How it Works
ZyXEL
Loading...
10W
User Manual
495 pgs14.9 Mb0

ZyXEL 10, 10W, 50, 100 User Manual

Download
ZyWALL 10/10W/50/100
Internet Security Gateway
User’s Guide
Versions 3.52 and 3.60
December 2002
Copyright
Copyright © 2002 by ZyXEL Communications Corporation.
The contents of this publication may not be reproduced in any part or as a whole, transcribed, stored in a retrieval system, translated into any language, or transmitted in any form or by any means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the prior written permission of ZyXEL Communications Corporation. Published by ZyXEL Communications Corporation. All rights reserved.
Disclaimer
ZyXEL does not assume any liability arising out of the application or use of any products, or software described herein. Neither does it convey any license under its patent rights nor the patent rights of others. ZyXEL further reserves the right to make changes in any products described herein without notice.
This publication is subject to change without notice.
Trademarks
Trademarks mentioned in this publication are used for identification purposes only and may be properties of their respective owners.
ii Copyright
Federal Communications Commission (FCC)
Interference Statement
This device complies with Part 15 of FCC rules. Operation is subject to the following two conditions: This device may not cause harmful interference. This device must accept any interference received, including interference that may cause undesired operations. This equipment has been tested and found to comply with the limits for a CLASS B digital device pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a commercial environment. This equipment generates, uses, and can radiate radio frequency energy, and if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. If this equipment does cause harmful interference to radio/television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures: Reorient or relocate the receiving antenna. Increase the separation between the equipment and the receiver. Connect the equipment into an outlet on a circuit different from that to which the receiver is connected. Consult the dealer or an experienced radio/TV technician for help.
Notice 1
Changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate the equipment.
Certifications
Refer to the product page at www.zyxel.com.
FCC iii
Information for Canadian Users
The Industry Canada label identifies certified equipment. This certification means that the equipment meets certain telecommunications network protective, operation, and safety requirements. The Industry Canada does not guarantee that the equipment will operate to a user's satisfaction. Before installing this equipment, users should ensure that it is permissible to be connected to the facilities of the local telecommunications company. The equipment must also be installed using an acceptable method of connection. In some cases, the company's inside wiring associated with a single line individual service may be extended by means of a certified connector assembly. The customer should be aware that the compliance with the above conditions may not prevent degradation of service in some situations. Repairs to certified equipment should be made by an authorized Canadian maintenance facility designated by the supplier. Any repairs or alterations made by the user to this equipment, or equipment malfunctions, may give the telecommunications company cause to request the user to disconnect the equipment. For their own protection, users should ensure that the electrical ground connections of the power utility, telephone lines, and internal metallic water pipe system, if present, are connected together. This precaution may be particularly important in rural areas.
Caution
Users should not attempt to make such connections themselves, but should contact the appropriate electrical inspection authority, or electrician, as appropriate.
Note
This digital apparatus does not exceed the class A limits for radio noise emissions from digital apparatus set out in the radio interference regulations of Industry Canada.
iv Information for Canadian Users
ZyXEL Limited Warranty
ZyXEL warrants to the original end user (purchaser) that this product is free from any defects in materials or workmanship for a period of up to two years from the date of purchase. During the warranty period, and upon proof of purchase, should the product have indications of failure due to faulty workmanship and/or materials, ZyXEL will, at its discretion, repair or replace the defective products or components without charge for either parts or labor, and to whatever extent it shall deem necessary to restore the product or components to proper operating condition. Any replacement will consist of a new or re-manufactured functionally equivalent product of equal value, and will be solely at the discretion of ZyXEL. This warranty shall not apply if the product is modified, misused, tampered with, damaged by an act of God, or subjected to abnormal working conditions.
NOTE
Repair or replacement, as provided under this warranty, is the exclusive remedy of the purchaser. This warranty is in lieu of all other warranties, express or implied, including any implied warranty of merchantability or fitness for a particular use or purpose. ZyXEL shall in no event be held liable for indirect or consequential damages of any kind of character to the purchaser. To obtain the services of this warranty, contact ZyXEL's Service Center for your Return Material Authorization number (RMA). Products must be returned Postage Prepaid. It is recommended that the unit be insured when shipped. Any returned products without proof of purchase or those with an out-dated warranty will be repaired or replaced (at the discretion of ZyXEL) and the customer will be billed for parts and labor. All repaired or replaced products will be shipped by ZyXEL to the corresponding return address, Postage Paid. This warranty gives you specific legal rights, and you may also have other rights that vary from country to country.
Online Registration
Register online registration at www.zyxel.com for free future product updates and information.
Warranty v
Customer Support
When you contact your customer support representative please have the following information ready: Please have the following information ready when you contact customer support.
• Product model and serial number.
• Information in Menu 24.2.1 – System Information.
• Warranty Information.
• Date that you received your device.
• Brief description of the problem and the steps you took to solve it.
LOCATION WORLDWIDE
AMERICA
METHOD
support@zyxel.com.tw
sales@zyxel.com.tw
support@zyxel.com +1-714-632-0882
sales@zyxel.com
support@zyxel.dk +45-3955-0700 www.zyxel.dk SCANDINAVIA
sales@zyxel.dk
support@zyxel.de +49-2405-6909-0 www.zyxel.de GERMANY
sales@zyxel.de
E-MAIL
SUPPORT/SALES
+886-3-578-2439 ftp.europe.zyxel.com
+1-714-632-0858 ftp.zyxel.com
+45-3955-0707 ftp.zyxel.dk
+49-2405-6909-99
TELEPHONE/FAX WEB SITE/ FTP SITE REGULAR MAIL
+886-3-578-3942 www.zyxel.com
www.europe.zyxel.com
www.zyxel.com NORTH
800-255-4101
ZyXEL Communications Corp., 6 Innovation Road II, Science­Based Industrial Park, Hsinchu 300, Taiwan
ZyXEL Communications Inc., 1650 Miraloma Avenue, Placentia, CA 92870, U.S.A.
ZyXEL Communications A/S, Columbusvej 5, 2860 Soeborg, Denmark
ZyXEL Deutschland GmbH. Adenauerstr. 20/A4 D-52146 Wuerselen, Germany
vi Customer Support
Table of Contents
Copyright......................................................................................................................................................ii
Federal Communications Commission (FCC) Interference Statement................................................. iii
Information for Canadian Users ...............................................................................................................iv
ZyXEL Limited Warranty ..........................................................................................................................v
Customer Support ......................................................................................................................................vi
List of Figures ...........................................................................................................................................xvi
List of Tables ............................................................................................................................................xxv
Preface ......................................................................................................................................................xxx
Overview ........................................................................................................................................................... I
Chapter 1 Getting to Know Your ZyWALL .......................................................................................... 1-1
1.1 The ZyWALL 10/10W/50/100 Internet Security Gateway........................................................ 1-1
1.2 Features ...................................................................................................................................... 1-1
1.3 Applications for the ZyWALL................................................................................................... 1-7
Chapter 2 Hardware Installation ........................................................................................................... 2-1
2.1 Front Panel LEDs and Back Panel Ports.................................................................................... 2-1
2.2 ZyWALL Rear Panel and Connections...................................................................................... 2-3
2.3 Additional Installation Requirements......................................................................................... 2-8
2.4 Additional Installation Requirements for Using 802.1x............................................................. 2-9
Initial Setup and Configuration.....................................................................................................................II
Chapter 3 Initial Setup............................................................................................................................ 3-1
3.1 Turning On Your ZyWALL....................................................................................................... 3-1
3.2 Navigating the SMT Interface....................................................................................................3-2
3.3 Changing the System Password ................................................................................................. 3-7
3.4 Resetting the ZyWALL.............................................................................................................. 3-8
Chapter 4 SMT Menu 1 - General Setup............................................................................................... 4-1
Table of Contents vii
4.1 System Name ..............................................................................................................................4-1
4.2 Dynamic DNS.............................................................................................................................4-1
4.3 General Setup..............................................................................................................................4-2
Chapter 5 WAN and Dial Backup Setup ................................................................................................5-1
5.1 Cloning The MAC Address ........................................................................................................5-1
5.2 WAN Setup.................................................................................................................................5-1
5.3 Dial Backup ................................................................................................................................5-2
5.4 Configuring Dial Backup in Menu 2...........................................................................................5-2
5.5 Advanced WAN Setup................................................................................................................5-4
5.6 Backup Remote Node Setup .......................................................................................................5-6
5.7 Remote Node Profile (Backup ISP)............................................................................................5-7
5.8 Editing PPP Options ...................................................................................................................5-9
5.9 Editing TCP/IP Options ............................................................................................................5-11
5.10 Editing Login Script..............................................................................................................5-12
5.11 Remote Node Filter............................................................................................................... 5-14
Chapter 6 LAN Setup...............................................................................................................................6-1
6.1 Introduction.................................................................................................................................6-1
6.2 LAN Port Filter Setup.................................................................................................................6-1
6.3 TCP/IP and LAN DHCP.............................................................................................................6-2
6.4 TCP/IP and DHCP Ethernet Setup Menu ...................................................................................6-5
6.5 Wireless LAN ...........................................................................................................................6-10
6.6 Wireless LAN Setup .................................................................................................................6-11
Chapter 7 Wireless LAN Security Setup ................................................................................................7-1
7.1 Levels of Security .......................................................................................................................7-1
7.2 Data Encryption with WEP.........................................................................................................7-1
7.3 Network Authentication..............................................................................................................7-3
7.4 Local User Authentication ..........................................................................................................7-8
viii Table of Contents
7.5 MAC Address Filtering............................................................................................................ 7-10
Chapter 8 DMZ Setup............................................................................................................................. 8-1
8.1 Introduction................................................................................................................................ 8-1
8.2 DMZ Port Filter Setup ............................................................................................................... 8-2
8.3 TCP/IP Setup.............................................................................................................................. 8-2
Chapter 9 Internet Access ....................................................................................................................... 9-1
9.1 Internet Access Setup ................................................................................................................. 9-1
9.2 Basic Setup Complete ................................................................................................................ 9-5
Advanced Applications ................................................................................................................................. III
Chapter 10 Remote Node Setup............................................................................................................ 10-1
10.1 Remote Node Setup.............................................................................................................. 10-1
10.2 Remote Node Profile............................................................................................................ 10-2
10.3 Editing TCP/IP Options (with Ethernet Encapsulation)....................................................... 10-7
10.4 Remote Node Filter ............................................................................................................ 10-11
10.5 Traffic Redirect .................................................................................................................. 10-12
Chapter 11 IP Static Route Setup ..........................................................................................................11-1
11.1 IP Static Route Setup............................................................................................................ 11-2
Chapter 12 Network Address Translation (NAT) ............................................................................... 12-1
12.1 Introduction.......................................................................................................................... 12-1
12.2 Using NAT........................................................................................................................... 12-6
12.3 NAT Setup ........................................................................................................................... 12-8
12.4 NAT Server Sets – Port Forwarding .................................................................................. 12-14
12.5 General NAT Examples ..................................................................................................... 12-17
12.6 Trigger Port Forwarding..................................................................................................... 12-24
Firewall and Content Filters ........................................................................................................................ IV
Chapter 13 Firewalls ............................................................................................................................. 13-1
13.1 What Is a Firewall? .............................................................................................................. 13-1
Table of Contents ix
13.2 Types of Firewalls.................................................................................................................13-1
13.3 Introduction to ZyXEL’s Firewall ........................................................................................13-2
13.4 Denial of Service...................................................................................................................13-3
13.5 Stateful Inspection ................................................................................................................13-7
13.6 Guidelines For Enhancing Security With Your Firewall....................................................13-11
13.7 Packet Filtering Vs Firewall ...............................................................................................13-12
Chapter 14 Introducing the ZyWALL Firewall ...................................................................................14-1
14.1 Remote Management and the Firewall .................................................................................14-1
14.2 Access Methods ....................................................................................................................14-1
14.3 Using ZyWALL SMT Menus...............................................................................................14-1
Chapter 15 Using the ZyWALL Web Configurator............................................................................. 15-1
15.1 Web Configurator Login and Main Menu Screens...............................................................15-1
15.2 Enabling the Firewall............................................................................................................15-1
15.3 Attack Alert...........................................................................................................................15-2
Chapter 16 Creating Custom Rules ......................................................................................................16-1
16.1 Rules Overview.....................................................................................................................16-1
16.2 Rule Logic Overview............................................................................................................16-2
16.3 Connection Direction Examples ...........................................................................................16-4
16.4 Rule Summary ......................................................................................................................16-5
16.5 Predefined Services...............................................................................................................16-8
16.6 Custom Ports.......................................................................................................................16-15
16.7 Creating/Editing A Custom Port.........................................................................................16-15
16.8 Example Firewall Rule .......................................................................................................16-17
Chapter 17 Content Filtering ................................................................................................................17-1
17.1 Categories .............................................................................................................................17-1
17.2 Free .......................................................................................................................................17-5
17.3 iCard .....................................................................................................................................17-7
x Table of Contents
17.4 List Update........................................................................................................................... 17-8
17.5 Exempt Computers............................................................................................................. 17-10
17.6 Customizing ....................................................................................................................... 17-11
17.7 Domain Name .................................................................................................................... 17-14
Logs, Filter Configuration, and SNMP Configuration ................................................................................V
Chapter 18 Centralized Logs................................................................................................................ 18-1
18.1 View Log.............................................................................................................................. 18-1
18.2 Log Settings ......................................................................................................................... 18-3
Chapter 19 Filter Configuration........................................................................................................... 19-1
19.1 About Filtering ..................................................................................................................... 19-1
19.2 Configuring a Filter Set........................................................................................................19-4
19.3 Example Filter.................................................................................................................... 19-13
19.4 Filter Types and NAT ........................................................................................................ 19-16
19.5 Firewall .............................................................................................................................. 19-16
19.6 Applying a Filter and Factory Defaults.............................................................................. 19-17
Chapter 20 SNMP Configuration ......................................................................................................... 20-1
20.1 About SNMP........................................................................................................................ 20-1
20.2 Supported MIBs ................................................................................................................... 20-3
20.3 SNMP Configuration............................................................................................................ 20-3
20.4 SNMP Traps......................................................................................................................... 20-4
System Information and Diagnosis and Firmware and Configuration File Maintenance...................... VI
Chapter 21 System Information & Diagnosis...................................................................................... 21-1
21.1 System Status ....................................................................................................................... 21-1
21.2 System Information and Console Port Speed....................................................................... 21-3
21.3 Log and Trace ...................................................................................................................... 21-5
21.4 Diagnostic .......................................................................................................................... 21-10
Chapter 22 Firmware and Configuration File Maintenance ............................................................. 22-1
Table of Contents xi
22.1 Filename Conventions ..........................................................................................................22-1
22.2 Backup Configuration...........................................................................................................22-2
22.3 Restore Configuration...........................................................................................................22-8
22.4 Uploading Firmware and Configuration Files ....................................................................22-11
System Maintenance and Information and Remote Management.......................................................... VII
Chapter 23 System Maintenance & Information.................................................................................23-1
23.1 Command Interpreter Mode..................................................................................................23-1
23.2 Call Control Support.............................................................................................................23-2
23.3 Time and Date Setting ..........................................................................................................23-5
Chapter 24 Remote Management ......................................................................................................... 24-1
24.1 Remote Management and the Firewall .................................................................................24-1
24.2 Telnet ....................................................................................................................................24-1
24.3 FTP .......................................................................................................................................24-2
24.4 Web....................................................................................................................................... 24-2
24.5 SNMP ...................................................................................................................................24-2
24.6 DNS ......................................................................................................................................24-2
24.7 Remote Management ............................................................................................................24-2
24.8 Remote Management and NAT ............................................................................................24-4
24.9 System Timeout .................................................................................................................... 24-5
Bandwidth Management............................................................................................................................VIII
Chapter 25 Bandwidth Management....................................................................................................25-1
25.1 Introduction...........................................................................................................................25-1
25.2 Bandwidth Classes and Filters .............................................................................................. 25-1
