User manual ZYXEL ZYWALL 2WE

ZyWALL 2/2WE Internet Security Gateway User's Guide Version 3.60 March 2003 ZyWALL 2 and ZyWALL 2WE Copyright Copyright © 2003 by ZyXEL Communications Corporation. The contents of this publication may not be reproduced in any part or as a whole, transcribed, stored in a retrieval system, translated into any language, or transmitted in any form or by any means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the prior written permission of ZyXEL Communications Corporation. Published by ZyXEL Communications Corporation. All rights reserved. Disclaimer ZyXEL does not assume any liability arising out of the application or use of any products, or software described herein. Neither does it convey any license under its patent rights nor the patent rights of others. ZyXEL further reserves the right to make changes in any products described herein without notice. This publication is subject to change without notice. Trademarks Trademarks mentioned in this publication are used for identification purposes only and may be properties of their respective owners. ii Copyright ZyWALL 2 and ZyWALL 2WE Federal Communications Commission (FCC) Interference Statement This device complies with Part 15 of FCC rules. Operation is subject to the following two conditions: This device may not cause harmful interference. This device must accept any interference received, including interference that may cause undesired operations. This equipment has been tested and found to comply with the limits for a CLASS B digital device pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a commercial environment. This equipment generates, uses, and can radiate radio frequency energy, and if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. If this equipment does cause harmful interference to radio/television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures: Reorient or relocate the receiving antenna. Increase the separation between the equipment and the receiver. Connect the equipment into an outlet on a circuit different from that to which the receiver is connected. Consult the dealer or an experienced radio/TV technician for help. Notice 1 Changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate the equipment. Certifications Refer to the product page at www.zyxel.com. FCC iii ZyWALL 2 and ZyWALL 2WE Information for Canadian Users The Industry Canada label identifies certified equipment. This certification means that the equipment meets certain telecommunications network protective, operation, and safety requirements. The Industry Canada does not guarantee that the equipment will operate to a user's satisfaction. Before installing this equipment, users should ensure that it is permissible to be connected to the facilities of the local telecommunications company. The equipment must also be installed using an acceptable method of connection. In some cases, the company's inside wiring associated with a single line individual service may be extended by means of a certified connector assembly. The customer should be aware that the compliance with the above conditions may not prevent degradation of service in some situations. Repairs to certified equipment should be made by an authorized Canadian maintenance facility designated by the supplier. Any repairs or alterations made by the user to this equipment, or equipment malfunctions, may give the telecommunications company cause to request the user to disconnect the equipment. For their own protection, users should ensure that the electrical ground connections of the power utility, telephone lines, and internal metallic water pipe system, if present, are connected together. This precaution may be particularly important in rural areas. Caution Users should not attempt to make such connections themselves, but should contact the appropriate electrical inspection authority, or electrician, as appropriate. Note This digital apparatus does not exceed the class A limits for radio noise emissions from digital apparatus set out in the radio interference regulations of Industry Canada. iv Information for Canadian Users ZyWALL 2 and ZyWALL 2WE ZyXEL Limited Warranty ZyXEL warrants to the original end user (purchaser) that this product is free from any defects in materials or workmanship for a period of up to two years from the date of purchase. During the warranty period, and upon proof of purchase, should the product have indications of failure due to faulty workmanship and/or materials, ZyXEL will, at its discretion, repair or replace the defective products or components without charge for either parts or labor, and to whatever extent it shall deem necessary to restore the product or components to proper operating condition. Any replacement will consist of a new or re-manufactured functionally equivalent product of equal value, and will be solely at the discretion of ZyXEL. This warranty shall not apply if the product is modified, misused, tampered with, damaged by an act of God, or subjected to abnormal working conditions. NOTE Repair or replacement, as provided under this warranty, is the exclusive remedy of the purchaser. This warranty is in lieu of all other warranties, express or implied, including any implied warranty of merchantability or fitness for a particular use or purpose. ZyXEL shall in no event be held liable for indirect or consequential damages of any kind of character to the purchaser. To obtain the services of this warranty, contact ZyXEL's Service Center for your Return Material Authorization number (RMA). Products must be returned Postage Prepaid. It is recommended that the unit be insured when shipped. Any returned products without proof of purchase or those with an out-dated warranty will be repaired or replaced (at the discretion of ZyXEL) and the customer will be billed for parts and labor. All repaired or replaced products will be shipped by ZyXEL to the corresponding return address, Postage Paid. This warranty gives you specific legal rights, and you may also have other rights that vary from country to country. Online Registration Register online registration at www.zyxel.com for free future product updates and information. Warranty v ZyWALL 2 and ZyWALL 2WE Customer Support When you contact your customer support representative please have the following information ready: Please have the following information ready when you contact customer support. · Product model and serial number. · Information in Menu 24.2.1 ­ System Information. · Warranty Information. · Date that you received your device. · Brief description of the problem and the steps you took to solve it. METHOD LOCATION WORLDWIDE E-MAIL SUPPORT/SALES support@zyxel.com.tw TELEPHONE/FAX WEB SITE/ FTP SITE REGULAR MAIL +886-3-578-3942 www.zyxel.com www.europe.zyxel.com ftp.europe.zyxel.com www.zyxel.com ftp.zyxel.com www.zyxel.dk ftp.zyxel.dk www.zyxel.de ZyXEL Communications Corp., 6 Innovation Road II, ScienceBased Industrial Park, Hsinchu 300, Taiwan ZyXEL Communications Inc., 1650 Miraloma Avenue, Placentia, CA 92870, U.S.A. ZyXEL Communications A/S, Columbusvej 5, 2860 Soeborg, Denmark ZyXEL Deutschland GmbH. Adenauerstr. 20/A2 D-52146 Wuerselen, Germany sales@zyxel.com.tw NORTH AMERICA support@zyxel.com sales@zyxel.com SCANDINAVIA support@zyxel.dk sales@zyxel.dk GERMANY support@zyxel.de sales@zyxel.de +886-3-578-2439 +1-714-632-0882 800-255-4101 +1-714-632-0858 +45-3955-0700 +45-3955-0707 +49-2405-6909-0 +49-2405-6909-99 vi Customer Support ZyWALL 2 and ZyWALL 2WE Table of Contents Copyright......................................................................................................................................................ii Federal Communications Commission (FCC) Interference Statement................................................. iii Information for Canadian Users ...............................................................................................................iv ZyXEL Limited Warranty ..........................................................................................................................v Customer Support ......................................................................................................................................vi List of Figures ...........................................................................................................................................xvi List of Tables .......................................................................................................................................... xxiii Preface ....................................................................................................................................................xxvii Overview ........................................................................................................................................................... I Chapter 1 Getting to Know Your ZyWALL .......................................................................................... 1-1 1.1 1.2 1.3 2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8 Introducing the ZyWALL 2/2WE Internet Security Gateway ................................................... 1-1 Features ...................................................................................................................................... 1-1 Applications for the ZyWALL ................................................................................................... 1-5 Introduction to Hardware Installation ........................................................................................ 2-1 Front Panels LEDs .................................................................................................................... 2-1 LED Descriptions....................................................................................................................... 2-2 ZyWALL Rear Panels and Connections .................................................................................... 2-3 Hardware Connections ............................................................................................................... 2-3 Hardware Mounting Options...................................................................................................... 2-5 Additional Installation Requirements for Using 802.1x............................................................. 2-5 Turning On Your ZyWALL....................................................................................................... 2-5 Chapter 2 Hardware Installation ........................................................................................................... 2-1 Initial Setup and Configuration.....................................................................................................................II Chapter 3 Introducing the Web Configurator ...................................................................................... 3-1 3.1 Introduction to the Web Configurator ........................................................................................ 