How it Works
ZyXEL Communications
Loading...
ZyWALL 2WE
User Manual
433 pgs10.63 Mb0

ZyXEL Communications ZyWALL 2WE User Manual

Download
ZyWALL 2/2WE
Internet Security Gateway
User’s Guide
Version 3.60
March 2003
ZyWALL 2 and ZyWALL 2WE
Copyright
Copyright © 2003 by ZyXEL Communications Corporation.
The contents of this publication may not be reproduced in any part or as a whole, transcribed, stored in a retrieval system, translated into any language, or transmitted in any form or by any means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the prior written permission of ZyXEL Communications Corporation. Published by ZyXEL Communications Corporation. All rights reserved.
Disclaimer
ZyXEL does not assume any liability arising out of the application or use of any products, or software described herein. Neither does it convey any license under its patent rights nor the patent rights of others. ZyXEL further reserves the right to make changes in any products described herein without notice.
This publication is subject to change without notice.
Trademarks
Trademarks mentioned in this publication are used for identification purposes only and may be properties of their respective owners.
ZyWALL 2 and ZyWALL 2WE
Federal Communications Commission (FCC)
Interference Statement
This device complies with Part 15 of FCC rules. Operation is subject to the following two conditions: This device may not cause harmful interference. This device must accept any interference received, including interference that may cause undesired operations. This equipment has been tested and found to comply with the limits for a CLASS B digital device pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a commercial environment. This equipment generates, uses, and can radiate radio frequency energy, and if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. If this equipment does cause harmful interference to radio/television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures: Reorient or relocate the receiving antenna. Increase the separation between the equipment and the receiver. Connect the equipment into an outlet on a circuit different from that to which the receiver is connected. Consult the dealer or an experienced radio/TV technician for help.
Notice 1
Changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate the equipment.
Certifications
Refer to the product page at www.zyxel.com.
FCC iii
ZyWALL 2 and ZyWALL 2WE
Information for Canadian Users
The Industry Canada label identifies certified equipment. This certification means that the equipment meets certain telecommunications network protective, operation, and safety requirements. The Industry Canada does not guarantee that the equipment will operate to a user's satisfaction. Before installing this equipment, users should ensure that it is permissible to be connected to the facilities of the local telecommunications company. The equipment must also be installed using an acceptable method of connection. In some cases, the company's inside wiring associated with a single line individual service may be extended by means of a certified connector assembly. The customer should be aware that the compliance with the above conditions may not prevent degradation of service in some situations. Repairs to certified equipment should be made by an authorized Canadian maintenance facility designated by the supplier. Any repairs or alterations made by the user to this equipment, or equipment malfunctions, may give the telecommunications company cause to request the user to disconnect the equipment. For their own protection, users should ensure that the electrical ground connections of the power utility, telephone lines, and internal metallic water pipe system, if present, are connected together. This precaution may be particularly important in rural areas.
Caution
Users should not attempt to make such connections themselves, but should contact the appropriate electrical inspection authority, or electrician, as appropriate.
Note
This digital apparatus does not exceed the class A limits for radio noise emissions from digital apparatus set out in the radio interference regulations of Industry Canada.
ZyWALL 2 and ZyWALL 2WE
ZyXEL Limited Warranty
ZyXEL warrants to the original end user (purchaser) that this product is free from any defects in materials or workmanship for a period of up to two years from the date of purchase. During the warranty period, and upon proof of purchase, should the product have indications of failure due to faulty workmanship and/or materials, ZyXEL will, at its discretion, repair or replace the defective products or components without charge for either parts or labor, and to whatever extent it shall deem necessary to restore the product or components to proper operating condition. Any replacement will consist of a new or re-manufactured functionally equivalent product of equal value, and will be solely at the discretion of ZyXEL. This warranty shall not apply if the product is modified, misused, tampered with, damaged by an act of God, or subjected to abnormal working conditions.
NOTE
Repair or replacement, as provided under this warranty, is the exclusive remedy of the purchaser. This warranty is in lieu of all other warranties, express or implied, including any implied warranty of merchantability or fitness for a particular use or purpose. ZyXEL shall in no event be held liable for indirect or consequential damages of any kind of character to the purchaser. To obtain the services of this warranty, contact ZyXEL's Service Center for your Return Material Authorization number (RMA). Products must be returned Postage Prepaid. It is recommended that the unit be insured when shipped. Any returned products without proof of purchase or those with an out-dated warranty will be repaired or replaced (at the discretion of ZyXEL) and the customer will be billed for parts and labor. All repaired or replaced products will be shipped by ZyXEL to the corresponding return address, Postage Paid. This warranty gives you specific legal rights, and you may also have other rights that vary from country to country.
Online Registration
Register online registration at www.zyxel.com for free future product updates and information.
Warranty v
ZyWALL 2 and ZyWALL 2WE
Customer Support
When you contact your customer support representative please have the following information ready: Please have the following information ready when you contact customer support.
• Product model and serial number.
• Information in Menu 24.2.1 – System Information.
• Warranty Information.
• Date that you received your device.
• Brief description of the problem and the steps you took to solve it.
LOCATION WORLDWIDE
AMERICA
METHOD
support@zyxel.com.tw
sales@zyxel.com.tw
support@zyxel.com +1-714-632-0882
sales@zyxel.com
support@zyxel.dk +45-3955-0700 www.zyxel.dk SCANDINAVIA
sales@zyxel.dk
support@zyxel.de +49-2405-6909-0 www.zyxel.de GERMANY
sales@zyxel.de
E-MAIL
SUPPORT/SALES
+886-3-578-2439 ftp.europe.zyxel.com
+1-714-632-0858 ftp.zyxel.com
+45-3955-0707 ftp.zyxel.dk
+49-2405-6909-99
TELEPHONE/FAX WEB SITE/ FTP SITE REGULAR MAIL
+886-3-578-3942 www.zyxel.com
www.europe.zyxel.com
www.zyxel.com NORTH
800-255-4101
ZyXEL Communications Corp., 6 Innovation Road II, Science­Based Industrial Park, Hsinchu 300, Taiwan
ZyXEL Communications Inc., 1650 Miraloma Avenue, Placentia, CA 92870, U.S.A.
ZyXEL Communications A/S, Columbusvej 5, 2860 Soeborg, Denmark
ZyXEL Deutschland GmbH. Adenauerstr. 20/A2 D-52146 Wuerselen, Germany
ZyWALL 2 and ZyWALL 2WE
Table of Contents
Copyright......................................................................................................................................................ii
Federal Communications Commission (FCC) Interference Statement................................................. iii
Information for Canadian Users ...............................................................................................................iv
ZyXEL Limited Warranty ..........................................................................................................................v
Customer Support ......................................................................................................................................vi
List of Figures ...........................................................................................................................................xvi
List of Tables .......................................................................................................................................... xxiii
Preface ....................................................................................................................................................xxvii
Overview ........................................................................................................................................................... I
Chapter 1 Getting to Know Your ZyWALL .......................................................................................... 1-1
1.1 Introducing the ZyWALL 2/2WE Internet Security Gateway ................................................... 1-1
1.2 Features ...................................................................................................................................... 1-1
1.3 Applications for the ZyWALL................................................................................................... 1-5
Chapter 2 Hardware Installation ........................................................................................................... 2-1
2.1 Introduction to Hardware Installation ........................................................................................ 2-1
2.2 Front Panels LEDs .................................................................................................................... 2-1
2.3 LED Descriptions....................................................................................................................... 2-2
2.4 ZyWALL Rear Panels and Connections .................................................................................... 2-3
2.5 Hardware Connections ............................................................................................................... 2-3
2.6 Hardware Mounting Options...................................................................................................... 2-5
2.7 Additional Installation Requirements for Using 802.1x............................................................. 2-5
2.8 Turning On Your ZyWALL....................................................................................................... 2-5
Initial Setup and Configuration.....................................................................................................................II
Chapter 3 Introducing the Web Configurator ......................................................................................3-1
3.1 Introduction to the Web Configurator ........................................................................................ 3-1
Table of Contents vii
ZyWALL 2 and ZyWALL 2WE
3.2 Accessing the ZyWALL Web Configurator ...............................................................................3-1
3.3 Web Configurator Navigation.....................................................................................................3-2
Chapter 4 Introducing the SMT..............................................................................................................4-1
4.1 Introduction to the SMT..............................................................................................................4-1
4.2 Accessing the Console Port via the Console Port .......................................................................4-1
4.3 Navigating the SMT Interface.....................................................................................................4-2
4.4 Changing the System Password ..................................................................................................4-7
4.5 Resetting the ZyWALL...............................................................................................................4-8
Chapter 5 SMT Menu 1 - General Setup................................................................................................5-1
5.1 Introduction to General Setup.....................................................................................................5-1
5.2 System Name ..............................................................................................................................5-1
5.3 Dynamic DNS.............................................................................................................................5-1
5.4 General Setup..............................................................................................................................5-2
Chapter 6 WAN Setup..............................................................................................................................6-1
6.1 Introduction to WAN Setup ........................................................................................................ 6-1
6.2 Cloning The MAC Address ........................................................................................................6-1
6.3 WAN Setup.................................................................................................................................6-1
Chapter 7 LAN Setup...............................................................................................................................7-1
7.1 Introduction to LAN Setup .........................................................................................................7-1
7.2 Accessing the LAN Menus .........................................................................................................7-1
7.3 LAN Port Filter Setup.................................................................................................................7-1
7.4 TCP/IP and LAN DHCP.............................................................................................................7-2
7.5 TCP/IP and DHCP Ethernet Setup Menu ...................................................................................7-5
7.6 Wireless LAN ...........................................................................................................................7-10
7.7 Wireless LAN Setup .................................................................................................................7-11
Chapter 8 Wireless LAN Security Setup ................................................................................................8-1
8.1 Introduction to Wireless LAN Security ......................................................................................8-1
ZyWALL 2 and ZyWALL 2WE
8.2 Levels of Security ...................................................................................................................... 8-1
8.3 Data Encryption with WEP ........................................................................................................8-2
8.4 Network Authentication ............................................................................................................. 8-3
8.5 Local User Authentication ......................................................................................................... 8-8
8.6 MAC Address Filtering............................................................................................................ 8-10
Chapter 9 Internet Access ....................................................................................................................... 9-1
9.1 Introduction to Internet Access Setup ........................................................................................ 9-1
9.2 Ethernet Encapsulation............................................................................................................... 9-1
9.3 PPTP Encapsulation ................................................................................................................... 9-2
9.4 PPPoE Encapsulation ................................................................................................................. 9-3
9.5 Basic Setup Complete ................................................................................................................ 9-5
Advanced Applications ................................................................................................................................. III
Chapter 10 Remote Node Setup............................................................................................................ 10-1
10.1 Introduction to Remote Node Setup..................................................................................... 10-1
10.2 Remote Node Setup.............................................................................................................. 10-1
10.3 Remote Node Profile Setup.................................................................................................. 10-2
10.4 Edit IP .................................................................................................................................. 10-7
10.5 Remote Node Filter ..............................................................................................................10-9
10.6 Traffic Redirect .................................................................................................................. 10-10
Chapter 11 IP Static Route Setup ..........................................................................................................11-1
11.1 Introduction to Static Route ................................................................................................. 11-1
11.2 IP Static Route Setup............................................................................................................ 11-2
Chapter 12 Network Address Translation (NAT) ............................................................................... 12-1
12.1 Introduction to NAT.............................................................................................................12-1
12.2 Using NAT........................................................................................................................... 12-6
12.3 NAT Setup ........................................................................................................................... 12-8
12.4 NAT Server Sets – Port Forwarding .................................................................................. 12-14
Table of Contents ix
ZyWALL 2 and ZyWALL 2WE
12.5 General NAT Examples......................................................................................................12-17
12.6 Trigger Port Forwarding .....................................................................................................12-24
Firewall and Content Filters.........................................................................................................................IV
Chapter 13 Firewalls..............................................................................................................................13-1
13.1 Introduction to Firewalls.......................................................................................................13-1
13.2 Types of Firewalls.................................................................................................................13-1
13.3 Introduction to ZyXEL’s Firewall ........................................................................................13-2
13.4 Denial of Service...................................................................................................................13-3
13.5 Stateful Inspection ................................................................................................................13-7
13.6 Guidelines For Enhancing Security With Your Firewall....................................................13-11
13.7 Packet Filtering Vs Firewall ...............................................................................................13-12
Chapter 14 Introducing the ZyWALL Firewall ...................................................................................14-1
14.1 Introduction to the ZyWALL Firewall..................................................................................14-1
14.2 Remote Management and the Firewall .................................................................................14-1
14.3 Access Methods ....................................................................................................................14-1
14.4 Using ZyWALL SMT Menus...............................................................................................14-1
Chapter 15 Firewall Configuration.......................................................................................................15-1
15.1 Introduction to Firewall Configuration .................................................................................15-1
15.2 Enabling the Firewall............................................................................................................15-1
15.3 Attack Alert...........................................................................................................................15-3
Chapter 16 Creating Custom Rules ......................................................................................................16-1
16.1 Introduction to Custom Rules ...............................................................................................16-1
16.2 Rule Logic Overview............................................................................................................16-2
16.3 Connection Direction Examples ...........................................................................................16-3
16.4 Rule Summary ......................................................................................................................16-5
16.5 Predefined Services...............................................................................................................16-7
16.6 Custom Ports.......................................................................................................................16-14
ZyWALL 2 and ZyWALL 2WE
16.7 Creating/Editing A Custom Port ........................................................................................ 16-14
16.8 Example Firewall Rule....................................................................................................... 16-15
Chapter 17 Content Filtering................................................................................................................ 17-1
17.1 Introduction to Content Filtering.......................................................................................... 17-1
17.2 Restrict Web Features .......................................................................................................... 17-1
17.3 Days and Times.................................................................................................................... 17-1
17.4 Configure Content Filtering ................................................................................................. 17-1
Logs, Filter Configuration, and SNMP Configuration ................................................................................V
Chapter 18 Centralized Logs................................................................................................................ 18-1
18.1 Introduction to Centralized Logs.......................................................................................... 18-1
18.2 View Log.............................................................................................................................. 18-1
18.3 Log Settings ......................................................................................................................... 18-3
18.4 Reports ................................................................................................................................. 18-6
Chapter 19 Filter Configuration........................................................................................................... 19-1
19.1 Introduction to Filters........................................................................................................... 19-1
19.2 Configuring a Filter Set........................................................................................................19-4
19.3 Example Filter.................................................................................................................... 19-13
19.4 Filter Types and SUA/NAT ............................................................................................... 19-16
19.5 Firewall Versus Filters ....................................................................................................... 19-16
19.6 Applying a Filter and Factory Defaults.............................................................................. 19-17
Chapter 20 SNMP Configuration ......................................................................................................... 20-1
20.1 Introduction to SNMP.......................................................................................................... 20-1
20.2 Supported MIBs ................................................................................................................... 20-3
20.3 SNMP Configuration............................................................................................................ 20-3
20.4 SNMP Traps......................................................................................................................... 20-4
System Information and Diagnosis and Firmware and Configuration File Maintenance...................... VI
Chapter 21 System Information & Diagnosis...................................................................................... 21-1
Table of Contents xi
ZyWALL 2 and ZyWALL 2WE
21.1 Introduction to System Status ...............................................................................................21-1
21.2 System Status........................................................................................................................21-1
21.3 System Information and Console Port Speed........................................................................21-3
21.4 Log and Trace .......................................................................................................................21-6
