of commands that you can store on the Z y WALL and run when you need them. Y ou can apply a configuration file or run a sh ell script without the Z yWALL restarting.
Chapter 47 File Manager ZyWALL USG 50 User’s Guide 738 These files have the same syntax, which is also identical to the way y ou run CLI commands manually . An example is shown below. While configur ation files and shell scri pts have the same syntax, the ZyW ALL applies configur ation files differently than it runs shell scripts.
Chapter 47 File Manager ZyWALL USG 50 User’s Guide 739 Y our configur ation files or shell scripts can use “exit” or a command line consisting of a single “! ” to have the Z yWALL exit sub c ommand mode. Note: “exit” or “!'” must follow sub commands if it is to make the ZyW ALL exit sub command mode.
Chapter 47 File Manager ZyWALL USG 50 User’s Guide 740 47.2 The Configuration File Screen Click Maintenance > File Manager > Configuration File to open the Configuration File screen. Use the Configuration File screen to store, run, and name configur at ion files.
Chapter 47 File Manager ZyWALL USG 50 User’s Guide 741 The following table describes t he labels in this screen. T able 234 Maintenance > File Manager > Configuration File LABEL DESCRIPTION Ren a m e Use this button to change the label of a configuration file on the Z yWALL.
Chapter 47 File Manager ZyWALL USG 50 User’s Guide 742 Copy Use this button to sav e a duplicate of a configuration file on the ZyW ALL. Click a configuration file’ s row to select it and click Copy to open the Copy File screen.
Chapter 47 File Manager ZyWALL USG 50 User’s Guide 743 Apply Use this button to have the Z yW ALL use a specific configuration file. Click a configuration file’ s row to select it and click Apply to have the Z yWALL use that configuration file.
Chapter 47 File Manager ZyWALL USG 50 User’s Guide 744 47.3 The Firmware Package Screen Click Maintenance > File Manager > Firmware Package to open the Firmware Package screen. Use the Firmware Package screen to check your current firmware version and upload firmw are to the ZyW ALL.
Chapter 47 File Manager ZyWALL USG 50 User’s Guide 745 Note: The Web Configurator is the recommended method for uploading firmware. Y ou only need to use the comma nd line interface if you need to recover the firmware. See the CLI Reference Guide for how to d etermine if you need to recover the firmware and how to recover it.
Chapter 47 File Manager ZyWALL USG 50 User’s Guide 746 After you see the Firmware Upload in Process screen, wait two minu tes befor e logging in to the ZyW ALL a ga i n. Figure 435 Firmware Upload In Process Note: The ZyW ALL automatically reboots aft er a successful upload.
Chapter 47 File Manager ZyWALL USG 50 User’s Guide 747 Note: Y ou should include write commands in your scripts. If you do not use the write command, the changes will be lost when the ZyW ALL rest arts. Y ou could use multiple write commands in a long script.
Chapter 47 File Manager ZyWALL USG 50 User’s Guide 748 Copy Use this button to save a duplicate of a shell script file on the Z yWALL. Click a shell script file’ s row to select it and click Copy to open the Copy File screen. Figure 440 Maintenance > File Ma nager > Shell Script > Copy Specify a name for the duplicate file.
ZyWALL USG 50 User’s Guide 749 C HAPTER 48 Diagnostics 48.1 Overview Use the diagnostics screen s for troubleshooting. 48.1.1 What Y ou Can Do in this Chapter •U s e t h e Maintenance > Diagnostics screen (see Sect ion 48.
Chapter 48 Diagnostics ZyWALL USG 50 User’s Guide 750 The following table describes t he labels in this screen. 48.3 The Packet Capture Screen Use this screen to capture network traffi c going throu gh th e Z yWALL’ s interf ace s. Studying these packet captures may help you i dentify network problems.
Chapter 48 Diagnostics ZyWALL USG 50 User’s Guide 751 The following table describes t he labels in this screen. T able 238 Maintenance > Diagnostics > Packet Ca pture LABEL DESCRIPTION Interfaces Enabled interfaces (except for virtual interfaces) appear under Available Interfaces .
Chapter 48 Diagnostics ZyWALL USG 50 User’s Guide 752 48.3.1 The Packet Capture Files Screen Click Maintenance > Diagnostics > Packet Capture > Files to open the packet capt ure files screen. This screen lists the files of pack et captures the Z yWALL has performed.
Chapter 48 Diagnostics ZyWALL USG 50 User’s Guide 753 48.3.2 Example of V iewing a Packet Capture File Here is an example of a packet capture file viewed in the Wiresh ark packet analyzer . Notice that the size of fr ame 15 on the wire is 1514 bytes while the captured size is only 1500 bytes.
Chapter 48 Diagnostics ZyWALL USG 50 User’s Guide 754.
ZyWALL USG 50 User’s Guide 755 C HAPTER 49 Reboot 49.1 Overview Use this to restart the device (for example, if the device beg ins behaving erratically). See also Secti on 1.5 on page 35 for information on d ifferent ways to start and stop the Z yWALL.
Chapter 49 Reboot ZyWALL USG 50 User’s Guide 756.
ZyWALL USG 50 User’s Guide 757 C HAPTER 50 Shutdown 50.1 Overview Use this to shutdown t he device in preparat ion for disconnecting the power . See also Section 1.
Chapter 50 Shu tdo wn ZyWALL USG 50 User’s Guide 758.
ZyWALL USG 50 User’s Guide 759 C HAPTER 51 Troubleshooting This chapter offers some suggestions to solv e problems you might encounter . • Y ou can also refer to the logs (see Chapter 9 on page 206 ). For individual lo g descriptions, see the User’ s Guide appendix Appendix A on page 783 .
Chapter 51 Tro u blesh oo tin g ZyWALL USG 50 User’s Guide 760 • If you ’ve fo rgo tten the ZyWALL’s IP addre ss, yo u can u se t h e c omm a nds through the consol e port to check it. C onnect your compu ter to the CONSOLE port using a console cable.
Chapter 51 Troubleshooting ZyWALL USG 50 User’s Guide 761 • Make sure y our Z yWALL has the cont en t filter category service registered and that the license i s not expired. Purchase a new license if the lic ense is expired. • Make sure y our Z yWALL is connected to the Internet.