3-1 Table of Contents vii ZyWALL 2 and ZyWALL 2WE 3.2 3.3 4.1 4.2 4.3 4.4 4.5 5.1 5.2 5.3 5.4 6.1 6.2 6.3 7.1 7.2 7.3 7.4 7.5 7.6 7.7 8.1 Accessing the ZyWALL Web Configurator ...............................................................................3-1 Web Configurator Navigation.....................................................................................................3-2 Introduction to the SMT..............................................................................................................4-1 Accessing the Console Port via the Console Port .......................................................................4-1 Navigating the SMT Interface.....................................................................................................4-2 Changing the System Password ..................................................................................................4-7 Resetting the ZyWALL...............................................................................................................4-8 Introduction to General Setup .....................................................................................................5-1 System Name ..............................................................................................................................5-1 Dynamic DNS.............................................................................................................................5-1 General Setup..............................................................................................................................5-2 Introduction to WAN Setup ........................................................................................................6-1 Cloning The MAC Address ........................................................................................................6-1 WAN Setup.................................................................................................................................6-1 Introduction to LAN Setup .........................................................................................................7-1 Accessing the LAN Menus .........................................................................................................7-1 LAN Port Filter Setup.................................................................................................................7-1 TCP/IP and LAN DHCP.............................................................................................................7-2 TCP/IP and DHCP Ethernet Setup Menu ...................................................................................7-5 Wireless LAN ...........................................................................................................................7-10 Wireless LAN Setup .................................................................................................................7-11 Introduction to Wireless LAN Security ......................................................................................8-1 Chapter 4 Introducing the SMT..............................................................................................................4-1 Chapter 5 SMT Menu 1 - General Setup................................................................................................5-1 Chapter 6 WAN Setup..............................................................................................................................6-1 Chapter 7 LAN Setup...............................................................................................................................7-1 Chapter 8 Wireless LAN Security Setup ................................................................................................8-1 viii Table of Contents ZyWALL 2 and ZyWALL 2WE 8.2 8.3 8.4 8.5 8.6 9.1 9.2 9.3 9.4 9.5 Levels of Security ...................................................................................................................... 8-1 Data Encryption with WEP ........................................................................................................ 8-2 Network Authentication ............................................................................................................. 8-3 Local User Authentication ......................................................................................................... 8-8 MAC Address Filtering............................................................................................................ 8-10 Introduction to Internet Access Setup ........................................................................................ 9-1 Ethernet Encapsulation............................................................................................................... 9-1 PPTP Encapsulation ................................................................................................................... 9-2 PPPoE Encapsulation ................................................................................................................. 9-3 Basic Setup Complete ................................................................................................................ 9-5 Chapter 9 Internet Access ....................................................................................................................... 9-1 Advanced Applications ................................................................................................................................. III Chapter 10 Remote Node Setup............................................................................................................ 10-1 10.1 10.2 10.3 10.4 10.5 10.6 11.1 11.2 12.1 12.2 12.3 12.4 Introduction to Remote Node Setup..................................................................................... 10-1 Remote Node Setup.............................................................................................................. 10-1 Remote Node Profile Setup.................................................................................................. 10-2 Edit IP .................................................................................................................................. 10-7 Remote Node Filter .............................................................................................................. 10-9 Traffic Redirect .................................................................................................................. 10-10 Introduction to Static Route ................................................................................................. 11-1 IP Static Route Setup............................................................................................................ 11-2 Introduction to NAT............................................................................................................. 12-1 Using NAT ........................................................................................................................... 12-6 NAT Setup ........................................................................................................................... 12-8 NAT Server Sets ­ Port Forwarding .................................................................................. 12-14 Chapter 11 IP Static Route Setup ..........................................................................................................11-1 Chapter 12 Network Address Translation (NAT) ............................................................................... 12-1 Table of Contents ix ZyWALL 2 and ZyWALL 2WE 12.5 12.6 General NAT Examples ......................................................................................................12-17 Trigger Port Forwarding .....................................................................................................12-24 Firewall and Content Filters .........................................................................................................................IV Chapter 13 Firewalls ..............................................................................................................................13-1 13.1 13.2 13.3 13.4 13.5 13.6 13.7 14.1 14.2 14.3 14.4 15.1 15.2 15.3 16.1 16.2 16.3 16.4 16.5 16.6 Introduction to Firewalls.......................................................................................................13-1 Types of Firewalls.................................................................................................................13-1 Introduction to ZyXEL's Firewall ........................................................................................13-2 Denial of Service...................................................................................................................13-3 Stateful Inspection ................................................................................................................13-7 Guidelines For Enhancing Security With Your Firewall ....................................................13-11 Packet Filtering Vs Firewall ...............................................................................................13-12 Introduction to the ZyWALL Firewall..................................................................................14-1 Remote Management and the Firewall .................................................................................14-1 Access Methods ....................................................................................................................14-1 Using ZyWALL SMT Menus ...............................................................................................14-1 Introduction to Firewall Configuration .................................................................................15-1 Enabling the Firewall............................................................................................................15-1 Attack Alert...........................................................................................................................15-3 Introduction to Custom Rules ...............................................................................................16-1 Rule Logic Overview............................................................................................................16-2 Connection Direction Examples ...........................................................................................16-3 Rule Summary ......................................................................................................................16-5 Predefined Services...............................................................................................................16-7 Custom Ports.......................................................................................................................16-14 Chapter 14 Introducing the ZyWALL Firewall ...................................................................................14-1 Chapter 15 Firewall Configuration.......................................................................................................15-1 Chapter 16 Creating Custom Rules ......................................................................................................16-1 x Table of Contents ZyWALL 2 and ZyWALL 2WE 16.7 16.8 17.1 17.2 17.3 17.4 Creating/Editing A Custom Port ........................................................................................ 16-14 Example Firewall Rule....................................................................................................... 16-15 Introduction to Content Filtering.......................................................................................... 17-1 Restrict Web Features .......................................................................................................... 17-1 Days and Times.................................................................................................................... 17-1 Configure Content Filtering ................................................................................................. 17-1 Chapter 17 Content Filtering................................................................................................................ 17-1 Logs, Filter Configuration, and SNMP Configuration ................................................................................V Chapter 18 Centralized Logs ................................................................................................................ 18-1 18.1 18.2 18.3 18.4 19.1 19.2 19.3 19.4 19.5 19.6 20.1 20.2 20.3 20.4 Introduction to Centralized Logs.......................................................................................... 18-1 View Log.............................................................................................................................. 18-1 Log Settings ......................................................................................................................... 18-3 Reports ................................................................................................................................. 18-6 Introduction to Filters........................................................................................................... 19-1 Configuring a Filter Set........................................................................................................ 19-4 Example Filter.................................................................................................................... 19-13 Filter Types and SUA/NAT ............................................................................................... 