21.5 Diagnostic ...........................................................................................................................21-11
Chapter 22 Firmware and Configuration File Maintenance ..............................................................22-1
22.1 Filename Conventions ..........................................................................................................22-1
22.2 Backup Configuration...........................................................................................................22-2
22.3 Restore Configuration...........................................................................................................22-8
22.4 Uploading Firmware and Configuration Files ....................................................................22-11
System Maintenance and Information and Remote Management.......................................................... VII
Chapter 23 System Maintenance & Information.................................................................................23-1
23.1 Command Interpreter Mode..................................................................................................23-1
23.2 Call Control Support.............................................................................................................23-2
23.3 Time and Date Setting ..........................................................................................................23-5
Chapter 24 Remote Management ......................................................................................................... 24-1
24.1 Remote Management and the Firewall .................................................................................24-1
24.2 Telnet ....................................................................................................................................24-1
24.3 FTP .......................................................................................................................................24-2
24.4 Web....................................................................................................................................... 24-2
24.5 SNMP ...................................................................................................................................24-2
24.6 DNS ......................................................................................................................................24-2
24.7 Remote Management ............................................................................................................24-2
24.8 Remote Management and SUA/NAT ...................................................................................24-4
24.9 System Timeout .................................................................................................................... 24-5
Call Scheduling and VPN/IPSec................................................................................................................VIII
Chapter 25 Call Scheduling...................................................................................................................25-1
ZyWALL 2 and ZyWALL 2WE
25.1 Introduction to Call Scheduling ........................................................................................... 25-1
25.2 Configuring Call Scheduling................................................................................................ 25-1
25.3 Applying Schedule Sets ....................................................................................................... 25-3
Chapter 26 Introduction to IPSec......................................................................................................... 26-1
26.1 VPN Overview..................................................................................................................... 26-1
26.2 IPSec Architecture ............................................................................................................... 26-3
26.3 Encapsulation ....................................................................................................................... 26-5
26.4 IPSec and NAT .................................................................................................................... 26-5
Chapter 27 VPN/IPSec Setup ............................................................................................................... 27-1
27.1 VPN/IPSec Overview........................................................................................................... 27-1
27.2 IPSec Algorithms ................................................................................................................. 27-1
27.3 My IP Address...................................................................................................................... 27-2
27.4 Secure Gateway Address...................................................................................................... 27-2
27.5 Summary Screen ..................................................................................................................27-3
27.6 Keep Alive ........................................................................................................................... 27-4
27.7 NAT Traversal ..................................................................................................................... 27-5
27.8 ID Type and Content............................................................................................................ 27-5
27.9 Configuring Basic IKE VPN Rule Setup ............................................................................. 27-7
27.10 IKE Phases ......................................................................................................................... 27-12
27.11 Configuring Advanced IKE Setup ..................................................................................... 27-14
27.12 Manual Key Setup.............................................................................................................. 27-20
27.13 Configuring Edit Manual Setup ......................................................................................... 27-20
27.14 SA Monitor ........................................................................................................................ 27-24
27.15 Global Settings................................................................................................................... 27-26
27.16 Telecommuter VPN/IPSec Examples ................................................................................ 27-27
Troubleshooting............................................................................................................................................. IX
Chapter 28 Troubleshooting ................................................................................................................. 28-1
Table of Contents xiii
ZyWALL 2 and ZyWALL 2WE
23.1 Problems Starting Up the ZyWALL .....................................................................................28-1
28.1 Problems with a LAN Interface ............................................................................................ 28-2
28.2 Problems with the WAN Interface........................................................................................28-2
28.3 Problems with Internet Access..............................................................................................28-3
23.2 Problems with the Password ................................................................................................. 28-3
28.4 Problems with Remote Management .................................................................................... 28-3
General Appendices........................................................................................................................................ X
Appendix A Setting up Your Computer’s IP Address............................................................................... 1
Appendix B Antennas................................................................................................................................ 14
Appendix C Triangle Route ...................................................................................................................... 16
Appendix D The Big Picture..................................................................................................................... 19
Appendix E Wireless LAN and IEEE 802.11 ..........................................................................................20
Appendix F Wireless LAN With IEEE 802.1x ........................................................................................23
Appendix G PPPoE ................................................................................................................................... 27
Appendix H PPTP ..................................................................................................................................... 29
Appendix I Hardware Specifications....................................................................................................... 32
Appendix J Universal Plug and Play ....................................................................................................... 36
Appendix K IP Subnetting ........................................................................................................................ 45
Appendix L Safety Warnings and Instructions....................................................................................... 53
Command and Log Appendices ....................................................................................................................XI
Appendix M Command Interpreter.........................................................................................................57
Appendix N Firewall Commands............................................................................................................. 58
Appendix O NetBIOS Filter Commands................................................................................................. 65
Appendix P Boot Commands.................................................................................................................... 68
Appendix Q Log Descriptions ..................................................................................................................70
Appendix R Brute-Force Password Guessing Protection ...................................................................... 88
Index .............................................................................................................................................................XII
ZyWALL 2 and ZyWALL 2WE
Index ............................................................................................................................................................A
Table of Contents xv
ZyWALL 2 and ZyWALL 2WE
List of Figures
Figure 1-1 Secure Internet Access and VPN Application ...............................................................................1-6
Figure 1-2 ZyWALL 2WE Wireless LAN Application...................................................................................1-6
Figure 2-1 ZyWALL 2WE Front Panel...........................................................................................................2-1
Figure 2-2 ZyWALL 2 Front Panel.................................................................................................................2-2
Figure 2-3 ZyWALL 2WE Rear Panel............................................................................................................2-3
Figure 2-4 ZyWALL 2 Rear Panel..................................................................................................................2-3
Figure 3-1 Change Password Screen ..............................................................................................................3-1
Figure 3-2 Web Configurator Main Menu ......................................................................................................3-2
Figure 4-1 Initial Screen .................................................................................................................................4-1
Figure 4-2 Password Screen ...........................................................................................................................4-2
Figure 4-3 Main Menu (ZyWALL 2WE)........................................................................................................4-3
Figure 4-4 Getting Started and Advanced Applications SMT Menus (ZyWALL 2WE).................................4-5
Figure 4-5 Advanced Management SMT Menus ............................................................................................4-6
Figure 4-6 Schedule Setup and IPSec VPN Configuration SMT Menus........................................................4-7
Figure 4-7 Menu 23: System Password ..........................................................................................................4-7
Figure 4-8 Example Xmodem Upload............................................................................................................4-8
Figure 5-1 Menu 1: General Setup..................................................................................................................5-2
Figure 5-2 Configure Dynamic DNS..............................................................................................................5-3
Figure 6-1 MAC Address Cloning in WAN Setup..........................................................................................6-1
Figure 7-1 Menu 3: LAN Setup......................................................................................................................7-1
Figure 7-2 Menu 3.1: LAN Port Filter Setup..................................................................................................7-2
Figure 7-3 Physical Network .......................................................................................................................... 7-5
Figure 7-4 Partitioned Logical Networks .......................................................................................................7-5
Figure 7-5 Menu 3: TCP/IP and DHCP Setup ................................................................................................7-6
Figure 7-6 Menu 3.2: TCP/IP and DHCP Ethernet Setup...............................................................................7-6
xvi List of Figures
ZyWALL 2 and ZyWALL 2WE
Figure 7-7 Menu 3.2.1: IP Alias Setup........................................................................................................... 7-9
Figure 7-8 RTS Threshold............................................................................................................................7-11
Figure 7-9 Menu 3.5 – Wireless LAN Setup................................................................................................ 7-12
Figure 8-1 ZyWALL Wireless Security Levels .............................................................................................. 8-1
Figure 8-2 Wireless LAN ............................................................................................................................... 8-2
Figure 8-3 Sequence for EAP Authentication ................................................................................................ 8-5
Figure 8-4 Wireless LAN 802.1X Authentication .......................................................................................... 8-6
Figure 8-5 Authentication RADIUS............................................................................................................... 8-7
Figure 8-6 Local User Database..................................................................................................................... 8-9
Figure 8-7 WLAN MAC Address Filter....................................................................................................... 8-10
Figure 9-1 Menu 4: Internet Access Setup (Ethernet).................................................................................... 9-1
Figure 9-2 Internet Access Setup (PPTP)....................................................................................................... 9-3
Figure 9-3 Internet Access Setup (PPPoE)..................................................................................................... 9-4
Figure 10-1 Menu 11 Remote Node Setup................................................................................................... 10-1
Figure 10-2 Menu 11.1: Remote Node Profile for Ethernet Encapsulation ................................................. 10-2
Figure 10-3 Menu 11.1: Remote Node Profile for PPPoE Encapsulation.................................................... 10-4
Figure 10-4 Menu 11.1: Remote Node Profile for PPTP Encapsulation...................................................... 10-6
Figure 10-5 Menu 11.3: Remote Node Network Layer Options for Ethernet Encapsulation ...................... 10-7
Figure 10-6 Menu 11.5: Remote Node Filter (Ethernet Encapsulation)....................................................... 10-9
Figure 10-7 Menu 11.5: Remote Node Filter (PPPoE or PPTP Encapsulation)......................................... 10-10
Figure 10-8 Traffic Redirect WAN Setup................................................................................................... 10-10
Figure 10-9 Traffic Redirect LAN Setup ....................................................................................................10-11
Figure 10-10 Menu 11.1: Remote Node Profile..........................................................................................10-11
Figure 10-11 Menu 11.6: Traffic Redirect Setup........................................................................................ 10-12
Figure 11-1 Example of Static Routing Topology.........................................................................................11-1
Figure 11-2 Menu 12: IP Static Route Setup.................................................................................................11-2
Figure 11-3 Menu 12. 1: Edit IP Static Route ...............................................................................................11-3
List of Figures xvii
ZyWALL 2 and ZyWALL 2WE
Figure 12-1 How NAT Works.......................................................................................................................12-3
Figure 12-2 NAT Application With IP Alias .................................................................................................12-4
Figure 12-3 Menu 4: Applying NAT for Internet Access..............................................................................12-7
Figure 12-4 Menu 11.3: Applying NAT to the Remote Node .......................................................................12-8
Figure 12-5 Menu 15: NAT Setup ................................................................................................................12-9
Figure 12-6 Menu 15.1: Address Mapping Sets ...........................................................................................12-9
Figure 12-7 Menu 15.1.255: SUA Address Mapping Rules .......................................................................12-10
Figure 12-8 Menu 15.1.1: First Set............................................................................................................. 12-11
Figure 12-9 Menu 15.1.1.1: Editing/Configuring an Individual Rule in a Set............................................12-13
Figure 12-10 Menu 15.2: NAT Server Setup .............................................................................................. 12-16
Figure 12-11 Multiple Servers Behind NAT Example................................................................................12-16
Figure 12-12 NAT Example 1.....................................................................................................................12-17
Figure 12-13 Menu 4: Internet Access & NAT Example ............................................................................ 12-17
Figure 12-14 NAT Example 2.....................................................................................................................12-18
Figure 12-15 Menu 15.2: Specifying an Inside Server ...............................................................................12-19
Figure 12-16 NAT Example 3.....................................................................................................................12-20
Figure 12-17 Example 3: Menu 11.3 .......................................................................................................... 12-21
Figure 12-18 Example 3: Menu 15.1.1.1 ....................................................................................................12-21
Figure 12-19 Example 3: Final Menu 15.1.1..............................................................................................12-22
Figure 12-20 Example 3: Menu 15.2 .......................................................................................................... 12-22
Figure 12-21 NAT Example 4.....................................................................................................................12-23
Figure 12-22 Example 4: Menu 15.1.1.1: Address Mapping Rule .............................................................12-24
Figure 12-23 Example 4: Menu 15.1.1: Address Mapping Rules...............................................................12-24
Figure 12-24 Trigger Port Forwarding Process: Example ..........................................................................12-25
Figure 12-25 Menu 15.3—Trigger Port Setup............................................................................................ 12-26
Figure 13-1 ZyWALL Firewall Application .................................................................................................13-3
Figure 13-2 Three-Way Handshake ..............................................................................................................13-5
xviii List of Figures
ZyWALL 2 and ZyWALL 2WE
Figure 13-3 SYN Flood................................................................................................................................ 13-5
Figure 13-4 Smurf Attack ............................................................................................................................ 13-6
Figure 13-5 Stateful Inspection.................................................................................................................... 13-8
Figure 14-1 Menu 21: Filter and Firewall Setup.......................................................................................... 14-1
Figure 14-2 Menu 21.2: Firewall Setup ....................................................................................................... 14-2
Figure 15-1 Enabling the Firewall ............................................................................................................... 15-2
Figure 15-2 Attack Alert .............................................................................................................................. 15-5
Figure 16-1 LAN to WAN Traffic................................................................................................................ 16-4
Figure 16-2 WAN to LAN Traffic................................................................................................................ 16-4
Figure 16-3 Firewall Rules Summary: First Screen..................................................................................... 16-5
Figure 16-4 Creating/Editing A Firewall Rule ............................................................................................16-11
Figure 16-5 Adding/Editing Source and Destination Addresses ................................................................ 16-13
Figure 16-6 Creating/Editing A Custom Port............................................................................................. 16-14
Figure 16-7 Firewall Rule Configuration Screen Example........................................................................ 16-16
Figure 16-8 Firewall IP Config Screen Example ....................................................................................... 16-17
Figure 16-9 Custom Port Example............................................................................................................. 16-18
Figure 16-10 Rule Configuration Example................................................................................................ 16-19
Figure 16-11 Rule Summary Example ....................................................................................................... 16-20
Figure 17-1Content Filter............................................................................................................................. 17-2
Figure 18-1 View Log .................................................................................................................................. 18-2
Figure 18-2 Log Settings.............................................................................................................................. 18-4
Figure 18-3 Reports ..................................................................................................................................... 18-7
Figure 18-4 Web Site Hits Report Example ................................................................................................. 18-9
Figure 18-5 Protocol/Port Report Example................................................................................................ 18-10
Figure 18-6 LAN IP Address Report Example............................................................................................18-11
Figure 19-1 Outgoing Packet Filtering Process ........................................................................................... 19-2
Figure 19-2 Filter Rule Process.................................................................................................................... 19-3
List of Figures xix
ZyWALL 2 and ZyWALL 2WE
Figure 19-3 Menu 21: Filter and Firewall Setup...........................................................................................19-4
Figure 19-4 Menu 21.1: Filter Set Configuration .........................................................................................19-4
Figure 19-5 Menu 21.1.1.1: TCP/IP Filter Rule ...........................................................................................19-7