Chapter 51 Tro u blesh oo tin g ZyWALL USG 50 User’s Guide 762 I cannot set up a PPP interface, virtual Ethernet interface or virtual VLAN interface on an Ethernet interface. Y ou cann ot set up a PPP interface, virt ual Ethernet interface or virtual VLAN interface if the underlying interface is a member of a bridge.
Chapter 51 Troubleshooting ZyWALL USG 50 User’s Guide 763 • If the Z yWALL has multiple WAN interfaces, mak e sure their IP addresses are o n different subnets. I cannot configure a particular VLAN interface on top of an Ethernet interface even though I have it configur ed it on top of anot her Ethernet interface.
Chapter 51 Tro u blesh oo tin g ZyWALL USG 50 User’s Guide 764 matched still goes through. Since the Z y W ALL erases the infect ed portion of the file before sending it, you may not be able to open the file. The ZyW ALL is not scanni ng some zipped files.
Chapter 51 Troubleshooting ZyWALL USG 50 User’s Guide 765 Z yWALL are overwritten with the new file. If this is not your intention, make sure that the files you import are not named ‘custom.rules’ . I cannot configure some items in ID P that I can configure in Snort.
Chapter 51 Tro u blesh oo tin g ZyWALL USG 50 User’s Guide 766 • The Z yW ALL may not determine the proper IP address if there is an HT TP proxy server between the Z yWALL and the DDNS serv er . I cannot create a second H TTP redirect rule for an incoming interface.
Chapter 51 Troubleshooting ZyWALL USG 50 User’s Guide 767 I cannot set up an IPSec VPN tunnel to another device. If the IPSec tunnel does not build properly , the problem is likely a configur ation error at one of the IPSec routers. Log in to both Z yXEL IPSec routers and check the settings in each field methodically and slowly .
Chapter 51 Tro u blesh oo tin g ZyWALL USG 50 User’s Guide 768 • Make sure the T o-ZyW ALL firewall rules al low IPSec VPN traffic to the Z yWALL. IKE uses UDP port 500, AH uses IP protocol 51, and ESP uses IP prot ocol 50. • The Z yW ALL supports UDP port 500 and UDP port 4500 for NA T tr aversal.
Chapter 51 Troubleshooting ZyWALL USG 50 User’s Guide 769 Av ailable resource links vary depend ing on the SSL applic ation object’s configu ration.
Chapter 51 Tro u blesh oo tin g ZyWALL USG 50 User’s Guide 770 I configured policy r outes to manage the bandwidth of TCP and UDP traf fic but the bandwidth management is not being applied properly . It is recommended to use application patrol instead of policy routes to manage the bandwidth of TCP and UDP tr affic.
Chapter 51 Troubleshooting ZyWALL USG 50 User’s Guide 771 I cannot get a certificate to import into the ZyW ALL. 1 For My Certificates , you can import a certificate that matches a corresponding certification request that w as generated by the Z yWALL.
Chapter 51 Tro u blesh oo tin g ZyWALL USG 50 User’s Guide 772 I uploaded a logo to use as the screen or window background but it does not display properly . Make sure the logo file is a GIF , JPG, or PNG of 100 kilobytes or less. The ZyW ALL’s traffic throug hput rate decreased af ter I started collecting traffic statistics.
Chapter 51 Troubleshooting ZyWALL USG 50 User’s Guide 773 See the CLI Reference Guide for how to determin e if you need to recover the firmware and how to recover it.
Chapter 51 Tro u blesh oo tin g ZyWALL USG 50 User’s Guide 774 2 Press the RESET button and hold it until the SYS LED begins to blink. (Thi s usually takes about fiv e seconds.) 3 Release the RESET button, and wait for the Z yWALL to restart. Y ou should be able to access the Z yWALL using the default settings.
ZyWALL USG 50 User’s Guide 775 C HAPTER 52 Product Specifications The followin g s pe cificat io ns are sub j ect to change without notice. See Chapter 2 on page 37 for a gener al overview of key f eatures. This table provides b asic device specifications.
Chapter 52 Product Specifications ZyWALL USG 50 User’s Guide 776 This table give s details about the Z yWALL’ s features. T able 242 ZyWALL Feature Specifications FEATUR E # of MAC 6 Flash Size 25.
Chapter 52 Product Specifications ZyWALL USG 50 User’s Guide 777 Address Groups 50 Maximum address object in one group 128 Service Objects 200 Service Groups 50 Maximum service object in one group 1.
Chapter 52 Product Specifications ZyWALL USG 50 User’s Guide 778 Custom Signatures 16 Maximum Number of IDP R ules 16 ADP Maximum Number of ADP Profiles 8 Maximum Number of ADP Ru les 16 Maximum Blo.
Chapter 52 Product Specifications ZyWALL USG 50 User’s Guide 779 The following table, which is not exhaust ive, lists standards referenced by Z yW ALL features. T able 243 Standards Referenced by Features FEATUR E ST ANDARD S REFERENCED Interface-Bridge A subset of the ANSI/IEEE 802.
Chapter 52 Product Specifications ZyWALL USG 50 User’s Guide 780 52.1 Power Adaptor S pecifications T able 244 North American Plug Standards AC POWER ADAPT OR MODEL P SA18R -120P (ZA)-R INPUT POWER 100-240VAC, 50/60HZ, 0.5A OUTPUT POW E R 12V DC , 1.
Chapter 52 Product Specifications ZyWALL USG 50 User’s Guide 781 POWER CONSUMPTION 20 W MAX. SAFETY ST ANDARDS CCC T able 249 China Plug Standards.
Chapter 52 Product Specifications ZyWALL USG 50 User’s Guide 782.
ZyWALL USG 50 User’s Guide 783 A PPENDIX A Log Descriptions This appendix provides descript ions of example log message s for the ZLD-based Z yWA LLs. The logs do not all apply to all of the ZLD-based Z yWALLs. Y ou will not necessecarily see al l of th ese logs in your de vice.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 784 T able 252 Blocked Web Site Logs LOG MESSAGE DESCRIPTION %s :%s The rating server responded that the web site is in a specified category and access was blocked according to a content filter profile.
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 785 %s: Proxy mode is detected The system detected a proxy connection an d blocked access according to a profile. %s: website host %s: Forbidden Web si te The web site is in forbidden web site list.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 786 Black List checking has been activated. The anti-spam black list has been turned on. Black List checking has been deactivated. The anti-spam black list has been turned off . Black List rule %d has been added.