19-16 Firewall Versus Filters ....................................................................................................... 19-16 Applying a Filter and Factory Defaults .............................................................................. 19-17 Introduction to SNMP .......................................................................................................... 20-1 Supported MIBs ................................................................................................................... 20-3 SNMP Configuration............................................................................................................ 20-3 SNMP Traps......................................................................................................................... 20-4 Chapter 19 Filter Configuration........................................................................................................... 19-1 Chapter 20 SNMP Configuration ......................................................................................................... 20-1 System Information and Diagnosis and Firmware and Configuration File Maintenance...................... VI Chapter 21 System Information & Diagnosis...................................................................................... 21-1 Table of Contents xi ZyWALL 2 and ZyWALL 2WE 21.1 21.2 21.3 21.4 21.5 22.1 22.2 22.3 22.4 Introduction to System Status ...............................................................................................21-1 System Status........................................................................................................................21-1 System Information and Console Port Speed........................................................................21-3 Log and Trace .......................................................................................................................21-6 Diagnostic ...........................................................................................................................21-11 Filename Conventions ..........................................................................................................22-1 Backup Configuration...........................................................................................................22-2 Restore Configuration...........................................................................................................22-8 Uploading Firmware and Configuration Files ....................................................................22-11 Chapter 22 Firmware and Configuration File Maintenance ..............................................................22-1 System Maintenance and Information and Remote Management .......................................................... VII Chapter 23 System Maintenance & Information.................................................................................23-1 23.1 23.2 23.3 24.1 24.2 24.3 24.4 24.5 24.6 24.7 24.8 24.9 Command Interpreter Mode..................................................................................................23-1 Call Control Support .............................................................................................................23-2 Time and Date Setting ..........................................................................................................23-5 Remote Management and the Firewall .................................................................................24-1 Telnet ....................................................................................................................................24-1 FTP .......................................................................................................................................24-2 Web.......................................................................................................................................24-2 SNMP ...................................................................................................................................24-2 DNS ......................................................................................................................................24-2 Remote Management ............................................................................................................24-2 Remote Management and SUA/NAT ...................................................................................24-4 System Timeout ....................................................................................................................24-5 Chapter 24 Remote Management .........................................................................................................24-1 Call Scheduling and VPN/IPSec ................................................................................................................VIII Chapter 25 Call Scheduling ...................................................................................................................25-1 xii Table of Contents ZyWALL 2 and ZyWALL 2WE 25.1 25.2 25.3 26.1 26.2 26.3 26.4 27.1 27.2 27.3 27.4 27.5 27.6 27.7 27.8 27.9 27.10 27.11 27.12 27.13 27.14 27.15 27.16 Introduction to Call Scheduling ........................................................................................... 25-1 Configuring Call Scheduling................................................................................................ 25-1 Applying Schedule Sets ....................................................................................................... 25-3 VPN Overview ..................................................................................................................... 26-1 IPSec Architecture ............................................................................................................... 26-3 Encapsulation ....................................................................................................................... 26-5 IPSec and NAT .................................................................................................................... 26-5 VPN/IPSec Overview........................................................................................................... 27-1 IPSec Algorithms ................................................................................................................. 27-1 My IP Address...................................................................................................................... 27-2 Secure Gateway Address...................................................................................................... 27-2 Summary Screen .................................................................................................................. 27-3 Keep Alive ........................................................................................................................... 27-4 NAT Traversal ..................................................................................................................... 27-5 ID Type and Content ............................................................................................................ 27-5 Configuring Basic IKE VPN Rule Setup ............................................................................. 27-7 IKE Phases ......................................................................................................................... 27-12 Configuring Advanced IKE Setup ..................................................................................... 27-14 Manual Key Setup.............................................................................................................. 27-20 Configuring Edit Manual Setup ......................................................................................... 27-20 SA Monitor ........................................................................................................................ 27-24 Global Settings ................................................................................................................... 27-26 Telecommuter VPN/IPSec Examples ................................................................................ 27-27 Chapter 26 Introduction to IPSec......................................................................................................... 26-1 Chapter 27 VPN/IPSec Setup ............................................................................................................... 27-1 Troubleshooting............................................................................................................................................. IX Chapter 28 Troubleshooting ................................................................................................................. 28-1 Table of Contents xiii ZyWALL 2 and ZyWALL 2WE 23.1 28.1 28.2 28.3 23.2 28.4 Problems Starting Up the ZyWALL .....................................................................................28-1 Problems with a LAN Interface ............................................................................................28-2 Problems with the WAN Interface........................................................................................28-2 Problems with Internet Access..............................................................................................28-3 Problems with the Password .................................................................................................28-3 Problems with Remote Management ....................................................................................28-3 General Appendices ........................................................................................................................................ X Appendix A Setting up Your Computer's IP Address............................................................................... 1 Appendix B Antennas................................................................................................................................ 14 Appendix C Triangle Route ...................................................................................................................... 16 Appendix D The Big Picture..................................................................................................................... 19 Appendix E Wireless LAN and IEEE 802.11 .......................................................................................... 20 Appendix F Wireless LAN With IEEE 802.1x ........................................................................................ 23 Appendix G PPPoE ................................................................................................................................... 27 Appendix H PPTP ..................................................................................................................................... 29 Appendix I Hardware Specifications ....................................................................................................... 32 Appendix J Universal Plug and Play ....................................................................................................... 36 Appendix K IP Subnetting........................................................................................................................ 45 Appendix L Safety Warnings and Instructions....................................................................................... 53 Command and Log Appendices....................................................................................................................XI Appendix M Command Interpreter......................................................................................................... 57 Appendix N Firewall Commands............................................................................................................. 58 Appendix O NetBIOS Filter Commands................................................................................................. 65 Appendix P Boot Commands.................................................................................................................... 68 Appendix Q Log Descriptions .................................................................................................................. 