Figure 19-6 Executing an IP Filter..............................................................................................................19-10
Figure 19-7 Menu 21.1.4.1: Generic Filter Rule.........................................................................................19-11
Figure 19-8 Telnet Filter Example ..............................................................................................................19-13
Figure 19-9 Example Filter: Menu 21.1.3.1................................................................................................19-14
Figure 19-10 Example Filter Rules Summary: Menu 21.1.3 ...................................................................... 19-15
Figure 19-11 Protocol and Device Filter Sets.............................................................................................19-16
Figure 19-12 Filtering LAN Traffic ............................................................................................................19-17
Figure 19-13 Filtering Remote Node Traffic ..............................................................................................19-18
Figure 20-1 SNMP Management Model.......................................................................................................20-2
Figure 20-2 Menu 22: SNMP Configuration ................................................................................................20-3
Figure 21-1 Menu 24: System Maintenance.................................................................................................21-1
Figure 21-2 Menu 24.1: System Maintenance: Status (ZyWALL 2WE) .....................................................21-2
Figure 21-3 Menu 24.2: System Information and Console Port Speed.........................................................21-4
Figure 21-4 Menu 24.2.1: System Maintenance: Information ......................................................................21-4
Figure 21-5 Menu 24.2.2: System Maintenance: Change Console Port Speed............................................ 21-5
Figure 21-6 Menu 24.3: System Maintenance: Log and Trace ..................................................................... 21-6
Figure 21-7 Examples of Error and Information Messages ..........................................................................21-7
Figure 21-8 Menu 24.3.2: System Maintenance: UNIX Syslog ...................................................................21-7
Figure 21-9 Call-Triggering Packet Example.............................................................................................21-11
Figure 21-10 Menu 24.4: System Maintenance: Diagnostic.......................................................................21-12
Figure 21-11 WAN & LAN DHCP .............................................................................................................21-13
Figure 22-1 Telnet into Menu 24.5 ...............................................................................................................22-3
Figure 22-2 FTP Session Example................................................................................................................22-4
Figure 22-3 System Maintenance: Backup Configuration............................................................................22-7
xx List of Figures
ZyWALL 2 and ZyWALL 2WE
Figure 22-4 System Maintenance: Starting Xmodem Download Screen..................................................... 22-7
Figure 22-5 Backup Configuration Example ............................................................................................... 22-7
Figure 22-6 Successful Backup Confirmation Screen.................................................................................. 22-7
Figure 22-7 Telnet into Menu 24.6............................................................................................................... 22-9
Figure 22-8 Restore Using FTP Session Example ..................................................................................... 22-10
Figure 22-9 System Maintenance: Restore Configuration......................................................................... 22-10
Figure 22-10 System Maintenance: Starting Xmodem Download Screen ................................................. 22-10
Figure 22-11 Restore Configuration Example ............................................................................................22-11
Figure 22-12 Successful Restoration Confirmation Screen ........................................................................22-11
Figure 22-13 Telnet Into Menu 24.7.1: Upload System Firmware............................................................. 22-12
Figure 22-14 Telnet Into Menu 24.7.2: System Maintenance .................................................................... 22-13
Figure 22-15 FTP Session Example of Firmware File Upload .................................................................. 22-14
Figure 22-16 Menu 24.7.1 as seen using the Console Port ........................................................................ 22-16
Figure 22-17 Example Xmodem Upload ................................................................................................... 22-16
Figure 22-18 Menu 24.7.2 as seen using the Console Port ........................................................................ 22-17
Figure 22-19 Example Xmodem Upload ................................................................................................... 22-18
Figure 23-1 Command Mode in Menu 24.................................................................................................... 23-1
Figure 23-2 Valid Commands ...................................................................................................................... 23-2
Figure 23-3 Call Control.............................................................................................................................. 23-2
Figure 23-4 Budget Management................................................................................................................. 23-3
Figure 23-5 Call History .............................................................................................................................. 23-4
Figure 23-6 Menu 24: System Maintenance ................................................................................................ 23-5
Figure 23-7 Menu 24.10 System Maintenance: Time and Date Setting....................................................... 23-5
Figure 24-1 Telnet Configuration on a TCP/IP Network ............................................................................. 24-1
Figure 24-2 Menu 24.11 – Remote Management Control............................................................................ 24-3
Figure 25-1 Menu 26 - Schedule Setup........................................................................................................ 25-1
Figure 25-2 Schedule Set Setup ................................................................................................................... 25-2
List of Figures xxi
ZyWALL 2 and ZyWALL 2WE
Figure 25-3 Applying Schedule Set(s) to a Remote Node (PPPoE)..............................................................25-4
Figure 25-4 Applying Schedule Set(s) to a Remote Node (PPTP) ...............................................................25-5
Figure 26-1 Encryption and Decryption .......................................................................................................26-2
Figure 26-2 VPN Application.......................................................................................................................26-3
Figure 26-3 IPSec Architecture.....................................................................................................................26-4
Figure 26-4 Transport and Tunnel Mode IPSec Encapsulation.....................................................................26-5
Figure 27-1 IPSec Summary Fields..............................................................................................................27-3
Figure 27-2 VPN Summary ..........................................................................................................................27-3
Figure 27-3 NAT Router Between IPSec Routers.........................................................................................27-5
Figure 27-4 Basic IKE VPN Rule Setup....................................................................................................... 27-8
Figure 27-5 Two Phases to Set Up the IPSec SA........................................................................................27-12
Figure 27-6 Advanced IKE VPN Rule Setup.................................................................................................27-15
Figure 27-7 Manual IKE VPN Rule Setup.....................................................................................................27-21
Figure 27-8 VPN SA Monitor.....................................................................................................................27-25
Figure 27-9 VPN Global Setting.................................................................................................................27-26
Figure 27-10 Telecommuters Sharing One VPN Rule Example.................................................................27-28
Figure 27-11 Telecommuters Using Unique VPN Rules Example .............................................................27-29
xxii List of Figures
ZyWALL 2 and ZyWALL 2WE
List of Tables
Table 2-1 LED Descriptions........................................................................................................................... 2-2
Table 2-2 ZyWALL Wireless LAN Coverage................................................................................................ 2-5
Table 4-1 Main Menu Summary .................................................................................................................... 4-3
Table 5-1 General Setup Menu Field ............................................................................................................. 5-2
Table 5-2 Configure Dynamic DNS Menu Fields.......................................................................................... 5-3
Table 6-1 MAC Address Cloning in WAN Setup........................................................................................... 6-2
Table 7-1 Example Of Network Properties For LAN Servers With Fixed IP Addresses ............................... 7-3
Table 7-2 Private IP Address Ranges ............................................................................................................. 7-4
Table 7-3 DHCP Ethernet Setup Menu Fields................................................................................................ 7-7
Table 7-4 LAN TCP/IP Setup Menu Fields.................................................................................................... 7-7
Table 7-5 IP Alias Setup Menu Fields............................................................................................................ 7-9
Table 7-6 Wireless LAN Setup Menu Fields................................................................................................ 7-12
Table 8-1 Wireless LAN................................................................................................................................. 8-3
Table 8-2 Wireless LAN 802.1X Authentication ........................................................................................... 8-6
Table 8-3 Authentication RADIUS ................................................................................................................ 8-7
Table 8-4 Local User Database .................................................................................................................... 8-10
Table 8-5 WLAN MAC Address Filter .........................................................................................................8-11
Table 9-1 Menu 4: Internet Access Setup Menu Fields.................................................................................. 9-1
Table 9-2 New Fields in Menu 4 (PPTP) Screen ........................................................................................... 9-3
Table 9-3 New Fields in Menu 4 (PPPoE) screen .......................................................................................... 9-4
Table 10-1 Fields in Menu 11.1.................................................................................................................... 10-2
Table 10-2 Fields in Menu 11.1 (PPPoE Encapsulation Specific) ............................................................... 10-5
Table 10-3 Fields in Menu 11.1 (PPTP Encapsulation)................................................................................ 10-6
Table 10-4 Remote Node Network Layer Options Menu Fields.................................................................. 10-8
Table 10-5 Menu 11.1: Remote Node Profile (Traffic Redirect Field) ...................................................... 10-12
List of Tables xxiii
ZyWALL 2 and ZyWALL 2WE
Table 10-6 Traffic Redirect Setup...............................................................................................................10-12
Table 11-1 IP Static Route Menu Fields .......................................................................................................11-3
Table 12-1 NAT Definitions..........................................................................................................................12-1
Table 12-2 NAT Mapping Types...................................................................................................................12-5
Table 12-3 Applying NAT in Menus 4 & 11.3..............................................................................................12-8
Table 12-4 SUA Address Mapping Rules ...................................................................................................12-10
Table 12-5 Fields in Menu 15.1.1 ...............................................................................................................12-12
Table 12-6 Menu 15.1.1.1: Editing/Configuring an Individual Rule in a Set .............................................12-13
Table 12-7 Services & Port Numbers .........................................................................................................12-14
Table 12-8 Menu 15.3—Trigger Port Setup Description............................................................................12-27
Table 13-1 Common IP Ports........................................................................................................................13-4
Table 13-2 ICMP Commands That Trigger Alerts........................................................................................13-6
Table 13-3 Legal NetBIOS Commands ........................................................................................................ 13-7
Table 13-4 Legal SMTP Commands.............................................................................................................13-7
Table 15-1 Attack Alert.................................................................................................................................15-5
Table 16-1 Firewall Rules Summary: First Screen .......................................................................................16-5
Table 16-2 Predefined Services ....................................................................................................................16-7
Table 16-3 Creating/Editing A Firewall Rule ............................................................................................. 16-11
Table 16-4 Adding/Editing Source and Destination Addresses ..................................................................16-13
Table 16-5 Creating/Editing A Custom Port ...............................................................................................16-15
Table 17-1 Content Filter ..............................................................................................................................17-2
Table 18-1 View Log ....................................................................................................................................18-2
Table 18-2 Log Settings ................................................................................................................................ 18-5
Table 18-3 Reports........................................................................................................................................18-8
Table 18-4 Web Site Hits Report ..................................................................................................................18-9
Table 18-5 Protocol/Port Report .................................................................................................................18-10
Table 18-6 Protocol/Port Report .................................................................................................................18-11
xxiv List of Tables
ZyWALL 2 and ZyWALL 2WE
Table 18-7 Reports Specifications.............................................................................................................. 18-12
Table 19-1 Abbreviations Used in the Filter Rules Summary Menu............................................................ 19-5
Table 19-2 Rule Abbreviations Used ........................................................................................................... 19-6
Table 19-3 TCP/IP Filter Rule Menu Fields................................................................................................. 19-7
Table 19-4 Generic Filter Rule Menu Fields.............................................................................................. 19-12
Table 20-1 SNMP Configuration Menu Fields............................................................................................. 20-3
Table 20-2 SNMP Traps............................................................................................................................... 20-4
Table 21-1 System Maintenance: Status Menu Fields.................................................................................. 21-2
Table 21-2 Fields in System Maintenance: Information .............................................................................. 21-5
Table 21-3 System Maintenance Menu Syslog Parameters.......................................................................... 21-8
Table 21-4 System Maintenance Menu Diagnostic.................................................................................... 21-13
Table 22-1 Filename Conventions................................................................................................................ 22-2
Table 22-2 General Commands for GUI-based FTP Clients........................................................................ 22-4
Table 22-3 General Commands for GUI-based TFTP Clients ..................................................................... 22-6
Table 23-1 Budget Management .................................................................................................................. 23-3
Table 23-2 Call History Fields ..................................................................................................................... 23-4
Table 23-3 Time and Date Setting Fields..................................................................................................... 23-6
Table 24-1 Menu 24.11 – Remote Management Control ............................................................................. 24-3
Table 25-1Schedule Set Setup Fields ........................................................................................................... 25-2
Table 26-1 VPN and NAT ............................................................................................................................ 26-6
Table 27-1 AH and ESP ............................................................................................................................... 27-1
Table 27-2 VPN Summary ........................................................................................................................... 27-4
Table 27-3 Local ID Type and Content Fields ............................................................................................. 27-6
Table 27-4 Peer ID Type and Content Fields ............................................................................................... 27-6
Table 27-5 Matching ID Type and Content Configuration Example............................................................ 27-7
Table 27-6 Mismatching ID Type and Content Configuration Example...................................................... 27-7
Table 27-7 Basic IKE VPN Rule Setup........................................................................................................ 27-8
List of Tables xxv
ZyWALL 2 and ZyWALL 2WE
Table 27-8 Advanced IKE VPN Rule Setup...................................................................................................27-16
Table 27-9 Manual IKE VPN Rule Setup ......................................................................................................27-21
Table 27-10 VPN SA Monitor ....................................................................................................................27-25
Table 27-11 VPN Global Setting ................................................................................................................27-26
Table 27-12 Telecommuter and Headquarters Configuration Example......................................................27-27
Table 28-1 Troubleshooting the Start-Up of Your ZyWALL ........................................................................28-1
Table 28-2 Troubleshooting the LAN Interface............................................................................................28-2
Table 28-3 Troubleshooting the WAN interface ...........................................................................................28-2
Table 28-4 Troubleshooting Internet Access.................................................................................................28-3
Table 28-5 Troubleshooting the Password....................................................................................................28-3
Table 28-6 Troubleshooting Telnet ...............................................................................................................28-3
xxvi List of Tables
ZyWALL 2 and ZyWALL 2WE
Preface
Congratulations on your purchase of the ZyWALL 2/2WE Internet Security Gateway.
About This User's Manual
This manual is designed to guide you through the configuration of your ZyWALL for its various applications. This manual may refer to the ZyWALL 2/2WE Internet Security Gateway as the ZyWALL. This manual covers the ZyWALL 2 and 2WEmodels. Supported features and the details of the features, vary by model.
You may use the System Management Terminal (SMT), web configurator or
command interpreter interface to configure your ZyWALL. Not all features can be
configured through all interfaces. This User's Guide primarily shows SMT
configuration but includes the other interfaces where appropriate.
Related Documentation
Support Disk
Refer to the included CD for support documents.
Quick Start Guide
The Quick Start Guide is designed to help you get up and running right away. It contains a detailed easy-to-follow connection diagram, default settings, handy checklists and information on setting up your network and configuring for Internet access.
Web Configurator Online Help
Embedded web help for descriptions of individual screens and supplementary information.
Packing List Card
The Packing List Card lists all items that should have come in the package.
Certifications
Refer to the product page at www.zyxel.com
ZyXEL Glossary and Web Site Please refer to www.zyxel.com
documentation.
for an online glossary of networking terms and additional support
for information on product certifications.
Syntax Conventions
• “Enter” means for you to type one or more characters and press the carriage return. “Select” or “Choose” means for you to use one of the predefined choices.
• The SMT menu titles and labels are in Bold Times New Roman font.
• The choices of a menu item are in Bold Arial font.
Preface xxvii
ZyWALL 2 and ZyWALL 2WE
• A single keystroke is in Arial font and enclosed in square brackets, for instance, [ENTER] means the Enter, or carriage return, key; [ESC] means the escape key and [SPACE BAR] means the space bar. [UP] and [DOWN] are the up and down arrow keys.
• Mouse action sequences are denoted using a comma. For example, “click the Apple icon, Control Panels and then Modem” means first click the Apple icon, then point your mouse pointer to Control Panels and then click Modem.
• For brevity’s sake, we will use “e.g.” as a shorthand for “for instance” and “i.e.” for “that is” or “in other words” throughout this manual.
Overview
Part I:
Overview
This part covers Getting to Know Your ZyWALL and Hardware Installation.
I
ZyWALL 2 and ZyWALL 2WE
Chapter 1
Getting to Know Your ZyWALL
This chapter introduces the main features and applications of the ZyWALL.
1.1 Introducing the ZyWALL 2/2WE Internet Security Gateway
The ZyWALL 2 and 2WE (Wireless LAN Embedded) are ideal secure gateways for all data passing between the Internet and the LAN. By integrating NAT, firewall and VPN capability, ZyXEL’s ZyWALL 2/2WE is a complete security solution that protects your Intranet and efficiently manages data traffic on your network. The ZyWALL 2WE has a built in wireless LAN that makes it easy for computers with IEEE 802.11b wireless LAN cards to connect to the network and the Internet. The embedded web configurator is easy to operate and totally independent of your operating system platform.
1.2 Features
Here is a list of the ZyWALL’s key features.
1.2.1 Physical Features
4-Port Switch
A combination of switch and router makes your ZyWALL a cost-effective and viable network solution. You can connect up to four computers to the ZyWALL without the cost of a hub. Use a hub to add more than four computers to your LAN.
Auto-negotiating 10/100 Mbps Ethernet LAN
The LAN interfaces automatically detect if they are on a 10 or a 100 Mbps Ethernet.
Auto-sensing 10/100 Mbps Ethernet LAN
The LAN interfaces automatically adjust to either a crossover or straight-through Ethernet cable.
Auto-negotiating 10/100 Mbps Ethernet WAN
The 10/100 Mbps Ethernet WAN port attaches to the Internet via broadband modem or router and automatically detects if it’s on a 10 or a 100 Mbps Ethernet.