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 787 T able 254 SSL VPN Logs LOG MESSAGE DESCRIPTION %s %s from %s has logged in SSLVPN A user has logged into SSL VPN. The first %s is the type of user account. The second %s is the user’s user name.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 788 The %s address-object is wrong type for 'network' in SSL Policy %s. The listed address object (first %s ) is not the right kind to be specified as a network in the listed SSL VPN policy (second %s).
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 789 %s %s from %s has been logged out SSLVPN (re- auth timeout) The specified user was signed out by the device due to a re- authentication timeout. The first %s is the type of user account. The second %s is the user’s user name.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 790 The Z ySH logs deal with internal system errors. T able 255 ZySH Logs LOG MESSAGE DESCRIPTION Invalid message queue.
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 791 Can't remove %s 1st:zysh list name Table OPS %s: cannot retrieve entries from table! 1st:zysh table name %s: index is out of range! 1s.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 792 T able 256 ADP Logs LOG MESSAGE DESCRIPTION from <zone> to <zone> [type=<type>] <message> , Action: <action>, Severity: <severity> The Z y WALL detected an anomaly in tr affic trav eling between the specified zones.
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 793 T able 257 Anti-Virus Logs LOG MESSAGE DES CRIPTION Initializing Anti-Virus signature reference table has failed. The Z yWALL failed to initialize the anti-virus signatures due to an internal error .
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 794 AV signature update has failed. Can not update last update time. The anti-virus signatur es update did not succeed.
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 795 Anti-Virus rule %d has been modified. The anti-virus rule of the specified number has been changed. Anti-Virus rule %d has been inserted. An anti- virus rule has been inserted. %d is the number of the new rule.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 796 T able 258 User Logs LOG MESSAGE DES CRIPTION %s %s from %s has logged in ZyWALL A user logged into the ZyW ALL. 1st %s: The type of user account. 2nd %s: The user ’s user name. 3rd %s: The name of the servi ce the user is using (HT TP , HTTPS, F T P , T eln e t, SS H , or conso le) .
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 797 Failed login attempt to ZyWALL from %s (login on a lockout address) A login attempt came from an IP address that the Z yWALL has locked out. %u.%u.%u.%u: the source address of the user’ s login attempt Failed login attempt to ZyWALL from %s (reach the max.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 798 Registration has failed. Because of lack must fields. The device received an incomplete response from the myZ yXEL.com server and it caused a parsing error for the device. %s:Trial service activation has failed:%s.
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 799 Do device register. The device started device registration. Do trial service activation. The device started tr ail service activation. Do standard service activation. The device started standard service activ ation.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 800 Device has latest signature file; no need to update The device already has the latest version of the signature file so no update is needed. Connect to update server has failed. The device cannot connect to the update server .
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 801 Get server response has failed. The device sent packets to the server , but did not receive a response. The root cause may be that the connection is abnormal. Expiration daily- check has failed:%s.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 802 Self signed certificate. V erification of a server’ s certificate failed because it is self- signed. Self signed certificate in certificate chain. V erification of a server’s certificate failed because there is a self-signed certificate in the server’s certificate chain.
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 803 Enable IDP engine succeeded. The device turned on the IDP engine. Disable IDP engine succeeded. The device turned off the IDP engine. IDP service is not registered. IDP will not be activated.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 804 Add custom signature error: signature <sid> is over length. An attempt to add a custom IDP signature failed because the signature’s contents were too long. Edit custom signature error: signature <sid> is over length.
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 805 from <zone> to <zone> [type=<type>] <message> , Action: <action>, Severity: <severity> The Z yWALL detected an intrusion in tr affic trav eling between the specified zones.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 806 Duplicate sid <sid> in import file at line <linenum>. The listed signature ID is duplicated at the listed line number in the signature file. IDP rule <num> has been deleted.
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 807 Protocol %s has been enabled. The listed protocol has been turned on in the application patrol. Protocol %s has been disabled. The listed protocol has been turned off in the application patrol.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 808 T able 262 IKE Logs LOG MESSAGE DESCRIPTION Peer has not announced DPD capability The remote IPSec router has not announced its dead peer detection (DPD) capability to this device. [COOKIE] Invalid cookie, no sa found Cannot find SA according to the cookie.
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 809 [SA] : Tunnel [%s] Phase 1 invalid protocol %s is the tunnel name. When nego tiating Phase-1, the packet was not a ISKAMP pack et in the protocol field. [SA] : Tunnel [%s] Phase 1 invalid transform %s is the tunnel name.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 810 Could not dial manual key tunnel "%s" %s is the tunnel name. The manual k ey tunnel cannot be dialed. DPD response with invalid ID When receiving a DPD response with inv alid ID ignored.
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 81 1 VPN gateway %s was enabled %s is the gatewa y name. An administrator enabled the VPN gateway . XAUTH fail! My name: %s %s is the my xauth name. This indicates that m y name is inv alid. XAUTH fail! Remote user: %s %s is the remote xauth name.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 812 Get outbound transform fail When outgoing packet need to be transformed, the engine cannot obtain the transform context.
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 813 Firewall %s %s rule %d was %s. 1st %s is from zone, 2nd %s is to zone, %d is the index of the rule 3rd %s is appended/inserted/modified Firewall %s %s rule %d has been moved to %d.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 814 The policy route %d uses empty user group! Use an empty object group. %d: the policy route rule number The policy route %d uses empty source address group! Use an empty object group.
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 815 T able 267 Built-in Services Logs LOG MESSAGE DESCRIPTION User on %u.%u.%u.%u has been denied access from %s HT TP/HTT PS/TELNET/SSH/FTP/SNMP access to the device was d en ied . %u.%u.%u.%u is IP address %s is HT TP/HTTPS/SSH/SNMP/FTP/TELNET HTTPS certificate:%s does not exist.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 816 SNMP port has been changed to port %s. An administrator changed the port number for SNMP . %s is port number assigned by user SNMP port has been changed to default port. An administrator changed the port nu mber for SNMP back to the default (161).
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 817 DNS access control rule %u has been moved to %d. An administrator mo ved the rule %u to index %d. %u is previous index %d variable is current index The default record of Zone Forwarder have reached the maximum number of 128 DNS servers.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 818 Access control rule %u of %s was modified. An access control rule was modified successfully . %u is the index of the access control rule. %s is HT TP/HTTPS/SSH/SNMP/FTP/TELNET . Access control rule %u of %s was deleted.
