Zyxel USG FLEX 100, USG FLEX 200, USG FLEX 500 User Manual

ZyWALL USG FLEX 100/200/500

USG FLEX Firewall

Precise protection. Flexible subscription.

Introducing the latest USG Series-USG FLEX, delivering higher levels of
performance and flexibility! USG FLEX's platform continue its tradition in
providing the latest, leading technologies, all while providing a complete
suite of security subscription with seamless, scalable gateway connectivity.
We want to bring top of the line experience for all business owners!

Benefits

Higher precision detection uncovers threats

Zyxel Security Cloud keeps learning from collecting threat information.
USG FLEX series supports advanced Anti-Malware with cloud query express
mode which expands billions of signatures. The cloud query with high
detection rate helps verify the file hash within seconds.

Growing

Database

Unknown File’s ID

Z

y

x

1983720985702843785893
74582487508274857
082387103448290347839
478971083
4781237489234787
2389471029348728934988
8384729742937190
0034928
7329347832347999942783
9134098757035683278942
6734917634
98736497319304
7820987348
173486089374837847
2397410934856801634702
934878978123650
9623984701384728374650
19234689
374789579878972666
29298197187409184789237
461656
7937846871987346987
39478023894709

e

l

S

d

u

o

l

C

y

e

t

c

i

r

u

1983720985702843785893
74582487508274857
082387103448290347839
478971083
4781237489234787
2389471029348728934988
8384729742937190
0034928
7329347832347999942783
9134098757035683278942
6734917634
98736497319304
7820987348
173486089374837847
2397410934856801634702
934878978123650
9623984701384728374650
19234689
374789579878972666
29298197187409184789237
461656
7937846871987346987
39478023894709

Cloud Query

Result : Malicious

Precise detection with cloud
query express mode

High assurance multi-layered
protection

Boosts up to 125% firewall
performance and 500% UTM
performance

Flexible subscription options
for your security needs

Robust SSL, IPSec and L2TP
over IPSec VPN connectivity
and VPN high availability (HA)

Enabled hospitality features
with hotspot, AP management,
and concurrent device
upgrades

USG FLEX

Datasheet ZyWALL USG FLEX 100/200/500

Best threat intelligence alliance

To ensure your network on getting the best protection, USG FLEX
integrates threat intelligence from leading companies and
organizations in the cybersecurity field for scaled information
about file and real-time threat data. By leveraging a wider
malware coverage with multiple-sourced database, this
increases the accuracy in threat detection. Web Filtering
is also included to safeguard all internet access, especially
with CTIRU (Counter-Terrorism Internet Referral Unit) to
restrict access to terrorist materials online.

Zyxel

Security

Cloud

High assurance multi-layered protection

USG FLEX is designed with multi-layer protection against
multiple types of threats from in and out. Anti-Malware,
URL Threat Filter, and Intrusion Prevention block external
attacks, while Application Patrol and Web Filtering
empower you to restrict users' inappropriate application
usage or web access, all together safeguarding your
network without any unattended gaps.

Flexible subscription for your need

USG FLEX security services turn your firewall into a
comprehensive security solution. Add Unified Threat
Management (UTM) and Hospitality bundled service to get the
protection and connectivity that meet your network needs.
You can also choose from a single license whenever you
need, such as Web Filtering, Anti-Malware, SecuReporter
Premium, and more.

Zyxel Security Subscriptions

Performance boost

The newly designed platform gains up to 125% firewall
performance. Maximizes UTM performance by minimizing
computing power usage and get additional 500% UTM

performance with cloud query express mode.

Datasheet ZyWALL USG FLEX 100/200/500

2

Analytics report and enhanced insights

USG FLEX series dashboard gives user-friendly traffic summary and threat statistic visuals. Utilize SecuReporter for further
threat analysis with correlation feature design, making it easy to proactively trackback network status to prevent the next
threat event. Centralized visibility of network activities for you to easily manage multiple clients.

Comprehensive connectivity

ZyWALL USG FLEX series not only can protect your network,
but it also support Hospitality features including Hotspot,
AP management, and concurrent device upgrade. You
can buy time-based bundle or quantity-based license to
optimize your initial investment and maximize the scale in
your environment.

Work Remotely and securely

As demands for remote access and work from home has
increased, USG FLEX offers IPsec, SSL or L2TP based VPNs
to provide flexible secure network options for many of the
common operating systems. Zero-configuration remote
access reduces complicated setup challenges. USG FLEX
series is also validated by Microsoft Azure and AWS for SMB
convenience by using a combination of onsite and cloud­based infrastructure with hybrid networks.