25.3 Proportional Bandwidth Allocation ......................................................................................25-2
25.4 Bandwidth Management Usage Examples............................................................................25-2
25.5 Scheduler ..............................................................................................................................25-4
25.6 Maximize Bandwidth Usage................................................................................................. 25-5
xii Table of Contents
25.7 Bandwidth Borrowing.......................................................................................................... 25-8
25.8 Bandwidth Management Setup .......................................................................................... 25-10
IP Policy Routing, Call Scheduling and VPN/IPSec................................................................................... IX
Chapter 26 IP Policy Routing ............................................................................................................... 26-1
26.1 Introduction.......................................................................................................................... 26-1
26.2 Benefits ................................................................................................................................ 26-1
26.3 Routing Policy...................................................................................................................... 26-1
26.4 IP Routing Policy Setup....................................................................................................... 26-2
26.5 Applying an IP Policy .......................................................................................................... 26-6
26.6 IP Policy Routing Example .................................................................................................. 26-7
Chapter 27 Call Scheduling .................................................................................................................. 27-1
27.1 Introduction.......................................................................................................................... 27-1
Chapter 28 Introduction to IPSec......................................................................................................... 28-1
28.1 Introduction.......................................................................................................................... 28-1
28.2 IPSec Architecture ............................................................................................................... 28-3
28.3 Encapsulation ....................................................................................................................... 28-5
28.4 IPSec and NAT .................................................................................................................... 28-5
Chapter 29 VPN/IPSec Setup ............................................................................................................... 29-1
29.1 VPN/IPSec Setup .................................................................................................................29-1
29.2 IPSec Algorithms ................................................................................................................. 29-2
29.3 IPSec Summary.................................................................................................................... 29-3
29.4 IPSec Setup ........................................................................................................................ 29-11
29.5 IKE Setup........................................................................................................................... 29-17
29.6 Manual Setup ..................................................................................................................... 29-21
Chapter 30 SA Monitor ......................................................................................................................... 30-1
30.1 Introduction.......................................................................................................................... 30-1
30.2 Using SA Monitor ................................................................................................................30-1
Table of Contents xiii
Troubleshooting .............................................................................................................................................. X
Chapter 31 Troubleshooting ....................................................................................................................... 1
31.1 Problems Starting Up the ZyWALL .......................................................................................... 1
31.2 Problems with the LAN Interface .............................................................................................. 2
31.3 Problems with the DMZ Interface..............................................................................................2
31.4 Problems with the WAN Interface............................................................................................. 3
31.5 Problems with Internet Access...................................................................................................3
31.6 Problems with the Password ......................................................................................................4
31.7 Problems with Remote Management ......................................................................................... 4
General Appendices.......................................................................................................................................XI
Appendix A Setting up Your Computer’s IP Address............................................................................... 1
Appendix B Triangle Route ......................................................................................................................12
Appendix C The Big Picture..................................................................................................................... 15
Appendix D Wireless LAN and IEEE 802.11 .......................................................................................... 16
Appendix E Wireless LAN With IEEE 802.1x ........................................................................................20
Appendix F PPPoE.................................................................................................................................... 23
Appendix G PPTP ..................................................................................................................................... 25
Appendix H Hardware Specifications ..................................................................................................... 28
Appendix I Universal Plug and Play........................................................................................................ 33
Appendix J IP Subnetting ......................................................................................................................... 42
Appendix K Safety Warnings and Instructions ...................................................................................... 50
Appendix L Removing and Installing a ZyWALL 100 Fuse .................................................................. 51
Command and Log Appendices .................................................................................................................. XII
Appendix M Command Interpreter.........................................................................................................55
Appendix N Firewall Commands............................................................................................................. 56
Appendix O NetBIOS Filter Commands................................................................................................. 63
Appendix P Boot Commands.................................................................................................................... 67
xiv Table of Contents
Appendix Q Log Descriptions...................................................................................................................69
Appendix R Brute-Force Password Guessing Protection.......................................................................87
Index............................................................................................................................................................ XIII
Index ............................................................................................................................................................A
Table of Contents xv
List of Figures
Figure 1-1 Secure Internet Access via Cable, DSL or Wireless Modem.........................................................1-8
Figure 1-2 VPN Application ...........................................................................................................................1-9
Figure 2-1 ZyWALL 100 Front Panel.............................................................................................................2-1
Figure 2-2 ZyWALL 50 Front Panel...............................................................................................................2-1
Figure 2-3 ZyWALL 10W Front Panel...........................................................................................................2-1
Figure 2-4 ZyWALL 10 Front Panel...............................................................................................................2-2
Figure 2-5 ZyWALL 100 Rear Panel..............................................................................................................2-4
Figure 2-6 ZyWALL 50 Rear Panel................................................................................................................2-4
Figure 2-7 ZyWALL 10W Rear Panel............................................................................................................2-5
Figure 2-8 ZyWALL 10 Rear Panel................................................................................................................2-5
Figure 2-9 Inserting the Wireless LAN Card ..................................................................................................2-8
Figure 3-1 Initial Screen .................................................................................................................................3-1
Figure 3-2 Password Screen ...........................................................................................................................3-2
Figure 3-3 Main Menu (ZyWALL 100)..........................................................................................................3-3
Figure 3-4 Getting Started and Advanced Applications SMT Menus .............................................................3-5
Figure 3-5 Advanced Management SMT Menus ............................................................................................3-6
Figure 3-6 Schedule Setup and IPSec VPN Configuration SMT Menus........................................................3-7
Figure 3-7 Menu 23: System Password ..........................................................................................................3-7
Figure 4-1 Menu 1: General Setup..................................................................................................................4-2
Figure 4-2 Configure Dynamic DNS..............................................................................................................4-3
Figure 5-1 MAC Address Cloning in WAN Setup..........................................................................................5-1
Figure 5-2 Menu 2: Dial Backup Setup .........................................................................................................5-3
Figure 5-3 Menu 2.1 Advanced WAN Setup ..................................................................................................5-5
Figure 5-4 Menu 11.1 Remote Node Profile (Backup ISP) ............................................................................5-7
Figure 5-5 Menu 11.2 - Remote Node PPP Options .....................................................................................5-10
xvi List of Figures
Figure 5-6 Remote Node PPP Options Menu Fields .................................................................................... 5-10
Figure 5-7 Menu 11.3: Remote Node Network Layer Options.....................................................................5-11
Figure 5-8 Menu 11.4 – Remote Node Setup Script .................................................................................... 5-14
Figure 5-9 Menu 11.5: Remote Node Filter (Ethernet)................................................................................ 5-15
Figure 5-10 Menu 11.5: Remote Node Filter (PPPoE or PPTP).................................................................. 5-15
Figure 6-1 Menu 3: LAN Setup ..................................................................................................................... 6-1
Figure 6-2 Menu 3.1: LAN Port Filter Setup ................................................................................................. 6-2
Figure 6-3 Physical Network ......................................................................................................................... 6-5
Figure 6-4 Partitioned Logical Networks....................................................................................................... 6-5
Figure 6-5 Menu 3: TCP/IP and DHCP Setup................................................................................................ 6-6
Figure 6-6 Menu 3.2: TCP/IP and DHCP Ethernet Setup.............................................................................. 6-6
Figure 6-7 Menu 3.2.1: IP Alias Setup........................................................................................................... 6-9
Figure 6-8 RTS Threshold............................................................................................................................6-11
Figure 6-9 Menu 3.5 – Wireless LAN Setup................................................................................................ 6-12
Figure 7-1 ZyWALL Wireless Security Levels .............................................................................................. 7-1
Figure 7-2 Wireless LAN ............................................................................................................................... 7-2
Figure 7-3 Sequence for EAP Authentication ................................................................................................ 7-5
Figure 7-4 Wireless LAN 802.1X Authentication .......................................................................................... 7-6
Figure 7-5 Authentication RADIUS............................................................................................................... 7-7
Figure 7-6 Local User Database..................................................................................................................... 7-9
Figure 7-7 WLAN MAC Address Filter........................................................................................................7-11
Figure 8-1 Menu 5: DMZ Setup.................................................................................................................... 8-1
Figure 8-2 Menu 5.1: DMZ Port Filter Setup ................................................................................................ 8-2
Figure 8-3 Menu 5: TCP/IP Setup.................................................................................................................. 8-2
Figure 8-4 Menu 5.2: TCP/IP Setup............................................................................................................... 8-3
Figure 8-5 Menu 5.2.1: IP Alias Setup........................................................................................................... 8-4
Figure 9-1 Menu 4: Internet Access Setup (Ethernet).................................................................................... 9-1
List of Figures xvii
Figure 9-2 Internet Access Setup (PPTP) .......................................................................................................9-3
Figure 9-3 Internet Access Setup (PPPoE) .....................................................................................................9-4
Figure 10-1 Menu 11 Remote Node Setup ...................................................................................................10-1
Figure 10-2 Menu 11.1: Remote Node Profile for Ethernet Encapsulation ..................................................10-2
Figure 10-3 Menu 11.1: Remote Node Profile for PPPoE Encapsulation ....................................................10-4
Figure 10-4 Menu 11.1: Remote Node Profile for PPTP Encapsulation.......................................................10-6
Figure 10-5 Menu 11.3: Remote Node Network Layer Options for Ethernet Encapsulation .......................10-7
Figure 10-6 Menu 11.3: Remote Node Network Layer Options for PPTP Encapsulation............................10-9
Figure 10-7 Menu 11.5: Remote Node Filter (Ethernet Encapsulation) .....................................................10-11
Figure 10-8 Menu 11.5: Remote Node Filter (PPPoE or PPTP Encapsulation) .........................................10-12
Figure 10-9 Traffic Redirect WAN Setup ...................................................................................................10-12
Figure 10-10 Traffic Redirect LAN Setup ..................................................................................................10-13
Figure 10-11 Menu 11.1: Remote Node Profile..........................................................................................10-13
Figure 10-12 Menu 11.6: Traffic Redirect Setup ........................................................................................10-14
Figure 11-1 Example of Static Routing Topology ........................................................................................11-1
Figure 11-2 Menu 12: IP Static Route Setup (ZyWALL 10W)..................................................................... 11-2
Figure 11-3 Menu 12. 1: Edit IP Static Route............................................................................................... 11-3
Figure 12-1 How NAT Works.......................................................................................................................12-3
Figure 12-2 NAT Application With IP Alias .................................................................................................12-4
Figure 12-3 Menu 4: Applying NAT for Internet Access..............................................................................12-7
Figure 12-4 Menu 11.3: Applying NAT to the Remote Node .......................................................................12-8
Figure 12-5 Menu 15: NAT Setup ................................................................................................................12-9
Figure 12-6 Menu 15.1: Address Mapping Sets ...........................................................................................12-9
Figure 12-7 Menu 15.1.255: SUA Address Mapping Rules .......................................................................12-10
Figure 12-8 Menu 15.1.1: First Set............................................................................................................. 12-11
Figure 12-9 Menu 15.1.1.1: Editing/Configuring an Individual Rule in a Set............................................12-13
Figure 12-10 Menu 15.2: NAT Server Setup .............................................................................................. 12-16
xviii List of Figures
Figure 12-11 Multiple Servers Behind NAT Example ............................................................................... 12-16
Figure 12-12 NAT Example 1 .................................................................................................................... 12-17
Figure 12-13 Menu 4: Internet Access & NAT Example ........................................................................... 12-17
Figure 12-14 NAT Example 2 .................................................................................................................... 12-18
Figure 12-15 Menu 15.2: Specifying an Inside Server............................................................................... 12-19
Figure 12-16 NAT Example 3 .................................................................................................................... 12-20
Figure 12-17 Example 3: Menu 11.3.......................................................................................................... 12-21
Figure 12-18 Example 3: Menu 15.1.1.1 ................................................................................................... 12-21
Figure 12-19 Example 3: Final Menu 15.1.1 ............................................................................................. 12-22
Figure 12-20 Example 3: Menu 15.2 ......................................................................................................... 12-22
Figure 12-21 NAT Example 4 .................................................................................................................... 12-23
Figure 12-22 Example 4: Menu 15.1.1.1: Address Mapping Rule............................................................. 12-24
Figure 12-23 Example 4: Menu 15.1.1: Address Mapping Rules .............................................................. 12-24
Figure 12-24 Trigger Port Forwarding Process: Example.......................................................................... 12-25
Figure 12-25 Menu 15.3—Trigger Port Setup ........................................................................................... 12-26
Figure 13-1 ZyWALL Firewall Application................................................................................................. 13-3
Figure 13-2 Three-Way Handshake ............................................................................................................. 13-5
Figure 13-3 SYN Flood................................................................................................................................ 13-5
Figure 13-4 Smurf Attack ............................................................................................................................ 13-6
Figure 13-5 Stateful Inspection.................................................................................................................... 13-8
Figure 14-1 Menu 21: Filter and Firewall Setup.......................................................................................... 14-1
Figure 14-2 Menu 21.2: Firewall Setup ....................................................................................................... 14-2
Figure 15-1 Enabling the Firewall (ZyWALL 100)...................................................................................... 15-2
Figure 15-2 Attack Alert .............................................................................................................................. 15-5
Figure 16-1 LAN to WAN Traffic................................................................................................................ 16-4
Figure 16-2 WAN to LAN Traffic................................................................................................................ 16-5
Figure 16-3 Firewall Rules Summary: First Screen (ZyWALL100) ............................................................ 16-6
List of Figures xix
Figure 16-4 Creating/Editing A Firewall Rule (ZyWALL100)...................................................................16-12
Figure 16-5 Adding/Editing Source and Destination Addresses .................................................................16-14
Figure 16-6 Creating/Editing A Custom Port..............................................................................................16-16
Figure 16-7 Firewall Rule Configuration Screen (ZyWALL100)...............................................................16-17
Figure 16-8 Firewall IP Config Screen .......................................................................................................16-18
Figure 16-9 Custom Port for MyService.....................................................................................................16-19
Figure 16-10 MyService Rule Configuration (ZyWALL100) ....................................................................16-20
Figure 16-11 Example 3: Rule Summary (ZyWALL100)...........................................................................16-21
Figure 17-1Content Filter: Categories ..........................................................................................................17-2
Figure 17-2 Content Filter: Free ...................................................................................................................17-6
Figure 17-3 Content Filter: iCard .................................................................................................................17-7
Figure 17-4 Content Filter: List Update........................................................................................................17-9
Figure 17-5 Content Filter: Exempt Zone...................................................................................................17-10
Figure 17-6 Content Filter: Customize .......................................................................................................17-12
Figure 17-7 Content Filter: Domain Name.................................................................................................17-14
Figure 18-1 View Log...................................................................................................................................18-2
Figure 18-2 Log Settings .............................................................................................................................. 18-4
Figure 19-1 Outgoing Packet Filtering Process ............................................................................................ 19-2
Figure 19-2 Filter Rule Process ....................................................................................................................19-3
Figure 19-4 Menu 21: Filter and Firewall Setup...........................................................................................19-4
Figure 19-5 Menu 21.1: Filter Set Configuration .........................................................................................19-4
Figure 19-6 Menu 21.1.1.1: TCP/IP Filter Rule ...........................................................................................19-7
Figure 19-7 Executing an IP Filter..............................................................................................................19-10
Figure 19-8 Menu 21.1.4.1: Generic Filter Rule.........................................................................................19-11
Figure 19-9 Telnet Filter Example ..............................................................................................................19-13
Figure 19-10 Example Filter: Menu 21.1.3.1..............................................................................................19-14
Figure 19-11 Example Filter Rules Summary: Menu 21.1.3 ...................................................................... 19-15
xx List of Figures
Figure 19-12 Protocol and Device Filter Sets ............................................................................................ 19-16
Figure 19-13 Filtering LAN Traffic ........................................................................................................... 19-17
Figure 19-14Filtering DMZ Traffic............................................................................................................ 19-18
Figure 19-15 Filtering Remote Node Traffic ............................................................................................. 19-18
Figure 20-1 SNMP Management Model ...................................................................................................... 20-2
Figure 20-2 Menu 22: SNMP Configuration................................................................................................ 20-3
Figure 21-1 Menu 24: System Maintenance ................................................................................................ 21-1
Figure 21-2 Menu 24.1: System Maintenance: Status (ZyWALL 100)....................................................... 21-2
Figure 21-3 Menu 24.2: System Information and Console Port Speed ........................................................ 21-3
Figure 21-4 Menu 24.2.1: System Maintenance: Information (ZyWALL 10W).......................................... 21-4
Figure 21-5 Menu 24.2.2: System Maintenance: Change Console Port Speed ............................................ 21-5