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 819 DHCP Server executed with cautious mode disabled DHCP Server ex ecuted with cautious mode disabled. Received packet is not an ARP response pack et A packet was received but it is not an ARP response packet.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 820 Device is rebooted by administrator! An administr ator restarted the device. Insufficient memory. Cannot allocate system memory . Connect to dyndns server has failed. Cannot connect to members.
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 821 Update the profile %s has failed because the feature requested is only available to donators. Update profile failed because the feature requested is only av ailable to donators, %s is the profile name.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 822 DDNS profile %s has been renamed as %s. Rename DDNS profile, 1st %s is the original profile name, 2nd %s is the new profile name. DDNS profile %s has been deleted. Delete DDNS profile, %s is the profile name, DDNS Initialization has failed.
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 823 The connectivity- check is activate for %s interface The link status of interface is still activate after check of connectivity check process.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 824 Can't get MAC address of %s interface! The connectivity check process can't get MAC address of interface. %s: interface name To send ARP REQUEST error! The connectivity check process can't send ARP request packet.
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 825 RIP redistribute static routes has been enabled. RIP redistribute static routes has been enabled. RIP on interface %s has been deactivated. RIP on interface %s has been deactivated. %s: In terface Name RIP direction on interface %s has b een changed to BiDir.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 826 Invalid OSPF %s authentication of area %s. OSPF md5 or text authentication has been set without setting md5 authentication id and key , or text authentication key first. Invalid OSPF virtual- link %d md5 authentication of area %s.
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 827 %s SIP ALG has succeeded. The SIP ALG has been turned on or off . %s: Enable or Disable Extra signal port of SIP ALG has been modified. Extra SIP ALG port has been changed. Signal port of SIP ALG has been modified.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 828 Prepare to import "%s" into "My Certificate" %s is the name of a certificate request. Prepare to import "%s" into Trusted Certificate" %s is the name of a certificate request.
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 829 Export X509 certificate "%s" from "My Certificate" failed The device was not able to export a x509 format certificate from My Certificates. %s is the certificate request name.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 830 15 CRL is too old. 16 CRL is not v alid. 17 CRL signature was not verified correctly . 18 CRL was not f ound (anywhere). 19 CRL was not added to the cache. 20 CRL decoding failed. 21 CRL is not currently v alid, but in the future.
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 831 (%s MTU - 8) < %s MTU, %s may not work correctly. An administrator configured ethernet, vlan or bridge and this interface is base interface of PPP interface.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 832 Interface %s is disconnected. A PPP interface disconnected successfully . %s: interface name. Interface %s connect failed: Peer not responding. The interface’ s connection w ill be terminated because the server did not send any LCP packets.
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 833 "SIM card of interface cellular%d in %s is damaged or not inserted. Please remove the device, then check the SIM card. The SIM card for the cellular device associated with the listed cellular interface (%d) cannot be detected.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 834 Interface cellular%d required authentication password.Please set password in cellular%d edit page. Y ou need to manually enter the password for the listed cellular interface (%d). "Cellular%d (IMSI=%s or ESN=%s) over time budget!(budget = %d seconds).
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 835 Duplicated interface name. A duplicate name was not permitted for an interface. This Interface can not be renamed. An interface’s name cannot be changed. Virtual interface is not supported on t his type of interface.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 836 name=%s,status=%s,TxP kts=%u, RxPkts=%u,Colli.=%u,T xB/s=%u, RxB/s=%u,UpTime=%s This log is sent to the VRPT server to show the specified PPP/ Cellular interface’s statistics and uptime.
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 837 T able 277 Force Authentication Logs LOG MESSAGE DESCRIPTION Force User Authentication will be enabled due to http server is enabled. Force user authentication will be turned on because HT TP server was turned on.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 838 Running %s... An administr ator ran the listed shell script. %s is script file name. Going to rollback previous running- config. Applying the configuration file failed and the Z yWALL is going to roll back to the previous running-config.
Appendix A Log Descriptions ZyWALL USG 50 User’s Guide 839 Failed to send report. Mail From address %s1 is inconsistent with SMTP account %s2. The user name and password configured for authenticating with the e-mail server are correct, but the (listed) sender e- mail address does not match the (listed) SMTP e-mail account.
Appendix A Log Descrip tio ns ZyWALL USG 50 User’s Guide 840 T able 283 EPS Logs LOG MESSAGE DESCRIPTION Windows service pack check fail in %s The Windows service pack on a user’s computer did not match the specified EPS object.
ZyWALL USG 50 User’s Guide 841 A PPENDIX B Common Services The following table lists some commonl y-used services and their associated protocols and port numbers. F or a comprehe nsiv e list of port numbers, ICMP type/ code numbers and services , visit the IANA (Internet Assigned Number Authority) web site.
Appendix B Com mon Servic es ZyWALL USG 50 User’s Guide 842 ESP (IPSEC_TUNNEL) User -Defined 50 The IPSEC ESP (Encapsulation Security Protocol) tunneling protocol uses this service. FINGER TCP 79 Finger is a UNIX or Internet related command that can be used to find out if a user is logged on.
Appendix B Common Services ZyWALL USG 50 User’s Guide 843 PPTP TCP 1723 Point -to-P oint T unneling Protocol enables secure transfer of data ov er public networks. This is the control channel. PPTP_TUNNEL (GRE) User -Defined 47 PPTP (P oint-to-Point T unneling Protocol) enables secure transfer of data over public networks.
Appendix B Com mon Servic es ZyWALL USG 50 User’s Guide 844 TFTP UDP 69 T rivial File T ransfer Protocol is an Internet file transfer protocol similar to FTP , but uses the UDP (User Datagram Protocol) r ather than TCP (T ransmission Control Protocol).
ZyWALL USG 50 User’s Guide 845 A PPENDIX C Importing Certificates This appendix shows you how to import public k ey certificates into your web browser . Public key certificates are used by web br owsers to ensure that a secure web site is legitimate.
Appendix C Importing Certificates ZyWALL USG 50 User’s Guide 846 1 If your device’ s W eb Configurator is set to use S SL certification, then the first time you browse to i t you are presented with a certificati on error . Figure 447 Internet Explorer 7: Cert ification Error 2 Click Continue to this website (not recommended) .
Appendix C Importing Certificates ZyWALL USG 50 User’s Guide 847 4 In the Certificate dialog bo x, click Install Certificate . Figure 450 Internet Explorer 7: Cert ificate 5 In the Certificate Import Wizard , click Next .