Datasheet ZyWALL USG FLEX 100/200/500

3

Licenses and Services

License Service Included Bundled License Renewal Bundled License Á -la-carte License

UTM License

Web Filtering Ye s Ye s Ye s

IPS (IDP) Ye s Ye s

Application Patrol Ye s Ye s

Anti-Malware Ye s Ye s Ye s

Email Security Ye s Ye s

SecuReporter Ye s

SecuReporter Premium Ye s Ye s

Hospitality License

Managed AP Service Yes (30-Day Trial) Yes (1 Year) Yes (Qty based)

Hotspot Management

*2

Yes (30-Day Trial) Yes (1 Year) Yes (Perpetual)

Concurrent device Yes (30-Day Trial) Yes (1 Year) Yes (Qty based)

*1: Will include Email Security license service
*2: Hotspot Management is available on USG FLEX 200/500 only
*3: Allowing additional connected clients is available to USG FLEX 500 only

License Service Feature

*1

*3

UTM License

Web Filtering Block access to malicious or risky web sites

IPS(IDP) Deep-packet inspection against known attacks from Network

Application Patrol Automatically categorize and manage the network application usage

Anti-Malware Scan files at the gateway or Zyxel security cloud for malware and other threats

Email Security Fast detection to block spam/phishing mail with malicious contents

SecuReporter Cloud-based intelligent analytics and report

Hospitality License

Managed AP Service AP auto discovery and provisioning

Hotspot Management Various Network Access Control

Concurrent device Top up allowed number of connected clients

Datasheet ZyWALL USG FLEX 100/200/500

4

Specifications

Model USG FLEX 100 USG FLEX 200 USG FLEX 500

Product photo

Hardware Specifications

10/100/1000 Mbps RJ-45 ports 4 x LAN/DMZ, 1 x WAN,

1 x SFP

USB3.0 ports 1 2 2
Console port Yes (RJ-45) Yes (DB9) Yes (DB9)
Rack-mountable - Ye s Ye s
Fanless Ye s Ye s -

System Capacity & Performance

SPI firewall throughput (Mbps)
VPN throughput (Mbps)
IDP throughput (Mbps)
AV throughput (Mbps)

*3

*4

*4

UTM throughput (AV and IDP)
Max. TCP concurrent sessions
Max. concurrent IPsec VPN tunnels

*1

*2

900 1,800 2,300

270 450 810

540 1,100 1,150

360 570 800

*4

*5

360 550 800

300,000 600,000 1,000,000

*6

40 100 300

Concurrent SSL VPN users 30 60 150
VLAN interface 8 16 64
Concurrent devices logins

(default/max.)

*7*8

64 200 200 / 300

Speedtest Performance

SPI firewall throughput (Mbps)

*11

760 810 810

WLAN Management

Managed AP number
(default/max.)

*7

8 / 24 8 / 40 8 / 72

Recommend max. AP in 1 AP Group 10 20 60

Security Service

Anti-Malware

*7

Ye s Ye s Ye s

IPS (IDP) Ye s Ye s Ye s
Application Patrol

*7

Ye s Ye s Ye s

Email Security Ye s Ye s Ye s
Web filtering (CF)
SecuReporter Premium

*7*9

Ye s Ye s Ye s

*7

Ye s Ye s Ye s

Key Features

VPN IKEv2, IPSec, SSL, L2TP/

IPSec

SSL (HTTPS) inspection Ye s Ye s Ye s
2-Factor Authentication Ye s Ye s Ye s
Hotspot Management

Ticket printer support

*7

*10

/

- Ye s Ye s

- Yes (SP350E) / 10 Yes (SP350E) / 10

Support Q'ty (max.)
Microsoft Azure Ye s Ye s Ye s
Amazon VPC Ye s Ye s Ye s
Device HA Pro - - Ye s

4 x LAN/DMZ, 2 x WAN,
1 x SFP

IKEv2, IPSec, SSL, L2TP/
IPSec

7 x (Configurable),
1 x SFP

IKEv2, IPSec, SSL, L2TP/
IPSec

Datasheet ZyWALL USG FLEX 100/200/500

5

Model USG FLEX 100 USG FLEX 200 USG FLEX 500

Power Requirements

Power input 12V DC, 2A max. 12V DC, 2.5A max. 12V DC, 4.17A max.

Max. power consumption

12.5 13.3 24.1

(Watt Max.)

Heat dissipation (BTU/hr) 42.65 45.38 82.23

Physical Specifications

Item Dimensions (WxDxH)

(mm/in.)