70 Appendix R Brute-Force Password Guessing Protection ...................................................................... 88 Index ............................................................................................................................................................. XII xiv Table of Contents ZyWALL 2 and ZyWALL 2WE Index ............................................................................................................................................................A Table of Contents xv ZyWALL 2 and ZyWALL 2WE List of Figures Figure 1-1 Secure Internet Access and VPN Application ...............................................................................1-6 Figure 1-2 ZyWALL 2WE Wireless LAN Application...................................................................................1-6 Figure 2-1 ZyWALL 2WE Front Panel...........................................................................................................2-1 Figure 2-2 ZyWALL 2 Front Panel.................................................................................................................2-2 Figure 2-3 ZyWALL 2WE Rear Panel............................................................................................................2-3 Figure 2-4 ZyWALL 2 Rear Panel..................................................................................................................2-3 Figure 3-1 Change Password Screen ..............................................................................................................3-1 Figure 3-2 Web Configurator Main Menu ......................................................................................................3-2 Figure 4-1 Initial Screen .................................................................................................................................4-1 Figure 4-2 Password Screen ...........................................................................................................................4-2 Figure 4-3 Main Menu (ZyWALL 2WE)........................................................................................................4-3 Figure 4-4 Getting Started and Advanced Applications SMT Menus (ZyWALL 2WE).................................4-5 Figure 4-5 Advanced Management SMT Menus ............................................................................................4-6 Figure 4-6 Schedule Setup and IPSec VPN Configuration SMT Menus........................................................4-7 Figure 4-7 Menu 23: System Password ..........................................................................................................4-7 Figure 4-8 Example Xmodem Upload............................................................................................................4-8 Figure 5-1 Menu 1: General Setup..................................................................................................................5-2 Figure 5-2 Configure Dynamic DNS..............................................................................................................5-3 Figure 6-1 MAC Address Cloning in WAN Setup..........................................................................................6-1 Figure 7-1 Menu 3: LAN Setup......................................................................................................................7-1 Figure 7-2 Menu 3.1: LAN Port Filter Setup..................................................................................................7-2 Figure 7-3 Physical Network ..........................................................................................................................7-5 Figure 7-4 Partitioned Logical Networks .......................................................................................................7-5 Figure 7-5 Menu 3: TCP/IP and DHCP Setup ................................................................................................7-6 Figure 7-6 Menu 3.2: TCP/IP and DHCP Ethernet Setup...............................................................................7-6 xvi List of Figures ZyWALL 2 and ZyWALL 2WE Figure 7-7 Menu 3.2.1: IP Alias Setup........................................................................................................... 7-9 Figure 7-8 RTS Threshold............................................................................................................................7-11 Figure 7-9 Menu 3.5 ­ Wireless LAN Setup................................................................................................ 7-12 Figure 8-1 ZyWALL Wireless Security Levels .............................................................................................. 8-1 Figure 8-2 Wireless LAN ............................................................................................................................... 8-2 Figure 8-3 Sequence for EAP Authentication ................................................................................................ 8-5 Figure 8-4 Wireless LAN 802.1X Authentication.......................................................................................... 8-6 Figure 8-5 Authentication RADIUS............................................................................................................... 8-7 Figure 8-6 Local User Database..................................................................................................................... 8-9 Figure 8-7 WLAN MAC Address Filter....................................................................................................... 8-10 Figure 9-1 Menu 4: Internet Access Setup (Ethernet) .................................................................................... 9-1 Figure 9-2 Internet Access Setup (PPTP)....................................................................................................... 9-3 Figure 9-3 Internet Access Setup (PPPoE)..................................................................................................... 9-4 Figure 10-1 Menu 11 Remote Node Setup................................................................................................... 10-1 Figure 10-2 Menu 11.1: Remote Node Profile for Ethernet Encapsulation ................................................. 10-2 Figure 10-3 Menu 11.1: Remote Node Profile for PPPoE Encapsulation.................................................... 10-4 Figure 10-4 Menu 11.1: Remote Node Profile for PPTP Encapsulation...................................................... 10-6 Figure 10-5 Menu 11.3: Remote Node Network Layer Options for Ethernet Encapsulation ...................... 10-7 Figure 10-6 Menu 11.5: Remote Node Filter (Ethernet Encapsulation)....................................................... 10-9 Figure 10-7 Menu 11.5: Remote Node Filter (PPPoE or PPTP Encapsulation)......................................... 10-10 Figure 10-8 Traffic Redirect WAN Setup................................................................................................... 10-10 Figure 10-9 Traffic Redirect LAN Setup ....................................................................................................10-11 Figure 10-10 Menu 11.1: Remote Node Profile ..........................................................................................10-11 Figure 10-11 Menu 11.6: Traffic Redirect Setup........................................................................................ 10-12 Figure 11-1 Example of Static Routing Topology.........................................................................................11-1 Figure 11-2 Menu 12: IP Static Route Setup.................................................................................................11-2 Figure 11-3 Menu 12. 1: Edit IP Static Route ...............................................................................................11-3 List of Figures xvii ZyWALL 2 and ZyWALL 2WE Figure 12-1 How NAT Works .......................................................................................................................12-3 Figure 12-2 NAT Application With IP Alias .................................................................................................12-4 Figure 12-3 Menu 4: Applying NAT for Internet Access..............................................................................12-7 Figure 12-4 Menu 11.3: Applying NAT to the Remote Node .......................................................................12-8 Figure 12-5 Menu 15: NAT Setup ................................................................................................................12-9 Figure 12-6 Menu 15.1: Address Mapping Sets ...........................................................................................12-9 Figure 12-7 Menu 15.1.255: SUA Address Mapping Rules .......................................................................12-10 Figure 12-8 Menu 15.1.1: First Set.............................................................................................................12-11 Figure 12-9 Menu 15.1.1.1: Editing/Configuring an Individual Rule in a Set............................................12-13 Figure 12-10 Menu 15.2: NAT Server Setup ..............................................................................................12-16 Figure 12-11 Multiple Servers Behind NAT Example................................................................................12-16 Figure 12-12 NAT Example 1.....................................................................................................................12-17 Figure 12-13 Menu 4: Internet Access & NAT Example ............................................................................12-17 Figure 12-14 NAT Example 2.....................................................................................................................12-18 Figure 12-15 Menu 15.2: Specifying an Inside Server ...............................................................................12-19 Figure 12-16 NAT Example 3.....................................................................................................................12-20 Figure 12-17 Example 3: Menu 11.3 ..........................................................................................................12-21 Figure 12-18 Example 3: Menu 15.1.1.1 ....................................................................................................12-21 Figure 12-19 Example 3: Final Menu 15.1.1 ..............................................................................................12-22 Figure 12-20 Example 3: Menu 15.2 ..........................................................................................................12-22 Figure 12-21 NAT Example 4.....................................................................................................................12-23 Figure 12-22 Example 4: Menu 15.1.1.1: Address Mapping Rule .............................................................12-24 Figure 12-23 Example 4: Menu 15.1.1: Address Mapping Rules...............................................................12-24 Figure 12-24 Trigger Port Forwarding Process: Example ..........................................................................12-25 Figure 12-25 Menu 15.3--Trigger Port Setup............................................................................................12-26 Figure 13-1 ZyWALL Firewall Application .................................................................................................13-3 Figure 13-2 Three-Way Handshake ..............................................................................................................13-5 xviii List of Figures ZyWALL 2 and ZyWALL 2WE Figure 13-3 SYN Flood................................................................................................................................ 13-5 Figure 13-4 Smurf Attack ............................................................................................................................ 13-6 Figure 13-5 Stateful Inspection .................................................................................................................... 13-8 Figure 14-1 Menu 21: Filter and Firewall Setup.......................................................................................... 14-1 Figure 14-2 Menu 21.2: Firewall Setup ....................................................................................................... 