Appendix C Importing Certificates ZyWALL USG 50 User’s Guide 848 6 If you w ant Internet Explorer to Automatically select certificate store based on the type of certificate , click Next again and then go to step 9.
Appendix C Importing Certificates ZyWALL USG 50 User’s Guide 849 8 In the Select Certificate Store dialog box, choose a location in which to sa ve the certificate and then clic k OK . Figure 454 Internet Explorer 7: Select Certificate S tore 9 In the Completing the Certificate Import Wizard screen, click Finish .
Appendix C Importing Certificates ZyWALL USG 50 User’s Guide 850 10 If you are presented with another Security Warning , c lick Yes . Figure 456 Internet Explorer 7: Security W arning 11 Finally , click OK when presented with the successful certificate installation message.
Appendix C Importing Certificates ZyWALL USG 50 User’s Guide 851 Inst alling a St and-Alone Certific ate File in Internet Explorer Rather t han browsing to a Z yXEL W eb Co nfigurator and installing a public k ey certificate when prompted, y ou can install a stand- alone certific ate file if one has been issued to you.
Appendix C Importing Certificates ZyWALL USG 50 User’s Guide 852 1 Open Internet Explorer and click Tools > Internet Options . Figure 461 Internet Explorer 7: T ools Menu 2 In the Internet Options dialog box, cl ick Conte nt > Certificates .
Appendix C Importing Certificates ZyWALL USG 50 User’s Guide 853 3 In the Certificates dialog box, click the Trusted Root Certificates Authorities tab, select the certificat e that yo u w ant to delete, and then click Remove . Figure 463 Internet Explorer 7: Cert ificates 4 In the Certificates confirmation, click Yes .
Appendix C Importing Certificates ZyWALL USG 50 User’s Guide 854 6 The next time you go to the web site that issued the public k ey certificate you just removed, a certification error appears. Firefox The following example uses Mozilla Firefox 2 on Windows XP Professional; however , the screens can also apply to Firefox 2 on all platforms.
Appendix C Importing Certificates ZyWALL USG 50 User’s Guide 855 3 The certificate is stored and you ca n now connect securely to the W eb Configurator . A sealed padlock appears in the address bar , which you can click to open the Page Info > Security windo w to view the web page’ s security informat ion.
Appendix C Importing Certificates ZyWALL USG 50 User’s Guide 856 1 Open Firefox and click Tools > Options . Figure 468 Firefox 2: T ools Menu 2 In the Options dialog bo x, cli ck Advanced > Encryption > View Certifica t es .
Appendix C Importing Certificates ZyWALL USG 50 User’s Guide 857 3 In the Certificate Manager dialog box, cl ick Web S ites > Import . Figure 470 Firefox 2: Cert ificate Manager 4 Use the Select File dialog bo x to locate the certificate and then click Op en .
Appendix C Importing Certificates ZyWALL USG 50 User’s Guide 858 Removing a Certificate in Firefox This section shows y ou how to remove a public key certificate in Fi refox 2. 1 Open Firefox and click Tools > Options . Figure 472 Firefox 2: T ools Menu 2 In the Options dialog bo x, cli ck Advanced > Encryption > View Certifica t es .
Appendix C Importing Certificates ZyWALL USG 50 User’s Guide 859 3 In the Certificate Manager dialog box, select the Web Sites tab , select the certificate that you w ant to remove, and then click Delete . Figure 474 Firefox 2: Cert ificate Manager 4 In the Delete Web Site Certificates dialog bo x, cli ck OK .
Appendix C Importing Certificates ZyWALL USG 50 User’s Guide 860 1 If your device’ s W eb Configurator is set to use S SL certification, then the first time you browse to i t you are presented with a certificati on error . 2 Click Install to accept the certi ficate.
Appendix C Importing Certificates ZyWALL USG 50 User’s Guide 861 Inst alling a St and-Alone Ce rtifica te File in Opera Rather t han browsing to a Z yXEL W eb Co nfigurator and installing a public k ey certificate when prompted, y ou can install a stand- alone certific ate file if one has been issued to you.
Appendix C Importing Certificates ZyWALL USG 50 User’s Guide 862 2 In Preferences , click Advanced > Security > Manage certificates . Figure 479 Opera 9: Prefer ences.
Appendix C Importing Certificates ZyWALL USG 50 User’s Guide 863 3 In the Certificates Manager , click Authorities > Import . Figure 480 Opera 9: Certificate manager 4 Use the Import certificate dialog box to locate the certificate and then click Open.
Appendix C Importing Certificates ZyWALL USG 50 User’s Guide 864 5 In the Install authority certificate dialog box, c lick Ins tall . Figure 482 Opera 9: Inst all authority certificate 6 Next, click OK .
Appendix C Importing Certificates ZyWALL USG 50 User’s Guide 865 1 Open Opera and click Tools > Preferences . Figure 484 Opera 9: T ools Menu 2 In Preferences , Advanced > Security > Manage certificates .
Appendix C Importing Certificates ZyWALL USG 50 User’s Guide 866 3 In the Certificates manager , sele ct the Authorities tab, select th e ce rtificat e that you wan t to rem ove , an d the n c lic k Delete .
Appendix C Importing Certificates ZyWALL USG 50 User’s Guide 867 2 Click Continue . Figure 487 Konquero r 3.5: Server Authentication 3 Click Forever when prompted to accept the certificate.
Appendix C Importing Certificates ZyWALL USG 50 User’s Guide 868 Inst alling a St and-Alone Ce rtificate File in Konqueror Rather t han browsing to a Z yXEL W eb Co nfigurator and installing a public k ey certificate when prompted, y ou can install a stand- alone certific ate file if one has been issued to you.
Appendix C Importing Certificates ZyWALL USG 50 User’s Guide 869 3 The next time you visit the web site, click the padlock in the address bar to open the KDE SSL Inf ormation window to view the web page’ s security details. Removing a Certificate in Konqueror This section shows y ou how to remove a public k e y certificate in K onqueror 3.
Appendix C Importing Certificates ZyWALL USG 50 User’s Guide 870 4 The next time you go to the web site that issued the public k ey certificate you just removed, a certification error appears.