216 x 147.3 x 33/

8.50 x 5.80 x 1.30

272 x 187 x 36/

10.7 x 7.36 x 1.42

300 x 188 x 44/

16.93 x 7.4 x 1.73

Weight (Kg/lb.) 0.85/1.87 1.4/3.09 1.65/3.64

Packing Dimensions (WxDxH)

(mm/in.)
Weight (kg/lb.) 1.40/3.09 2.23 (W/O bracket)

284 x 190 x 100/

11.18 x 7.48 x 3.94

427 x 247 x 73/

16.81 x 9.72 x 2.87

351 x 152 x 245/

13.82 x 5.98 x 9.65

2.83/6.24

2.42 (W/ bracket)

Included accessories • Power adapter

• RJ-45 - RS-232 cable
for console connection

• Power adapter

• Rack mounting kit
(optional, by regions)

• Power adapter

• Power cord

• Rack mounting kit

Environmental Specifications

Operating Temperature 0°C to 40°C (32°F to 104°F) 0°C to 40°C (32°F to 104°F) 0°C to 40°C (32°F to 104°F)

Humidity 10% to 90%

(non-condensing)

Storage Temperature -30°C to 70°C

(-22°F to 158°F)

Humidity 10% to 90%

(non-condensing)

10% to 90%
(non-condensing)

-30°C to 70°C
(-22°F to 158°F)

10% to 90%
(non-condensing)

10% to 90%
(non-condensing)

-30°C to 70°C
(-22°F to 158°F)

10% to 90%
(non-condensing)

MTBF (hr) 989810.8 529688.2 529688.2
Acoustic Noise - - 24.5dBA on < 25degC

Operating Temperature,

41.5dBA on full FAN speed

Certifications

EMC FCC Part 15 (Class B),

CE EMC (Class B),BSMI

FCC Part 15 (Class B),
CE EMC (Class B),
C-Tick (Class B), BSMI

FCC Part 15 (Class A),
CE EMC (Class A),
C-Tick (Class A), BSMI

Safety LVD (EN60950-1), BSMI LVD (EN60950-1), BSMI LVD (EN60950-1), BSMI

*: This matrix with firmware ZLD4.50 or later.
*1: Actual performance may vary depending on system configuration, network conditions, and activated applications.
*2: Maximum throughput based on RFC 2544 (1,518-byte UDP packets).
*3: VPN throughput measured based on RFC 2544 (1,424-byte UDP packets).
*4: AV (with Express Mode) and IDP throughput measured using the industry standard HTTP performance test (1,460-byte HTTP packets). Testing done with
multiple flows.
*5: Maximum sessions measured using the industry standard IXIA IxLoad testing tool
*6: Including Gateway-to-Gateway and Client-to-Gateway.
*7: With Zyxel service license to enable or extend the feature capacity.
*8: This is the recommend maximum number of concurrent logged-in devices.
*9: SafeSearch function in CF need to enable SSL inspection firstly and not for small business models.
*10: With Hotspot Management license support
*11: The Speedtest result is conducted with 1Gbps WAN link in real world and it is subject to fluctuate due to quality of the ISP link.

Datasheet ZyWALL USG FLEX 100/200/500

6

Access Point Compatibility List

Product Unified AP Unified Pro AP

Models • NWA5121-N

• NWA5121-NI

• NWA5123-AC

• NWA5123-AC HD

• NWA5123-NI

Functions

Central management Ye s Ye s
Auto provisioning Ye s Ye s
Data forwarding Local bridge Local bridge/Data tunnel
ZyMesh Yes Yes

*: From APC3.0, commercial gateways supporting APC technology are able to recognize APs with FW release higher than APC3.0 as Forward Compatible

APs. Resellers can introduce newly-available Zyxel APs with basic features supported without upgrading any new controller firmware.

• NWA5301-NJ

• WAC5302D-S

• WAX510D*

• WAC6103D-I

• WAC6303D-S

• WAC6502D-E

• WAC6502D-S

• WAC6503D-S

• WAC6552D-S

• WAC6553D-E

• WAX650S*

Software Features

Security Service

Firewall

• ICSA-certified corporate firewall

• Routing and transparent (bridge)
modes

• Stateful packet inspection

• User-aware policy enforcement

• SIP/H.323 NAT traversal

• ALG support for customized ports

• Protocol anomaly detection and

protection

• Traffic anomaly detection and

protection

• Flooding detection and protection

• DoS/DDoS protection

Unified Security Policy

• Unified policy management interface

• Support Content Filtering,

Application Patrol, firewall (ACL/SSL)

• Policy criteria: zone, source and

destination IP address, user, time

IPS(IDP)