Getting to Know Your ZyWALL 1-1
ZyWALL 2 and ZyWALL 2WE
Auxiliary Port
The ZyWALL 2 and 2WE use the same port for console management and for an auxiliary WAN backup. The AUX port can be used in reserve as a traditional dial-up connection when/if ever the broadband connection to the WAN port fails.
1
Time and Date
The ZyWALL allows you to get the current time and date from an external server when you turn on your ZyWALL. You can also set the time manually.
Reset Button
The ZyWALL reset button is built into the rear panel. Use this button to restore the factory default password to 1234; IP address to 192.168.1.1, subnet mask to 255.255.255.0 and DHCP server enabled with a pool of 32 IP addresses starting at 192.168.1.33.
IEEE 802.11b 11 Mbps Wireless LAN
The ZyWALL 2WE has an internal 11 Mbps wireless LAN card that provides mobility and a fast network environment for small and home offices. You can connect to the local area network without any wiring efforts and enjoy reliable high-speed connectivity.
1.2.2 Non-Physical Features
IPSec VPN Capability
Establish Virtual Private Network (VPN) tunnels to connect (home) office computers to your company network using data encryption and the Internet; thus providing secure communications without the expense of leased site-to-site lines. The ZyWALL VPN is based on the IPSec standard and is fully interoperable with other IPSec-based VPN products.
The ZyWALL supports two simultaneous VPN connections.
Firewall
The ZyWALL has a stateful inspection firewall with DoS (Denial of Service) protection. By default, when the firewall is activated, all incoming traffic from the WAN to the LAN is blocked unless it is initiated from the LAN. The ZyWALL firewall supports TCP/UDP inspection, DoS detection and protection, real time alerts, reports and logs.
EAP (RFC2284)
The ZyWALL 2WE uses EAP (Extensible Authentication Protocol). EAP supports multiple authentication methods to ensure the highest security level available.
1
The auxiliary port function was not available at the time of writing.
1-2 Getting to Know Your ZyWALL
ZyWALL 2 and ZyWALL 2WE
RADIUS (RFC2138, 2139)
The ZyWALL 2WE uses RADIUS (Remote Authentication Dial In User Service) to have a server handle authentication, authorization and accounting for your wireless network.
IEEE 802.1x for Network Security
The ZyWALL 2WE supports the IEEE 802.1x standard that works with the IEEE 802.11 to enhance user authentication. With the local user profile, the ZyWALL allows you to configure up to 32 user profiles without a network authentication server. In addition, centralized user and accounting management is possible on an optional network authentication server.
Wireless LAN MAC Address Filtering
The ZyWALL 2WE allows you to use MAC Address Filtering together with ESSID (Extended Service Set IDentifier) and WEP (Wired Equivalent Privacy) to provide security for your wireless LAN.
Brute-Force Password Guessing Protection
The ZyWALL has a special protection mechanism to discourage brute-force password guessing attacks on the ZyWALL’s management interfaces. You can specify a wait-time that must expire before entering a fourth password after three incorrect passwords have been entered. Please see the appendices for details about this feature.
Content Filtering
The ZyWALL can block web features such as ActiveX controls, Java applets and cookies, as well as disable web proxies. The ZyWALL can block specific URLs by using the keyword feature. It also allows the administrator to define time periods and days during which content filtering is enabled.
Packet Filtering
The packet filtering mechanism blocks unwanted traffic from entering/leaving your network.
Universal Plug and Play (UPnP)
Using the standard TCP/IP protocol, the ZyWALL and other UPnP enabled devices can dynamically join a network, obtain an IP address and convey its capabilities to other devices on the network.
Call Scheduling
Configure call time periods to restrict and allow access for users on remote nodes.
PPPoE
PPPoE facilitates the interaction of a host with an Internet modem to achieve access to high-speed data networks via a familiar "dial-up networking" user interface.
PPTP Encapsulation
Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables secure transfer of data from a remote client to a private server, creating a Virtual Private Network (VPN) using a TCP/IP-based network.
Getting to Know Your ZyWALL 1-3
ZyWALL 2 and ZyWALL 2WE
PPTP supports on-demand, multi-protocol and virtual private networking over public networks, such as the Internet. The ZyWALL supports one PPTP server connection at any given time.
Dynamic DNS Support
With Dynamic DNS (Domain Name System) support, you can have a static hostname alias for a dynamic IP address, allowing the host to be more easily accessible from various locations on the Internet. You must register for this service with a Dynamic DNS service provider.
IP Multicast
Deliver IP packets to a specific group of hosts using IP multicast. IGMP (Internet Group Management Protocol) is the protocol used to support multicast groups. The latest version is version 2 (see RFC 2236); the ZyWALL supports both versions 1 and 2.
IP Alias
IP Alias allows you to partition a physical network into logical networks over the same Ethernet interface. The ZyWALL supports three logical LAN interfaces via its single physical Ethernet LAN interface with the ZyWALL itself as the gateway for each LAN network.
Central Network Management
Central Network Management (CNM) allows an enterprise or service provider network administrator to manage your ZyWALL. The enterprise or service provider network administrator can configure your ZyWALL, perform firmware upgrades and do troubleshooting for you.
SNMP
SNMP (Simple Network Management Protocol) is a protocol used for exchanging management information between network devices. SNMP is a member of the TCP/IP protocol suite. Your ZyWALL supports SNMP agent functionality, which allows a manager station to manage and monitor the ZyWALL through the network. The ZyWALL supports SNMP version one (SNMPv1).
Network Address Translation (NAT)
NAT (Network Address Translation - NAT, RFC 1631) allows the translation of multiple IP addresses used within one network to different IP addresses known within another network.
Traffic Redirect
Traffic Redirect forwards WAN traffic to a backup gateway when the ZyWALL cannot connect to the Internet, thus acting as an auxiliary backup when your regular WAN connection fails.
Port Forwarding
Use this feature to forward incoming service requests to a server on your local network. You may enter a single port number or a range of port numbers to be forwarded, and the local IP address of the desired server.
1-4 Getting to Know Your ZyWALL
ZyWALL 2 and ZyWALL 2WE
DHCP (Dynamic Host Configuration Protocol)
DHCP (Dynamic Host Configuration Protocol) allows the individual client computers to obtain the TCP/IP configuration at start-up from a centralized DHCP server. The ZyWALL has built-in DHCP server capability, enabled by default, which means it can assign IP addresses, an IP default gateway and DNS servers to all systems that support the DHCP client. The ZyWALL can also act as a surrogate DHCP server (DHCP Relay) where it relays IP address assignment from another DHCP server to the clients.
Full Network Management
The embedded web configurator is an all-platform web-based utility that allows you to easily access the ZyWALL’s management settings and configure the firewall. The ZyWALL also provides the SMT (System Management Terminal) interface. The SMT is a menu-driven interface that you can access from a terminal emulator through the console port or over a telnet connection.
RoadRunner Support
In addition to standard cable modem services, the ZyWALL supports Time Warner’s RoadRunner Service.
Logging and Tracing
♦ Built-in message logging and packet tracing. ♦ Unix syslog facility support. ♦ Firewall logs. ♦ Content filtering logs.
Upgrade ZyWALL Firmware
The firmware of the ZyWALL can be upgraded via the console port or the LAN.
Embedded FTP and TFTP Servers
The ZyWALL’s embedded FTP and TFTP Servers enable fast firmware upgrades as well as configuration file backups and restoration.
1.3 Applications for the ZyWALL
1.3.1 Secure Broadband Internet Access and VPN
You can connect a cable, DSL or wireless modem to the ZyWALL via Ethernet for broadband Internet access. The ZyWALL also provides IP address sharing and a firewall-protected local network with traffic management. ZyWALL VPN is an ideal cost-effective way to connect branch offices and business partners over the Internet without the need (and expense) of leased lines between sites. Two of the LAN computers can use VPN tunnels for secure connections to remote computers.
Getting to Know Your ZyWALL 1-5
ZyWALL 2 and ZyWALL 2WE
Figure 1-1 Secure Internet Access and VPN Application
1.3.2 Wireless LAN Application
The ZyWALL 2WE is an ideal access solution for wireless Internet connections for a small office or home environment. A typical Internet access application is shown next.
Figure 1-2 ZyWALL 2WE Wireless LAN Application
1-6 Getting to Know Your ZyWALL
ZyWALL 2 and ZyWALL 2WE
Chapter 2
Hardware Installation
This chapter explains the LEDs and ports as well as how to connect the hardware. The wireless
LAN information applies to the ZyWALL 2WE only.
2.1 Introduction to Hardware Installation
This chapter provides graphics of the front and rear panels, descriptions of the ZyWALL’s front panel LEDs and hardware connection instructions.
2.2 Front Panels LEDs
The LEDs on the front panel indicate the operational status of the ZyWALL.
Figure 2-1 ZyWALL 2WE Front Panel
Hardware Installation 2-1
ZyWALL 2 and ZyWALL 2WE
Figure 2-2 ZyWALL 2 Front Panel
2.3 LED Descriptions
The following table describes the LED functions. The SYS and WLAN LEDs apply to the ZyWALL 2WE.
Table 2-1 LED Descriptions
LED STATUS LED DESCRIPTION
PWR Green Light on
Light flashing Green Light off
SYS Green Light on
Light flashing Red Light on
LAN 10/100M 1-4
WAN Green light
CON/AUX Green light
WLAN Light on
Green light Orange light Both lights off Light flashing
Orange light Light off Light flashing
Orange light
Light off Light flashing
Light off Light flashing
The ZyWALL is on and receiving power. The ZyWALL is performing a self-test. The ZyWALL is not receiving power.
The ZyWALL is ready. The ZyWALL is performing a self-test. The ZyWALL is experiencing low voltage.
The ZyWALL has a LAN connection of 10Mbps. The ZyWALL has a LAN connection of 100Mbps. The ZyWALL does not have an Ethernet connection. The ZyWALL is sending/receiving packets.
The WAN link is connected at 10Mbps. The WAN link is connected at 100Mbps. The WAN link is not ready, or has failed. The WAN link is sending/receiving packets.
The CON/AUX switch is set to CON, the CON/AUX port is connected to a management computer and someone is logged into the ZyWALL. The CON/AUX switch is set to AUX and the CON/AUX port has an Internet connection through a dial-up modem. The CON/AUX link is not ready, or has failed. The CON/AUX switch is set to AUX and the CON/AUX port is sending or receiving data through a dial-up modem or ISDN TA.
The Wireless LAN feature is enabled. The Wireless LAN link is not ready, or has failed. The Wireless LAN link is sending/receiving packets.
2-2 Hardware Installation
2.4 ZyWALL Rear Panels and Connections
The following figure shows the rear panels of the ZyWALL.
ZyWALL 2 and ZyWALL 2WE
Figure 2-3 ZyWALL 2WE Rear Panel
Figure 2-4 ZyWALL 2 Rear Panel
2.5 Hardware Connections
This section outlines how to connect your ZyWALL. If you want to connect a cable modem, you must connect the coaxial cable from your cable service to the threaded coaxial cable connector on the back of the
Hardware Installation 2-3
ZyWALL 2 and ZyWALL 2WE
cable modem. Connect a DSL modem to the DSL wall jack. See the Safety Warnings and Instructions Appendix for safety instructions when making connections to the ZyWALL.
2.5.1 Connecting a Broadband Modem to the WAN Port
You need a cable/DSL/wireless modem and an ISP account.
Connecting the ZyWALL to a cable modem:
Connect the port labeled WAN on the ZyWALL to the Ethernet port on the cable modem using the Ethernet cable that came with your cable modem. The Ethernet port on a cable modem is sometimes labeled "PC" or "Workstation".
Connecting the ZyWALL to a DSL modem:
Connect the port labeled WAN on the ZyWALL to the Ethernet port on the DSL modem using the Ethernet cable that came with your DSL modem.
Connecting the ZyWALL to a wireless modem:
Connect the port labeled WAN on the ZyWALL to the Ethernet port on the wireless modem using the Ethernet cable that came with your wireless modem.
2.5.2 Connecting the Console Port
Use terminal emulator software on a computer for configuring your ZyWALL via console port. Connect the 9-pin male end of the console cable to the port labeled CON/AUX on the ZyWALL and push the CON/AUX switch to CON. Connect the other end to a serial port (COM1, COM2 or other COM port) on your computer. You can use an extension console cable if the enclosed one is not long enough.
2.5.3 Connecting the AUX Port
The console port is also the auxiliary WAN port. Push the CON/AUX switch to AUX and use the included CON/AUX converter with the console cable to connect the CON/AUX port to your modem or TA.
2.5.4 LAN 10/100M Ports
You can connect up to four computers with Ethernet cards directly to the ZyWALL’s LAN ports. For each computer, connect a 10/100M LAN port on the ZyWALL to the Ethernet card on the computer using an Ethernet cable. If you want to connect more than four computers to your ZyWALL, you must use an external hub. Connect a 10/100M LAN port on the ZyWALL to a port on the hub using an Ethernet cable.
When the ZyWALL is on and properly connected to a computer or a hub, the
corresponding LAN LED on the front panel turns on.
2.5.5 Connecting the Power to your ZyWALL
Connect the included power adaptor to the socket labeled POWER on the rear panel of your ZyWALL.
2-4 Hardware Installation
ZyWALL 2 and ZyWALL 2WE
2.5.6 Antennas
The ZyWALL 2WE is equipped with two reverse SMA connectors and two detachable omni-directional 2dBi antennas to provide a clear radio signal between the wireless stations and the access points. Refer to the Antennas appendix for more information. The following table shows the ZyWALL’s coverage (in meters) using the included antennas. The distance may differ depending on the network environment.
Table 2-2 ZyWALL Wireless LAN Coverage
≤11 Mbps ≤ 5.5 Mbps
Indoor
Outdoor
50 m 80 m
200 m 300 m
2.6 Hardware Mounting Options
The ZyWALL may be placed on a flat surface or wall-mounted. In general, the best location to place the access point is at the center of your intended wireless coverage area. For better performance, mount the ZyWALL in a high position free of obstructions.
To keep the ZyWALL operating at optimal internal temperature, keep the bottom,
sides and rear clear of obstructions and away from the exhaust of other
equipment.
2.7 Additional Installation Requirements for Using 802.1x
1. A computer with an IEEE 802.11b wireless LAN card.
2. A computer equipped with a web browser (with JavaScript enabled) and/or Telnet.
3. A wireless client computer must be running IEEE 802.1x-compliant software. Currently, this is offered in Windows XP.
4. An optional network RADIUS server for remote user authentication and accounting.
2.8 Turning On Your ZyWALL
At this point, you should have connected the console port, the LAN port, the WAN port, the Wireless LAN port and the power port to the appropriate devices or lines. Plug the power cord or power adaptor into an appropriate power source. For models that have a power switch, push the power switch to the on position. The PWR LED turns on. The PWR LED (ZyWALL 2) or the SYS LED (ZyWALL 2WE) blinks while the ZyWALL performs system testing and then stays on if the testing is successful. The WAN LED, WLAN LED and one of the LAN LEDs turn on immediately after the PWR or SYS LED stops blinking and stays on, if connections have been made to the LAN and WAN ports.
Hardware Installation 2-5
Initial Setup and Configuration
Part II:
Initial Setup and Configuration
This part covers Introducing the Web Configurator, Introducing the SMT, SMT Menu 1 General
Setup, WAN Setup, LAN Setup, Wireless LAN Security and Internet Access.
II
ZyWALL 2 and ZyWALL 2WE
Chapter 3
Introducing the Web Configurator
This chapter describes how to access and navigate the ZyWALL web configurator.
3.1 Introduction to the Web Configurator
The embedded web configurator is easy to navigate and use to configure the ZyWALL. The web configurator is independent of the operating system platform you use. Use the directions in this chapter in order to access and navigate the web configurator.
3.2 Accessing the ZyWALL Web Configurator
Step 1. Make sure your ZyWALL hardware is properly connected (refer to instructions in the
Hardware Installation chapter).