ZyWALL USG 50 User’s Guide 871 A PPENDIX D Open Sof tware Announcement s End-User License Agreement for “ZyW ALL USG 50” WARNING: Z yXEL Communications Corp. IS WILLING T O LICENSE THE SOFTWARE T O YOU ONL Y UPON THE CONDITION THA T YOU ACCEPT ALL OF THE TERMS CONT AINED IN THIS LICENSE AG REEMENT .
Appendix D O pen Software Announcements ZyWALL USG 50 User’s Guide 872 therein shall remain at all t imes with ZyXEL. Any other use of the Software by any other entity is strictl y forbidden and is a violation of this License Agreement.
Appendix D Open Software Announcements ZyWALL USG 50 User’s Guide 873 Y ou acknowledge that the Software contai ns proprietary tr ade secrets of Z yXEL and you hereby agree to maintain the confident.
Appendix D O pen Software Announcements ZyWALL USG 50 User’s Guide 874 THIS LICENSE AGRE EM ENT IS EXPRES SL Y MADE SUBJECT TO ANY APPLICABLE LAWS, REGULA TIONS, ORDERS, OR O T HE R RESTRICTIONS ON THE EXPOR T OF THE SOFTWARE OR INFORMA TION ABOU T SUCH SOF TWARE WHICH MA Y BE IMPOSED FROM TIME T O TIME.
Appendix D Open Software Announcements ZyWALL USG 50 User’s Guide 875 NOTE: Some components of this product incorpor ate source code covered under the open source code licenses.
Appendix D O pen Software Announcements ZyWALL USG 50 User’s Guide 876 The above copyri ght notice and this permission not ice shall be included in al l copies or substantial portions of the Software.
Appendix D Open Software Announcements ZyWALL USG 50 User’s Guide 877 ------------ --- /* ================== =============== ================= * Copyright (c) 1998-2008 The OpenSSL Project.
Appendix D O pen Software Announcements ZyWALL USG 50 User’s Guide 878 * * 5. Products derived from this software ma y not be called "OpenSSL" * nor may " OpenSSL" appear in their names without prior written * permission of the OpenSSL Project.
Appendix D Open Software Announcements ZyWALL USG 50 User’s Guide 879 * * This product includes cryptograp hic software wri tten by Eric Y oung * (eay@cryptsoft.
Appendix D O pen Software Announcements ZyWALL USG 50 User’s Guide 880 * as the author of the parts of the library used. * This can be in the form of a textual message at program startup or * in documentation (online or te xtual) provided with the packag e.
Appendix D Open Software Announcements ZyWALL USG 50 User’s Guide 881 * IMPLIED WARRANTIES OF MERCHANT ABILITY AND FITNESS FOR A PA RT I C U L A R P U R P O S E * ARE DISCLAIMED .
Appendix D O pen Software Announcements ZyWALL USG 50 User’s Guide 882 This is the BSD license wit hout the obnoxious advertising claus e. It's also known as the "modified BSD license.
Appendix D Open Software Announcements ZyWALL USG 50 User’s Guide 883 OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. This Product incl udes httpd software developed by t he Apache Software Foundation under Apache License. Apache License V ersion 2.
Appendix D O pen Software Announcements ZyWALL USG 50 User’s Guide 884 work of authorship. F or the purposes of this License, Deriv ative W orks shall not include works that remain separable from, or merely link (or bind by n ame) to the interfaces of , the W or k and Derivative W orks there of .
Appendix D Open Software Announcements ZyWALL USG 50 User’s Guide 885 (b) Y ou must cause any modifi ed files to carry promi nent notices stating that Y ou changed the fil es ; and (c) Y ou must re .
Appendix D O pen Software Announcements ZyWALL USG 50 User’s Guide 886 8. Limitation of Liabil it y . In no event and under no legal theory , whether in tort (including negligence), contract, or oth.
Appendix D Open Software Announcements ZyWALL USG 50 User’s Guide 887 THIS SOF TWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NO T LIMITED T O, THE IMPLI ED WARRANTIES OF MERCHANT ABILITY AND FITNESS FOR A PA R TICULAR PURPOSE ARE DISCLAIMED.
Appendix D O pen Software Announcements ZyWALL USG 50 User’s Guide 888 Public License is the better strategy to use in any particular case, based on the explanations below . When we speak of free software, we are referring to freedom of use, not price.
Appendix D Open Software Announcements ZyWALL USG 50 User’s Guide 889 derivati ve of the original li brary . The ordinary General Public License therefore permits such linking only if the entire co mbination fits its criteria of freedom. The Lesser Gener al Public License permits more lax cri teria for linking other code with the library .
Appendix D O pen Software Announcements ZyWALL USG 50 User’s Guide 890 software library or work which has been distri buted under these terms. A "work based on the Library" means either th.
Appendix D Open Software Announcements ZyWALL USG 50 User’s Guide 891 part of a whole which is a work based on the Li br ary , the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every p art regardless of who wrote it.
Appendix D O pen Software Announcements ZyWALL USG 50 User’s Guide 892 significant if the work can be link ed without the Library , or if the work is its elf a library .
Appendix D Open Software Announcements ZyWALL USG 50 User’s Guide 893 include anything that is normally distribute d (in either source or binary form) with the major components (compiler , kernel, and so on) of the operating syst em on which the executable runs, unless that component itself accompanies the executable.
Appendix D O pen Software Announcements ZyWALL USG 50 User’s Guide 894 License. If you cannot distribute so as to satisfy si multaneously yo ur obligations under this License and any other pertinent obligations, then as a consequence y ou may not distribut e the Library at all.
Appendix D Open Software Announcements ZyWALL USG 50 User’s Guide 895 NO WARRANTY 15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE LIBR ARY , TO THE EXTENT PE RMIT TED BY APPLICABLE L A W .
Appendix D O pen Software Announcements ZyWALL USG 50 User’s Guide 896 commit to using it. (Some other Free Softw are Foundati on s oftware is cove red by the GNU Libr ary General Public License i nstead.) Y ou can apply it to y our programs, too. When we speak of free software, we ar e referring to freedo m, not price.
Appendix D Open Software Announcements ZyWALL USG 50 User’s Guide 897 copying, distribution and modifi cati on are not covered by this License; they are outside its scope.
Appendix D O pen Software Announcements ZyWALL USG 50 User’s Guide 898 Program) on a volume of a storage or distribution medium does not bring the other work under the sc ope of this License .