• Routing and transparent (bridge)
mode

• Signature-based and behavior
based scanning

• Customized signatures supported

• Automatic signature updates

Application Patrol

• Granular control over the most

important applications

• Identifies and controls application
behavior

• Supports 30+ application categories

• Supports user authentication

• Real-time statistics and reports

Anti-Malware

• Support Stream-based scan engine
and Express mode for cloud query

• No file size limitation

• Works with local cache for stream
mode

• Express mode support over 30 billion
cloud databases and growing

• HTTP(s), FTP(s), SMTP(s), POP3(s)
protocol support

• Automatic signature updates

• Multiple file types supported

E-mail Security

• Transparent mail interception via
SMTP and POP3 protocols

• Spam and Phishing mail detection

• Blacklist and whitelist support

• Supports DNSBL checking

URL Threat Filter

• Botnet C&C websites blocking

• Malicious URL blocking

Content Filtering

• HTTPs domain filtering

• SafeSearch support

• Whitelist websites enforcement

• URL blacklist and whitelist, keyword
blocking support

• Customizable warning messages
and redirection URL

• URL categories increased to 100+

• CTIRU (Counter-Terrorism Internet
Referral Unit) support*

• Geo IP blocking

• Geographical visibility on traffics
statistics and logs

• IPv6 address support

1

IP Exception

• Provides granular control for target
source and destination IP

• Supports security service scan

bypass for IDP and Anti-Malware

VPN

IPSec VPN

• Key management:

IKEv1 (x-auth, mode-config),
IKEv2 (EAP, configuration payload)

• Encryption: DES, 3DES, AES (256-bit)

• Authentication: MD5, SHA1, SHA2

(512-bit)

• Perfect forward secrecy (DH groups)
support 1, 2, 5, 14, 15-18

• PSK and PKI (X.509) certificate support

• IPSec NAT traversal (NAT-T)

• Dead Peer Detection (DPD) and relay
detection

• VPN concentrator

• Route-based VPN Tunnel Interface
(VTI)

• VPN high availability (Failover, LB)

• GRE over IPSec

• NAT over IPSec

• L2TP over IPSec

• Zyxel VPN client provisioning

• Support iOS L2TP/IKE/IKEv2 VPN

client provision

SSL VPN

• Supports Windows and Mac OS X

• Supports full tunnel mode

• Supports 2-Factor authentication

Datasheet ZyWALL USG FLEX 100/200/500

7

Networking

WLAN Management

• Support AP Controller (APC) version

3.40

• 802.11k/v/r support for wave 2 11ac AP

• Wireless L2 isolation

• Supports auto AP FW update

• Scheduled WiFi service

• Dynamic Channel Selection (DCS)

• Client steering for 5 GHz priority and
sticky client prevention

• Auto healing

• Customizable captive portal page

• WiFi Multimedia (WMM) wireless QoS

• CAPWAP discovery protocol

• Multiple SSID with VLAN

• Supports ZyMesh

• Support AP forward compatibility

• Rogue AP Detection

Mobile Broadband

• WAN connection failover via 3G and
4G*2 USB modems

• Auto fallback when primary WAN
recovers

IPv6 Support

• Dual stack

• IPv4 tunneling (6rd and 6to4

transition tunnel)

• SLAAC, static IP address

• DNS, DHCPv6 server/client

• Static/Policy route

• IPSec (IKEv2 6in6, 4in6, 6in4)

Connection

• Routing mode, bridge mode and
hybrid mode

• Ethernet and PPPoE

• NAT and PAT

• VLAN tagging (802.1Q)

• Virtual interface (alias interface)

• Policy-based routing (user-aware)

• Policy-based NAT (SNAT)

• GRE

• Dynamic routing (RIPv1/v2 and OSPF,
BGP)

• DHCP client/server/relay

• Dynamic DNS support

• WAN trunk for more than 2 ports

• Per host session limit

• Guaranteed bandwidth

• Maximum bandwidth

• Priority-bandwidth utilization

• Bandwidth limit per user

• Bandwidth limit per IP

• Bandwidth management by

application

Management

Authentication

• Local user database

• External user database: Microsoft
Windows Active Directory, RADIUS,
LDAP

• IEEE 802.1x authentication

• Captive portal Web authentication

• XAUTH, IKEv2 with EAP VPN

authentication

• IP-MAC address binding

• SSO (Single Sign-On) support

• Supports 2-step authentication for
administrator

System Management

• Role-based administration

• Multi-lingual Web GUI (HTTPS and
HTTP)

• Command line interface (console,
web console, SSH and telnet)

• SNMP v1, v2c, v3

• System configuration rollback

• Firmware upgrade via FTP, FTP-TLS
and Web GUI

• New firmware notify and auto

upgrade

• Dual firmware images

• Cloud CNM SecuManager

Logging and Monitoring

• Comprehensive local logging

• Syslog (to up to 4 servers)

• Email alerts (to up to 2 servers)

• Real-time traffic monitoring

• Built-in daily report

• Cloud CNM SecuReporter

*1 Available in June 2020

*2 For specific models supporting the 3G and

4G dongles on the list, please refer to the
Zyxel product page at 3G dongle document.

For more product information, visit us on the web at www.zyxel.com

Copyright © 2020 Zyxel and/or its affiliates. All rights reserved.
All specifications are subject to change without notice.

Datasheet ZyWALL USG FLEX 100/200/500

07/05/20