14-2 Figure 15-1 Enabling the Firewall ............................................................................................................... 15-2 Figure 15-2 Attack Alert .............................................................................................................................. 15-5 Figure 16-1 LAN to WAN Traffic................................................................................................................ 16-4 Figure 16-2 WAN to LAN Traffic................................................................................................................ 16-4 Figure 16-3 Firewall Rules Summary: First Screen..................................................................................... 16-5 Figure 16-4 Creating/Editing A Firewall Rule ............................................................................................16-11 Figure 16-5 Adding/Editing Source and Destination Addresses ................................................................ 16-13 Figure 16-6 Creating/Editing A Custom Port............................................................................................. 16-14 Figure 16-7 Firewall Rule Configuration Screen Example ........................................................................ 16-16 Figure 16-8 Firewall IP Config Screen Example ....................................................................................... 16-17 Figure 16-9 Custom Port Example............................................................................................................. 16-18 Figure 16-10 Rule Configuration Example ................................................................................................ 16-19 Figure 16-11 Rule Summary Example ....................................................................................................... 16-20 Figure 17-1Content Filter............................................................................................................................. 17-2 Figure 18-1 View Log .................................................................................................................................. 18-2 Figure 18-2 Log Settings.............................................................................................................................. 18-4 Figure 18-3 Reports ..................................................................................................................................... 18-7 Figure 18-4 Web Site Hits Report Example ................................................................................................. 18-9 Figure 18-5 Protocol/Port Report Example................................................................................................ 18-10 Figure 18-6 LAN IP Address Report Example............................................................................................18-11 Figure 19-1 Outgoing Packet Filtering Process ........................................................................................... 19-2 Figure 19-2 Filter Rule Process.................................................................................................................... 19-3 List of Figures xix ZyWALL 2 and ZyWALL 2WE Figure 19-3 Menu 21: Filter and Firewall Setup...........................................................................................19-4 Figure 19-4 Menu 21.1: Filter Set Configuration .........................................................................................19-4 Figure 19-5 Menu 21.1.1.1: TCP/IP Filter Rule ...........................................................................................19-7 Figure 19-6 Executing an IP Filter..............................................................................................................19-10 Figure 19-7 Menu 21.1.4.1: Generic Filter Rule.........................................................................................19-11 Figure 19-8 Telnet Filter Example ..............................................................................................................19-13 Figure 19-9 Example Filter: Menu 21.1.3.1................................................................................................19-14 Figure 19-10 Example Filter Rules Summary: Menu 21.1.3 ......................................................................19-15 Figure 19-11 Protocol and Device Filter Sets .............................................................................................19-16 Figure 19-12 Filtering LAN Traffic ............................................................................................................19-17 Figure 19-13 Filtering Remote Node Traffic ..............................................................................................19-18 Figure 20-1 SNMP Management Model.......................................................................................................20-2 Figure 20-2 Menu 22: SNMP Configuration ................................................................................................20-3 Figure 21-1 Menu 24: System Maintenance .................................................................................................21-1 Figure 21-2 Menu 24.1: System Maintenance: Status (ZyWALL 2WE) .....................................................21-2 Figure 21-3 Menu 24.2: System Information and Console Port Speed.........................................................21-4 Figure 21-4 Menu 24.2.1: System Maintenance: Information ......................................................................21-4 Figure 21-5 Menu 24.2.2: System Maintenance: Change Console Port Speed............................................21-5 Figure 21-6 Menu 24.3: System Maintenance: Log and Trace .....................................................................21-6 Figure 21-7 Examples of Error and Information Messages ..........................................................................21-7 Figure 21-8 Menu 24.3.2: System Maintenance: UNIX Syslog ...................................................................21-7 Figure 21-9 Call-Triggering Packet Example .............................................................................................21-11 Figure 21-10 Menu 24.4: System Maintenance: Diagnostic.......................................................................21-12 Figure 21-11 WAN & LAN DHCP.............................................................................................................21-13 Figure 22-1 Telnet into Menu 24.5 ...............................................................................................................22-3 Figure 22-2 FTP Session Example................................................................................................................22-4 Figure 22-3 System Maintenance: Backup Configuration............................................................................22-7 xx List of Figures ZyWALL 2 and ZyWALL 2WE Figure 22-4 System Maintenance: Starting Xmodem Download Screen..................................................... 22-7 Figure 22-5 Backup Configuration Example ............................................................................................... 22-7 Figure 22-6 Successful Backup Confirmation Screen.................................................................................. 22-7 Figure 22-7 Telnet into Menu 24.6............................................................................................................... 22-9 Figure 22-8 Restore Using FTP Session Example ..................................................................................... 22-10 Figure 22-9 System Maintenance: Restore Configuration ......................................................................... 22-10 Figure 22-10 System Maintenance: Starting Xmodem Download Screen ................................................. 22-10 Figure 22-11 Restore Configuration Example ............................................................................................22-11 Figure 22-12 Successful Restoration Confirmation Screen ........................................................................22-11 Figure 22-13 Telnet Into Menu 24.7.1: Upload System Firmware............................................................. 22-12 Figure 22-14 Telnet Into Menu 24.7.2: System Maintenance .................................................................... 22-13 Figure 22-15 FTP Session Example of Firmware File Upload .................................................................. 22-14 Figure 22-16 Menu 24.7.1 as seen using the Console Port ........................................................................ 22-16 Figure 22-17 Example Xmodem Upload ................................................................................................... 22-16 Figure 22-18 Menu 24.7.2 as seen using the Console Port ........................................................................ 22-17 Figure 22-19 Example Xmodem Upload ................................................................................................... 22-18 Figure 23-1 Command Mode in Menu 24.................................................................................................... 23-1 Figure 23-2 Valid Commands ...................................................................................................................... 23-2 Figure 23-3 Call Control .............................................................................................................................. 23-2 Figure 23-4 Budget Management................................................................................................................. 23-3 Figure 23-5 Call History .............................................................................................................................. 23-4 Figure 23-6 Menu 24: System Maintenance ................................................................................................ 23-5 Figure 23-7 Menu 24.10 System Maintenance: Time and Date Setting....................................................... 23-5 Figure 24-1 Telnet Configuration on a TCP/IP Network ............................................................................. 24-1 Figure 24-2 Menu 24.11 ­ Remote Management Control............................................................................ 24-3 Figure 25-1 Menu 26 - Schedule Setup........................................................................................................ 25-1 Figure 25-2 Schedule Set Setup ................................................................................................................... 25-2 List of Figures xxi ZyWALL 2 and ZyWALL 2WE Figure 25-3 Applying Schedule Set(s) to a Remote Node (PPPoE)..............................................................25-4 Figure 25-4 Applying Schedule Set(s) to a Remote Node (PPTP) ...............................................................25-5 Figure 26-1 Encryption and Decryption .......................................................................................................26-2 Figure 26-2 VPN Application .......................................................................................................................26-3 Figure 26-3 IPSec Architecture.....................................................................................................................26-4 Figure 26-4 Transport and Tunnel Mode IPSec Encapsulation.....................................................................26-5 Figure 27-1 IPSec Summary Fields ..............................................................................................................27-3 Figure 27-2 VPN Summary ..........................................................................................................................27-3 Figure 27-3 NAT Router Between IPSec Routers.........................................................................................27-5 Figure 27-4 Basic IKE VPN Rule Setup.......................................................................................................27-8 Figure 27-5 Two Phases to Set Up the IPSec SA........................................................................................27-12 Figure 27-6 Advanced IKE VPN Rule Setup .................................................................................................27-15 Figure 27-7 Manual IKE VPN Rule Setup.....................................................................................................27-21 Figure 27-8 VPN SA Monitor.....................................................................................................................27-25 Figure 27-9 VPN Global Setting.................................................................................................................27-26 Figure 27-10 Telecommuters Sharing One VPN Rule Example.................................................................27-28 Figure 27-11 Telecommuters Using Unique VPN Rules Example .............................................................27-29 xxii List of Figures ZyWALL 2 and ZyWALL 2WE List of Tables Table 2-1 LED Descriptions........................................................................................................................... 