Figure 21-6 Menu 24.3: System Maintenance: Log and Trace .................................................................... 21-6
Figure 21-7 Examples of Error and Information Messages ......................................................................... 21-6
Figure 21-8 Menu 24.3.2: System Maintenance: UNIX Syslog (ZyWALL 100)......................................... 21-7
Figure 21-9 Call-Triggering Packet Example ............................................................................................ 21-10
Figure 21-10 Menu 24.4: System Maintenance: Diagnostic.......................................................................21-11
Figure 21-11 WAN & LAN DHCP ............................................................................................................ 21-12
Figure 22-1 Telnet into Menu 24.5............................................................................................................... 22-3
Figure 22-2 FTP Session Example ............................................................................................................... 22-4
Figure 22-3 System Maintenance: Backup Configuration........................................................................... 22-7
Figure 22-4 System Maintenance: Starting Xmodem Download Screen..................................................... 22-7
Figure 22-5 Backup Configuration Example ............................................................................................... 22-7
Figure 22-6 Successful Backup Confirmation Screen.................................................................................. 22-7
Figure 22-7 Telnet into Menu 24.6............................................................................................................... 22-9
Figure 22-8 Restore Using FTP Session Example ..................................................................................... 22-10
Figure 22-9 System Maintenance: Restore Configuration......................................................................... 22-10
Figure 22-10 System Maintenance: Starting Xmodem Download Screen ................................................. 22-10
List of Figures xxi
Figure 22-11 Restore Configuration Example ............................................................................................22-11
Figure 22-12 Successful Restoration Confirmation Screen........................................................................ 22-11
Figure 22-13 Telnet Into Menu 24.7.1: Upload System Firmware .............................................................22-12
Figure 22-14 Telnet Into Menu 24.7.2: System Maintenance.....................................................................22-13
Figure 22-15 FTP Session Example of Firmware File Upload ...................................................................22-14
Figure 22-16 Menu 24.7.1 as seen using the Console Port.........................................................................22-16
Figure 22-17 Example Xmodem Upload....................................................................................................22-17
Figure 22-18 Menu 24.7.2 as seen using the Console Port.........................................................................22-18
Figure 22-19 Example Xmodem Upload....................................................................................................22-19
Figure 23-1 Command Mode in Menu 24 ....................................................................................................23-1
Figure 23-2 Valid Commands .......................................................................................................................23-2
Figure 23-3 Call Control...............................................................................................................................23-2
Figure 23-4 Budget Management .................................................................................................................23-3
Figure 23-5 Call History...............................................................................................................................23-4
Figure 23-6 Menu 24: System Maintenance.................................................................................................23-5
Figure 23-7 Menu 24.10 System Maintenance: Time and Date Setting .......................................................23-6
Figure 24-1 Telnet Configuration on a TCP/IP Network .............................................................................. 24-1
Figure 24-2 Menu 24.11 – Remote Management Control ............................................................................24-3
Figure 25-1 Application-based Bandwidth Management Example ..............................................................25-3
Figure 25-2 Subnet-based Bandwidth Management Example ......................................................................25-3
Figure 25-3 Application and Subnet-based Bandwidth Management Example............................................25-4
Figure 25-4 Bandwidth Allotment Example .................................................................................................25-6
Figure 25-5 Maximize Bandwidth Usage Example......................................................................................25-7
Figure 25-6 Bandwidth Borrowing Example................................................................................................25-9
Figure 25-7 Bandwidth Manager: Summary .............................................................................................. 25-11
Figure 25-8 Bandwidth Manager: Class Setup ...........................................................................................25-13
Figure 25-9 Bandwidth Manager: Class Configuration..............................................................................25-14
xxii List of Figures
Figure 25-10 Bandwidth Management Statistics ....................................................................................... 25-16
Figure 25-11 Bandwidth Manager Monitor ............................................................................................... 25-18
Figure 26-2 IP Routing Policy Setup ........................................................................................................... 26-2
Figure 26-4 Menu 25.1: Sample IP Routing Policy Setup ...........................................................................26-3
Figure 26-5 IP Routing Policy ..................................................................................................................... 26-4
Figure 26-6 Menu 3.2: TCP/IP and DHCP Ethernet Setup .......................................................................... 26-6
Figure 26-7 Example of IP Policy Routing .................................................................................................. 26-7
Figure 26-8 IP Routing Policy Example ...................................................................................................... 26-8
Figure 26-9 IP Routing Policy ..................................................................................................................... 26-9
Figure 26-10 Applying IP Policies ............................................................................................................. 26-10
Figure 27-1 Menu 26 - Schedule Setup........................................................................................................ 27-1
Figure 27-2 Schedule Set Setup ................................................................................................................... 27-2
Figure 27-3 Applying Schedule Set(s) to a Remote Node (PPPoE)............................................................. 27-4
Figure 27-4 Applying Schedule Set(s) to a Remote Node (PPTP)............................................................... 27-5
Figure 28-1 Encryption and Decryption....................................................................................................... 28-2
Figure 28-2 VPN Application ...................................................................................................................... 28-3
Figure 28-3 IPSec Architecture .................................................................................................................... 28-4
Figure 28-4 Transport and Tunnel Mode IPSec Encapsulation.................................................................... 28-5
Figure 29-1 VPN SMT Menu Tree............................................................................................................... 29-1
Figure 29-2 Menu 27: VPN/IPSec Setup ..................................................................................................... 29-2
Figure 29-3 IPSec Summary Fields ............................................................................................................. 29-3
Figure 29-4 Telecommuter’s ZyWALL Configuration.................................................................................29-7
Figure 29-5 Headquarters ZyWALL Configuration ..................................................................................... 29-7
Figure 29-6 Menu 27.1: IPSec Summary..................................................................................................... 29-8
Figure 29-7 Menu 27.1.1: IPSec Setup ...................................................................................................... 29-12
Figure 29-8 Two Phases to Set Up the IPSec SA....................................................................................... 29-17
Figure 29-9 Menu 27.1.1.1: IKE Setup...................................................................................................... 29-19
List of Figures xxiii
Figure 29-10 Menu 27.1.1.2: Manual Setup ...............................................................................................29-22
Figure 30-1 Menu 27.2: SA Monitor ............................................................................................................30-1
xxiv List of Figures
List of Tables
Table 1-1 Model Specific Features................................................................................................................. 1-1
Table 2-1 LED Descriptions........................................................................................................................... 2-2
Table 2-2 LAN Port Connections With an Uplink Button ............................................................................. 2-7
Table 3-1 Main Menu Commands.................................................................................................................. 3-2
Table 3-2 Main Menu Summary .................................................................................................................... 3-3
Table 4-1 General Setup Menu Field ............................................................................................................. 4-2
Table 4-2 Configure Dynamic DNS Menu Fields.......................................................................................... 4-3
Table 5-1 MAC Address Cloning in WAN Setup........................................................................................... 5-2
Table 5-2 Menu 2: Dial Backup Setup ........................................................................................................... 5-3
Table 5-3 Advanced WAN Port Setup: AT Commands Fields ....................................................................... 5-5
Table 5-4 Advanced WAN Port Setup: Call Control Parameters ................................................................... 5-6
Table 5-5 Fields in Menu 11.1 Remote Node Profile (Backup ISP) .............................................................. 5-7
Table 5-6 Remote Node Network Layer Options Menu Fields.....................................................................5-11
Table 5-7 Remote Node Script Menu Fields ................................................................................................ 5-14
Table 6-1 Example Of Network Properties For LAN Servers With Fixed IP Addresses ............................... 6-3
Table 6-2 Private IP Address Ranges ............................................................................................................. 6-4
Table 6-3 DHCP Ethernet Setup Menu Fields................................................................................................ 6-7
Table 6-4 LAN TCP/IP Setup Menu Fields.................................................................................................... 6-7
Table 6-5 IP Alias Setup Menu Fields............................................................................................................ 6-9
Table 6-6 Wireless LAN Setup Menu Fields................................................................................................ 6-12
Table 7-1 Wireless LAN................................................................................................................................. 7-3
Table 7-2 Wireless LAN 802.1X Authentication ........................................................................................... 7-6
Table 7-3 Authentication RADIUS ................................................................................................................ 7-7
Table 7-4 Local User Database .................................................................................................................... 7-10
Table 7-5 WLAN MAC Address Filter .........................................................................................................7-11
List of Tables xxv
Table 9-1 Menu 4: Internet Access Setup Menu Fields ..................................................................................9-1
Table 9-2 New Fields in Menu 4 (PPTP) Screen ............................................................................................9-3
Table 9-3 New Fields in Menu 4 (PPPoE) screen...........................................................................................9-5
Table 10-1 Fields in Menu 11.1 ....................................................................................................................10-2
Table 10-2 Fields in Menu 11.1 (PPPoE Encapsulation Specific)................................................................10-5
Table 10-3 Fields in Menu 11.1 (PPTP Encapsulation) ................................................................................ 10-6
Table 10-4 Remote Node Network Layer Options Menu Fields...................................................................10-7
Table 10-5 Remote Node Network Layer Options Menu Fields...................................................................10-9
Table 10-6 Menu 11.1: Remote Node Profile (Traffic Redirect Field) .......................................................10-14
Table 10-7 Traffic Redirect Setup...............................................................................................................10-14
Table 11-1 IP Static Route Menu Fields .......................................................................................................11-3
Table 12-1 NAT Definitions..........................................................................................................................12-1
Table 12-2 NAT Mapping Types...................................................................................................................12-5
Table 12-3 Applying NAT in Menus 4 & 11.3..............................................................................................12-8
Table 12-4 SUA Address Mapping Rules ...................................................................................................12-10
Table 12-5 Fields in Menu 15.1.1 ...............................................................................................................12-12
Table 12-6 Menu 15.1.1.1: Editing/Configuring an Individual Rule in a Set .............................................12-13
Table 12-7 Services & Port Numbers .........................................................................................................12-14
Table 12-8 Menu 15.3—Trigger Port Setup Description............................................................................12-27
Table 13-1 Common IP Ports........................................................................................................................13-4
Table 13-2 ICMP Commands That Trigger Alerts........................................................................................13-6
Table 13-3 Legal NetBIOS Commands ........................................................................................................ 13-7
Table 13-4 Legal SMTP Commands.............................................................................................................13-7
Table 15-1 Attack Alert.................................................................................................................................15-5
Table 16-1 Firewall Rules Summary: First Screen .......................................................................................16-6
Table 16-2 Predefined Services ....................................................................................................................16-8
Table 16-3 Creating/Editing A Firewall Rule .............................................................................................16-12
xxvi List of Tables
Table 16-4 Adding/Editing Source and Destination Addresses.................................................................. 16-15
Table 16-5 Creating/Editing A Custom Port............................................................................................... 16-16
Table 17-1 Content Filter: Categories .......................................................................................................... 17-2
Table 17-2 Content Filter: Free .................................................................................................................... 17-6
Table 17-3 Content Filter: iCard .................................................................................................................. 17-7
Table 17-4 Content Filter: List Update ........................................................................................................ 17-9
Table 17-5 Content Filter: Exempt Zone.................................................................................................... 17-10
Table 17-6 Content Filter: Customize ........................................................................................................ 17-12
Table 17-7 Content Filter: Domain Name .................................................................................................. 17-14
Table 18-1 View Log.................................................................................................................................... 18-2
Table 18-2 Log Settings Screen ................................................................................................................... 18-5
Table 19-1 Abbreviations Used in the Filter Rules Summary Menu............................................................ 19-5
Table 19-2 Rule Abbreviations Used ........................................................................................................... 19-6
Table 19-3 TCP/IP Filter Rule Menu Fields................................................................................................. 19-7
Table 19-4 Generic Filter Rule Menu Fields.............................................................................................. 19-12
Table 20-1 SNMP Configuration Menu Fields............................................................................................. 20-3
Table 20-2 SNMP Traps............................................................................................................................... 20-4
Table 21-1 System Maintenance: Status Menu Fields.................................................................................. 21-2
Table 21-2 Fields in System Maintenance: Information .............................................................................. 21-4
Table 21-3 System Maintenance Menu Syslog Parameters.......................................................................... 21-7
Table 21-4 System Maintenance Menu Diagnostic.................................................................................... 21-12
Table 22-1 Filename Conventions................................................................................................................ 22-2
Table 22-2 General Commands for GUI-based FTP Clients........................................................................ 22-4
Table 22-3 General Commands for GUI-based TFTP Clients ..................................................................... 22-6
Table 23-1 Budget Management .................................................................................................................. 23-3
Table 23-2 Call History Fields ..................................................................................................................... 23-4
Table 23-3 Time and Date Setting Fields..................................................................................................... 23-6
List of Tables xxvii
Table 24-1 Menu 24.11 – Remote Management Control..............................................................................24-3
Table 25-1 Application and Subnet-based Bandwidth Management Example .............................................25-4
Table 25-2 Bandwidth Manager: Summary ................................................................................................25-12
Table 25-3 Bandwidth Manager: Class Setup.............................................................................................25-13
Table 25-4 Bandwidth Manager: Class Configuration................................................................................25-14
Table 25-5Services and Port Numbers........................................................................................................25-16
Table 25-6 Bandwidth Management Statistics............................................................................................25-17
Table 25-7 Bandwidth Manager Monitor....................................................................................................25-18
Table 26-1 IP Routing Policy Setup..............................................................................................................26-3
Table 26-2 IP Routing Policy........................................................................................................................26-4
Table 27-1Schedule Set Setup Fields............................................................................................................27-2
Table 28-1 VPN and NAT.............................................................................................................................28-6
Table 29-1 AH and ESP................................................................................................................................29-3
Table 29-2 Local Fields ................................................................................................................................29-4
Table 29-3 Peer Fields ..................................................................................................................................29-5
Table 29-4 Matching ID Type and Content Configuration Example ............................................................29-5
Table 29-5 Mismatching ID Type and Content Configuration Example.......................................................29-6
Table 29-6 Telecommuter and Headquarters Configuration Example ..........................................................29-7
Table 29-7 Menu 27.1: IPSec Summary .......................................................................................................29-8
Table 29-8 Menu 27.1.1: IPSec Setup.........................................................................................................29-12
Table 29-9 Menu 27.1.1.1: IKE Setup ........................................................................................................29-19
Table 29-10 Active Protocol: Encapsulation and Security Protocol ........................................................... 29-21
Table 29-11 Menu 27.1.1.2: Manual Setup.................................................................................................29-22
Table 30-1 Menu 27.2: SA Monitor..............................................................................................................30-2
Table 31-1 Troubleshooting the Start-Up of your ZyWALL..............................................................................1
Table 31-2 Troubleshooting the LAN Interface................................................................................................. 2
Table 31-3 Troubleshooting the LAN Interface................................................................................................. 2
xxviii List of Tables
Table 31-4 Troubleshooting the WAN interface................................................................................................. 3
Table 31-5 Troubleshooting Internet Access......................................................................................................3
Table 31-6 Troubleshooting the Password .........................................................................................................4
Table 31-7 Troubleshooting Telnet.....................................................................................................................4
List of Tables xxix
Preface
About Your ZyWALL
Congratulations on your purchase of the ZyWALL 10, 10W, 50 or 100 Internet Security Gateway.
About This User's Manual
This manual is designed to guide you through the configuration of your ZyWALL for its various applications. Primarily SMT menus are shown, but web configurator screens are shown for features that do not have SMT menus or the recommendation is to configure via web configurator. This manual may refer to the ZyWALL 10/10W/50/100 Internet Security Gateway as the ZyWALL. This manual covers the ZyWALL 10, 10W, 50 and 100 models. Supported features and the details of the features, vary from model to model. Not every feature applies to every model; refer to the Model Comparison Chart in chapter 1 to see what features are specific to your ZyWALL model.
Related Documentation
Support Disk
Refer to the included CD for support documents.
Read Me First
The Read Me First is designed to help you get up and running right away. It contains a detailed easy-to-follow connection diagram, default settings, handy checklists and information on setting up your network and configuring for Internet access.
Web Configurator Online Help
Embedded web help for descriptions of individual screens and supplementary information.
Packing List Card
The Packing List Card lists all items that should have come in the package.
Certifications
Refer to the product page at www.zyxel.com
ZyXEL Glossary and Web Site Please refer to www.zyxel.com
documentation.
for an online glossary of networking terms and additional support
for information on product certifications.
Syntax Conventions
• “Enter” means for you to type one or more characters and press the carriage return. “Select” or “Choose” means for you to use one of the predefined choices.
• The SMT menu titles and labels are in Bold Times New Roman font.
• The choices of a menu item are in Bold Arial font.
• A single keystroke is in Arial font and enclosed in square brackets, for instance, [ENTER] means the
Enter, or carriage return, key; [ESC] means the escape key and [SPACE BAR] means the space bar. [UP] and [DOWN] are the up and down arrow keys.
xxx Preface
• Mouse action sequences are denoted using a comma. For example, “click the Apple icon, Control Panels and then Modem” means first click the Apple icon, then point your mouse pointer to Control Panels and then click Modem.
• For brevity’s sake, we will use “e.g.” as a shorthand for “for instance” and “i.e.” for “that is” or “in other words” throughout this manual.
Preface xxxi
Overview
Part I:
Overview
This part covers Getting to Know Your ZyWALL and Hardware Installation.
I
ZyWALL 10~100 Series Internet Security Gateway
Chapter 1
Getting to Know Your ZyWALL
This chapter introduces the main features and applications of the ZyWALL.
1.1 The ZyWALL 10/10W/50/100 Internet Security Gateway
The ZyWALL 10/10W/50/100 are the ideal secure gateways for all data passing between the Internet and the LAN. By integrating NAT, firewall and VPN capability, ZyXEL’s ZyWALL 10/10W/50/100 is a complete security solution that protects your Intranet and efficiently manages data traffic on your network. The embedded web configurator is easy to operate and totally independent of the operating system platform you use.
1.2 Features
The following sections describe the features of the ZyWALL 10/10W/50/100. Features vary by ZyWALL model. Refer to the following table to see the differences between the ZyWALL 10, 50 and 100.