Appendix D Open Software Announcements ZyWALL USG 50 User’s Guide 899 all its terms and conditions for copying, distributing or modifyi ng the Program or works based on it.
Appendix D O pen Software Announcements ZyWALL USG 50 User’s Guide 900 Program does not specify a version number of this License, you may choose any version ever published by the Free Softw a re Foundation.
Appendix D Open Software Announcements ZyWALL USG 50 User’s Guide 901 The Regents of the University of California . All rights reserved. R edistribution and use in source and binary forms, with or w.
Appendix D O pen Software Announcements ZyWALL USG 50 User’s Guide 902 NONINFRINGE M EN T . IN NO EVENT SHALL THE AUTHORS OR COP YRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DA MAGES OR O THER LIABILITY .
Appendix D Open Software Announcements ZyWALL USG 50 User’s Guide 903 Copyright 1999-2003 The OpenLD AP F oundation, Redwood City , California, USA. All Rights R eserved. P ermission to copy and distribut e verbatim copies of this document is gr anted.
Appendix D O pen Software Announcements ZyWALL USG 50 User’s Guide 904 disclaimer and license as libpng-0.96, with the following indivi dual s added to the list of Contributing Authors: To m L a n e Glenn Randers-P e hrson Willem v an Schaik libpng versions 0.
Appendix D Open Software Announcements ZyWALL USG 50 User’s Guide 905 2. Altered versions must be plainl y mark ed as such and must not be misrepresented as being the original source. 3. This Copyright notice ma y not be remove d or altered from any source or altered source distribution.
Appendix D O pen Software Announcements ZyWALL USG 50 User’s Guide 906 This Product includes pcmcia-cs software under the MPL License Mozilla Public Lice n s e V ersion 1.1 1. Definitions. 1.0.1. "Commercial Use" means distribution or ot herwise making the Covered Code a vailable to a t hird party .
Appendix D Open Software Announcements ZyWALL USG 50 User’s Guide 907 1.8.1. "Licensable" means having the rig h t to grant, to the maxim um ex ten t pos s ib le, w het he r at the time of th e initial g rant or subse que ntly acquired, any an d al l of the rights convey ed herein.
Appendix D O pen Software Announcements ZyWALL USG 50 User’s Guide 908 2.1. The Initial Developer Gr ant. The Initial Developer hereby gr ants Y ou a world-wide, royalty -fre e, non-exclusive license, subject t o third part y intellect ual propert y claims: a.
Appendix D Open Software Announcements ZyWALL USG 50 User’s Guide 909 The Modifications which Y ou create or to which Y ou contribute are governed by the terms of this License, including without limitation Section 2.
Appendix D O pen Software Announcements ZyWALL USG 50 User’s Guide 910 (b) Contributor APIs If Contributor's Modifications include an application progr amming interface and Contributor has knowledge of patent lice nses which are reason ably necessary to implement that API, Contributor must also include this information in the legal file.
Appendix D Open Software Announcements ZyWALL USG 50 User’s Guide 91 1 alone, not by the Initial Developer or an y Contributor . Y ou hereby agree to indemn ify the Initial D evel o p e r a nd ever y Contribut o r fo r any liability in c urred by the Initial Developer or such Contributor as a result of any such terms Y ou offer .
Appendix D O pen Software Announcements ZyWALL USG 50 User’s Guide 912 "MOZILLAPL", "MOZPL", "Netscape", "MPL ", "NPL" or any confusingly similar ph.
Appendix D Open Software Announcements ZyWALL USG 50 User’s Guide 913 payment arr angement are not mutually agr eed upon in writing by the parties or the litigation claim is not wi thdrawn, the rig hts granted by P articipant to Y ou under Sections 2.
Appendix D O pen Software Announcements ZyWALL USG 50 User’s Guide 914 11. Miscellaneous This License represents the complete agreement concerning subject matter hereof . If any provision of this License is held to be unenforceable, such provision shall be reformed only to the extent ne cessary to mak e it enforceable.
Appendix D Open Software Announcements ZyWALL USG 50 User’s Guide 915 The Original Code is ______________________________ ________. The Initial Developer of the Original Code is ________________________. P ortions created by ______________________ are Copyright (C) ___ ___ _______________________.
Appendix D O pen Software Announcements ZyWALL USG 50 User’s Guide 916.
ZyWALL USG 50 User’s Guide 917 A PPENDIX E Legal Information Copyright Copyright © 2010 by Z yXEL Communications Corporation. The contents of this publication ma y not be reproduced in any part or .
Appendix E Leg al In fo rm at ion ZyWALL USG 50 User’s Guide 918 • This device may not cause harmful interference. • This dev ice must acc e pt any interf erence received, including interference that may cause undesired operations.
Appendix E Legal Information ZyWALL USG 50 User’s Guide 919 Notices Changes or modifications not expressly appro ved by the party responsible for compliance could v oid the user's authority to oper ate the equipment. This Class B digital appar atus complies with Canadian ICES-003.
Appendix E Leg al In fo rm at ion ZyWALL USG 50 User’s Guide 920 T o obtain the services of this warr anty , conta ct yo ur ve ndor . Y ou may als o re fer to the warrant y policy for the region in wh ich you bought the devic e at http:// www .zyxel.
Index ZyWALL USG 50 User’s Guide 921 Index Numerics 3322 Dynamic DNS 315 3DES 400 3G 11 3 3G see also cellular 237 A AAA Base DN 620 Bind DN 620 , 623 directory structure 619 Distinguished Name, see.
Index ZyWALL USG 50 User’s Guide 922 types of 599 where used 105 address record 685 admin user troubleshooting 770 admin users 583 multiple logins 594 see also users 583 ADP 513 base profiles 514 , .
Index ZyWALL USG 50 User’s Guide 923 APN 241 Application Layer Gatewa y , see ALG application order 91 application patrol 437 actions 438 and firewall 438 and HT TP redirect 332 bandwidth management.
Index ZyWALL USG 50 User’s Guide 924 and routing protocols 309 MD5 309 , 400 SHA1 400 text 309 Authentication Header , see AH authentication method objects 627 and users 584 and WWW 694 create 629 e.
Index ZyWALL USG 50 User’s Guide 925 certificate troubleshooting 771 Certificate Authority (CA) see certificates Certificate Management Protocol (CMP) 641 Certificate Revocation List (CRL) 63 4 vs O.