2-2 Table 2-2 ZyWALL Wireless LAN Coverage ................................................................................................ 2-5 Table 4-1 Main Menu Summary .................................................................................................................... 4-3 Table 5-1 General Setup Menu Field ............................................................................................................. 5-2 Table 5-2 Configure Dynamic DNS Menu Fields.......................................................................................... 5-3 Table 6-1 MAC Address Cloning in WAN Setup........................................................................................... 6-2 Table 7-1 Example Of Network Properties For LAN Servers With Fixed IP Addresses ............................... 7-3 Table 7-2 Private IP Address Ranges ............................................................................................................. 7-4 Table 7-3 DHCP Ethernet Setup Menu Fields................................................................................................ 7-7 Table 7-4 LAN TCP/IP Setup Menu Fields.................................................................................................... 7-7 Table 7-5 IP Alias Setup Menu Fields............................................................................................................ 7-9 Table 7-6 Wireless LAN Setup Menu Fields................................................................................................ 7-12 Table 8-1 Wireless LAN................................................................................................................................. 8-3 Table 8-2 Wireless LAN 802.1X Authentication ........................................................................................... 8-6 Table 8-3 Authentication RADIUS ................................................................................................................ 8-7 Table 8-4 Local User Database .................................................................................................................... 8-10 Table 8-5 WLAN MAC Address Filter .........................................................................................................8-11 Table 9-1 Menu 4: Internet Access Setup Menu Fields.................................................................................. 9-1 Table 9-2 New Fields in Menu 4 (PPTP) Screen ........................................................................................... 9-3 Table 9-3 New Fields in Menu 4 (PPPoE) screen .......................................................................................... 9-4 Table 10-1 Fields in Menu 11.1.................................................................................................................... 10-2 Table 10-2 Fields in Menu 11.1 (PPPoE Encapsulation Specific) ............................................................... 10-5 Table 10-3 Fields in Menu 11.1 (PPTP Encapsulation)................................................................................ 10-6 Table 10-4 Remote Node Network Layer Options Menu Fields.................................................................. 10-8 Table 10-5 Menu 11.1: Remote Node Profile (Traffic Redirect Field) ...................................................... 10-12 List of Tables xxiii ZyWALL 2 and ZyWALL 2WE Table 10-6 Traffic Redirect Setup...............................................................................................................10-12 Table 11-1 IP Static Route Menu Fields .......................................................................................................11-3 Table 12-1 NAT Definitions..........................................................................................................................12-1 Table 12-2 NAT Mapping Types...................................................................................................................12-5 Table 12-3 Applying NAT in Menus 4 & 11.3 ..............................................................................................12-8 Table 12-4 SUA Address Mapping Rules ...................................................................................................12-10 Table 12-5 Fields in Menu 15.1.1 ...............................................................................................................12-12 Table 12-6 Menu 15.1.1.1: Editing/Configuring an Individual Rule in a Set .............................................12-13 Table 12-7 Services & Port Numbers .........................................................................................................12-14 Table 12-8 Menu 15.3--Trigger Port Setup Description ............................................................................12-27 Table 13-1 Common IP Ports........................................................................................................................13-4 Table 13-2 ICMP Commands That Trigger Alerts ........................................................................................13-6 Table 13-3 Legal NetBIOS Commands ........................................................................................................13-7 Table 13-4 Legal SMTP Commands.............................................................................................................13-7 Table 15-1 Attack Alert.................................................................................................................................15-5 Table 16-1 Firewall Rules Summary: First Screen .......................................................................................16-5 Table 16-2 Predefined Services ....................................................................................................................16-7 Table 16-3 Creating/Editing A Firewall Rule .............................................................................................16-11 Table 16-4 Adding/Editing Source and Destination Addresses ..................................................................16-13 Table 16-5 Creating/Editing A Custom Port ...............................................................................................16-15 Table 17-1 Content Filter..............................................................................................................................17-2 Table 18-1 View Log ....................................................................................................................................18-2 Table 18-2 Log Settings................................................................................................................................18-5 Table 18-3 Reports........................................................................................................................................18-8 Table 18-4 Web Site Hits Report ..................................................................................................................18-9 Table 18-5 Protocol/Port Report .................................................................................................................18-10 Table 18-6 Protocol/Port Report .................................................................................................................18-11 xxiv List of Tables ZyWALL 2 and ZyWALL 2WE Table 18-7 Reports Specifications.............................................................................................................. 18-12 Table 19-1 Abbreviations Used in the Filter Rules Summary Menu............................................................ 19-5 Table 19-2 Rule Abbreviations Used ........................................................................................................... 19-6 Table 19-3 TCP/IP Filter Rule Menu Fields................................................................................................. 19-7 Table 19-4 Generic Filter Rule Menu Fields.............................................................................................. 19-12 Table 20-1 SNMP Configuration Menu Fields............................................................................................. 20-3 Table 20-2 SNMP Traps............................................................................................................................... 20-4 Table 21-1 System Maintenance: Status Menu Fields.................................................................................. 21-2 Table 21-2 Fields in System Maintenance: Information .............................................................................. 21-5 Table 21-3 System Maintenance Menu Syslog Parameters.......................................................................... 21-8 Table 21-4 System Maintenance Menu Diagnostic.................................................................................... 21-13 Table 22-1 Filename Conventions................................................................................................................ 22-2 Table 22-2 General Commands for GUI-based FTP Clients........................................................................ 22-4 Table 22-3 General Commands for GUI-based TFTP Clients ..................................................................... 22-6 Table 23-1 Budget Management .................................................................................................................. 23-3 Table 23-2 Call History Fields ..................................................................................................................... 23-4 Table 23-3 Time and Date Setting Fields ..................................................................................................... 23-6 Table 24-1 Menu 24.11 ­ Remote Management Control ............................................................................. 24-3 Table 25-1Schedule Set Setup Fields ........................................................................................................... 25-2 Table 26-1 VPN and NAT ............................................................................................................................ 26-6 Table 27-1 AH and ESP ............................................................................................................................... 27-1 Table 27-2 VPN Summary ........................................................................................................................... 27-4 Table 27-3 Local ID Type and Content Fields ............................................................................................. 27-6 Table 27-4 Peer ID Type and Content Fields ............................................................................................... 27-6 Table 27-5 Matching ID Type and Content Configuration Example............................................................ 27-7 Table 27-6 Mismatching ID Type and Content Configuration Example...................................................... 27-7 Table 27-7 Basic IKE VPN Rule Setup........................................................................................................ 