Table 1-1 Model Specific Features
ZYWALL MODEL
FEATURES
Firmware Version Number 3.52 3.52 3.60 3.52
Dial Backup (or Auxiliary) O *
PCMCIA Slot O O
PCMCIA Card Release Button O
802.11b Wireless LAN Support O O
802.1x Wireless LAN Support O O
Real Time Chip O O O
Auto-sensing 10/100 Mbps Ethernet LAN O
Auto-negotiating 10/100 Mbps Ethernet DMZ O
Auto-negotiating 10/100 Mbps Ethernet WAN O O O
Reset Button O O O
100 50 10W 10
Getting to Know Your ZyWALL 1-1
ZyWALL 10~100 Series Internet Security Gateway
Table 1-1 Model Specific Features
ZYWALL MODEL
FEATURES
Uplink Button O O O
Power Switch O
Traffic Redirect O O O
Bandwidth Management O
IP Policy Routing O
Number of Static Routes 50 30 12 12
Number of Firewall Rules 400 100 50 30
Number of IPSec VPN Security Associations 100 50 10 10
UPnP O
* The ZyWALL 10W uses the same port for console management and for an auxiliary WAN backup1.
Table Key: An “O” in a model’s column shows that the model has the specified feature. A number specific to an individual model may alternately be displayed. The information in this table was correct at the time of writing, although it may be subject to change.
100 50 10W 10
1.2.1 Physical Features
Auto-negotiating 10/100 Mbps Ethernet LAN
The LAN interface automatically detects if it’s on a 10 or a 100 Mbps Ethernet.
Auto-sensing 10/100 Mbps Ethernet LAN
The LAN interface automatically adjusts to either a crossover or straight-through Ethernet cable. This feature is not available on all models.
Auto-negotiating 10/100 Mbps Ethernet DMZ
Public servers (Web, FTP, etc.) attached to the DeMilitarized Zone (DMZ) port are visible to the outside world (while still being protected from DoS (Denial of Service) attacks such as SYN flooding and Ping of Death) and can also be accessed from the secure LAN. This feature is not available on all models.
1
The ZyWALL 10W auxiliary WAN backup feature was not available at the time of writing.
1-2 Getting to Know Your ZyWALL
ZyWALL 10~100 Series Internet Security Gateway
10/100 Mbps Ethernet WAN
The 10/100 Mbps Ethernet WAN port attaches to the Internet via broadband modem or router. This feature is not available on all models.
Backup WAN or Auxiliary
The Dial Backup or Auxiliary port can be used in reserve as a traditional dial-up connection when/if ever the broadband connection to the WAN port fails. This feature is not available on all models.
Time and Date
The ZyWALL allows you to get the current time and date from an external server when you turn on your ZyWALL. You can also set the time manually. The Real Time Chip (RTC) keeps track of the time and date (not available in all models).
Reset Button
The ZyWALL reset button is built into the rear panel. Use this button to restore the factory default password to 1234; IP address to 192.168.1.1, subnet mask to 255.255.255.0 and DHCP server enabled with a pool of 32 IP addresses starting at 192.168.1.33. This feature is not available on all models.
PCMCIA Port
The PCMCIA port provides the option of a wireless LAN. This feature is not available on all models.
IEEE 802.11b 11 Mbps Wireless LAN
The optional 11 Mbps wireless LAN card provides mobility and a fast network environment for small and home offices. Users can connect to the local area network without any wiring efforts and enjoy reliable high­speed connectivity. This feature is not available on all models.
1.2.2 Non-Physical Features
Bandwidth Management
Bandwidth management allows you to allocate network resources according to defined policies. This policy­based bandwidth allocation helps your network to better handle real-time applications such as Voice-over-IP (VoIP).
IPSec VPN Capability
Establish a Virtual Private Network (VPN) to connect with business partners and branch offices using data encryption and the Internet to provide secure communications without the expense of leased site-to-site lines. The ZyWALL VPN is based on the IPSec standard and is fully interoperable with other IPSec-based VPN products.
Getting to Know Your ZyWALL 1-3
ZyWALL 10~100 Series Internet Security Gateway
Firewall
The ZyWALL is a stateful inspection firewall with DoS (Denial of Service) protection. By default, when the firewall is activated, all incoming traffic from the WAN to the LAN is blocked unless it is initiated from the LAN. The ZyWALL firewall supports TCP/UDP inspection, DoS detection and prevention, real time alerts, reports and logs.
RADIUS (RFC2138, 2139)
RADIUS (Remote Authentication Dial In User Service) server enables authentication, authorization and accounting for your wireless network. This feature is not available on all models.
IEEE 802.1x for Network Security
The ZyWALL supports the IEEE 802.1x standard that works with the IEEE 802.11 to enhance user authentication. With the local user profile, the ZyWALL allows you to configure up 32 user profiles without a network authentication server. In addition, centralized user and accounting management is possible on an optional network authentication server. This feature is not available on all models.
Content Filtering
The ZyWALL can block web features such as ActiveX controls, Java applets and cookies, as well as disable web proxies. The ZyWALL can block specific URLs by using the keyword feature. It also allows the administrator to define time periods and days during which content filtering is enabled and to include or exclude a range of users on the LAN from content filtering.
You can configure most features of the ZyWALL via SMT but ZyXEL recommends
using the embedded web configurator to configure the firewall and content
filtering.
Wireless LAN MAC Address Filtering
MAC Address Filtering together with ESSID (Extended Service Set IDentifier) and WEP (Wired Equivalent Privacy) ensure the most secure wireless solution. This feature is not available on all models.
Brute-Force Password Guessing Protection
The ZyWALL has a special protection mechanism to discourage brute-force password guessing attacks on the ZyWALL’s management interfaces. You can specify a wait-time that must expire before entering a fourth password after three incorrect passwords have been entered. Please see the appendices for details about this feature.
2
Packet Filtering
The packet filtering mechanism blocks unwanted traffic from entering/leaving your network.
2
Brute Force Password Protection was not available on every model at the time of writing.
1-4 Getting to Know Your ZyWALL
ZyWALL 10~100 Series Internet Security Gateway
Universal Plug and Play (UPnP)
Using the standard TCP/IP protocol, the ZyWALL and other UPnP enabled devices can dynamically join a network, obtain an IP address and convey its capabilities to other devices on the network. This feature is not available on all models.
Call Scheduling
Configure call time periods to restrict and allow access for users on remote nodes.
PPPoE
PPPoE facilitates the interaction of a host with an Internet modem to achieve access to high-speed data networks via a familiar "dial-up networking" user interface.
PPTP Encapsulation
Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables secure transfer of data from a remote client to a private server, creating a Virtual Private Network (VPN) using a TCP/IP-based network. PPTP supports on-demand, multi-protocol and virtual private networking over public networks, such as the Internet. The ZyWALL supports one PPTP server connection at any given time.
Dynamic DNS Support
With Dynamic DNS (Domain Name System) support, you can have a static hostname alias for a dynamic IP address, allowing the host to be more easily accessible from various locations on the Internet. You must register for this service with a Dynamic DNS service provider.
IP Multicast
Deliver IP packets to a specific group of hosts using IP multicast. IGMP (Internet Group Management Protocol) is the protocol used to support multicast groups. The latest version is version 2 (see RFC 2236); the ZyWALL supports both versions 1 and 2. IP Alias IP Alias allows you to partition a physical network into logical networks over the same Ethernet interface. The ZyWALL supports three logical LAN interfaces via its single physical Ethernet LAN interface with the ZyWALL itself as the gateway for each LAN network.
IP Policy Routing
IP Policy Routing provides a mechanism to override the default routing behavior and alter packet forwarding based on the policies defined by the network administrator. This feature is not available on all models.
Central Network Management
Central Network Management (CNM) allows an enterprise or service provider network administrator to manage your ZyWALL. The enterprise or service provider network administrator can configure your ZyWALL, perform firmware upgrades and do troubleshooting for you.
Getting to Know Your ZyWALL 1-5
ZyWALL 10~100 Series Internet Security Gateway
SNMP
SNMP (Simple Network Management Protocol) is a protocol used for exchanging management information between network devices. SNMP is a member of the TCP/IP protocol suite. Your ZyWALL supports SNMP agent functionality, which allows a manager station to manage and monitor the ZyWALL through the network. The ZyWALL supports SNMP version one (SNMPv1).
Network Address Translation (NAT)
NAT (Network Address Translation - NAT, RFC 1631) allows the translation of multiple IP addresses used within one network to different IP addresses known within another network.
Traffic Redirect
Traffic Redirect forwards WAN traffic to a backup gateway on the LAN when the ZyWALL cannot connect to the Internet, thus acting as an auxiliary backup when your regular WAN connection fails. This feature is not available on all models.
Port Forwarding
Use this feature to forward incoming service requests to a server on your local network. You may enter a single port number or a range of port numbers to be forwarded, and the local IP address of the desired server.
DHCP (Dynamic Host Configuration Protocol)
DHCP (Dynamic Host Configuration Protocol) allows the individual client computers to obtain the TCP/IP configuration at start-up from a centralized DHCP server. The ZyWALL has built-in DHCP server capability, enabled by default, which means it can assign IP addresses, an IP default gateway and DNS servers to all systems that support the DHCP client. The ZyWALL can also act as a surrogate DHCP server (DHCP Relay) where it relays IP address assignment from the actual real DHCP server to the clients.
Full Network Management
The embedded web configurator is an all-platform web-based utility that allows you to easily access the ZyWALL’s management settings and configure the firewall. Most functions of the ZyWALL are also software configurable via the SMT (System Management Terminal) interface. The SMT is a menu-driven interface that you can access from a terminal emulator through the console port or over a telnet connection.
RoadRunner Support
In addition to standard cable modem services, the ZyWALL supports Time Warner’s RoadRunner Service.
Logging and Tracing
♦ Built-in message logging and packet tracing. ♦ Unix syslog facility support. ♦ Firewall logs. ♦ Content filtering logs.
1-6 Getting to Know Your ZyWALL
ZyWALL 10~100 Series Internet Security Gateway
Upgrade ZyWALL Firmware via LAN
The firmware of the ZyWALL can be upgraded via the LAN.
Embedded FTP and TFTP Servers
The ZyWALL’s embedded FTP and TFTP Servers enable fast firmware upgrades as well as configuration file backups and restoration.
1.2.3 ZyWALL 100 Note
The ZyWALL 100 is designed to act as a secure gateway for all data passing between the Internet and the LAN or the DMZ. It has three Ethernet ports, one RS-232 auxiliary port and one PCMCIA port (for optional wireless applications), which are used to physically separate the network into three areas.
I. LAN Network (a trusted network)
LAN port: The auto-negotiating 10/100 Mbps Ethernet LAN interface automatically
detects if it’s on a 10 or a 100 Mbps Ethernet. Attach computers that are to be secured from the outside world to this port. These computers will have access to e-mail, FTP and the World Wide Web but incoming connections (from the Internet) are only allowed if the connection is originally initiated from the LAN computer or a firewall rule has been specifically configured to allow access.
II. DMZ Network
DMZ port: Attach public servers (Web, FTP, etc.) to the DeMilitarized Zone (DMZ) port.
Computers attached to this port are visible to the outside world (while still being protected from DoS (Denial of Service) attacks such as SYN flooding and Ping of Death) and can also be accessed from the secure LAN.
III. WAN Network
WAN port: The 10/100 Mbps Ethernet WAN port attaches to the Internet via broadband modem or
router.
Dial Backup port: This auxiliary port can be used as a backup line when/if the broadband
connection to the WAN port fails.
1.3 Applications for the ZyWALL
1.3.1 Secure Broadband Internet Access via Cable or DSL Modem
You can connect a cable modem, DSL or wireless modem to the ZyWALL for broadband Internet access via Ethernet or wireless port on the modem. The ZyWALL guarantees not only high speed Internet access, but secure internal network protection and traffic management as well.
Getting to Know Your ZyWALL 1-7
ZyWALL 10~100 Series Internet Security Gateway
Figure 1-1 Secure Internet Access via Cable, DSL or Wireless Modem
1-8 Getting to Know Your ZyWALL
ZyWALL 10~100 Series Internet Security Gateway
1.3.2 VPN Application
ZyWALL VPN is an ideal cost-effective way to connect branch offices and business partners over the Internet without the need (and expense) for leased lines between sites.
Figure 1-2 VPN Application
Getting to Know Your ZyWALL 1-9
ZyWALL 10~100 Series Internet Security Gateway
Chapter 2
Hardware Installation
This chapter explains the LEDs and ports as well as how to connect the hardware. Refer to Table
1-1 for a list of hardware features that are specific to individual models.
2.1 Front Panel LEDs and Back Panel Ports
2.1.1 Front Panel LEDs
The LEDs on the front panel indicate the operational status of the ZyWALL.
Figure 2-1 ZyWALL 100 Front Panel
Figure 2-2 ZyWALL 50 Front Panel
Figure 2-3 ZyWALL 10W Front Panel
Hardware Installation 2-1
ZyWALL 10~100 Series Internet Security Gateway
Figure 2-4 ZyWALL 10 Front Panel
The following table describes the LED functions. Not all LEDs are included in every model.
Table 2-1 LED Descriptions
LED COLOR STATUS MEANING
On The ZyWALL is turned on. PWR Green
Off The ZyWALL is turned off.
SYS Green Off The ZyWALL is not ready or failed.
WLAN Green Off The wireless LAN is not ready, or has failed.
On The ZyWALL is ready and running.
Flashing The ZyWALL is rebooting.
Red On The power to the ZyWALL is too low.
On The wireless LAN is OK.
Flashing The wireless LAN is sending or receiving packets.
LAN 10M
LAN 100M
DMZ 10M
Green Off The 10M LAN is not connected.
On The ZyWALL is connected to a 10M LAN.
Flashing The 10M LAN is sending or receiving packets.
Orange
Green Off The 10M DMZ is not connected.
On The ZyWALL is connected to a 10M DMZ.
Flashing The 10M DMZ is sending/receiving packets.
Off The 100M LAN is not connected.
On The ZyWALL is connected to a 100Mbps LAN.
Flashing The 100M LAN is sending or receiving packets.
2-2 Hardware Installation
ZyWALL 10~100 Series Internet Security Gateway
Table 2-1 LED Descriptions
LED COLOR STATUS MEANING
DMZ 100M
Orange Off The 100M DMZ is not connected.
On The ZyWALL is connected to a 100Mbps DMZ.
Flashing The 100M DMZ is sending or receiving packets.
WAN 10M Green
WAN 100M
AUX ACT Green
CON/AUX Off The CON/AUX link is not ready, or has failed.
Orange Off The CON/AUX link is not ready, or has failed.
On The CON/AUX switch is set to AUX and the
Flashing The CON/AUX switch is set to AUX and the
Orange
Green
Off The 10M WAN link is not ready, or has failed.
On The 10M WAN link is OK.
Flashing The 10M WAN link is sending or receiving packets.
Off The 100M WAN link is not ready, or has failed.
On The 100M WAN link is OK.
Flashing The 100M WAN link is sending or receiving
packets.
Off The backup port is not connected. AUX LNK Green
On The backup port is connected.
Off The auxiliary port is not sending or receiving
packets.
Flashing The auxiliary port is sending or receiving packets.
On The CON/AUX switch is set to CON and the
CON/AUX port is connected to a management computer.
CON/AUX port has an Internet connection through a dial-up modem.
CON/AUX port is sending or receiving data through a dial-up modem.
2.2 ZyWALL Rear Panel and Connections
The following figure shows the rear panels of the ZyWALL.
Hardware Installation 2-3
ZyWALL 10~100 Series Internet Security Gateway
Figure 2-5 ZyWALL 100 Rear Panel
Figure 2-6 ZyWALL 50 Rear Panel
2-4 Hardware Installation
ZyWALL 10~100 Series Internet Security Gateway
Figure 2-7 ZyWALL 10W Rear Panel
Figure 2-8 ZyWALL 10 Rear Panel
This section outlines how to connect your ZyWALL. If you want to connect a cable modem, you must connect the coaxial cable from your cable service to the threaded coaxial cable connector on the back of the cable modem. Connect a DSL modem to the DSL wall jack. See the Safety Warnings and Instructions Appendix for safety instructions when making connections to the ZyWALL. Skip sections that do not apply to your particular ZyWALL model.
Hardware Installation 2-5
ZyWALL 10~100 Series Internet Security Gateway
2.2.1 Connecting the Console Port
Use terminal emulator software on a computer for configuring your ZyWALL via console port. Connect the 9-pin male end of the console cable to the port labeled CONSOLE (or CON/AUX SOLE on the ZyWALL 10W and push the CON/AUX switch to CON) on the ZyWALL and the other end (choice of 9-pin or 25-pin, depending on your computer) to a serial port (COM1, COM2 or other COM port) of your computer. You can use an extension console cable if the enclosed one is too short.
2.2.2 Connecting the Dial Backup Port
The dial backup port is an RS-232 DB-9M connector. Connect the 9-pin female end of your modem
or TA cable to the dial backup port of the ZyWALL and the other end to your modem or TA. This feature is not available on all models.
With the ZyWALL 10W, the console port is also the auxiliary WAN port. Push the CON/AUX
switch to AUX and use the included CON/AUX converter with the console cable to connect the CON/AUX port to your modem or TA.