Step 2. Prepare your computer/computer network to connect to the ZyWALL (refer to the Quick Start
Guide).
Step 3. Launch your web browser. Step 4. Type "192.168.1.1" as the URL. Step 5. Type "1234" (default) as the password and click Login. In some versions, the default password
appears automatically - if this is the case, click Login.
Step 6. You should see a screen asking you to change your password (highly recommended) as shown
next. Type a new password (and retype it to confirm) and click Apply or click Ignore.
Figure 3-1 Change Password Screen
Step 7. You should now see the MAIN MENU screen.
ZyWALL 2 and ZyWALL 2WE
The ZyWALL automatically times out after five minutes of inactivity. Simply log
back into the ZyWALL if this happens to you.
3.3 Web Configurator Navigation
Click a link on the navigation panel on the left to open a screen or a submenu.
Click WIZARD SETUP for initial configuration including general setup, ISP parameters for Internet Access and WAN IP/DNS Server/MAC address assignment.
Use submenus to configure ZyWALL features.
Click MAINTENANCE to view information about your ZyWALL or
Click LOGOUT at any time to exit the web configurator.
upgrade configuration/firmware files. Maintenance includes SYSTEM
STATUS (Statistics), DHCP TABLE, F/W (firmware) UPGRADE and CONFIGURATION (Backup, Restore Default).
Figure 3-2 Web Configurator Main Menu
The rest of this User’s Guide shows you how to configure the SMT menus except where no SMT menus exist for certain features such as UPnP and the firewall. For web configurator screens that have SMT menu equivalents, read this guide for background information, but refer to the web screen online help for actual screen configuration.
3-2 Introducing the Web Configurator
ZyWALL 2 and ZyWALL 2WE
Chapter 4
Introducing the SMT
This chapter explains how to perform the initial ZyWALL setup and gives an overview of SMT
menus.
4.1 Introduction to the SMT
The ZyWALL’s SMT (System Management Terminal) is a menu-driven interface that you can access from a terminal emulator through the console port or over a telnet connection. This chapter shows you how to access the SMT (System Management Terminal) menus via console port, how to navigate the SMT and how to configure SMT menus.
4.2 Accessing the Console Port via the Console Port
Make sure you have the physical connection properly set up as described in the hardware installation chapter. In addition to the contents of your package, you need a computer equipped with communications software configured to the following parameters:
♦ VT100 terminal emulation. ♦ 9600 Baud. ♦ No parity, 8 data bits, 1 stop bit, flow control set to none.
4.2.1 Initial Screen
When you turn on your ZyWALL, it performs several internal tests as well as line initialization. After the tests, the ZyWALL asks you to press [ENTER] to continue, as shown next.
Copyright (c) 1994 - 2002 ZyXEL Communications Corp. initialize ch =0, ethernet address: 00:a0:c5:41:51:61 initialize ch =1, ethernet address: 00:a0:c5:41:51:62 Press ENTER to continue...
Figure 4-1 Initial Screen
4.2.2 Entering the Password
The login screen appears after you press [ENTER], prompting you to enter the password, as shown below. For your first login, enter the default password “1234”. As you type the password, the screen displays an “X” for each character you type.
ZyWALL 2 and ZyWALL 2WE
Please note that if there is no activity for longer than five minutes after you log in, your ZyWALL automatically logs you out and displays a blank screen. If you see a blank screen, press [ENTER] to bring up the login screen again.
Enter Password : XXXX
Figure 4-2 Password Screen
4.3 Navigating the SMT Interface
The SMT (System Management Terminal) is the interface that you use to configure your ZyWALL. Several operations that you should be familiar with before you attempt to modify the configuration are listed in the table below.
OPERATION DESCRIPTION
Move down to another menu
Move up to a previous menu
Move to a “hidden” menu
Move the cursor Within a menu, press [ENTER] to move to the next field. You can also use the
Entering information
Required fields All fields with the symbol <?> or ChangeMe must be filled in order be able to save the new
N/A fields Some of the fields in the SMT will show a <N/A>. This symbol refers to an option that is
Save your configuration
Exit the SMT Type 99 at the main menu prompt and press [ENTER] to exit the SMT interface.
To move forward to a submenu, type in the number of the desired submenu and press [ENTER].
Press the [ESC] key to move back to the previous menu.
Fields beginning with “Edit” lead to hidden menus and have a default setting of No. Press [SPACE BAR] to change No to Yes, and then press [ENTER] to go to a “hidden” menu.
[UP]/[DOWN] arrow keys to move to the previous and the next field, respectively.
You need to fill in two types of fields. The first requires you to type in the appropriate information. The second allows you to cycle through the available choices by pressing [SPACE BAR], and then pressing [ENTER] to select your choice and move to the next field.
configuration.
Not Applicable.
Save your configuration by pressing [ENTER] at the message “Press ENTER to confirm or ESC to cancel”. Saving the data on the screen will take you, in most cases to the previous menu.
4-2 Introducing the SMT
ZyWALL 2 and ZyWALL 2WE
4.3.1 Main Menu
After you enter the password, the SMT displays the ZyWALL Main Menu, as shown next.
ZyWALL 2WE Main Menu
Getting Started Advanced Management
1. General Setup
2. WAN Setup
3. LAN Setup
4. Internet Access Setup
Advanced Applications
11. Remote Node Setup
12. Static Routing Setup
15. NAT Setup
Enter Menu Selection Number:
Copyright (c) 1994 - 2001 ZyXEL Communications Corp.
21. Filter and Firewall Setup
22. SNMP Configuration
23. System Password
24. System Maintenance
26. Schedule Setup
27. VPN/IPSec Setup
99. Exit
Figure 4-3 Main Menu (ZyWALL 2WE)
4.3.2 System Management Terminal Interface Summary
Table 4-1 Main Menu Summary
NO. MENU TITLE FUNCTION
1 General Setup Use this menu to set up dynamic DNS and administrative information.
2 WAN Setup Use this menu to clone a MAC address from a computer on your LAN.
3 LAN Setup Use this menu to apply LAN filters, configure LAN DHCP and TCP/IP
settings and configure the wireless LAN port (not available on all models).
4 Internet Access Setup Configure your Internet Access setup (Internet address, gateway, login,
etc.) with this menu.
11 Remote Node Setup Use this menu to configure detailed remote node settings (your ISP is
also a remote node) as well as apply WAN filters.
12 Static Routing Setup Configure IP static routes in this menu.
15 NAT Setup Use this menu to configure Network Address Translation.
21 Filter and Firewall Setup Configure filters, activate/deactivate the firewall and view the firewall log.
22 SNMP Configuration Use this menu to configure SNMP-related parameters.
ZyWALL 2 and ZyWALL 2WE
Table 4-1 Main Menu Summary
NO. MENU TITLE FUNCTION
23 System Password Change your password in this menu (recommended).
24 System Maintenance From displaying system status to uploading firmware, this menu provides
comprehensive system maintenance.
26 Schedule Setup Use this menu to schedule outgoing calls.
27 VPN /IPSec Setup Use this menu to configure VPN connections.
99 Exit Use this menu to exit (necessary for remote configuration).
4.3.3 SMT Menus at a Glance
The available SMT screens vary by ZyWALL model. The wireless LAN SMT menus apply to the ZyWALL 2WE.
4-4 Introducing the SMT
ZyWALL 2 and ZyWALL 2WE
Figure 4-4 Getting Started and Advanced Applications SMT Menus (ZyWALL 2WE)
ZyWALL 2 and ZyWALL 2WE
Figure 4-5 Advanced Management SMT Menus
4-6 Introducing the SMT
ZyWALL 2 and ZyWALL 2WE
Figure 4-6 Schedule Setup and IPSec VPN Configuration SMT Menus
4.4 Changing the System Password
Change the default system password by following the steps shown next. Step 1. Enter 23 in the main menu to open Menu 23 - System Password as shown next.
Menu 23 - System Password
Old Password= ? New Password= ? Retype to confirm= ?
Enter here to CONFIRM or ESC to CANCEL:
Figure 4-7 Menu 23: System Password
Step 2. Type your existing password and press [ENTER]. Step 3. Type your new system password and press [ENTER]. Step 4. Re-type your new system password for confirmation and press [ENTER].
Note that as you type a password, the screen displays an “X” for each character you type.
ZyWALL 2 and ZyWALL 2WE
4.5 Resetting the ZyWALL
If you forget your password or cannot access the SMT menu, you will need to reload the factory-default configuration file or use the RESET button the back of the ZyWALL. Uploading this configuration file replaces the current configuration file with the factory-default configuration file. This means that you will lose all configurations that you had previously and the speed of the console port will be reset to the default of 9600bps with 8 data bit, no parity, one stop bit and flow control set to none. The password will be reset to “1234”, also.
4.5.1 Uploading a Configuration File Via Console Port
Step 1. Download the default configuration file from the ZyXEL FTP site, unzip it and save it in a folder.
Step 2. Turn off the ZyWALL, begin a terminal emulation software session and turn on the ZyWALL
again. When you see the message "Press Any key to enter Debug Mode within 3 seconds", press any key to enter debug mode.
Step 3. Enter "y" at the prompt below to go into debug mode.
Step 4. Enter "atlc" after "Enter Debug Mode" message.
Step 5. Wait for "Starting XMODEM upload" message before activating Xmodem upload on your
terminal. This is an example Xmodem configuration upload using HyperTerminal.
Step 6. Click Transfer, then Send File to display the following screen.
Type the configuration file’s location, or click Browse to search for it.
Choose the Xmodem protocol.
Then click Send.
Figure 4-8 Example Xmodem Upload
Step 7. After successful firmware upload, enter "atgo" to restart the router.
4-8 Introducing the SMT
ZyWALL 2 and ZyWALL 2WE
4.5.2 Procedure To Use The Reset Button
Make sure the PWR LED (ZyWALL 2) or SYS LED (ZyWALL 2WE) is on (not blinking) before you begin this procedure.
Step 1. Press the RESET button for ten seconds, and then release it. If the SYS LED begins to blink, the
defaults have been restored and the ZyWALL restarts. Otherwise, go to step 2.
Step 2. Turn the ZyWALL off.
Step 3. While pressing the RESET button, turn the ZyWALL on.
Step 4. Continue to hold the RESET button. The SYS LED will begin to blink and flicker very quickly
after about 10 or 15 seconds. This indicates that the defaults have been restored and the ZyWALL is now restarting.
Step 5. Release the RESET button and wait for the ZyWALL to finish restarting.
ZyWALL 2 and ZyWALL 2WE
Chapter 5
SMT Menu 1 - General Setup
Menu 1 - General Setup contains administrative and system-related information.
5.1 Introduction to General Setup
Menu 1 - General Setup contains administrative and system-related information. Use the instructions in this chapter to configure identification and dynamic DNS for your ZyWALL.
5.2 System Name
System Name is for identification purposes. ZyXEL recommends you enter your computer’s “Computer name”.
• In Windows 95/98 click Start -> Settings -> Control Panel and then double-click Network. Click
the Identification tab, note the entry for the Computer name field and enter it in the ZyWALL System Name field.
• In Windows 2000 click Start->Settings->Control Panel and then double-click System. Click the
Network Identification tab and then the Properties button. Note the entry for the Computer name field and enter it in the ZyWALL System Name field.
• In Windows XP, click start -> My Computer -> View system information and then click the
Computer Name tab. Note the entry in the Full computer name field and enter it as the ZyWALL System Name.
The Domain Name entry is what is propagated to the DHCP clients on the LAN. If you leave this field blank, the domain name obtained by DHCP from the ISP is used. While you must enter the host name (System Name) on each individual machine, the domain name can be assigned from the ZyWALL via DHCP.
5.3 Dynamic DNS
Dynamic DNS (Domain Name System) allows you to update your current dynamic IP address with one or many dynamic DNS services so that anyone can contact you (in NetMeeting, CU-SeeMe or other services). You can also access your FTP server or Web site on your own computer using a DNS-like address (for example, myhost.dhs.org, where myhost is a name of your choice) that will never change instead of using an IP address that changes each time you reconnect. Your friends or relatives will always be able to call you even if they don’t know your IP address. First of all, you need to have registered a dynamic DNS account with www.dyndns.org. This is for people with a dynamic IP from their ISP or DHCP server that would still like to have a DNS name.
SMT Menu 1 – General Setup 5-1
ZyWALL 2 and ZyWALL 2WE
To use this service, you must register with the Dynamic DNS service provider. The Dynamic DNS service provider will give you a password or key. The ZyWALL supports www.dyndns.org. You can apply to this service provider for Dynamic DNS service.
5.3.1 DYNDNS Wildcard
Enabling the wildcard feature for your host causes *.yourhost.dyndns.org to be aliased to the same IP address as yourhost.dyndns.org. This feature is useful if you want to be able to use for example, www.yourhost.dyndns.org and still reach your hostname.
5.4 General Setup
Step 1. Enter 1 in the main menu to open Menu 1: General Setup. Step 2. The Menu 1 - General Setup screen appears, as shown next. Fill in the required fields.
Menu 1 - General Setup
System Name= ZyWALL Domain Name=zyxel.com.tw Edit Dynamic DNS= No
Press ENTER to Confirm or ESC to Cancel:
Figure 5-1 Menu 1: General Setup
Table 5-1 General Setup Menu Field
FIELD DESCRIPTION EXAMPLE
System Name Choose a descriptive name for identification purposes. It is
recommended you enter your computer’s “Computer name” (see section 5.1) in this field. This name can be up to 30 alphanumeric characters long. Spaces are not allowed, but dashes “-” and underscores "_" are accepted.
Domain Name Enter the domain name (if you know it) here. If you leave this field
blank, the ISP may assign a domain name via DHCP. You can go to menu 24.8 and type "sys domain name" to see the current domain name used by your router.
The domain name entered by you is given priority over the ISP assigned domain name. If you want to clear this field just press [SPACE BAR] and then [ENTER].
Edit Dynamic DNS
Press [SPACE BAR] and then [ENTER] to select Yes or No (default). Select Yes to configure Menu 1.1: Configure Dynamic DNS discussed next.
ZyWALL
zyxel.com.tw
No
(default)
5-2 SMT Menu 1 – General Setup
ZyWALL 2 and ZyWALL 2WE
Table 5-1 General Setup Menu Field
FIELD DESCRIPTION EXAMPLE
When you have completed this menu, press [ENTER] at the prompt “Press ENTER to Confirm…” to save your configuration, or press [ESC] at any time to cancel.
5.4.1 Configuring Dynamic DNS
To configure Dynamic DNS, go to Menu 1: General Setup and press [SPACE BAR] to select Yes in the Edit Dynamic DNS field. Press [ENTER] to display Menu 1.1— Configure Dynamic DNS (shown next).
Menu 1.1 - Configure Dynamic DNS
Service Provider= WWW.DynDNS.ORG Active= Yes DDNSType= DynamicDNS Host1= Host2= Host3= EMAIL= USER= Password= ******** Enable Wildcard= No Offline= N/A Edit Update IP Address: Use Server Detected IP= Yes User Specified IP Addr=No IP Address=N/A
Press ENTER to confirm or ESC to cancel:
Figure 5-2 Configure Dynamic DNS
Follow the instructions in the next table to configure Dynamic DNS parameters.
Table 5-2 Configure Dynamic DNS Menu Fields
FIELD DESCRIPTION EXAMPLE
Service Provider This is the name of your Dynamic DNS service provider. WWW.DynDNS.ORG
(default)
Active
Press [SPACE BAR] to select Yes and then press [ENTER] to
Yes
make dynamic DNS active.