Index ZyWALL USG 50 User’s Guide 926 and address objects 533 , 534 , 539 and registration 538 , 540 , 542 and schedules 533 , 534 and user groups 533 and users 533 by category 534 , 544 by keyword (.
Index ZyWALL USG 50 User’s Guide 927 directory service 617 file structure 619 directory trav ersal attack 529 directory trav ersals 529 disclaimer 5 , 917 Distinguished Name (DN) 620 , 621 , 62 3 , .
Index ZyWALL USG 50 User’s Guide 928 and VPN gateways 378 IKE SA 404 ext-user troubleshooting 770 F false negatives 486 , 518 false positives 486 , 518 , 520 FCC interference statement 917 feature s.
Index ZyWALL USG 50 User’s Guide 929 ge2 32 ge3 32 Generic Rou ting Encapsulation, see GRE. global SSL setting 416 user portal logo 418 GRE 270 GSM 242 Guide CLI Reference 3 Quick Start 3 H header c.
Index ZyWALL USG 50 User’s Guide 930 Snort signatures 51 1 statistics 196 traffic directions 479 trial service activation 212 troubleshooting 760 , 764 troubleshooting signatures update 760 verifying custom signatures 509 IEEE 802.
Index ZyWALL USG 50 User’s Guide 931 Internet Protocol Security , see IPSec Internet Protocol (IP) 497 intrusions host 510 network 51 1 Intrusion, Detection and Prevention see IDP 479 IP address 32 .
Index ZyWALL USG 50 User’s Guide 932 IP/MAC binding 343 exempt list 347 monitor 181 static DHCP 346 ISP account CHAP 657 CHAP/PAP 657 MPPE 657 MSCHAP 657 MSCHAP-V2 657 PAP 657 ISP accounts 655 and P.
Index ZyWALL USG 50 User’s Guide 933 configuration o v erv iew 107 descriptions 783 e-mail profiles 725 e-mailing log messages 207 , 729 formats 727 log consolidation 730 settings 725 syslog servers.
Index ZyWALL USG 50 User’s Guide 934 Name Server , see NBNS. NetBIOS Name Server , see N BNS NetMeeting 342 see also H.323 Netscape Navigator 43 network access mode 40 full tunnel 41 , 41 1 Network .
Index ZyWALL USG 50 User’s Guide 935 P P2P (Peer-to-peer) 490 attacks 490 see also Peer-to-peer packet flow 91 inspection signatures 483 , 487 scan 464 statistics 170 , 172 packet capture 750 exampl.
Index ZyWALL USG 50 User’s Guide 936 PPP interfaces subnet mask 266 PPPoE 27 0 and RADIUS 270 TCP port 1723 270 PPPoE/PPTP interfaces 216 , 231 and ISP accounts 231 , 655 basic characteristics 217 g.
Index ZyWALL USG 50 User’s Guide 937 anti-virus 194 collecting data 176 configuration o v erv iew 107 content filtering 198 daily 724 daily e-mail 724 IDP 196 specifications 178 traffic statistics 1.
Index ZyWALL USG 50 User’s Guide 938 and firewall 606 and IP protocols 606 and policy routes 606 service subscription status 214 services 605 , 841 and firewall 370 and port triggering 290 subscript.
Index ZyWALL USG 50 User’s Guide 939 and certificates 709 and zones 710 client requirements 708 encryption methods 708 for secure T elnet 710 how connection is established 707 vers ion s 708 with Li.
Index ZyWALL USG 50 User’s Guide 940 content filtering 212 IDP 212 new IDP/AppPatrol signatures 212 see also IDP SSL V PN 210 SSL VPN, see also SSL VPN status 214 , 448 , 467 upgrading 214 supported.
Index ZyWALL USG 50 User’s Guide 941 ext-user 770 firewall 761 firmware package 769 firmware upload 772 FTP 766 HT TP redirect 766 H.323 766 IDP 760 , 764 IDP signatures up date 760 interface 761 In.
Index ZyWALL USG 50 User’s Guide 942 local user database 619 user awareness 585 User Datagram Protocol, see UDP user group objects 583 user groups 583 , 585 and content filtering 533 and firewall 37.
Index ZyWALL USG 50 User’s Guide 943 VLAN interfaces 216 , 248 and Ethernet interfaces 24 8 , 763 basic characteristics 217 V oIP pass through 342 and firewall 338 and NA T 338 and policy routes 337.
Index ZyWALL USG 50 User’s Guide 944 and VPN 88 , 31 1 and WWW 695 block intra- zone traffic 314 , 366 configuration o v erv iew 98 default 89 extra- zone traffic 312 inter- zone traffic 312 intra- .
Un punto importante, dopo l’acquisto del dispositivo (o anche prima di acquisto) è quello di leggere il manuale. Dobbiamo farlo per diversi motivi semplici:
Se non hai ancora comprato il ZyXEL Communications 91-009-073003B è un buon momento per familiarizzare con i dati di base del prodotto. Prime consultare le pagine iniziali del manuale d’uso, che si trova al di sopra. Dovresti trovare lì i dati tecnici più importanti del ZyXEL Communications 91-009-073003B - in questo modo è possibile verificare se l’apparecchio soddisfa le tue esigenze. Esplorando le pagine segenti del manuali d’uso ZyXEL Communications 91-009-073003B imparerai tutte le caratteristiche del prodotto e le informazioni sul suo funzionamento. Le informazioni sul ZyXEL Communications 91-009-073003B ti aiuteranno sicuramente a prendere una decisione relativa all’acquisto.
In una situazione in cui hai già il ZyXEL Communications 91-009-073003B, ma non hai ancora letto il manuale d’uso, dovresti farlo per le ragioni sopra descritte. Saprai quindi se hai correttamente usato le funzioni disponibili, e se hai commesso errori che possono ridurre la durata di vita del ZyXEL Communications 91-009-073003B.
Tuttavia, uno dei ruoli più importanti per l’utente svolti dal manuale d’uso è quello di aiutare a risolvere i problemi con il ZyXEL Communications 91-009-073003B. Quasi sempre, ci troverai Troubleshooting, cioè i guasti più frequenti e malfunzionamenti del dispositivo ZyXEL Communications 91-009-073003B insieme con le istruzioni su come risolverli. Anche se non si riesci a risolvere il problema, il manuale d’uso ti mostrerà il percorso di ulteriori procedimenti – il contatto con il centro servizio clienti o il servizio più vicino.