2.2.3 Connecting a Broadband Modem to the WAN Port
Connecting the ZyWALL to a cable modem:
Connect the port labeled WAN on the ZyWALL to the Ethernet port on the cable modem using the Ethernet cable that came with your cable modem. The Ethernet port on a cable modem is sometimes labeled "PC" or "Workstation".
Connecting the ZyWALL to a DSL modem:
Connect the port labeled WAN on the ZyWALL to the Ethernet port on the DSL modem using the Ethernet cable that came with your DSL modem.
Connecting the ZyWALL to a wireless modem:
Connect the port labeled WAN on the ZyWALL to the Ethernet port on the wireless modem using the Ethernet cable that came with your wireless modem.
2.2.4 Connecting the DMZ Port
Connect public servers (Web, FTP, etc.) to the DMZ port to make them visible to the outside world. For a single computer, connect the 10/100M DMZ port on the ZyWALL to the network adapter on the computer using a crossover cable. If you have more than one public server, then you must use an external hub. Connect the 10/100M DMZ port on the ZyWALL to a port on the hub using a straight-through Ethernet cable. This feature is not available on all models.
2.2.5 Connecting the Ethernet LAN
Some ZyWALL models come with an auto-sensing LAN port that automatically adjusts to straight-through or crossover Ethernet cables.
2-6 Hardware Installation
ZyWALL 10~100 Series Internet Security Gateway
Other ZyWALL models have an uplink button that allows you to switch
When the ZyWALL is on and properly connected to a computer or a hub, the
corresponding LAN LED on the front panel turns on.
Table 2-2 LAN Port Connections With an Uplink Button
CABLE FOR CONNECTING TO: A COMPUTER A HUB
UPLINK button “on” (pushed in)
UPLINK button “off” (out)
Straight-through Ethernet cable Crossover Ethernet cable
Crossover Ethernet cable Straight-through Ethernet cable
2.2.6 Connecting the Wireless LAN
Make sure the ZyWALL is turned off before inserting or removing an 11 Mbps 802.11b-compliant wireless LAN PCMCIA card (to avoid damage). Do not insert or remove the card with the ZyWALL turned on. This feature is not available on all models. Use the PCMCIA card release button (on models that have one) when you remove a PCMCIA card from the slot.
Slide the 64-pin connector end of the PCMCIA wireless LAN card into the slot. See Figure 2-9 for an example.
Hardware Installation 2-7
ZyWALL 10~100 Series Internet Security Gateway
Do not force, bend or twist the wireless LAN card.
Figure 2-9 Inserting the Wireless LAN Card
2.2.7 Connecting the Power to your ZyWALL
Connect the female end of the included power adaptor or power cord to the port labeled POWER on the rear panel of your ZyWALL.
2.3 Additional Installation Requirements
In addition to the contents of your package, there are other hardware and software requirements you need before you can configure and use your ZyWALL. These requirements include:
1. A computer with an installed Ethernet NIC (Network Interface Card).
2. To configure via console port: a computer equipped with communications software configured to the following parameters:
♦ VT100 terminal emulation. ♦ 9600 Baud. ♦ No parity, 8 data bits, 1 stop bit, flow control set to none.
3. A cable/DSL/wireless modem and an ISP account.
2-8 Hardware Installation
ZyWALL 10~100 Series Internet Security Gateway
After the ZyWALL is properly set up, you can make future changes to the configuration through telnet connections.
To keep the ZyWALL operating at optimal internal temperature, keep the bottom,
sides and rear clear of obstructions and away from the exhaust of other
equipment.
2.4 Additional Installation Requirements for Using 802.1x
1. A computer with an IEEE 802.11b wireless LAN card.
2. A computer equipped with a web browser (with JavaScript enabled) and/or Telnet.
3. A wireless client computer must be running IEEE 802.1x-compliant software. Currently, this is offered in Windows XP.
4. An optional network RADIUS server for remote user authentication and accounting.
Hardware Installation 2-9
Initial Setup and Configuration
Part II:
Initial Setup and Configuration
This part covers Initial Setup, SMT Menu 1 General Setup, WAN and Dial Backup Setup, LAN
Setup, Wireless LAN Setup, DMZ Setup, and Internet Access.
II
ZyWALL 10~100 Series Internet Security Gateway
Chapter 3
Initial Setup
This chapter explains how to perform the initial ZyWALL setup and gives an overview of SMT
menus.
3.1 Turning On Your ZyWALL
At this point, you should have connected the console port, the LAN port, the WAN port, the Wireless LAN port and the power port to the appropriate devices or lines. Plug the power cord or power adaptor into an appropriate power source. For models that have a power switch, push the power switch to the on position. The PWR LED turns on. The SYS LED turns on after the system tests are complete. The WAN LED, WLAN LED and one of the LAN LEDs turn on immediately after the SYS LED turns on, if connections have been made to the LAN and WAN ports.
3.1.1 Initial Screen
When you turn on your ZyWALL, it performs several internal tests as well as line initialization. After the tests, the ZyWALL asks you to press [ENTER] to continue, as shown next.
Copyright (c) 1994 - 2002 ZyXEL Communications Corp. initialize ch =0, ethernet address: 00:a0:c5:41:51:61 initialize ch =1, ethernet address: 00:a0:c5:41:51:62 Press ENTER to continue...
Figure 3-1 Initial Screen
3.1.2 Entering the Password
The login screen appears after you press [ENTER], prompting you to enter the password, as shown below. For your first login, enter the default password “1234”. As you type the password, the screen displays an “X” for each character you type. Please note that if there is no activity for longer than five minutes after you log in, your ZyWALL will automatically log you out and display a blank screen. If you see a blank screen, press [ENTER] to bring up the login screen again.
Initial Setup 3-1
ZyWALL 10~100 Series Internet Security Gateway
Enter Password : XXXX
Figure 3-2 Password Screen
3.2 Navigating the SMT Interface
The SMT (System Management Terminal) is the interface that you use to configure your ZyWALL. Several operations that you should be familiar with before you attempt to modify the configuration are listed in the table below.
Table 3-1 Main Menu Commands
OPERATION KEYSTROKES DESCRIPTION
Move down to another menu
Move up to a previous menu
Move to a “hidden” menu
Move the cursor [ENTER] or
Entering information
Required fields <? > All fields with the symbol <?> must be filled in order be able to save
N/A fields <N/A> Some of the fields in the SMT will show a <N/A>. This symbol refers
Save your configuration
[ENTER] To move forward to a submenu, type in the number of the desired
submenu and press [ENTER].
[ESC] Press the [ESC] key to move back to the previous menu.
Press [SPACE BAR] to change No to Yes then press [ENTER].
[UP]/[DOWN] arrow keys
Fill in, or press [SPACE BAR], then press [ENTER] to select from choices.
[ENTER] Save your configuration by pressing [ENTER] at the message
Fields beginning with “Edit” lead to hidden menus and have a default setting of No. Press [SPACE BAR] to change No to Yes, and then press [ENTER] to go to a “hidden” menu.
Within a menu, press [ENTER] to move to the next field. You can also use the [UP]/[DOWN] arrow keys to move to the previous and the next field, respectively.
You need to fill in two types of fields. The first requires you to type in the appropriate information. The second allows you to cycle through the available choices by pressing [SPACE BAR].
the new configuration.
to an option that is Not Applicable.
“Press ENTER to confirm or ESC to cancel”. Saving the data on the screen will take you, in most cases to the previous menu.
3-2 Initial Setup
ZyWALL 10~100 Series Internet Security Gateway
Table 3-1 Main Menu Commands
OPERATION KEYSTROKES DESCRIPTION
Exit the SMT Type 99, then press
[ENTER].
Type 99 at the main menu prompt and press [ENTER] to exit the SMT interface.
3.2.1 Main Menu
After you enter the password, the SMT displays the ZyWALL Main Menu, as shown next. Not all models have all the features shown.
ZyWALL 100 Main Menu
Getting Started Advanced Management
1. General Setup
2. WAN Setup
3. LAN Setup
4. Internet Access Setup
5. DMZ Setup
Advanced Applications
11. Remote Node Setup
12. Static Routing Setup
15. NAT Setup
Enter Menu Selection Number:
Copyright (c) 1994 - 2001 ZyXEL Communications Corp.
21. Filter and Firewall Setup
22. SNMP Configuration
23. System Password
24. System Maintenance
25. IP Routing Policy
26. Schedule Setup
27. VPN/IPSec Setup
99. Exit
Figure 3-3 Main Menu (ZyWALL 100)
3.2.2 System Management Terminal Interface Summary
Table 3-2 Main Menu Summary
NO. MENU TITLE FUNCTION
1 General Setup Use this menu to set up dynamic DNS and administrative information.
2 WAN Setup Use this menu to clone a MAC address from a computer on your LAN and
configure the backup WAN dial-up connection.
3 LAN Setup Use this menu to apply LAN filters, configure LAN DHCP and TCP/IP
settings and configure the wireless LAN port (not available on all models).
Initial Setup 3-3
ZyWALL 10~100 Series Internet Security Gateway
Table 3-2 Main Menu Summary
NO. MENU TITLE FUNCTION
4 Internet Access Setup Configure your Internet Access setup (Internet address, gateway, login,
etc.) with this menu.
5 DMZ Setup (This feature
is not available on all models.)
11 Remote Node Setup Use this menu to configure detailed remote node settings (your ISP is
12 Static Routing Setup Configure IP static routes in this menu.
15 NAT Setup Use this menu to configure Network Address Translation.
21 Filter and Firewall Setup Configure filters, activate/deactivate the firewall and view the firewall log.
22 SNMP Configuration Use this menu to configure SNMP-related parameters.
23 System Password Change your password in this menu (recommended).
24 System Maintenance From displaying system status to uploading firmware, this menu provides
25 IP Routing Policy Setup Use this menu to configure policies for use in IP policy routing.
26 Schedule Setup Use this menu to schedule outgoing calls.
27 VPN /IPSec Setup Use this menu to configure VPN connections.
99 Exit Use this menu to exit (necessary for remote configuration).
Use this menu to configure your public servers connected to the DMZ port.
also a remote node) as well as apply WAN filters.
comprehensive system maintenance.
3-4 Initial Setup
ZyWALL 10~100 Series Internet Security Gateway
3.2.3 SMT Menus at a Glance
The available SMT screens vary by ZyWALL model. The following SMT overview applies to the ZyWALL
100.
Figure 3-4 Getting Started and Advanced Applications SMT Menus
Initial Setup 3-5
ZyWALL 10~100 Series Internet Security Gateway
Figure 3-5 Advanced Management SMT Menus
3-6 Initial Setup
ZyWALL 10~100 Series Internet Security Gateway
Figure 3-6 Schedule Setup and IPSec VPN Configuration SMT Menus
3.3 Changing the System Password
Change the default system password by following the steps shown next. Step 1. Enter 23 in the main menu to open Menu 23 - System Password as shown next.
Menu 23 - System Password
Old Password= ? New Password= ? Retype to confirm= ?
Enter here to CONFIRM or ESC to CANCEL:
Figure 3-7 Menu 23: System Password
Step 2. Type your existing password and press [ENTER]. Step 3. Type your new system password and press [ENTER]. Step 4. Re-type your new system password for confirmation and press [ENTER].
Note that as you type a password, the screen displays an “X” for each character you type.
Initial Setup 3-7
ZyWALL 10~100 Series Internet Security Gateway
3.4 Resetting the ZyWALL
If you forget your password or cannot access the ZyWALL, you will need to reload the factory-default configuration file. Uploading this configuration file replaces the current configuration file with the factory­default configuration file. This means that you will lose all configurations that you had previously and the speed of the console port will be reset to the default of 9600bps with 8 data bit, no parity, one stop bit and flow control set to none. The password will be reset to “1234” and the LAN IP address to 192.168.1.1also.
To obtain the default configuration file, download it from the ZyXEL FTP site, unzip it and save it in a folder. Turn the ZyWALL off and then on to begin a session. When you turn on the ZyWALL again you will see the initial screen. When you see the message “Press any key to enter Debug Mode within 3 seconds” press any key to enter debug mode. To upload the configuration file, do the following:
1. Type atlc after the Enter Debug Mode message.
2. Wait for the Starting XMODEM upload message before activating XMODEM upload on your terminal.
3. After a successful firmware upload, type atgo to restart the ZyWALL.
The ZyWALL is now reinitialized with a default configuration file including the default password of “1234”.
3.4.1 Methods of Restoring Factory-Defaults
You can erase the current configuration and restore factory defaults in three ways:
a. Upload the default configuration file via the console port as described above. See later in
this User’s Guide for more information on how to transfer the configuration file to your ZyWALL using the SMT menus.
b. Use the RESET button on the rear panel of the ZyWALL (see the next section). Use this
method for cases when the password or IP address of the ZyWALL is not known.
c. Use the web configurator to restore defaults (see the web configurator HTML help).
3.4.2 Procedure To Use The Reset Button
Make sure the SYS LED is on (not blinking) before you begin this procedure.
1. Press the RESET button for ten seconds, and then release it. If the SYS LED begins to blink, the
defaults have been restored and the ZyWALL restarts. Otherwise, go to step 2.
2. Turn the ZyWALL off.
3. While pressing the RESET button, turn the ZyWALL on.
4. Continue to hold the RESET button. The SYS LED will begin to blink and flicker very quickly
after about 10 or 15 seconds. This indicates that the defaults have been restored and the ZyWALL is now restarting.
5. Release the RESET button and wait for the ZyWALL to finish restarting.
3-8 Initial Setup
ZyWALL 10~100 Series Internet Security Gateway
Chapter 4
SMT Menu 1 - General Setup
Menu 1 - General Setup contains administrative and system-related information.
4.1 System Name
System Name is for identification purposes. ZyXEL recommends you enter your computer’s “Computer name”.
• In Windows 95/98 click Start -> Settings -> Control Panel and then double-click Network. Click the Identification tab, note the entry for the Computer name field and enter it in the ZyWALL System Name field.
• In Windows 2000 click Start->Settings->Control Panel and then double-click System. Click the Network Identification tab and then the Properties button. Note the entry for the Computer name field and enter it in the ZyWALL System Name field.
• In Windows XP, click start -> My Computer -> View system information and then click the Computer Name tab. Note the entry in the Full computer name field and enter it as the ZyWALL System Name.
The Domain Name entry is what is propagated to the DHCP clients on the LAN. If you leave this field blank, the domain name obtained by DHCP from the ISP is used. While you must enter the host name (System Name) on each individual machine, the domain name can be assigned from the ZyWALL via DHCP.
4.2 Dynamic DNS
Dynamic DNS (Domain Name System) allows you to update your current dynamic IP address with one or many dynamic DNS services so that anyone can contact you (in NetMeeting, CU-SeeMe or other services). You can also access your FTP server or Web site on your own computer using a DNS-like address (for example, myhost.dhs.org, where myhost is a name of your choice) that will never change instead of using an IP address that changes each time you reconnect. Your friends or relatives will always be able to call you even if they don’t know your IP address. First of all, you need to have registered a dynamic DNS account with www.dyndns.org. This is for people with a dynamic IP from their ISP or DHCP server that would still like to have a DNS name. To use this service, you must register with the Dynamic DNS service provider. The Dynamic DNS service provider will give you a password or key. The ZyWALL supports www.dyndns.org. You can apply to this service provider for Dynamic DNS service.
SMT Menu 1 – General Setup 4-1
ZyWALL 10~100 Series Internet Security Gateway
4.2.1 DYNDNS Wildcard
Enabling the wildcard feature for your host causes *.yourhost.dyndns.org to be aliased to the same IP address as yourhost.dyndns.org. This feature is useful if you want to be able to use for example, www.yourhost.dyndns.org and still reach your hostname.
4.3 General Setup
Step 1. Enter 1 in the main menu to open Menu 1: General Setup. Step 2. The Menu 1 - General Setup screen appears, as shown next. Fill in the required fields.
Menu 1 - General Setup
System Name= ZyWALL Domain Name=zyxel.com.tw Edit Dynamic DNS= No
Press ENTER to Confirm or ESC to Cancel:
Figure 4-1 Menu 1: General Setup
Table 4-1 General Setup Menu Field
FIELD DESCRIPTION EXAMPLE
System Name Choose a descriptive name for identification purposes. It is
recommended you enter your computer’s “Computer name” (see section 4.1) in this field. This name can be up to 30 alphanumeric characters long. Spaces are not allowed, but dashes “-” and underscores "_" are accepted.
Domain Name Enter the domain name (if you know it) here. If you leave this field
blank, the ISP may assign a domain name via DHCP. You can go to menu 24.8 and type "sys domain name" to see the current domain name used by your router.
If you want to clear this field just press [SPACE BAR] and then [ENTER]. The domain name entered by you is given priority over the ISP assigned domain name.
Edit Dynamic DNS
When you have completed this menu, press [ENTER] at the prompt “Press ENTER to Confirm…” to save your configuration, or press [ESC] at any time to cancel.