SMT Menu 1 – General Setup 5-3
ZyWALL 2 and ZyWALL 2WE
Table 5-2 Configure Dynamic DNS Menu Fields
FIELD DESCRIPTION EXAMPLE
DDNS Type
Host1-3 Enter your host name(s) in the fields provided. You can specify
EMAIL Enter your e-mail address. mail@mailserver
USER Enter your user name.
Password Enter the password assigned to you.
Enable Wildcard Your ZyWALL supports DYNDNS Wildcard. Press [SPACE BAR]
Offline
Edit Update IP Address:
You can select Yes in either the Use Server Detected IP field (recommended) or the User Specified IP Addr field, but not both.
With the Use Server Detected IP and User Specified IP Addr fields both set to No, the DDNS server automatically updates the IP address of the host name(s) with the ZyWALL’s WAN IP address.
DDNS does not work with a private IP address. When both fields are set to No, the ZyWALL must have a public WAN IP address in order for DDNS to work.
Use Server Detected IP
Press [SPACE BAR] and then [ENTER] to select DynamicDNS if you have a dynamic IP address(es). Select StaticDNS if you have a static IP address(s).
Select CustomDNS to have dyns.org provide DNS service for a domain name that you already have from a source other than dyndns.org.
up to two host names separated by a comma in each field.
and then [ENTER] to select Yes or No This field is N/A when you choose DDNS client as your service provider.
This field is only available when CustomDNS is selected in the DDNS Type field. Press [SPACE BAR] and then [ENTER] to select Yes. When Yes is selected, traffic is redirected to a URL that you have previously specified (see www.dyndns.org for details).
Press [SPACE BAR] to select Yes and then press [ENTER] to have the DDNS server automatically update the IP address of the host name(s) with the public IP address that the ZyWALL uses or is behind.
You can set this field to Yes whether the IP address is public or private, static or dynamic.
DynamicDNS
(default)
me.dyndns.org
No
Yes
Yes
5-4 SMT Menu 1 – General Setup
ZyWALL 2 and ZyWALL 2WE
Table 5-2 Configure Dynamic DNS Menu Fields
FIELD DESCRIPTION EXAMPLE
Press [SPACE BAR] to select Yes and then press [ENTER] to
User Specified IP Addr
IP Address
When you have completed this menu, press [ENTER] at the prompt “Press ENTER to Confirm…” to save your configuration, or press [ESC] at any time to cancel.
update the IP address of the host name(s) to the IP address specified below.
Only select Yes if the ZyWALL uses or is behind a static public IP address.
Enter the static public IP address if you select Yes in the User
Specified IP Addr field.
No
N/A
The IP address updates when you reconfigure menu 1 or perform DHCP client renewal.
SMT Menu 1 – General Setup 5-5
ZyWALL 2 and ZyWALL 2WE
Chapter 6
WAN Setup
This chapter describes how to configure the WAN using menu 2.
6.1 Introduction to WAN Setup
This chapter explains how to configure settings for your WAN port.
6.2 Cloning The MAC Address
The MAC address field allows users to configure the WAN port's MAC address by using either the factory default or cloning the MAC address from a computer on your LAN. Once it is successfully configured, the address will be copied to the rom file (ZyNOS configuration file). It will not change unless you change the setting in menu 2 or upload a different rom file.
ZyXEL recommends that you clone the MAC address of a computer on your LAN
even if your ISP does not require MAC address authentication.
6.3 WAN Setup
From the main menu, enter 2 to open menu 2.
Menu 2 - WAN Setup
MAC Address: Assigned By= Factory default IP Address= N/A
Figure 6-1 MAC Address Cloning in WAN Setup
The following table contains instructions on how to configure your WAN setup.
WAN Setup 6-1
ZyWALL 2 and ZyWALL 2WE
Table 6-1 MAC Address Cloning in WAN Setup
FIELD DESCRIPTION EXAMPLE
MAC Address:
Assigned By Press [SPACE BAR] and then [ENTER] to choose one of two methods
to assign a MAC Address. Choose Factory Default to select the factory assigned default MAC Address. Choose IP address attached on LAN to use the MAC Address of that workstation whose IP you give in the following field.
IP Address
When you have completed this menu, press [ENTER] at the prompt “Press ENTER to Confirm…” to save your configuration, or press [ESC] at any time to cancel.
This field is applicable only if you choose the IP address attached on LAN method in the Assigned By field. Enter the IP address of the computer on the LAN whose MAC you are cloning.
IP address
attached on
LAN
192.168.1.35
6-2 WAN Setup
ZyWALL 2 and ZyWALL 2WE
Chapter 7
LAN Setup
This chapter describes how to configure the LAN using Menu 3: LAN Setup.
7.1 Introduction to LAN Setup
This chapter describes how to configure the ZyWALL for LAN and wireless LAN connections.
7.2 Accessing the LAN Menus
From the main menu, enter 3 to open Menu 3 – LAN Setup.
Menu 3 - LAN Setup
1. LAN Port Filter Setup
2. TCP/IP and DHCP Setup
5. Wireless LAN Setup
Enter Menu Selection Number:
Figure 7-1 Menu 3: LAN Setup
7.3 LAN Port Filter Setup
This menu allows you to specify the filter sets that you wish to apply to the LAN traffic. You seldom need to filter the LAN traffic, however, the filter sets may be useful to block certain packets, reduce traffic and prevent security breaches.
LAN Setup 7-1
ZyWALL 2 and ZyWALL 2WE
Menu 3.1 – LAN Port Filter Setup
Input Filter Sets:
protocol filters= device filters= Output Filter Sets: protocol filters= device filters=
Press ENTER to Confirm or ESC to Cancel:
Figure 7-2 Menu 3.1: LAN Port Filter Setup
7.4 TCP/IP and LAN DHCP
The ZyWALL has built-in DHCP server capability that assigns IP addresses and DNS servers to systems that support DHCP client capability.
7.4.1 Factory LAN Defaults
The LAN parameters of the ZyWALL are preset in the factory with the following values:
1. IP address of 192.168.1.1 with subnet mask of 255.255.255.0 (24 bits).
2. DHCP server enabled with 32 client IP addresses starting from 192.168.1.33.
These parameters should work for the majority of installations. If your ISP gives you an explicit DNS server address(es), skip ahead to section 7.5 to see how to enter the DNS server address(es).
7.4.2 DHCP Configuration
DHCP (Dynamic Host Configuration Protocol, RFC 2131 and RFC 2132) allows individual clients to obtain TCP/IP configuration at start-up from a server. You can configure the ZyWALL as a DHCP server or disable it. When configured as a server, the ZyWALL provides the TCP/IP configuration for the clients. If set to None, DHCP service will be disabled and you must have another DHCP server on your LAN, or else the computer must be manually configured.
IP Pool Setup
The ZyWALL is pre-configured with a pool of 32 IP addresses ranging from 192.168.1.33 to 192.168.1.64. This configuration leaves 31 IP addresses (excluding the ZyWALL itself) in the lower range for other server machines, e.g., server for mail, FTP, Telnet, web, etc., that you may have.
DNS Server Address
Use DNS to map a domain name to its corresponding IP address and vice versa, for example, the IP address of www.zyxel.com is 204.217.0.2. The DNS server is extremely important because without it, you must know the IP address of a machine before you can access it.
7-2 LAN Setup
ZyWALL 2 and ZyWALL 2WE
There are two ways that an ISP disseminates the DNS server addresses. The first is for an ISP to tell a customer the DNS server addresses, usually in the form of an information sheet, when you sign up. If your ISP gives you DNS server addresses, enter them in the DNS Server fields in DHCP Setup. The second is to leave this field blank, i.e., 0.0.0.0 — in this case; the ZyWALL acts as a DNS proxy.
Table 7-1 Example Of Network Properties For LAN Servers With Fixed IP Addresses
Choose an IP address 192.168.1.2 - 192.168.1.32; 192.168.1.65 - 192.168.1.254
Subnet mask 255.255.255.0
Gateway (or default route) 192.168.1.1 (ZyWALL LAN IP Address)
7.4.3 IP Address and Subnet Mask
Similar to the way houses on a street share a common street name, so too do machines on a LAN share one common network number. Where you obtain your network number depends on your particular situation. If the ISP or your network administrator assigns you a block of registered IP addresses, follow their instructions in selecting the IP addresses and the subnet mask. If the ISP did not explicitly give you an IP network number, then most likely you have a single user account and the ISP will assign you a dynamic IP address when the connection is established. If this is the case, it is recommended that you select a network number from 192.168.0.0 to 192.168.255.0 and you must enable the Network Address Translation (NAT) feature of the ZyWALL. The Internet Assigned Number Authority (IANA) reserved this block of addresses specifically for private use; please do not use any other number unless you are told otherwise. Let’s say you select 192.168.1.0 as the network number; which covers 254 individual addresses, from 192.168.1.1 to 192.168.1.254 (zero and 255 are reserved). In other words, the first three numbers specify the network number while the last number identifies an individual workstation on that network. Once you have decided on the network number, pick an IP address that is easy to remember, for example192.168.1.1, for your ZyWALL, but make sure that no other device on your network is using that IP address. The subnet mask specifies the network number portion of an IP address. Your ZyWALL will compute the subnet mask automatically based on the IP address that you entered. You don’t need to change the subnet mask computed by the ZyWALL unless you are instructed to do otherwise.
Private IP Addresses
Every computer on the Internet must have a unique IP address. If your networks are isolated from the Internet, for example, only between your two branch offices, you can assign any IP addresses to the hosts without problems. However, the Internet Assigned Numbers Authority (IANA) has reserved the following three blocks of IP addresses specifically for private networks:
LAN Setup 7-3
ZyWALL 2 and ZyWALL 2WE
Table 7-2 Private IP Address Ranges
10.0.0.0 — 10.255.255.255
172.16.0.0 — 172.31.255.255
192.168.0.0 — 192.168.255.255
You can obtain your IP address from the IANA, from an ISP or have it assigned by a private network. If you belong to a small organization and your Internet access is through an ISP, the ISP can provide you with the Internet addresses for your local networks. On the other hand, if you are part of a much larger organization, you should consult your network administrator for the appropriate IP addresses.
Regardless of your particular situation, do not create an arbitrary IP address;
always follow the guidelines above. For more information on address assignment,
please refer to RFC 1597, Address Allocation for Private Internets and RFC 1466,
Guidelines for Management of IP Address Space.
7.4.4 RIP Setup
RIP (Routing Information Protocol, RFC1058 and RFC 1389) allows a router to exchange routing information with other routers. The RIP Direction field controls the sending and receiving of RIP packets. When set to Both or Out Only, the ZyWALL will broadcast its routing table periodically. When set to Both or In Only, it will incorporate the RIP information that it receives; when set to None, it will not send any RIP packets and will ignore any RIP packets received. The Version field controls the format and the broadcasting method of the RIP packets that the ZyWALL sends (it recognizes both formats when receiving). RIP-1 is universally supported; but RIP-2 carries more information. RIP-1 is probably adequate for most networks, unless you have an unusual network topology. Both RIP-2B and RIP-2M sends the routing data in RIP-2 format; the difference being that RIP-2B uses subnet broadcasting while RIP-2M uses multicasting. Multicasting can reduce the load on non-router machines since they generally do not listen to the RIP multicast address and so will not receive the RIP packets. However, if one router uses multicasting, then all routers on your network must use multicasting, also. By default, RIP Direction is set to Both and the Version set to RIP-1.
7.4.5 IP Multicast
Traditionally, IP packets are transmitted in one of either two ways - Unicast (one sender — one recipient) or Broadcast (one sender — everybody on the network). Multicast delivers IP packets to a group of hosts on the network - not everybody and not just one. IGMP (Internet Group Multicast Protocol) is a session-layer protocol used to establish membership in a multicast group - it is not used to carry user data. IGMP version 2 (RFC 2236) is an improvement over version 1 (RFC 1112) but IGMP version 1 is still in wide use. If you would like to read more detailed
7-4 LAN Setup
ZyWALL 2 and ZyWALL 2WE
information about interoperability between IGMP version 2 and version 1, please see sections 4 and 5 of RFC 2236. The class D IP address is used to identify host groups and can be in the range 224.0.0.0 to
239.255.255.255. The address 224.0.0.0 is not assigned to any group and is used by IP multicast computers.
The address 224.0.0.1 is used for query messages and is assigned to the permanent group of all IP hosts (including gateways). All hosts must join the 224.0.0.1 group in order to participate in IGMP. The address
224.0.0.2 is assigned to the multicast routers group.
The ZyWALL supports both IGMP version 1 (IGMP-v1) and IGMP version 2 (IGMP-v2). At start up, the ZyWALL queries all directly connected networks to gather group membership. After that, the ZyWALL periodically updates this information. IP Multicasting can be enabled/disabled on the ZyWALL LAN and/or WAN interfaces using menus 3.2 (LAN) and 11.3 (WAN). Select None to disable IP Multicasting on these interfaces.
7.4.6 IP Alias
IP Alias allows you to partition a physical network into different logical networks over the same Ethernet interface. The ZyWALL supports three logical LAN interfaces via its single physical Ethernet interface with the ZyWALL itself as the gateway for each LAN network. Use menu 3.2.1 to configure IP Alias on your ZyWALL.
Figure 7-3 Physical Network Figure 7-4 Partitioned Logical Networks
7.5 TCP/IP and DHCP Ethernet Setup Menu
From the main menu, enter 3 to open Menu 3 - LAN Setup to configure TCP/IP (RFC 1155) and DHCP Ethernet setup.
LAN Setup 7-5
ZyWALL 2 and ZyWALL 2WE
Menu 3 - LAN Setup
1. LAN Port Filter Setup
2. TCP/IP and DHCP Setup
5. Wireless LAN Setup
Enter Menu Selection Number:
Figure 7-5 Menu 3: TCP/IP and DHCP Setup
From menu 3, select the submenu option TCP/IP and DHCP Setup and press [ENTER]. The screen now displays
Menu 3.2: TCP/IP and DHCP Ethernet Setup, as shown next.
DHCP= Server Configuration: Client IP Pool Starting Address= 192.168.1.33 Size of Client IP Pool= 32 Primary DNS Server= 0.0.0.0 Secondary DNS Server= 0.0.0.0 DHCP Server Address= N/A
TCP/IP Setup: IP Address= 192.168.1.1 IP Subnet Mask= 255.255.255.0 RIP Direction= Both Version= RIP-1 Multicast= None Edit IP Alias= No IP Policies=
Press ENTER to Confirm or ESC to Cancel: Press Space Bar to Toggle.
Menu 3.2 - TCP/IP and DHCP Ethernet Setup
First address in
the IP Pool
Size of the IP
Pool
IP addresses of
the DNS
servers
Figure 7-6 Menu 3.2: TCP/IP and DHCP Ethernet Setup
7-6 LAN Setup
ZyWALL 2 and ZyWALL 2WE
Follow the instructions in the next table on how to configure the DHCP fields.
Table 7-3 DHCP Ethernet Setup Menu Fields
FIELD DESCRIPTION EXAMPLE
DHCP This field enables/disables the DHCP server.
If set to Server, your ZyWALL will act as a DHCP server. If set to None, the DHCP server will be disabled. If set to Relay, the ZyWALL acts as a surrogate DHCP server and relays requests and responses between the remote server and the clients.
When set to Server, the following items need to be set:
Configuration:
Client IP Pool
Starting
Address
Size of Client
IP Pool
Primary DNS
Server
Secondary
DNS Server
DHCP Server
Address
This field specifies the first of the contiguous addresses in the IP address pool.
This field specifies the size, or count of the IP address pool. 32
Type the IP addresses of the DNS servers. The DNS servers are passed to the DHCP clients along with the IP address and the subnet mask.
If Relay is selected in the DHCP field above, then type the IP address of the actual, remote DHCP server here.
Follow the instructions in the following table to configure TCP/IP parameters for the LAN port.