27-8 List of Tables xxv ZyWALL 2 and ZyWALL 2WE Table 27-8 Advanced IKE VPN Rule Setup...................................................................................................27-16 Table 27-9 Manual IKE VPN Rule Setup ......................................................................................................27-21 Table 27-10 VPN SA Monitor ....................................................................................................................27-25 Table 27-11 VPN Global Setting ................................................................................................................27-26 Table 27-12 Telecommuter and Headquarters Configuration Example ......................................................27-27 Table 28-1 Troubleshooting the Start-Up of Your ZyWALL ........................................................................28-1 Table 28-2 Troubleshooting the LAN Interface ............................................................................................28-2 Table 28-3 Troubleshooting the WAN interface ...........................................................................................28-2 Table 28-4 Troubleshooting Internet Access.................................................................................................28-3 Table 28-5 Troubleshooting the Password ....................................................................................................28-3 Table 28-6 Troubleshooting Telnet ...............................................................................................................28-3 xxvi List of Tables ZyWALL 2 and ZyWALL 2WE Preface Congratulations on your purchase of the ZyWALL 2/2WE Internet Security Gateway. About This User's Manual This manual is designed to guide you through the configuration of your ZyWALL for its various applications. This manual may refer to the ZyWALL 2/2WE Internet Security Gateway as the ZyWALL. This manual covers the ZyWALL 2 and 2WEmodels. Supported features and the details of the features, vary by model. You may use the System Management Terminal (SMT), web configurator or command interpreter interface to configure your ZyWALL. Not all features can be configured through all interfaces. This User's Guide primarily shows SMT configuration but includes the other interfaces where appropriate. Related Documentation Support Disk Refer to the included CD for support documents. Quick Start Guide The Quick Start Guide is designed to help you get up and running right away. It contains a detailed easy-to-follow connection diagram, default settings, handy checklists and information on setting up your network and configuring for Internet access. Web Configurator Online Help Embedded web help for descriptions of individual screens and supplementary information. Packing List Card The Packing List Card lists all items that should have come in the package. Certifications Refer to the product page at www.zyxel.com for information on product certifications. ZyXEL Glossary and Web Site Please refer to www.zyxel.com for an online glossary of networking terms and additional support documentation. Syntax Conventions · · · "Enter" means for you to type one or more characters and press the carriage return. "Select" or "Choose" means for you to use one of the predefined choices. The SMT menu titles and labels are in Bold Times New Roman font. The choices of a menu item are in Bold Arial font. Preface xxvii ZyWALL 2 and ZyWALL 2WE · · · A single keystroke is in Arial font and enclosed in square brackets, for instance, [ENTER] means the Enter, or carriage return, key; [ESC] means the escape key and [SPACE BAR] means the space bar. [UP] and [DOWN] are the up and down arrow keys. Mouse action sequences are denoted using a comma. For example, "click the Apple icon, Control Panels and then Modem" means first click the Apple icon, then point your mouse pointer to Control Panels and then click Modem. For brevity's sake, we will use "e.g." as a shorthand for "for instance" and "i.e." for "that is" or "in other words" throughout this manual. xxviii Preface Overview Part I: Overview This part covers Getting to Know Your ZyWALL and Hardware Installation. I ZyWALL 2 and ZyWALL 2WE Chapter 1 Getting to Know Your ZyWALL This chapter introduces the main features and applications of the ZyWALL. 1.1 Introducing the ZyWALL 2/2WE Internet Security Gateway The ZyWALL 2 and 2WE (Wireless LAN Embedded) are ideal secure gateways for all data passing between the Internet and the LAN. By integrating NAT, firewall and VPN capability, ZyXEL's ZyWALL 2/2WE is a complete security solution that protects your Intranet and efficiently manages data traffic on your network. The ZyWALL 2WE has a built in wireless LAN that makes it easy for computers with IEEE 802.11b wireless LAN cards to connect to the network and the Internet. The embedded web configurator is easy to operate and totally independent of your operating system platform. 1.2 1.2.1 Features Physical Features Here is a list of the ZyWALL's key features. 4-Port Switch A combination of switch and router makes your ZyWALL a cost-effective and viable network solution. You can connect up to four computers to the ZyWALL without the cost of a hub. Use a hub to add more than four computers to your LAN. Auto-negotiating 10/100 Mbps Ethernet LAN The LAN interfaces automatically detect if they are on a 10 or a 100 Mbps Ethernet. Auto-sensing 10/100 Mbps Ethernet LAN The LAN interfaces automatically adjust to either a crossover or straight-through Ethernet cable. Auto-negotiating 10/100 Mbps Ethernet WAN The 10/100 Mbps Ethernet WAN port attaches to the Internet via broadband modem or router and automatically detects if it's on a 10 or a 100 Mbps Ethernet. Getting to Know Your ZyWALL 1-1 ZyWALL 2 and ZyWALL 2WE Auxiliary Port The ZyWALL 2 and 2WE use the same port for console management and for an auxiliary WAN backup. The AUX port can be used in reserve as a traditional dial-up connection when/if ever the broadband connection to the WAN port fails. 1 Time and Date The ZyWALL allows you to get the current time and date from an external server when you turn on your ZyWALL. You can also set the time manually. Reset Button The ZyWALL reset button is built into the rear panel. Use this button to restore the factory default password to 1234; IP address to 192.168.1.1, subnet mask to 255.255.255.0 and DHCP server enabled with a pool of 32 IP addresses starting at 192.168.1.33. IEEE 802.11b 11 Mbps Wireless LAN The ZyWALL 2WE has an internal 11 Mbps wireless LAN card that provides mobility and a fast network environment for small and home offices. You can connect to the local area network without any wiring efforts and enjoy reliable high-speed connectivity. 1.2.2 Non-Physical Features IPSec VPN Capability Establish Virtual Private Network (VPN) tunnels to connect (home) office computers to your company network using data encryption and the Internet; thus providing secure communications without the expense of leased site-to-site lines. The ZyWALL VPN is based on the IPSec standard and is fully interoperable with other IPSec-based VPN products. The ZyWALL supports two simultaneous VPN connections. Firewall The ZyWALL has a stateful inspection firewall with DoS (Denial of Service) protection. By default, when the firewall is activated, all incoming traffic from the WAN to the LAN is blocked unless it is initiated from the LAN. The ZyWALL firewall supports TCP/UDP inspection, DoS detection and protection, real time alerts, reports and logs. EAP (RFC2284) The ZyWALL 2WE uses EAP (Extensible Authentication Protocol). EAP supports multiple authentication methods to ensure the highest security level available. 1 The auxiliary port function was not available at the time of writing. Getting to Know Your ZyWALL 1-2 ZyWALL 2 and ZyWALL 2WE RADIUS (RFC2138, 2139) The ZyWALL 2WE uses RADIUS (Remote Authentication Dial In User Service) to have a server handle authentication, authorization and accounting for your wireless network. IEEE 802.1x for Network Security The ZyWALL 2WE supports the IEEE 802.1x standard that works with the IEEE 802.11 to enhance user authentication. With the local user profile, the ZyWALL allows you to configure up to 32 user profiles without a network authentication server. In addition, centralized user and accounting management is possible on an optional network authentication server. Wireless LAN MAC Address Filtering The ZyWALL 2WE allows you to use MAC Address Filtering together with ESSID (Extended Service Set IDentifier) and WEP (Wired Equivalent Privacy) to provide security for your wireless LAN. Brute-Force Password Guessing Protection The ZyWALL has a special protection mechanism to discourage brute-force password guessing attacks on the ZyWALL's management interfaces. You can specify a wait-time that must expire before entering a fourth password after three incorrect passwords have been entered. Please see the appendices for details about this feature. Content Filtering The ZyWALL can block web features such as ActiveX controls, Java applets and cookies, as well as disable web proxies. The ZyWALL can block specific URLs by using the keyword feature. It also allows the administrator to define time periods and days during which content filtering is enabled. Packet Filtering The packet filtering mechanism blocks unwanted traffic from entering/leaving your network. Universal Plug and Play (UPnP) Using the standard TCP/IP protocol, the ZyWALL and other UPnP enabled devices can dynamically join a network, obtain an IP address and convey its capabilities to other devices on the network. Call Scheduling Configure call time periods to restrict and allow access for users on remote nodes. PPPoE PPPoE facilitates the interaction of a host with an Internet modem to achieve access to high-speed data networks via a familiar "dial-up networking" user interface. PPTP Encapsulation Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables secure transfer of data from a remote client to a private server, creating a Virtual Private Network (VPN) using a TCP/IP-based network. Getting to Know Your ZyWALL 1-3 ZyWALL 2 and ZyWALL 2WE PPTP supports on-demand, multi-protocol and virtual private networking over public networks, such as the Internet. The ZyWALL supports one PPTP server connection at any given time. Dynamic DNS Support With Dynamic DNS (Domain Name System) support, you can have a static hostname alias for a dynamic IP address, allowing the host to be more easily accessible from various locations on the Internet. You must register for this service with a Dynamic DNS service provider. IP Multicast Deliver IP packets to a specific group of hosts using IP multicast. IGMP (Internet Group Management Protocol) is the protocol used to support multicast groups. The latest version is version 2 (see RFC 2236); the ZyWALL supports both versions 1 and 2. IP Alias IP Alias allows you to partition a physical network into logical networks over the same Ethernet interface. The ZyWALL supports three logical LAN interfaces via its single physical Ethernet LAN interface with the ZyWALL itself as the gateway for each LAN network. Central Network Management Central Network Management (CNM) allows an enterprise or service provider network administrator to manage your ZyWALL. The enterprise or service provider network administrator can configure your ZyWALL, perform firmware upgrades and do troubleshooting for you. SNMP SNMP (Simple Network Management Protocol) is a protocol used for exchanging management information between network devices. SNMP is a member of the TCP/IP protocol suite. Your ZyWALL supports SNMP agent functionality, which allows a manager station to manage and monitor the ZyWALL through the network. The ZyWALL supports SNMP version one (SNMPv1). Network Address Translation (NAT) NAT (Network Address Translation - NAT, RFC 1631) allows the translation of multiple IP addresses used within one network to different IP addresses known within another network. Traffic Redirect Traffic Redirect forwards WAN traffic to a backup gateway when the ZyWALL cannot connect to the Internet, thus acting as an auxiliary backup when your regular WAN connection fails. Port Forwarding Use this feature to forward incoming service requests to a server on your local network. You may enter a single port number or a range of port numbers to be forwarded, and the local IP address of the desired server. 