Press [SPACE BAR] and then [ENTER] to select Yes or No (default). Select Yes to configure Menu 1.1: Configure Dynamic DNS discussed next.
ZyWALL
zyxel.com.tw
No
(default)
4-2 SMT Menu 1 – General Setup
ZyWALL 10~100 Series Internet Security Gateway
4.3.1 Configuring Dynamic DNS
To configure Dynamic DNS, go to Menu 1: General Setup and press [SPACE BAR] to select Yes in the Edit Dynamic DNS field. Press [ENTER] to display Menu 1.1— Configure Dynamic DNS (shown next).
Not all models have every field shown.
Menu 1.1 - Configure Dynamic DNS
Service Provider= WWW.DynDNS.ORG Active= Yes DDNSType= DynamicDNS Host1= Host2= Host3= EMAIL= USER= Password= ******** Enable Wildcard= No Offline= N/A Edit Update IP Address: Use Server Detected IP= Yes User Specified IP Addr=No IP Address=N/A
Press ENTER to confirm or ESC to cancel:
Figure 4-2 Configure Dynamic DNS
Follow the instructions in the next table to configure Dynamic DNS parameters.
Table 4-2 Configure Dynamic DNS Menu Fields
FIELD DESCRIPTION EXAMPLE
Service Provider This is the name of your Dynamic DNS service provider. WWW.DynDNS.ORG
(default)
Active
Press [SPACE BAR] to select Yes and then press [ENTER] to
Yes
make dynamic DNS active.
DDNS Type
Press [SPACE BAR] and then [ENTER] to select DynamicDNS if you have a dynamic IP address(es). Select StaticDNS if you
DynamicDNS
(default)
have a static IP address(s).
Select CustomDNS to have dyns.org provide DNS service for a domain name that you already have from a source other than dyndns.org.
Host1-3 Enter your host name(s) in the fields provided. You can specify
me.dyndns.org
up to two host names separated by a comma in each field.
EMAIL Enter your e-mail address. mail@mailserver
SMT Menu 1 – General Setup 4-3
ZyWALL 10~100 Series Internet Security Gateway
Table 4-2 Configure Dynamic DNS Menu Fields
FIELD DESCRIPTION EXAMPLE
USER Enter your user name.
Password Enter the password assigned to you.
Enable Wildcard Your ZyWALL supports DYNDNS Wildcard. Press [SPACE BAR]
and then [ENTER] to select Yes or No This field is N/A when you choose DDNS client as your service provider.
Offline
Edit Update IP Address:
You can select Yes in either the Use Server Detected IP field (recommended) or the User Specified IP Addr field, but not both.
With the Use Server Detected IP and User Specified IP Addr fields both set to No, the DDNS server automatically updates the IP address of the host name(s) with the ZyWALL’s WAN IP address.
DDNS does not work with a private IP address. When both fields are set to No, the ZyWALL must have a public WAN IP address in order for DDNS to work.
Use Server Detected IP
User Specified IP Addr
IP Address
When you have completed this menu, press [ENTER] at the prompt “Press ENTER to Confirm…” to save your configuration, or press [ESC] at any time to cancel.
This field is only available when CustomDNS is selected in the DDNS Type field. Press [SPACE BAR] and then [ENTER] to select Yes. When Yes is selected, traffic is redirected to a URL that you have previously specified (see www.dyndns.org for details).
Press [SPACE BAR] to select Yes and then press [ENTER] to have the DDNS server automatically update the IP address of the host name(s) with the public IP address that the ZyWALL uses or is behind.
You can set this field to Yes whether the IP address is public or private, static or dynamic.
Press [SPACE BAR] to select Yes and then press [ENTER] to update the IP address of the host name(s) to the IP address specified below.
Only select Yes if the ZyWALL uses or is behind a static public IP address.
Enter the static public IP address if you select Yes in the User
Specified IP Addr field.
No
Yes
Yes
No
N/A
The IP address updates when you reconfigure menu 1 or perform DHCP client renewal.
4-4 SMT Menu 1 – General Setup
ZyWALL 10~100 Series Internet Security Gateway
Chapter 5
WAN and Dial Backup Setup
This chapter describes how to configure the WAN using menu 2 and dial-backup using menus 2.1
and 11.1. Dial-backup applies to the ZyWALL 100 and 10W (see Table 1-1 Model Specific
Features).
5.1 Cloning The MAC Address
The MAC address field allows users to configure the WAN port's MAC address by using either the factory default or cloning the MAC address from a computer on your LAN. Once it is successfully configured, the address will be copied to the rom file (ZyNOS configuration file). It will not change unless you change the setting in menu 2 or upload a different rom file.
ZyXEL recommends that you clone the MAC address of a computer on your LAN
even if your ISP does not require MAC address authentication.
5.2 WAN Setup
From the main menu, enter 2 to open menu 2.
Menu 2 - WAN Setup
MAC Address: Assigned By= Factory default IP Address= N/A
Dial-Backup: Active= No Phone Number= Port Speed= 115200 AT Command String: Init= at&fs0=0 Edit Advanced Setup= No
Figure 5-1 MAC Address Cloning in WAN Setup
The following table contains instructions on how to configure your WAN setup.
WAN and Dial Backup Setup 5-1
ZyWALL 10~100 Series Internet Security Gateway
Table 5-1 MAC Address Cloning in WAN Setup
FIELD DESCRIPTION EXAMPLE
MAC Address:
Assigned By Press [SPACE BAR] and then [ENTER] to choose one of two methods
to assign a MAC Address. Choose Factory Default to select the factory assigned default MAC Address. Choose IP address attached on LAN to use the MAC Address of that workstation whose IP you give in the following field.
IP Address
When you have completed this menu, press [ENTER] at the prompt “Press ENTER to Confirm…” to save your configuration, or press [ESC] at any time to cancel.
This field is applicable only if you choose the IP address attached on LAN method in the Assigned By field. Enter the IP address of the computer on the LAN whose MAC you are cloning.
IP address
attached on
LAN
192.168.1.35
5.3 Dial Backup
The Dial Backup port or CON/AUX port can be used in reserve, as a traditional dial-up connection should the broadband connection to the WAN port fail. This feature is not available on all models. To set up the auxiliary port (Dial Backup or CON/AUX) for use in the event that the regular WAN connection is dropped, first make sure you have set up the switch and port connection (see the Hardware Installation chapter), then configure
1. Menu 2 - WAN Setup,
2. Menu 2.1 - Advanced WAN Setup and
3. Menu 11.1 - Remote Node Profile (Backup ISP) as shown next
Refer also to the traffic redirect section in this User’s Guide for information on an alternate backup WAN connection.
5.4 Configuring Dial Backup in Menu 2
From the main menu, enter 2 to open menu 2.
5-2 WAN and Dial Backup Setup
ZyWALL 10~100 Series Internet Security Gateway
Menu 2 - WAN Setup
MAC Address: Assigned By= Factory default IP Address= N/A
Dial-Backup: Active= No Phone Number= Port Speed= 115200 AT Command String: Init= at&fs0=0 Edit Advanced Setup= No
Press ENTER to Confirm or ESC to Cancel:
Figure 5-2 Menu 2: Dial Backup Setup
Table 5-2 Menu 2: Dial Backup Setup
FIELD DESCRIPTION EXAMPLE
Dial-Backup:
Active
Phone
Number
Port Speed Press [SPACE BAR] and then press [ENTER] to select the speed of the
AT Command
String:
Edit Advanced Setup
Use this field to turn the dial-backup feature on (Yes) or off (No). No
Enter the telephone number assigned to your line by your telephone company. This field only accepts digits; do not include dashes and spaces.
connection between the Dial Backup port and the external device.
Available speeds are:
9600, 19200, 38400, 57600, 115200 or 230400 bps.
Init Enter the AT command string to initialize the WAN device. Consult the
manual of your WAN device connected to your Dial Backup port for specific AT commands.
To edit the advanced setup for the Dial Backup port, move the cursor to this field; press the [SPACE BAR] to select Yes and then press [ENTER] to go to Menu 2.1: Advanced Setup.
1234567
115200
at&fs0=0
Yes
WAN and Dial Backup Setup 5-3
ZyWALL 10~100 Series Internet Security Gateway
Table 5-2 Menu 2: Dial Backup Setup
FIELD DESCRIPTION EXAMPLE
When you have completed this menu, press [ENTER] at the prompt “Press ENTER to Confirm…” to save your configuration, or press [ESC] at any time to cancel.
5.5 Advanced WAN Setup
Consult the manual of your WAN device connected to your Dial Backup port for
specific AT commands.
5.5.1 AT Command Strings
For regular telephone lines, the default “Dial” string tells the modem that the line uses tone dialing. “ATDT” is the command for a switch that requires tone dialing. If your switch requires pulse dialing, change the string to “ATDP”. For ISDN lines, there are many more protocols and operational modes. Please consult the documentation of your TA. You may need additional commands in both “Dial” and “Init” strings.
5.5.2 DTR Signal
The majority of WAN devices default to hanging up the current call when the DTR (Data Terminal Ready) signal is dropped by the DTE. When “Drop DTR When Hang Up” is set to Yes, the ZyWALL uses this hardware signal to force the WAN device to hang up, in addition to issuing the drop command “ATH”.
5.5.3 Response Strings
The response strings tell the ZyWALL the tags, or labels, immediately preceding the various call parameters sent from the WAN device. The response strings have not been standardized; please consult the documentation of your WAN device to find the correct tags. To edit the advanced setup for the Dial Backup port, move the cursor to the Edit Advanced Setup field in
Menu 2 - WAN Setup, press the [SPACE BAR] to select Yes and then press [ENTER].
5-4 WAN and Dial Backup Setup
ZyWALL 10~100 Series Internet Security Gateway
AT Command Strings: Call Control: Dial= atdt Dial Timeout(sec)= 60 Drop= ~~+++~~ath Retry Count= 0 Answer= ata Retry Interval(sec)= N/A Drop Timeout(sec)= 20 Drop DTR When Hang Up= Yes Call Back Delay(sec)= 15
AT Response Strings: CLID= NMBR = Called Id= Speed= CONNECT
Menu 2.1 - Advanced WAN Setup
Figure 5-3 Menu 2.1 Advanced WAN Setup
The following table describes fields in this menu.
Table 5-3 Advanced WAN Port Setup: AT Commands Fields
FIELD DESCRIPTION DEFAULT
AT Command Strings:
Dial Enter the AT Command string to make a call. atdt
Drop Enter the AT Command string to drop a call. “~” represents a one
+++ath second wait, e.g., “~~~+++~~ath” can be used if your modem has a slow response time.
Answer Enter the AT Command string to answer a call. ata
Drop DTR When Hang Up
Press the [SPACE BAR] to choose either Yes or No. When Yes
is selected (the default), the DTR (Data Terminal Ready) signal is
Yes
dropped after the “AT Command String: Drop” is sent out.
AT Response String:
CLID (Calling Line
Identification)
Enter the keyword that precedes the CLID (Calling Line Identification) in the AT response string. This lets the ZyWALL capture the CLID in
NMBR =
the AT response string that comes from the WAN device. CLID is required for CLID authentication.
WAN and Dial Backup Setup 5-5
ZyWALL 10~100 Series Internet Security Gateway
Table 5-3 Advanced WAN Port Setup: AT Commands Fields
FIELD DESCRIPTION DEFAULT
Called Id Enter the keyword preceding the dialed number. TO
Speed Enter the keyword preceding the connection speed. CONNECT
Table 5-4 Advanced WAN Port Setup: Call Control Parameters
FIELD DESCRIPTION DEFAULT
Call Control
Dial Timeout (sec) Enter a number of seconds for the ZyWALL to keep trying to set up
an outgoing call before timing out (stopping). The ZyWALL times out and stops if it cannot set up an outgoing call within the timeout value.
Retry Count Enter a number of times for the ZyWALL to retry a busy or no-
answer phone number before blacklisting the number.
Retry Interval
(sec)
Drop Timeout
(sec)
Call Back Delay
(sec)
Enter a number of seconds for the ZyWALL to wait before trying another call after a call has failed. This applies before a phone number is blacklisted.
Enter a number of seconds for the ZyWALL to wait before dropping the DTR signal if it does not receive a positive disconnect confirmation.
Enter a number of seconds for the ZyWALL to wait between dropping a callback request call and dialing the co-responding callback call.
60 seconds
0 to disable
the blacklist
control
20 seconds
15 seconds
5.6 Backup Remote Node Setup
The rest of this chapter shows you how to configure a remote node for a dial-backup connection.
5.6.1 Metric
The metric sets the priority for the ZyWALL’s routes to the Internet. If any two of the default routes have the same metric, the ZyWALL uses the following pre-defined priorities:
1. Normal route: designated by the ISP (see Remote Node Setup chapter) or a static route (see the IP Static Route Setup chapter)
2. Traffic-redirect route (see the Remote Node Setup chapter)
5-6 WAN and Dial Backup Setup
ZyWALL 10~100 Series Internet Security Gateway
3. Dial-backup route (see the Backup Remote Node Setup chapter) For example, if the normal route has a metric of "1" and the traffic-redirect route has a metric of "2" and dial­backup route has a metric of "3", then the normal route acts as the primary default route. If the normal route fails to connect to the Internet, the ZyWALL tries the traffic-redirect route next. In the same manner, the ZyWALL uses the dial-backup route if the traffic-redirect route also fails.
If you want the dial-backup route to take first priority over the traffic-redirect route or even the normal route, all you need to do is set the dial-backup route’s metric to "1" and the others to "2" (or greater).
5.7 Remote Node Profile (Backup ISP)
Enter 2 in Menu 11 Remote Node Setup to open Menu 11.1 Remote Node Profile (Backup ISP) (shown below) and configure the setup for your Dial Backup port connection. This feature is not available on all models.
Rem Node Name= ? Edit PPP Options= No Active= Yes Rem IP Addr= 0.0.0.0 Edit IP= No Outgoing: Edit Script Options= No My Login= My Password= ******** Telco Option: Authen= CHAP/PAP Allocated Budget(min)= 0 Pri Phone #= ? Period(hr)= 0 Sec Phone #= Nailed-Up Connection= No
Session Options: Edit Filter Sets= No Idle Timeout(sec)= 100
Press ENTER to Confirm or ESC to Cancel:
Menu 11.1 - Remote Node Profile (Backup ISP)
Figure 5-4 Menu 11.1 Remote Node Profile (Backup ISP)
Table 5-5 Fields in Menu 11.1 Remote Node Profile (Backup ISP)
FIELD DESCRIPTION EXAMPLE
Rem Node Name
Active
Outgoing
Enter a descriptive name for the remote node. This field can be up to eight characters.
Press [SPACE BAR] and then [ENTER] to select Yes to enable the remote node or No to disable the remote node.
LAoffice
Yes
WAN and Dial Backup Setup 5-7
ZyWALL 10~100 Series Internet Security Gateway
Table 5-5 Fields in Menu 11.1 Remote Node Profile (Backup ISP)
FIELD DESCRIPTION EXAMPLE
My Login Enter the login name assigned by your ISP for this remote node. jim
My Password Enter the password assigned by your ISP for this remote node. *****
Authen This field sets the authentication protocol used for outgoing calls.
Options for this field are:
CHAP/PAP - Your ZyWALL will accept either CHAP or PAP when requested by this remote node.
CHAP - accept CHAP only.
PAP - accept PAP only.
Pri Phone #
Sec Phone #
Enter the first (primary) phone number from the ISP for this remote node. If the Primary Phone number is busy or does not answer, your ZyWALL dials the Secondary Phone number if available. Some areas require dialing the pound sign # before the phone number for local calls. Include a # symbol at the beginning of the phone numbers as required.
CHAP/PAP
Edit PPP Options
Rem IP Addr Leave the field set to 0.0.0.0 (default) if the remote gateway has a
Edit IP
Edit Script Options
Telco Option
Allocated
Budget
Move the cursor to this field and use the space bar to select [Yes] and press [Enter] to edit the PPP options for this remote node. This brings you to Menu 11.2 - Remote Node PPP Options (see section 5.8).
dynamic IP address. Enter the remote gateway’s IP address here if it is static.
This field leads to a “hidden” menu. Press [SPACE BAR] to select Yes and press [ENTER] to go to Menu 11.3 - Remote Node Network Layer Options. See section 5.9 for more information.
Press [SPACE BAR] to select Yes and press [ENTER] to edit the AT script for the dial backup remote node (Menu 11.4 - Remote Node Script). See section 5.10 for more information.
Enter the maximum number of minutes that this remote node may be called within the time period configured in the Period field. The default for this field is 0 meaning there is no budget control and no time limit for accessing this remote node.
No
(default)
0.0.0.0
(default)
No
(default)
No
(default)
0
(default)
5-8 WAN and Dial Backup Setup
ZyWALL 10~100 Series Internet Security Gateway
Table 5-5 Fields in Menu 11.1 Remote Node Profile (Backup ISP)
FIELD DESCRIPTION EXAMPLE
Period(hr) Enter the time period (in hours) for how often the budget should be
reset. For example, to allow calls to this remote node for a maximum of 10 minutes every hour, set the Allocated Budget to 10 (minutes) and the Period to 1 (hour).