Server
192.168.1.33
Table 7-4 LAN TCP/IP Setup Menu Fields
FIELD DESCRIPTION EXAMPLE
TCP/IP Setup:
IP Address Enter the IP address of your ZyWALL in dotted decimal notation 192.168.1.1
(default)
IP Subnet Mask Your ZyWALL will automatically calculate the subnet mask based
on the IP address that you assign. Unless you are implementing subnetting, use the subnet mask computed by the ZyWALL.
RIP Direction Press [SPACE BAR] and then [ENTER] to select the RIP direction.
Options are: Both, In Only, Out Only or None.
255.255.255.0
Both
(default)
LAN Setup 7-7
ZyWALL 2 and ZyWALL 2WE
Table 7-4 LAN TCP/IP Setup Menu Fields
FIELD DESCRIPTION EXAMPLE
Version Press [SPACE BAR] and then [ENTER] to select the RIP version.
Options are: RIP-1, RIP-2B or RIP-2M.
Multicast IGMP (Internet Group Multicast Protocol) is a session-layer
protocol used to establish membership in a Multicast group. The ZyWALL supports both IGMP version 1 (IGMP-v1) and version 2 (IGMP-v2). Press [SPACE BAR] and then [ENTER] to enable IP Multicasting or select None (default) to disable it.
Edit IP Alias The ZyWALL supports three logical LAN interfaces via its single
physical Ethernet interface with the ZyWALL itself as the gateway for each LAN network. Press [SPACE BAR] to select Yes and then press [ENTER] to display menu 3.2.1
IP Policies You can apply up to four IP Policy sets (from twelve) by typing
their numbers separated by commas.
When you have completed this menu, press [ENTER] at the prompt [Press ENTER to Confirm…] to save your configuration, or press [ESC] at any time to cancel.
RIP-1
(default)
None
Yes
2,7,9,11
7.5.1 IP Alias Setup
You must use menu 3.2 to configure the first network. Move the cursor to the Edit IP Alias field, press [SPACE BAR] to choose Yes and press [ENTER] to configure the second and third network. Press [ENTER] to open Menu 3.2.1 - IP Alias Setup, as shown next.
7-8 LAN Setup
ZyWALL 2 and ZyWALL 2WE
IP Alias 1= No IP Address= N/A IP Subnet Mask= N/A RIP Direction= N/A Version= N/A Incoming protocol filters= N/A Outgoing protocol filters= N/A IP Alias 2= No IP Address= N/A IP Subnet Mask= N/A RIP Direction= N/A Version= N/A Incoming protocol filters= N/A Outgoing protocol filters= N/A
Enter here to CONFIRM or ESC to CANCEL:
Press Space Bar to Toggle.
Menu 3.2.1 - IP Alias Setup
Figure 7-7 Menu 3.2.1: IP Alias Setup
Use the instructions in the following table to configure IP Alias parameters.
Table 7-5 IP Alias Setup Menu Fields
FIELD DESCRIPTION DEFAULT
IP Alias
IP Address Enter the IP address of your ZyWALL in dotted decimal notation. 192.168.2.1
IP Subnet Mask Your ZyWALL will automatically calculate the subnet mask based
RIP Direction Press [SPACE BAR] and then [ENTER] to select the RIP
Version Press [SPACE BAR] and then [ENTER] to select the RIP version.
Incoming
Protocol Filters
Outgoing
Protocol Filters
When you have completed this menu, press [ENTER] at the prompt [Press ENTER to Confirm…] to save your configuration, or press [ESC] at any time to cancel.
Choose Yes to configure the LAN network for the ZyWALL. Yes
255.255.255.0 on the IP address that you assign. Unless you are implementing subnetting, use the subnet mask computed by the ZyWALL.
None
direction. Options are
Both, In Only, Out Only or None.
RIP-1
Options are RIP-1, RIP-2B or RIP-2M.
Enter the filter set(s) you wish to apply to the incoming traffic
1
between this node and the ZyWALL.
Enter the filter set(s) you wish to apply to the outgoing traffic
2
between this node and the ZyWALL.
LAN Setup 7-9
ZyWALL 2 and ZyWALL 2WE
7.6 Wireless LAN
This section introduces the wireless LAN and some basic configuration. Wireless LANs can be as simple as two computers with wireless network interface cards (NICs) communicating in a peer-to-peer network or as complex as a number of computers with wireless NICs communicating through access points which bridge network traffic to the wired LAN. See Chapter 8 for information on wireless LAN security features.
7.6.1 Channel
IEEE 802.11b wireless devices use ranges of radio frequencies called channels. Choose the radio channel depending on your geographical area. Adjacent Access Points (APs) should use different channels to reduce crosstalk. Crosstalk occurs when radio signals from access points overlap and cause interference that degrades performance.
7.6.2 ESS ID
Extended Service Set (ESS) is defined as one or more APs acting as a bridge between a wired LAN and the associated wireless clients. The ESS ID is a unique ID given to the APs and the wireless clients that participate in the same wireless network. You can think of the ESS ID as being similar to a workgroup name in a Microsoft network.
The ESS ID provides a minimum level of security for your network; see Chapter 8 for more information.
7.6.3 RTS Threshold
The RTS (Request To Send) Threshold prevents the problem of hidden nodes. The hidden node problem occurs when two stations are within range of the same access point, but are not within range of each other. The following figure illustrates the hidden node problem. Both stations (STA) are within range of the (AP), however, they cannot hear each other. Therefore, they are considered hidden from each other. When a station starts data transmission with the AP, it might not know that the other station is already using the wireless medium. When these two stations send data at the same time, it might collide when arriving simultaneously at the AP. The collision will almost certainly result in a loss of messages for both stations.
7-10 LAN Setup
ZyWALL 2 and ZyWALL 2WE
Figure 7-8 RTS Threshold
The RTS Threshold mechanism provides a solution to prevent these data collisions. When you enable RTS Threshold on a possible hidden station, this station and its AP will use a Request to Send/Clear to Send protocol (RTS/CTS). The station send an RTS message to the AP, informing that it is going to transmit the data. Upon receipt, the AP responds with a CTS message to all stations within its range to notify all other stations to defer transmission. It also confirms with the requesting station that the AP has reserved it for the time frame of the requested transmission.
The ZyWALL activates the RTS function if the packet size exceeds the value you set. It is highly recommended that you set the value ranging from 0 to 2432.
Enabling the RTS Threshold causes redundant network overhead that could negatively affect the throughput performance instead of providing a remedy.
7.6.4 Fragmentation Threshold
Fragmentation improves efficiency when high traffic flows along in the wireless network.
7.6.5 WEP
As the first line of protection against wireless network intrusion, the ZyWALL provides the standard WEP (Wired Equivalent Privacy) for data encryption. However, there may be a significant degradation of the data throughput on the wireless link when WEP is enabled. See section 8.3 for more information about configuring WEP data encryption.
7.7 Wireless LAN Setup
Use menu 3.5 to set up your ZyWALL as the wireless access point.
LAN Setup 7-11
ZyWALL 2 and ZyWALL 2WE
See section 8.3 for instructions on WEP and section 8.6 for instructions on configuring the MAC address filter.
If you are configuring the ZyWALL from a computer connected to the wireless LAN
and you change the ZyWALL’s ESSID or WEP settings, you will lose your wireless
connection when you press [ENTER] to confirm. You must then change the
wireless settings of your computer to match the ZyWALL’s new settings.
From the main menu, enter 3 to open Menu 3 – LAN Setup to configure the Wireless LAN setup. To edit the wireless LAN configuration, enter 5 to open Menu 3.5 – Wireless LAN Setup as shown next.
Enable Wireless LAN= No ESSID= Wireless Hide ESSID= No Channel ID= CH01 2412MHz RTS Threshold= 2432 Frag. Threshold= 2432 WEP= Disable Default Key= N/A Key1= N/A Key2= N/A Key3= N/A Key4= N/A Edit MAC Address Filter= No
Menu 3.5 - Wireless LAN Setup
Figure 7-9 Menu 3.5 – Wireless LAN Setup
The settings of all client stations on the wireless LAN must match those of the
ZyWALL.
Follow the instructions in the next table on how to configure the wireless LAN parameters.
Table 7-6 Wireless LAN Setup Menu Fields
FIELD DESCRIPTION EXAMPLE
Enable Wireless LAN
ESSID (Extended Service Set IDentification) The ESSID identifies the Service Set
Press [SPACE BAR] to select Yes to turn on the wireless LAN. The wireless LAN is off by default. Configure wireless LAN security features such as Mac filters and 802.1X before you turn on the wireless LAN (see Chapter 8).
the station is to connect to. Wireless clients associating to the Access
No
(default)
Wireless
Point must have the same ESSID. Enter a descriptive name (up to 32 characters) for the wireless LAN.
7-12 LAN Setup
ZyWALL 2 and ZyWALL 2WE
Table 7-6 Wireless LAN Setup Menu Fields
FIELD DESCRIPTION EXAMPLE
Hide ESSID
Channel ID This allows you to set the operating frequency/channel depending on your
RTS Threshold
Frag. Threshold
When you have completed this menu, press [ENTER] at the prompt “Press ENTER to Confirm…” to save your configuration, or press [ESC] at any time to cancel.
Press [SPACE BAR] to select Yes to hide the ESSID in the outgoing beacon frame so a station cannot obtain the ESSID through passive scanning.
particular region. Use the [SPACE BAR] to select a channel.
• CH01 2412 MHz / CH02 2417 MHz ~ CH11 2462 MHz (North America/FCC)
• CH01 2412 MHz / CH02 2417 MHz ~ CH13 2472 MHz (Europe CE/ ETSI)
• CH01 2412 MHz / CH02 2417 MHz ~ Ch14 2484 MHz (Japan)
• CH10 2457 MHz / CH11 2462 MHz (Spain)
• CH10 2457 MHz / CH11 2462 MHz ~ CH13 2472 MHz (France)
(Request To Send) The threshold (number of bytes) for enabling RTS/CTS handshake. Data with its frame size larger than this value will perform the RTS/CTS handshake. Setting this attribute to be larger than the maximum MSDU (MAC service data unit) size turns off the RTS/CTS handshake. Setting this attribute to zero turns on the RTS/CTS handshake. Enter a value between 0 and 2432. The threshold (number of bytes) for the fragmentation boundary for directed messages. It is the maximum data fragment size that can be sent. Enter a value between 256 and 2432.
No
(default)
CH01 2412
MHz
2432
(default)
2432
(default)
The ZyWALL LAN Ethernet and wireless ports can transparently communicate with
each other (transparent bridge).
LAN Setup 7-13
ZyWALL 2 and ZyWALL 2WE
Chapter 8
Wireless LAN Security Setup
This chapter describes the types of security you can enable on the ZyWALL. Wireless LAN is
available on the ZyWALL 2WE.
8.1 Introduction to Wireless LAN Security
Wireless security is vital to your network to protect wireless communication between wireless clients, access points and other wireless. Use the web configurator to configure your ZyWALL’s wireless LAN security settings. Refer to the Introducing the Web Configurator chapter for details on how to access and navigate the web configurator
8.2 Levels of Security
The figure below shows the possible wireless security levels on your ZyWALL. The highest security level is EAP (Extensible Authentication Protocol) authentication. It requires interaction with a RADIUS (Remote Authentication Dial In User Service) server either on the WAN or your LAN to provide authentication service for wireless clients.
Figure 8-1 ZyWALL Wireless Security Levels
If you do not enable any wireless security on your ZyWALL, your network is accessible to any wireless networking device that is within range. Use the ZyWALL web configurator to configurator to set up your wireless LAN security settings. Refer to the chapter on using the ZyWALL web configurator to see how to access the web configurator.
Wireless LAN Security Setup 8-1
ZyWALL 2 and ZyWALL 2WE
8.3 Data Encryption with WEP
WEP encryption scrambles the data transmitted between the wireless clients and the access points to keep network communications private. It encrypts unicast and multicast communications in a network. Both the wireless clients and the access points must use the same WEP key for data encryption and decryption. For wireless LAN setup, refer to section 7.7. Your ZyWALL allows you to configure up to four 64-bit or 128-bit WEP keys but only one key can be enabled at any one time.
8.3.1 Setting Up WEP
In order to configure and enable WEP encryption; click Wireless and the Wireless tab to the display the Wireless LAN screen.
Figure 8-2 Wireless LAN
8-2 Wireless LAN Security Setup
ZyWALL 2 and ZyWALL 2WE
The following table describes the WEP related fields in this screen. For wireless LAN field descriptions refer to section 7.7.
Table 8-1 Wireless LAN
FIELD DESCRIPTION EXAMPLE
Enable Wireless LAN
WEP
Key 1 to Key 4
Click Apply to save your changes back to the ZyWALL. Click Reset to begin configuring this screen afresh.
Before you enable the wireless LAN you should configure some security by setting MAC filters and/or 802.1x security; otherwise your wireless LAN will be vulnerable upon enabling it. Select Yes from the drop-down list box to enable the wireless LAN.
WEP (Wired Equivalent Privacy) provides data encryption to prevent unauthorized wireless stations from accessing data transmitted over the wireless network. Select Disable to allow wireless clients to communicate with the access points without any data encryption. Select 64-bit WEP or 128-bit WEP to enable data encryption.
If you chose 64-bit WEP in the WEP Encryption field, then enter any 5 characters (ASCII string) or 10 hexadecimal digits ("0-9", "A-F") preceded by 0x for each key. If you chose 128-bit WEP in the WEP Encryption field, then enter 13 characters (ASCII string) or 26 hexadecimal digits ("0-9", "A-F") preceded by 0x for each key.
There are four data encryption keys to secure your data from eavesdropping by unauthorized wireless users. The values for the keys must be set up exactly the same on the access points as they are on the wireless client computers.
No
Disable
8.4 Network Authentication
You can set the ZyWALL and your network to authenticate a wireless client before the wireless client can communicate with the ZyWALL and the wired network to which the ZyWALL is connected.
8.4.1 EAP
EAP is an authentication protocol designed originally to run over PPP (Point-to-Point Protocol) frames in order to support multiple types of user authentication. By using EAP to interact with an EAP-compatible RADIUS server, the access point helps a wireless client and a RADIUS server to perform mutual authentication.
8.4.2 RADIUS
RADIUS is based on a client-sever model that supports authentication, authorization and accounting. The access point is the client and the server is the RADIUS server. The RADIUS server handles the following tasks:
Wireless LAN Security Setup 8-3
ZyWALL 2 and ZyWALL 2WE
• Authentication
Determines the identity of the users.
• Authorization
Determines the network services available to authenticated users once they are connected to the
network.
• Accounting
Keeps track of the client’s network activity.
RADIUS is a simple package exchange in which your ZyWALL acts as a message relay between the wireless client and the network RADIUS server.
Types of RADIUS Messages
The following types of RADIUS messages are exchanged between the access point and the RADIUS server for user authentication:
• Access-Request
Sent by an access point requesting authentication.
• Access-Reject
Sent by a RADIUS server rejecting access.
• Access-Accept
Sent by a RADIUS server allowing access.
• Access-Challenge
Sent by a RADIUS server requesting more information in order to allow access. The access point sends a proper response from the user and then sends another Access-Request message.
The following types of RADIUS messages are exchanged between the access point and the RADIUS server for user accounting:
• Accounting-Request
Sent by the access point requesting accounting.
• Accounting-Response
Sent by the RADIUS server to indicate that it has started or stopped accounting.
8-4 Wireless LAN Security Setup
ZyWALL 2 and ZyWALL 2WE
In order to ensure network security, the access point and the RADIUS server use a shared secret key, which is a password, they both know. The key is not sent over the network. In addition to the shared key, password information exchanged is also encrypted to protect the network from unauthorized access.
8.4.3 Sequence for EAP Authentication
The following figure shows the authentication steps when you enable EAP and specify a RADIUS server on your access point.