Nailed-Up
Connection
Session Options
Edit Filter sets This field leads to another “hidden” menu. Use [SPACE BAR] to select
Idle Timeout Enter the number of seconds of idle time (when there is no traffic from
Once you have configured this menu, press [ENTER] at the message “Press ENTER to Confirm...” to save your configuration, or press [ESC] at any time to cancel.
Press [SPACE BAR] to select Yes to set this connection to always be on, regardless of whether or not there is any traffic. Select No to have this connection act as a dial-up connection.
Yes and press [ENTER] to open menu 11.5 to edit the filter sets. See section 5.11 for more details.
the ZyWALL to the remote node) that can elapse before the ZyWALL automatically disconnects the PPP connection. This option only applies when the ZyWALL initiates the call.
0
(default)
No
(default)
No
(default)
100
seconds
(default)
5.8 Editing PPP Options
The ZyWALL’s dial back-up feature uses PPP. To edit the remote node PPP Options, move the cursor to the [Edit PPP Options] field in Menu 11.1 - Remote Node Profile, and use the space bar to select [Yes]. Press
[Enter] to open Menu 11.2 as shown next.
WAN and Dial Backup Setup 5-9
ZyWALL 10~100 Series Internet Security Gateway
Encapsulation= Standard PPP Compression= No
Enter here to CONFIRM or ESC to CANCEL:
Press Space Bar to Toggle.
Menu 11.2 - Remote Node PPP Options
Figure 5-5 Menu 11.2 - Remote Node PPP Options
This table describes the Remote Node PPP Options Menu, and contains instructions on how to configure the PPP options fields.
Figure 5-6 Remote Node PPP Options Menu Fields
FIELD DESCRIPTION EXAMPLE
Encapsulation
Press [SPACE BAR] and then [ENTER] to select CISCO PPP if your Dial Backup WAN device uses Cisco PPP encapsulation,
Standard PPP
(default)
otherwise select Standard PPP.
Compression
Press [SPACE BAR] and then [ENTER] to select Yes to enable or
No to disable Stac compression.
No
(default)
5-10 WAN and Dial Backup Setup
ZyWALL 10~100 Series Internet Security Gateway
5.9 Editing TCP/IP Options
Move the cursor to the Edit IP field in menu 11.1, then press [SPACE BAR] to select Yes. Press [ENTER] to open Menu 11.3 - Network Layer Options.
Rem IP Addr= 0.0.0.0 Rem Subnet Mask= 0.0.0.0 My WAN Addr= 0.0.0.0
Network Address Translation= None Metric= 15 Private= No RIP Direction= Both Version= RIP-2B Multicast= None
Enter here to CONFIRM or ESC to CANCEL:
Menu 11.3 - Remote Node Network Layer Options
Figure 5-7 Menu 11.3: Remote Node Network Layer Options
The next table gives you instructions about configuring remote node network layer options.
Table 5-6 Remote Node Network Layer Options Menu Fields
FIELD DESCRIPTION EXAMPLE
Rem IP Address
Rem IP Subnet Mask
My WAN Addr
Leave this field set to 0.0.0.0 to have the ISP or other remote router dynamically (automatically) send its IP address if you do not know it. Enter the remote gateway’s IP address here if you know it (static).
Leave this field set to 0.0.0.0 to have the ISP or other remote router dynamically send its subnet mask if you do not know it. Enter the remote gateway’s subnet mask here if you know it (static).
Leave the field set to 0.0.0.0 to have the ISP or other remote router dynamically (automatically) assign your WAN IP address if you do not know it. Enter your WAN IP address here if you know it (static).
This is the address assigned to your local ZyWALL, not the remote router.
0.0.0.0
(default)
0.0.0.0
(default)
0.0.0.0
(default)
WAN and Dial Backup Setup 5-11
ZyWALL 10~100 Series Internet Security Gateway
Table 5-6 Remote Node Network Layer Options Menu Fields
FIELD DESCRIPTION EXAMPLE
Network Address Translation
Metric Enter a number from 1 to 15 to set this route’s priority among the
Private This parameter determines if the ZyWALL will include the route to this
RIP Direction
Version Press [SPACE BAR] and then [ENTER] to select the RIP version from
Multicast IGMP (Internet Group Multicast Protocol) is a session-layer protocol
Once you have completed filling in Menu 11.3 Remote Node Network Layer Options, press [ENTER] at the message “Press ENTER to Confirm...” to save your configuration and return to menu 11, or press [ESC] at any time to cancel.
Press [SPACE BAR] and then [ENTER] to select either Full Feature, None or SUA Only. See the Network Address Translation (NAT) chapter for a full discussion on this feature.
ZyWALL’s routes (see section 5.6.1) The smaller the number, the higher priority the route has.
remote node in its RIP broadcasts. If set to Yes, this route is kept private and not included in RIP broadcasts. If No, the route to this remote node will be propagated to other hosts through RIP broadcasts.
Press [SPACE BAR] and then [ENTER] to select the RIP direction from
Both/ None/In Only/Out Only and None.
RIP-1/RIP-2B/RIP-2M.
used to establish membership in a Multicast group. The ZyWALL supports both IGMP version 1 (IGMP-v1) and version 2 (IGMP-v2). Press the [SPACE BAR] to enable IP Multicasting or select None to disable it. See the LAN Setup chapter for more information on this feature.
None
(default)
15
(default)
No
(default)
Both
(default)
RIP-1
None
(default)
5.10 Editing Login Script
For some remote gateways, text login is required before PPP negotiation is started. The ZyWALL provides a script facility for this purpose. The script has six programmable sets; each set is composed of an ‘Expect’ string and a ‘Send’ string. After matching a message from the server to the ‘Expect’ field, the ZyWALL returns the set’s ‘Send’ string to the server. For instance, a typical login sequence starts with the server printing a banner, a login prompt for you to enter the user name and a password prompt to enter the password:
Welcome to Acme, Inc. Login: myLogin Password:
To handle the first prompt, you specify “ogin: ” as the ‘Expect’ string and “myLogin” as the ‘Send’ string in set 1. The reason for leaving out the leading “L” is to avoid having to know exactly whether it is
5-12 WAN and Dial Backup Setup
ZyWALL 10~100 Series Internet Security Gateway
upper or lower case. Similarly, you specify “word: ” as the ‘Expect’ string and your password as the ‘Send’ string for the second prompt in set 2. You can use two variables, $USERNAME and $PASSWORD (all UPPER case), to represent the actual user name and password in the script, so they will not show in the clear. They are replaced with the outgoing login name and password in the remote node when the ZyWALL sees them in a ‘Send’ string. Please note that both variables must been entered exactly as shown. No other characters may appear before or after, either, i.e., they must be used alone in response to login and password prompts. Please note that the ordering of the sets is significant, i.e., starting from set 1, the ZyWALL will wait until the ‘Expect’ string is matched before it proceeds to set 2, and so on for the rest of the script. When both the ‘Expect’ and the ‘Send’ fields of the current set are empty, the ZyWALL will terminate the script processing and start PPP negotiation. This implies two things: first, the sets must be contiguous; the sets after an empty one are ignored. Second, the last set should match the final message sent by the server. For instance, if the server prints:
login successful. Starting PPP...
after you enter the password, then you should create a third set to match the final “PPP...” but without a “Send” string. Otherwise, the ZyWALL will start PPP prematurely right after sending your password to the server. If there are errors in the script and it gets stuck at a set for longer than the “Dial Timeout” in menu 2 (default 60 seconds), the ZyWALL will timeout and drop the line. To debug a script, go to Menu 24.4 to initiate a manual call and watch the trace display to see if the sequence of messages and prompts from the server differs from what you expect.
WAN and Dial Backup Setup 5-13
ZyWALL 10~100 Series Internet Security Gateway
Active= No
Set 1: Set 5: Expect= Expect= Send= Send= Set 2: Set 6: Expect= Expect= Send= Send= Set 3: Expect= Send= Set 4: Expect= Send=
Enter here to CONFIRM or ESC to CANCEL:
Menu 11.4 - Remote Node Script
Figure 5-8 Menu 11.4 – Remote Node Setup Script
The following table describes each field in Menu 11.4 – Remote Node Setup Script.
Table 5-7 Remote Node Script Menu Fields
FIELD DESCRIPTION EXAMPLE
Active
Set 1-6: Expect
Set 1-6: Send
Press [SPACE BAR] and then [ENTER] to select either Yes to enable the AT strings or No to disable them.
(default)
Enter an Expect string to match. After matching the Expect string, the ZyWALL returns the string in the Send field.
Enter a string to send out after the Expect string is matched. 0.0.0.0
No
5.11 Remote Node Filter
Move the cursor to the field Edit Filter Sets in menu 11.1, and then press [SPACE BAR] to set the value to
Yes. Press [ENTER] to open Menu 11.5 - Remote Node Filter.
5-14 WAN and Dial Backup Setup
ZyWALL 10~100 Series Internet Security Gateway
Use menu 11.5 to specify the filter set(s) to apply to the incoming and outgoing traffic between this remote node and the ZyWALL to prevent certain packets from triggering calls. You can specify up to four filter sets separated by commas, for example, 1, 5, 9, 12, in each filter field. Note that spaces are accepted in this field. Please refer to the Filters chapter for more information on defining the filters. With PPPoE and PPTP encapsulations you also have the option of specifying remote node call filter sets.
Input Filter Sets: protocol filters= device filters= Output Filter Sets: protocol filters= device filters=
Enter here to CONFIRM or ESC to CANCEL:
Menu 11.5 - Remote Node Filter
Figure 5-9 Menu 11.5: Remote Node Filter (Ethernet)
Input Filter Sets: protocol filters= device filters= Output Filter Sets: protocol filters= device filters= Call Filter Sets: protocol filters= device filters=
Enter here to CONFIRM or ESC to CANCEL:
Menu 11.5 - Remote Node Filter
Figure 5-10 Menu 11.5: Remote Node Filter (PPPoE or PPTP)
WAN and Dial Backup Setup 5-15
ZyWALL 10~100 Series Internet Security Gateway
Chapter 6
LAN Setup
This chapter describes how to configure the LAN using Menu 3: LAN Setup. Wireless LAN is
available on the ZyWALL 10W and 100 models.
6.1 Introduction
From the main menu, enter 3 to open Menu 3 – LAN Setup.
Menu 3 - LAN Setup
1. LAN Port Filter Setup
2. TCP/IP and DHCP Setup
5. Wireless LAN Setup
Enter Menu Selection Number:
Figure 6-1 Menu 3: LAN Setup
6.2 LAN Port Filter Setup
This menu allows you to specify the filter sets that you wish to apply to the LAN traffic. You seldom need to filter the LAN traffic, however, the filter sets may be useful to block certain packets, reduce traffic and prevent security breaches.
LAN Setup 6-1
ZyWALL 10~100 Series Internet Security Gateway
Menu 3.1 – LAN Port Filter Setup
Input Filter Sets:
protocol filters= device filters= Output Filter Sets: protocol filters= device filters=
Press ENTER to Confirm or ESC to Cancel:
Figure 6-2 Menu 3.1: LAN Port Filter Setup
6.3 TCP/IP and LAN DHCP
The ZyWALL has built-in DHCP server capability that assigns IP addresses and DNS servers to systems that support DHCP client capability.
6.3.1 Factory LAN Defaults
The LAN parameters of the ZyWALL are preset in the factory with the following values:
1. IP address of 192.168.1.1 with subnet mask of 255.255.255.0 (24 bits).
2. DHCP server enabled with 32 client IP addresses starting from 192.168.1.33.
These parameters should work for the majority of installations. If your ISP gives you an explicit DNS server address(es), skip ahead to section 6.4 to see how to enter the DNS server address(es).
6.3.2 DHCP Configuration
DHCP (Dynamic Host Configuration Protocol, RFC 2131 and RFC 2132) allows individual clients to obtain TCP/IP configuration at start-up from a server. You can configure the ZyWALL as a DHCP server or disable it. When configured as a server, the ZyWALL provides the TCP/IP configuration for the clients. If set to None, DHCP service will be disabled and you must have another DHCP server on your LAN, or else the computer must be manually configured.
IP Pool Setup
The ZyWALL is pre-configured with a pool of 32 IP addresses ranging from 192.168.1.33 to 192.168.1.64. This configuration leaves 31 IP addresses (excluding the ZyWALL itself) in the lower range for other server machines, e.g., server for mail, FTP, Telnet, web, etc., that you may have.
DNS Server Address
Use DNS to map a domain name to its corresponding IP address and vice versa, for example, the IP address of www.zyxel.com is 204.217.0.2. The DNS server is extremely important because without it, you must know the IP address of a machine before you can access it.
6-2 LAN Setup
ZyWALL 10~100 Series Internet Security Gateway
There are two ways that an ISP disseminates the DNS server addresses. The first is for an ISP to tell a customer the DNS server addresses, usually in the form of an information sheet, when you sign up. If your ISP gives you DNS server addresses, enter them in the DNS Server fields in DHCP Setup. The second is to leave this field blank, i.e., 0.0.0.0 — in this case; the ZyWALL acts as a DNS proxy.
Table 6-1 Example Of Network Properties For LAN Servers With Fixed IP Addresses
Choose an IP address 192.168.1.2 - 192.168.1.32; 192.168.1.65 - 192.168.1.254
Subnet mask 255.255.255.0
Gateway (or default route) 192.168.1.1 (ZyWALL LAN IP Address)
6.3.3 IP Address and Subnet Mask
Similar to the way houses on a street share a common street name, so too do machines on a LAN share one common network number. Where you obtain your network number depends on your particular situation. If the ISP or your network administrator assigns you a block of registered IP addresses, follow their instructions in selecting the IP addresses and the subnet mask. If the ISP did not explicitly give you an IP network number, then most likely you have a single user account and the ISP will assign you a dynamic IP address when the connection is established. If this is the case, it is recommended that you select a network number from 192.168.0.0 to 192.168.255.0 and you must enable the Network Address Translation (NAT) feature of the ZyWALL. The Internet Assigned Number Authority (IANA) reserved this block of addresses specifically for private use; please do not use any other number unless you are told otherwise. Let’s say you select 192.168.1.0 as the network number; which covers 254 individual addresses, from 192.168.1.1 to 192.168.1.254 (zero and 255 are reserved). In other words, the first three numbers specify the network number while the last number identifies an individual workstation on that network. Once you have decided on the network number, pick an IP address that is easy to remember, for example192.168.1.1, for your ZyWALL, but make sure that no other device on your network is using that IP address. The subnet mask specifies the network number portion of an IP address. Your ZyWALL will compute the subnet mask automatically based on the IP address that you entered. You don’t need to change the subnet mask computed by the ZyWALL unless you are instructed to do otherwise.
Private IP Addresses
Every computer on the Internet must have a unique IP address. If your networks are isolated from the Internet, for example, only between your two branch offices, you can assign any IP addresses to the hosts without problems. However, the Internet Assigned Numbers Authority (IANA) has reserved the following three blocks of IP addresses specifically for private networks:
LAN Setup 6-3
ZyWALL 10~100 Series Internet Security Gateway
Table 6-2 Private IP Address Ranges
10.0.0.0 — 10.255.255.255
172.16.0.0 — 172.31.255.255
192.168.0.0 — 192.168.255.255
You can obtain your IP address from the IANA, from an ISP or have it assigned by a private network. If you belong to a small organization and your Internet access is through an ISP, the ISP can provide you with the Internet addresses for your local networks. On the other hand, if you are part of a much larger organization, you should consult your network administrator for the appropriate IP addresses.
Regardless of your particular situation, do not create an arbitrary IP address;
always follow the guidelines above. For more information on address assignment,
please refer to RFC 1597, Address Allocation for Private Internets and RFC 1466,
Guidelines for Management of IP Address Space.
6.3.4 RIP Setup
RIP (Routing Information Protocol, RFC1058 and RFC 1389) allows a router to exchange routing information with other routers. The RIP Direction field controls the sending and receiving of RIP packets. When set to Both or Out Only, the ZyWALL will broadcast its routing table periodically. When set to Both or In Only, it will incorporate the RIP information that it receives; when set to None, it will not send any RIP packets and will ignore any RIP packets received. The Version field controls the format and the broadcasting method of the RIP packets that the ZyWALL sends (it recognizes both formats when receiving). RIP-1 is universally supported; but RIP-2 carries more information. RIP-1 is probably adequate for most networks, unless you have an unusual network topology. Both RIP-2B and RIP-2M sends the routing data in RIP-2 format; the difference being that RIP-2B uses subnet broadcasting while RIP-2M uses multicasting. Multicasting can reduce the load on non-router machines since they generally do not listen to the RIP multicast address and so will not receive the RIP packets. However, if one router uses multicasting, then all routers on your network must use multicasting, also. By default, RIP Direction is set to Both and the Version set to RIP-1.
6.3.5 IP Multicast
Traditionally, IP packets are transmitted in one of either two ways - Unicast (one sender — one recipient) or Broadcast (one sender — everybody on the network). Multicast delivers IP packets to a group of hosts on the network - not everybody and not just one. IGMP (Internet Group Multicast Protocol) is a session-layer protocol used to establish membership in a multicast group - it is not used to carry user data. IGMP version 2 (RFC 2236) is an improvement over version 1 (RFC 1112) but IGMP version 1 is still in wide use. If you would like to read more detailed
6-4 LAN Setup
ZyWALL 10~100 Series Internet Security Gateway
information about interoperability between IGMP version 2 and version 1, please see sections 4 and 5 of RFC 2236. The class D IP address is used to identify host groups and can be in the range 224.0.0.0 to
239.255.255.255. The address 224.0.0.0 is not assigned to any group and is used by IP multicast computers. The address 224.0.0.1 is used for query messages and is assigned to the permanent group of all IP hosts (including gateways). All hosts must join the 224.0.0.1 group in order to participate in IGMP. The address
224.0.0.2 is assigned to the multicast routers group. The ZyWALL supports both IGMP version 1 (IGMP-v1) and IGMP version 2 (IGMP-v2). At start up, the ZyWALL queries all directly connected networks to gather group membership. After that, the ZyWALL periodically updates this information. IP Multicasting can be enabled/disabled on the ZyWALL LAN and/or WAN interfaces using menus 3.2 (LAN) and 11.3 (WAN). Select None to disable IP Multicasting on these interfaces.
6.3.6 IP Alias
IP Alias allows you to partition a physical network into different logical networks over the same Ethernet interface. The ZyWALL supports three logical LAN interfaces via its single physical Ethernet interface with the ZyWALL itself as the gateway for each LAN network. Use menu 3.2.1 to configure IP Alias on your ZyWALL.
Figure 6-3 Physical Network Figure 6-4 Partitioned Logical Networks
6.4 TCP/IP and DHCP Ethernet Setup Menu
From the main menu, enter 3 to open Menu 3 - LAN Setup to configure TCP/IP (RFC 1155) and DHCP Ethernet setup.
LAN Setup 6-5
ZyWALL 10~100 Series Internet Security Gateway
Menu 3 - LAN Setup
1. LAN Port Filter Setup
2. TCP/IP and DHCP Setup
5. Wireless LAN Setup
Enter Menu Selection Number:
Figure 6-5 Menu 3: TCP/IP and DHCP Setup
From menu 3, select the submenu option TCP/IP and DHCP Setup and press [ENTER]. The screen now displays
Menu 3.2: TCP/IP and DHCP Ethernet Setup, as shown next.
DHCP= Server Configuration: Client IP Pool Starting Address= 192.168.1.33 Size of Client IP Pool= 32 Primary DNS Server= 0.0.0.0 Secondary DNS Server= 0.0.0.0 DHCP Server Address= N/A
TCP/IP Setup: IP Address= 192.168.1.1 IP Subnet Mask= 255.255.255.0 RIP Direction= Both Version= RIP-1 Multicast= None Edit IP Alias= No IP Policies=
Press ENTER to Confirm or ESC to Cancel: Press Space Bar to Toggle.
Menu 3.2 - TCP/IP and DHCP Ethernet Setup
First address in
the IP Pool
Size of the IP
Pool
IP addresses of
the DNS
servers
Figure 6-6 Menu 3.2: TCP/IP and DHCP Ethernet Setup
6-6 LAN Setup
ZyWALL 10~100 Series Internet Security Gateway
Follow the instructions in the next table on how to configure the DHCP fields.
Table 6-3 DHCP Ethernet Setup Menu Fields
FIELD DESCRIPTION EXAMPLE
DHCP This field enables/disables the DHCP server.
If set to Server, your ZyWALL will act as a DHCP server. If set to None, the DHCP server will be disabled. If set to Relay, the ZyWALL acts as a surrogate DHCP server and relays requests and responses between the remote server and the clients.
When set to Server, the following items need to be set:
Configuration:
Client IP Pool
Starting
Address
Size of Client
IP Pool
Primary DNS
Server
Secondary
DNS Server
DHCP Server
Address
This field specifies the first of the contiguous addresses in the IP address pool.
This field specifies the size, or count of the IP address pool. 32
Type the IP addresses of the DNS servers. The DNS servers are passed to the DHCP clients along with the IP address and the subnet mask.
If Relay is selected in the DHCP field above, then type the IP address of the actual, remote DHCP server here.
Follow the instructions in the following table to configure TCP/IP parameters for the LAN port.
Server
192.168.1.33
LAN and DMZ IP addresses must be on separate subnets.
Table 6-4 LAN TCP/IP Setup Menu Fields
FIELD DESCRIPTION EXAMPLE
TCP/IP Setup:
IP Address Enter the IP address of your ZyWALL in dotted decimal notation 192.168.1.1
(default)
IP Subnet Mask Your ZyWALL will automatically calculate the subnet mask based
on the IP address that you assign. Unless you are implementing subnetting, use the subnet mask computed by the ZyWALL.
255.255.255.0
LAN Setup 6-7
ZyWALL 10~100 Series Internet Security Gateway
Table 6-4 LAN TCP/IP Setup Menu Fields
FIELD DESCRIPTION EXAMPLE
RIP Direction Press [SPACE BAR] and then [ENTER] to select the RIP direction.
Options are: Both, In Only, Out Only or None.
Version Press [SPACE BAR] and then [ENTER] to select the RIP version.
Options are: RIP-1, RIP-2B or RIP-2M.
Multicast IGMP (Internet Group Multicast Protocol) is a session-layer
protocol used to establish membership in a Multicast group. The ZyWALL supports both IGMP version 1 (IGMP-v1) and version 2 (IGMP-v2). Press [SPACE BAR] and then [ENTER] to enable IP Multicasting or select None (default) to disable it.
Edit IP Alias The ZyWALL supports three logical LAN interfaces via its single
physical Ethernet interface with the ZyWALL itself as the gateway for each LAN network. Press [SPACE BAR] to select Yes and then press [ENTER] to display menu 3.2.1
IP Policies You can apply up to four IP Policy sets (from twelve) by typing
their numbers separated by commas.
When you have completed this menu, press [ENTER] at the prompt [Press ENTER to Confirm…] to save your configuration, or press [ESC] at any time to cancel.
Both
(default)
RIP-1
(default)
None
Yes
2,7,9,11
6.4.1 IP Alias Setup
You must use menu 3.2 to configure the first network. Move the cursor to the Edit IP Alias field, press [SPACE BAR] to choose Yes and press [ENTER] to configure the second and third network. Press [ENTER] to open Menu 3.2.1 - IP Alias Setup, as shown next.
6-8 LAN Setup
ZyWALL 10~100 Series Internet Security Gateway
IP Alias 1= No IP Address= N/A IP Subnet Mask= N/A RIP Direction= N/A Version= N/A Incoming protocol filters= N/A Outgoing protocol filters= N/A IP Alias 2= No IP Address= N/A IP Subnet Mask= N/A RIP Direction= N/A Version= N/A Incoming protocol filters= N/A Outgoing protocol filters= N/A
Enter here to CONFIRM or ESC to CANCEL:
Press Space Bar to Toggle.
Menu 3.2.1 - IP Alias Setup
Figure 6-7 Menu 3.2.1: IP Alias Setup
Use the instructions in the following table to configure IP Alias parameters.
Table 6-5 IP Alias Setup Menu Fields
FIELD DESCRIPTION DEFAULT
IP Alias
IP Address Enter the IP address of your ZyWALL in dotted decimal notation. 192.168.2.1
IP Subnet Mask Your ZyWALL will automatically calculate the subnet mask based
RIP Direction Press [SPACE BAR] and then [ENTER] to select the RIP
Version Press [SPACE BAR] and then [ENTER] to select the RIP version.
Incoming Protocol Filters
Outgoing Protocol Filters
When you have completed this menu, press [ENTER] at the prompt [Press ENTER to Confirm…] to save your configuration, or press [ESC] at any time to cancel.
Choose Yes to configure the LAN network for the ZyWALL. Yes
255.255.255.0 on the IP address that you assign. Unless you are implementing subnetting, use the subnet mask computed by the ZyWALL.
None
direction. Options are
Both, In Only, Out Only or None.
RIP-1
Options are RIP-1, RIP-2B or RIP-2M.
Enter the filter set(s) you wish to apply to the incoming traffic
1
between this node and the ZyWALL.
Enter the filter set(s) you wish to apply to the outgoing traffic
2
between this node and the ZyWALL.
LAN Setup 6-9
ZyWALL 10~100 Series Internet Security Gateway
6.5 Wireless LAN
This section introduces the wireless LAN and some basic configuration. Wireless LANs can be as simple as two computers with wireless network interface cards (NICs) communicating in a peer-to-peer network or as complex as a number of computers with wireless NICs communicating through access points which bridge network traffic to the wired LAN. See Chapter 7 for information on wireless LAN security features.
6.5.1 Channel
IEEE 802.11b wireless devices use ranges of radio frequencies called channels. Choose the radio channel depending on your geographical area. Adjacent Access Points (APs) should use different channels to reduce crosstalk. Crosstalk occurs when radio signals from access points overlap and cause interference that degrades performance.
6.5.2 ESS ID
Extended Service Set (ESS) is defined as one or more APs acting as a bridge between a wired LAN and the associated wireless clients. The ESS ID is a unique ID given to the APs and the wireless clients that participate in the same wireless network. You can think of the ESS ID as being similar to a workgroup name in a Microsoft network.
The ESS ID provides a minimum level of security for your network; see Chapter 7 for more information.
6.5.3 RTS Threshold
The RTS (Request To Send) Threshold prevents the problem of hidden nodes. The hidden node problem occurs when two stations are within range of the same access point, but are not within range of each other. The following figure illustrates the hidden node problem. Both stations (STA) are within range of the (AP), however, they cannot hear each other. Therefore, they are considered hidden from each other. When a station starts data transmission with the AP, it might not know that the other station is already using the wireless medium. When these two stations send data at the same time, it might collide when arriving simultaneously at the AP. The collision will almost certainly result in a loss of messages for both stations.
6-10 LAN Setup
ZyWALL 10~100 Series Internet Security Gateway
Figure 6-8 RTS Threshold
The RTS Threshold mechanism provides a solution to prevent these data collisions. When you enable RTS Threshold on a possible hidden station, this station and its AP will use a Request to Send/Clear to Send protocol (RTS/CTS). The station send an RTS message to the AP, informing that it is going to transmit the data. Upon receipt, the AP responds with a CTS message to all stations within its range to notify all other stations to defer transmission. It also confirms with the requesting station that the AP has reserved it for the time frame of the requested transmission.
The ZyWALL activates the RTS function if the packet size exceeds the value you set. It is highly recommended that you set the value ranging from 0 to 2432.
Enabling the RTS Threshold causes redundant network overhead that could negatively affect the throughput performance instead of providing a remedy.
6.5.4 Fragmentation Threshold
Fragmentation improves efficiency when high traffic flows along in the wireless network.
6.5.5 WEP
As the first line of protection against wireless network intrusion, the ZyWALL provides the standard WEP (Wired Equivalent Privacy) for data encryption. However, there may be a significant degradation of the data throughput on the wireless link when WEP is enabled. See section 7.2 for more information about configuring WEP data encryption.
6.6 Wireless LAN Setup
Use menu 3.5 to set up your ZyWALL as the wireless access point.
LAN Setup 6-11
ZyWALL 10~100 Series Internet Security Gateway
See section 7.2 for instructions on WEP and section 7.5 for instructions on configuring the MAC address filter.
If you are configuring the ZyWALL from a computer connected to the wireless LAN
and you change the ZyWALL’s ESSID or WEP settings, you will lose your wireless
connection when you press [ENTER] to confirm. You must then change the
wireless settings of your computer to match the ZyWALL’s new settings.
From the main menu, enter 3 to open Menu 3 – LAN Setup to configure the Wireless LAN setup. To edit the wireless LAN configuration, enter 5 to open Menu 3.5 – Wireless LAN Setup as shown next.
Enable Wireless LAN= No ESSID= Wireless Hide ESSID= No Channel ID= CH01 2412MHz RTS Threshold= 2432 Frag. Threshold= 2432 WEP= Disable Default Key= N/A Key1= N/A Key2= N/A Key3= N/A Key4= N/A Edit MAC Address Filter= No
Menu 3.5 - Wireless LAN Setup
Figure 6-9 Menu 3.5 – Wireless LAN Setup
The settings of all client stations on the wireless LAN must match those of the
ZyWALL.
Follow the instructions in the next table on how to configure the wireless LAN parameters.
Table 6-6 Wireless LAN Setup Menu Fields
FIELD DESCRIPTION EXAMPLE
Enable Wireless LAN
ESSID (Extended Service Set IDentification) The ESSID identifies the Service Set
Press [SPACE BAR] to select Yes to turn on the wireless LAN. The wireless LAN is off by default. Configure wireless LAN security features such as Mac filters and 802.1X before you turn on the wireless LAN (see Chapter 7).
the station is to connect to. Wireless clients associating to the Access
No
(default)
Wireless
Point must have the same ESSID. Enter a descriptive name (up to 32 characters) for the wireless LAN.
6-12 LAN Setup
ZyWALL 10~100 Series Internet Security Gateway
Table 6-6 Wireless LAN Setup Menu Fields
FIELD DESCRIPTION EXAMPLE
Hide ESSID
Channel ID This allows you to set the operating frequency/channel depending on your
RTS Threshold
Frag. Threshold
When you have completed this menu, press [ENTER] at the prompt “Press ENTER to Confirm…” to save your configuration, or press [ESC] at any time to cancel.
Press [SPACE BAR] to select Yes to hide the ESSID in the outgoing beacon frame so a station cannot obtain the ESSID through passive scanning.
particular region. Use the [SPACE BAR] to select a channel.
• CH01 2412 MHz / CH02 2417 MHz ~ CH11 2462 MHz (North America/FCC)
• CH01 2412 MHz / CH02 2417 MHz ~ CH13 2472 MHz (Europe CE/ ETSI)
• CH01 2412 MHz / CH02 2417 MHz ~ Ch14 2484 MHz (Japan)
• CH10 2457 MHz / CH11 2462 MHz (Spain)
• CH10 2457 MHz / CH11 2462 MHz ~ CH13 2472 MHz (France)
(Request To Send) The threshold (number of bytes) for enabling RTS/CTS handshake. Data with its frame size larger than this value will perform the RTS/CTS handshake. Setting this attribute to be larger than the maximum MSDU (MAC service data unit) size turns off the RTS/CTS handshake. Setting this attribute to zero turns on the RTS/CTS handshake. Enter a value between 0 and 2432. The threshold (number of bytes) for the fragmentation boundary for directed messages. It is the maximum data fragment size that can be sent. Enter a value between 256 and 2432.
No
(default)
CH01 2412
MHz
2432
(default)
2432
(default)
The ZyWALL LAN Ethernet and wireless ports can transparently communicate with
each other (transparent bridge).
LAN Setup 6-13
ZyWALL 10~100 Series Internet Security Gateway
Chapter 7
Wireless LAN Security Setup
This chapter describes the types of security you can enable on the ZyWALL. Wireless LAN is
available on the ZyWALL 10W and 100 models.
7.1 Levels of Security
Wireless security is vital to your network to protect wireless communication between wireless clients, access points and other wireless. The figure below shows the possible wireless security levels on your ZyWALL. The highest security level is EAP (Extensible Authentication Protocol) authentication. It requires interaction with a RADIUS (Remote Authentication Dial In User Service) server either on the WAN or your LAN to provide authentication service for wireless clients.
Figure 7-1 ZyWALL Wireless Security Levels
If you do not enable any wireless security on your ZyWALL, your network is accessible to any wireless networking device that is within range. Use the ZyWALL web configurator to configurator to set up your wireless LAN security settings. Refer to the chapter on using the ZyWALL web configurator to see how to access the web configurator.
7.2 Data Encryption with WEP
WEP encryption scrambles the data transmitted between the wireless clients and the access points to keep network communications private. It encrypts unicast and multicast communications in a network. Both the wireless clients and the access points must use the same WEP key for data encryption and decryption. For wireless LAN setup, refer to section 6.6.
Wireless LAN Security Setup 7-1
ZyWALL 10~100 Series Internet Security Gateway
Your ZyWALL allows you to configure up to four 64-bit or 128-bit WEP keys but only one key can be enabled at any one time. In order to configure and enable WEP encryption; click Advanced, Wireless and the Wireless tab to the display the Wireless LAN screen.
Figure 7-2 Wireless LAN
The following table describes the WEP related fields in this screen. For wireless LAN field descriptions refer to section 6.6.
7-2 Wireless LAN Security Setup
Loading...
Buy Points How it Works FAQ Contact Us Questions and Suggestions Privacy Policy Cookie Policy Terms of Use