Figure 8-3 Sequence for EAP Authentication
The steps below describe how the IEEE 802.1x EAP authentication works.
Step 1. The wireless client sends a “request” message to the ZyWALL.
Step 2. The ZyWALL sends a “request” message to the wireless client for identity information.
Step 3. The wireless client replies with the password and username information.
Step 4. The ZyWALL receives the message and repackets this information into an Access-Request
package which is then sent to the remote RADIUS server (or the Authentication server).
Step 5. The RADIUS server checks the user information against its user profile database and sends an
“accept” or a “deny” packet to the ZyWALL.
Step 6. When the ZyWALL receives the “accept” packet, the client port is placed into an authorized state
and traffic is allowed to proceed. Otherwise, no traffic is allowed.
8.4.4 Enable EAP Authentication on Your ZyWALL
Click Wireless and the 802.1X tab to display the Wireless LAN 802.1X Authentication screen.
Wireless LAN Security Setup 8-5
ZyWALL 2 and ZyWALL 2WE
Figure 8-4 Wireless LAN 802.1X Authentication
The following table describes the fields in this screen.
Table 8-2 Wireless LAN 802.1X Authentication
FIELD DESCRIPTION
Authentication Control
Reauthentication Period
Click Apply to save these settings back to the ZyWALL. Click Reset to start this screen afresh.
Select Force Authorized, Force UnAuthorized or Auto from the drop-down list box.
Select Auto to authenticate all wireless clients before they can access the wired network.
Select Force Authorized to allow all wireless clients to access your wired network without authentication.
Select Force UnAuthorized to deny all wireless clients access to your wired network.
Specify the time interval between the RADIUS server’s authentication checks of wireless users connected to the network.
This field is activated only when you select Auto authentication control.
8.4.5 Configuring an External RADIUS Server
Once you enable the EAP authentication, you need to specify the external sever for remote user authentication and accounting.
Click Wireless and the RADIUS tab to the display the Authentication RADIUS screen.
8-6 Wireless LAN Security Setup
Figure 8-5 Authentication RADIUS
The following table describes the fields in this screen.
ZyWALL 2 and ZyWALL 2WE
Table 8-3 Authentication RADIUS
FIELD DESCRIPTION EXAMPLE
Authentication Server
Active
Server Address Enter the IP address of the external authentication server in
Select Yes from the drop-down list box to enable user authentication through an external authentication server.
Select No to enable user authentication using the local user database on the ZyWALL.
dotted decimal notation.
No
10.11.12.13
Wireless LAN Security Setup 8-7
ZyWALL 2 and ZyWALL 2WE
Table 8-3 Authentication RADIUS
FIELD DESCRIPTION EXAMPLE
Port Number The default port of the RADIUS server for authentication is
1812.
You need not change this value unless your network administrator instructs you to do so with additional information.
Key Enter a password (up to 31 alphanumeric characters) as the key
to be shared between the external authentication server and the access points.
The key is not sent over the network. This key must be the same on the external authentication server and ZyWALL.
Accounting Server
Active
Server Address Enter the IP address of the external accounting server in dotted
Port Number
Click Apply to save these settings back to the ZyWALL. Click Reset to start this screen afresh.
Select Yes from the drop-down list box to enable user authentication through an external accounting server.
decimal notation.
The default port of the RADIUS server for accounting is 1813.
You need not change this value unless your network administrator instructs you to do so with additional information.
Key Enter a password (up to 31 alphanumeric characters) as the key
to be shared between the external accounting server and the access points.
The key is not sent over the network. This key must be the same on the external accounting server and ZyWALL.
1812
No
10.11.12.13
1813
8.5 Local User Authentication
By storing user profiles locally, your ZyWALL is able to authenticate wireless users without interacting with a network RADIUS server. Click Wireless and the Local User Database tab to the display the following screen (some of the screen’s blank rows are not shown).
8-8 Wireless LAN Security Setup
ZyWALL 2 and ZyWALL 2WE
Figure 8-6 Local User Database
Wireless LAN Security Setup 8-9
ZyWALL 2 and ZyWALL 2WE
The following table describes the fields in this screen.
Table 8-4 Local User Database
FIELD DESCRIPTION
Active Select this check box to enable the user profile.
User Name Enter the user name of the user profile.
Password Enter a password up to 31 characters long for this user profile.
Click Apply to save these settings back to the ZyWALL. Click Reset to start this screen afresh.
8.6 MAC Address Filtering
Your ZyWALL checks the MAC address of the wireless client device against a list of allowed or denied MAC addresses. However, intruders could fake allowed MAC addresses so MAC-based authentication is less secure than EAP authentication.
Click Wireless and the MAC Filter tab to the display the Wireless LAN MAC Filter screen.
Figure 8-7 WLAN MAC Address Filter
8-10 Wireless LAN Security Setup
ZyWALL 2 and ZyWALL 2WE
The following table describes the fields in this menu.
Table 8-5 WLAN MAC Address Filter
FIELD DESCRIPTION
Active Use the drop down list box to enable or disable MAC address filtering.
Define the filter action for the list of MAC addresses in the MAC address filter table.
Filter Action
Select Deny Association to block access to the router, MAC addresses not listed will be allowed to access the router. Select Allow Association to permit access to the router, MAC addresses not listed will be denied access to the router.
MAC Address
Click Apply to save these settings back to the ZyWALL. Click Reset to start this screen afresh.
Enter the MAC addresses (in XX:XX:XX:XX:XX:XX format) of the client computers that are allowed or denied access to the ZyWALL in these address fields.
Wireless LAN Security Setup 8-11
ZyWALL 2 and ZyWALL 2WE
Chapter 9
Internet Access
This chapter shows you how to configure your ZyWALL for Internet access.
9.1 Introduction to Internet Access Setup
Use information from your ISP along with the instructions in this chapter to set up your ZyWALL to access the Internet. There are three different menu 4 screens depending on whether you chose Ethernet, PPTP or
PPPoE Encapsulation. Contact your ISP to determine what encapsulation type you should use.
9.2 Ethernet Encapsulation
If you choose Ethernet in menu 4 you will see the next screen.
Menu 4 - Internet Access Setup
ISP's Name= ChangeMe Encapsulation= Ethernet Service Type= Standard My Login= N/A My Password= N/A Login Server IP= N/A
IP Address Assignment= Dynamic IP Address= N/A IP Subnet Mask= N/A Gateway IP Address= N/A Network Address Translation= SUA Only
Press ENTER to Confirm or ESC to Cancel:
Figure 9-1 Menu 4: Internet Access Setup (Ethernet)
The following table describes this screen.
Table 9-1 Menu 4: Internet Access Setup Menu Fields
FIELD DESCRIPTION
ISP’s Name Enter the name of your Internet Service Provider, e.g., myISP. This information is
for identification purposes only.
Internet Access 9-1
ZyWALL 2 and ZyWALL 2WE
Table 9-1 Menu 4: Internet Access Setup Menu Fields
FIELD DESCRIPTION
Encapsulation
Service Type
Note: DSL users must choose the Standard option only. The My Login, My Password and Login Server fields are not applicable in this case.
My Login Enter the login name given to you by your ISP.
My Password Enter the password associated with the login name above.
Login Server The ZyWALL will find the RoadRunner Server IP if this field is left blank. If it does
IP Address Assignment
IP Address Enter the (fixed) IP address assigned to you by your ISP (static IP address
IP Subnet Mask Enter the subnet mask associated with your static IP.
Gateway IP
Address
Network Address Translation
When you have completed this menu, press [ENTER] at the prompt “Press ENTER to Confirm…” to save your configuration, or press [ESC] at any time to cancel.
Press [SPACE BAR] and then press [ENTER] to choose Ethernet. The encapsulation method influences your choices for the IP Address field.
Press [SPACE BAR] and then [ENTER] to select Standard, RR-Toshiba (RoadRunner Toshiba authentication method), RR-Manager (RoadRunner Manager authentication method) or RR-Telstra. Choose a RoadRunner service type if your ISP is Time Warner's RoadRunner; otherwise choose Standard.
not, then you must enter the authentication server IP address.
If your ISP did not assign you a fixed IP address, press [SPACE BAR] and then [ENTER] to select Dynamic, otherwise select Static and enter the IP address and subnet mask in the following fields.
Assignment is selected in the previous field).
Enter the gateway IP address associated with your static IP.
Please see the NAT chapter for a more detailed discussion on the Network Address Translation feature. The choices are Full Feature, None or SUA Only.
9.3 PPTP Encapsulation
Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables secure transfer of data from a remote client to a private server, creating a Virtual Private Network (VPN) using TCP/IP-based networks. PPTP supports on-demand, multi-protocol and virtual private networking over public networks, such as the Internet.
9-2 Internet Access
ZyWALL 2 and ZyWALL 2WE
The ZyWALL supports only one PPTP server connection at any given time.
9.3.1 Configuring the PPTP Client
To configure a PPTP client, you must configure the My Login and Password fields for a PPP connection and the PPTP parameters for a PPTP connection.
After configuring My Login and Password for PPP connection, press [SPACE BAR] and then [ENTER] in the Encapsulation field in Menu 4 -Internet Access Setup to choose PPTP as your encapsulation option. This brings up the following screen.
Menu 4 - Internet Access Setup
ISP's Name= ChangeMe Encapsulation= PPTP Service Type= N/A My Login= username
My Password= ****** Idle Timeout= 100
IP Address Assignment= Dynamic
IP Address= N/A IP Subnet Mask= N/A Gateway IP Address=N/A
Network Address Translation= SUA Only
Press ENTER to Confirm or ESC to Cancel:
Figure 9-2 Internet Access Setup (PPTP)
The following table contains instructions about the new fields when you choose PPTP in the Encapsulation field in menu 4.
Table 9-2 New Fields in Menu 4 (PPTP) Screen
FIELD DESCRIPTION EXAMPLE
Encapsulation
Press [SPACE BAR] and then press [ENTER] to choose PPTP. The
PPTP
encapsulation method influences your choices for the IP Address field.
Idle Timeout This value specifies the time, in seconds, that elapses before the
ZyWALL automatically disconnects from the PPTP server.
100
(default)
9.4 PPPoE Encapsulation
The ZyWALL supports PPPoE (Point-to-Point Protocol over Ethernet). PPPoE is an IETF Draft standard (RFC 2516) specifying how a personal computer (PC) interacts with a broadband modem (DSL, cable, wireless, etc.) connection. The PPPoE option is for a dial-up connection using PPPoE.
Internet Access 9-3
ZyWALL 2 and ZyWALL 2WE
For the service provider, PPPoE offers an access and authentication method that works with existing access control systems (for example Radius). PPPoE provides a login and authentication method that the existing Microsoft Dial-Up Networking software can activate, and therefore requires no new learning or procedures for Windows users.
One of the benefits of PPPoE is the ability to let you access one of multiple network services, a function known as dynamic service selection. This enables the service provider to easily create and offer new IP services for individuals.
Operationally, PPPoE saves significant effort for both you and the ISP or carrier, as it requires no specific configuration of the broadband modem at the customer site.
By implementing PPPoE directly on the ZyWALL (rather than individual computers), the computers on the LAN do not need PPPoE software installed, since the ZyWALL does that part of the task. Furthermore, with NAT, all of the LANs’ computers will have access.
9.4.1 Configuring the PPPoE Client
If you enable PPPoE in menu 4, you will see the next screen. For more information on PPPoE, please see the Appendices.
Menu 4 - Internet Access Setup
ISP's Name= ChangeMe Encapsulation= PPPoE Service Type= N/A My Login= My Password= ******** Idle Timeout= 100
IP Address Assignment= Dynamic IP Address= N/A IP Subnet Mask= N/A Gateway IP Address= N/A Network Address Translation= Full Feature
Press ENTER to Confirm or ESC to Cancel:
Figure 9-3 Internet Access Setup (PPPoE)
Table 9-3 New Fields in Menu 4 (PPPoE) screen
FIELD DESCRIPTION EXAMPLE
Encapsulation
Press [SPACE BAR] and then press [ENTER] to choose PPPoE.
PPPoE
The encapsulation method influences your choices in the IP Address field.
9-4 Internet Access
ZyWALL 2 and ZyWALL 2WE
Table 9-3 New Fields in Menu 4 (PPPoE) screen
FIELD DESCRIPTION EXAMPLE
Idle Timeout This value specifies the time in seconds that elapses before the
ZyWALL automatically disconnects from the PPPoE server.
100
(default)
If you need a PPPoE service name to identify and reach the PPPoE server, please go to menu 11 and enter the PPPoE service name provided to you in the Service Name field.
9.5 Basic Setup Complete
Well done! You have successfully connected, installed and set up your ZyWALL to operate on your network as well as access the Internet.
When the firewall is activated, the default policy allows all communications to the
Internet that originate from the LAN, and blocks all traffic to the LAN that
originates from the Internet.
You may deactivate the firewall in menu 21.2 or via the ZyWALL embedded web configurator. You may also define additional firewall rules or modify existing ones but please exercise extreme caution in doing so. See the firewall chapters for more information on the firewall.
Internet Access 9-5
Advanced Applications
Part III:
Advanced Applications
This part covers Remote Node Setup, IP Static Route Setup and Network Address Translation
(NAT).
III
ZyWALL 2 and ZyWALL 2WE
Chapter 10
Remote Node Setup
This chapter shows you how to configure a remote node.
10.1 Introduction to Remote Node Setup
A remote node is required for placing calls to a remote gateway. A remote node represents both the remote
gateway and the network behind it across a WAN connection. Note that when you use menu 4 to set up
Internet access, you are actually configuring a remote node. The following describes how to configure
Menu 11.1 Remote Node Profile, Menu 11.3 - Remote Node Network Layer Options and Menu 11.5 -
Remote Node Filter.
10.2 Remote Node Setup
From the main menu, select menu option 11 to open Menu 11 Remote Node Setup (shown below).
Then enter 1 to open Menu 11.1 Remote Node Profile and configure the setup for your regular ISP.
1. ChangeMe (ISP, SUA)
2. ________
Enter Node # to Edit:
Menu 11 - Remote Node Setup
Figure 10-1 Menu 11 Remote Node Setup
Remote Node Setup 10-1
ZyWALL 2 and ZyWALL 2WE
10.3 Remote Node Profile Setup
The following explains how to configure the remote node profile menu.
10.3.1 Ethernet Encapsulation
There are two variations of menu 11.1 depending on whether you choose Ethernet Encapsulation or
PPPoE Encapsulation. You must choose the Ethernet option when the WAN port is used as a regular
Ethernet. The first menu 11.1 screen you see is for Ethernet encapsulation shown next.
Rem Node Name= ChangeMe Route= IP Active= Yes
Encapsulation= Ethernet Edit IP= No Service Type= Standard Session Options: Service Name= N/A Edit Filter Sets= No Outgoing: My Login= N/A My Password= N/A Edit Traffic Redirect= No Retype to Confirm= N/A Server IP= N/A
Press ENTER to Confirm or ESC to Cancel:
Menu 11.1 - Remote Node Profile
Figure 10-2 Menu 11.1: Remote Node Profile for Ethernet Encapsulation
Table 10-1 Fields in Menu 11.1
FIELD DESCRIPTION EXAMPLE
Rem Node Name
Active
Encapsulation
Enter a descriptive name for the remote node. This field can be up to eight characters.
Press [SPACE BAR] and then [ENTER] to select Yes (activate remote node) or No (deactivate remote node).
Ethernet is the default encapsulation. Press [SPACE BAR] and then [ENTER] to change to PPPoE or PPTP encapsulation.
LAoffice
Yes
Ethernet
10-2 Remote Node Setup
Loading...
Buy Points How it Works FAQ Contact Us Questions and Suggestions Privacy Policy Cookie Policy Terms of Use