1-4 Getting to Know Your ZyWALL ZyWALL 2 and ZyWALL 2WE DHCP (Dynamic Host Configuration Protocol) DHCP (Dynamic Host Configuration Protocol) allows the individual client computers to obtain the TCP/IP configuration at start-up from a centralized DHCP server. The ZyWALL has built-in DHCP server capability, enabled by default, which means it can assign IP addresses, an IP default gateway and DNS servers to all systems that support the DHCP client. The ZyWALL can also act as a surrogate DHCP server (DHCP Relay) where it relays IP address assignment from another DHCP server to the clients. Full Network Management The embedded web configurator is an all-platform web-based utility that allows you to easily access the ZyWALL's management settings and configure the firewall. The ZyWALL also provides the SMT (System Management Terminal) interface. The SMT is a menu-driven interface that you can access from a terminal emulator through the console port or over a telnet connection. RoadRunner Support In addition to standard cable modem services, the ZyWALL supports Time Warner's RoadRunner Service. Logging and Tracing Built-in message logging and packet tracing. Unix syslog facility support. Firewall logs. Content filtering logs. Upgrade ZyWALL Firmware The firmware of the ZyWALL can be upgraded via the console port or the LAN. Embedded FTP and TFTP Servers The ZyWALL's embedded FTP and TFTP Servers enable fast firmware upgrades as well as configuration file backups and restoration. 1.3 1.3.1 Applications for the ZyWALL Secure Broadband Internet Access and VPN You can connect a cable, DSL or wireless modem to the ZyWALL via Ethernet for broadband Internet access. The ZyWALL also provides IP address sharing and a firewall-protected local network with traffic management. ZyWALL VPN is an ideal cost-effective way to connect branch offices and business partners over the Internet without the need (and expense) of leased lines between sites. Two of the LAN computers can use VPN tunnels for secure connections to remote computers. Getting to Know Your ZyWALL 1-5 ZyWALL 2 and ZyWALL 2WE Figure 1-1 Secure Internet Access and VPN Application 1.3.2 Wireless LAN Application The ZyWALL 2WE is an ideal access solution for wireless Internet connections for a small office or home environment. A typical Internet access application is shown next. Figure 1-2 ZyWALL 2WE Wireless LAN Application 1-6 Getting to Know Your ZyWALL ZyWALL 2 and ZyWALL 2WE Chapter 2 Hardware Installation This chapter explains the LEDs and ports as well as how to connect the hardware. The wireless LAN information applies to the ZyWALL 2WE only. 2.1 Introduction to Hardware Installation This chapter provides graphics of the front and rear panels, descriptions of the ZyWALL's front panel LEDs and hardware connection instructions. 2.2 Front Panels LEDs The LEDs on the front panel indicate the operational status of the ZyWALL. Figure 2-1 ZyWALL 2WE Front Panel Hardware Installation 2-1 ZyWALL 2 and ZyWALL 2WE Figure 2-2 ZyWALL 2 Front Panel 2.3 LED Descriptions Table 2-1 LED Descriptions The following table describes the LED functions. The SYS and WLAN LEDs apply to the ZyWALL 2WE. LED PWR STATUS Green Light on Light flashing Green Light off Green Light on Light flashing Red Light on Green light Orange light Both lights off Light flashing Green light Orange light Light off Light flashing LED DESCRIPTION The ZyWALL is on and receiving power. The ZyWALL is performing a self-test. The ZyWALL is not receiving power. The ZyWALL is ready. The ZyWALL is performing a self-test. The ZyWALL is experiencing low voltage. The ZyWALL has a LAN connection of 10Mbps. The ZyWALL has a LAN connection of 100Mbps. The ZyWALL does not have an Ethernet connection. The ZyWALL is sending/receiving packets. The WAN link is connected at 10Mbps. The WAN link is connected at 100Mbps. The WAN link is not ready, or has failed. The WAN link is sending/receiving packets. The CON/AUX switch is set to CON, the CON/AUX port is connected to a management computer and someone is logged into the ZyWALL. The CON/AUX switch is set to AUX and the CON/AUX port has an Internet connection through a dial-up modem. The CON/AUX link is not ready, or has failed. The CON/AUX switch is set to AUX and the CON/AUX port is sending or receiving data through a dial-up modem or ISDN TA. The Wireless LAN feature is enabled. The Wireless LAN link is not ready, or has failed. The Wireless LAN link is sending/receiving packets. SYS LAN 10/100M 1-4 WAN CON/AUX Green light Orange light Light off Light flashing WLAN Light on Light off Light flashing 2-2 Hardware Installation ZyWALL 2 and ZyWALL 2WE 2.4 ZyWALL Rear Panels and Connections The following figure shows the rear panels of the ZyWALL. Figure 2-3 ZyWALL 2WE Rear Panel Figure 2-4 ZyWALL 2 Rear Panel 2.5 Hardware Connections This section outlines how to connect your ZyWALL. If you want to connect a cable modem, you must connect the coaxial cable from your cable service to the threaded coaxial cable connector on the back of the Hardware Installation 2-3 ZyWALL 2 and ZyWALL 2WE cable modem. Connect a DSL modem to the DSL wall jack. See the Safety Warnings and Instructions Appendix for safety instructions when making connections to the ZyWALL. 2.5.1 Connecting a Broadband Modem to the WAN Port Connecting the ZyWALL to a cable modem: Connect the port labeled WAN on the ZyWALL to the Ethernet port on the cable modem using the Ethernet cable that came with your cable modem. The Ethernet port on a cable modem is sometimes labeled "PC" or "Workstation". Connecting the ZyWALL to a DSL modem: Connect the port labeled WAN on the ZyWALL to the Ethernet port on the DSL modem using the Ethernet cable that came with your DSL modem. Connecting the ZyWALL to a wireless modem: Connect the port labeled WAN on the ZyWALL to the Ethernet port on the wireless modem using the Ethernet cable that came with your wireless modem. You need a cable/DSL/wireless modem and an ISP account. 2.5.2 Connecting the Console Port Use terminal emulator software on a computer for configuring your ZyWALL via console port. Connect the 9-pin male end of the console cable to the port labeled CON/AUX on the ZyWALL and push the CON/AUX switch to CON. Connect the other end to a serial port (COM1, COM2 or other COM port) on your computer. You can use an extension console cable if the enclosed one is not long enough. 2.5.3 Connecting the AUX Port The console port is also the auxiliary WAN port. Push the CON/AUX switch to AUX and use the included CON/AUX converter with the console cable to connect the CON/AUX port to your modem or TA. 2.5.4 LAN 10/100M Ports You can connect up to four computers with Ethernet cards directly to the ZyWALL's LAN ports. For each computer, connect a 10/100M LAN port on the ZyWALL to the Ethernet card on the computer using an Ethernet cable. If you want to connect more than four computers to your ZyWALL, you must use an external hub. Connect a 10/100M LAN port on the ZyWALL to a port on the hub using an Ethernet cable. When the ZyWALL is on and properly connected to a computer or a hub, the corresponding LAN LED on the front panel turns on. 2.5.5 Connecting the Power to your ZyWALL Connect the included power adaptor to the socket labeled POWER on the rear panel of your ZyWALL. 2-4 Hardware Installation ZyWALL 2 and ZyWALL 2WE 2.5.6 Antennas The ZyWALL 2WE is equipped with two reverse SMA connectors and two detachable omni-directional 2dBi antennas to provide a clear radio signal between the wireless stations and the access points. Refer to the Antennas appendix for more information. The following table shows the ZyWALL's coverage (in meters) using the included antennas. The distance may differ depending on the network environment. Table 2-2 ZyWALL Wireless LAN Coverage 11 Mbps Indoor Outdoor 50 m 200 m 5.5 Mbps 80 m 300 m 2.6 Hardware Mounting Options The ZyWALL may be placed on a flat surface or wall-mounted. In general, the best location to place the access point is at the center of your intended wireless coverage area. For better performance, mount the ZyWALL in a high position free of obstructions. To keep the ZyWALL operating at optimal internal temperature, keep the bottom, sides and rear clear of obstructions and away from the exhaust of other equipment. 2.7 1. 2. 3. 4. Additional Installation Requirements for Using 802.1x A computer with an IEEE 802.11b wireless LAN card. A computer equipped with a web browser (with JavaScript enabled) and/or Telnet. A wireless client computer must be running IEEE 802.1x-compliant software. Currently, this is offered in Windows XP. An optional network RADIUS server for remote user authentication and accounting. 2.8 Turning On Your ZyWALL At this point, you should have connected the console port, the LAN port, the WAN port, the Wireless LAN port and the power port to the appropriate devices or lines. Plug the power cord or power adaptor into an appropriate power source. For models that have a power switch, push the power switch to the on position. The PWR LED turns on. The PWR LED (ZyWALL 2) or the SYS LED (ZyWALL 2WE) blinks while the ZyWALL performs system testing and then stays on if the testing is successful. The WAN LED, WLAN LED and one of the LAN LEDs turn on immediately after the PWR or SYS LED stops blinking and stays on, if connections have been made to the LAN and WAN ports. Hardware Installation 2-5 Initial Setup and Configuration Part II: Initial Setup and Configuration This part covers Introducing the Web Configurator, Introducing the SMT, SMT Menu 1 General Setup, WAN Setup, LAN Setup, Wireless LAN Security and Internet Access. II ZyWALL 2 and ZyWALL 2WE Chapter 3 Introducing the Web Configurator This chapter describes how to access and navigate the ZyWALL web configurator. 3.1 Introduction to the Web Configurator The embedded web configurator is easy to navigate and use to configure the ZyWALL. The web configurator is independent of the operating system platform you use. Use the directions in this chapter in order to access and navigate the web configurator. 3.2 Step 1. Step 2. Step 3. Step 4. Step 5. Step 6. Accessing the ZyWALL Web Configurator Make sure your ZyWALL hardware is properly connected (refer to instructions in the Hardware Installation chapter). Prepare your computer/computer network to connect to the ZyWALL (refer to the Quick Start Guide). Launch your web browser. Type "192.168.1.1" as the URL. Type "1234" (default) as the password and click Login. In some versions, the default password appears automatically - if this is the case, click Login. You should see a screen asking you to change your password (highly recommended) as shown next. Type a new password (and retype it to confirm) and click Apply or click Ignore. Step 7. Figure 3-1 Change Password Screen You should now see the MAIN MENU screen. Introducing the Web Configurator 3-1 ZyWALL 2 and ZyWALL 2WE The ZyWALL automatically times out after five minutes of inactivity. Simply log back into the ZyWALL if this happens to you. 3.3 Web Configurator Navigation Click a link on the navigation panel on the left to open a screen or a submenu. Click WIZARD SETUP for initial configuration including general setup, ISP parameters for Internet Access and WAN IP/DNS Server/MAC address assignment. Use submenus to configure ZyWALL features. Click LOGOUT at any time to exit the web configurator. Click MAINTENANCE to view information about your ZyWALL or upgrade configuration/firmware files. Maintenance includes SYSTEM STATUS (Statistics), DHCP TABLE, F/W (firmware) UPGRADE and CONFIGURATION (Backup, Restore Default). Figure 3-2 Web Configurator Main Menu The rest of this User's Guide shows you how to configure the SMT menus except where no SMT menus exist for certain features such as UPnP and the firewall. For web configurator screens that have SMT menu equivalents, read this guide for background information, but refer to the web screen online help for actual screen configuration. 3-2 Introducing the Web Configurator ZyWALL 2 and ZyWALL 2WE Chapter 4 Introducing the SMT This chapter explains how to perform the initial ZyWALL setup and gives an overview of SMT menus. 4.1 Introduction to the SMT The ZyWALL's SMT (System Management Terminal) is a menu-driven interface that you can access from a terminal emulator through the console port or over a telnet connection. This chapter shows you how to access the SMT (System Management Terminal) menus via console port, how to navigate the SMT and how to configure SMT menus. 4.2 Accessing the Console Port via the Console Port Make sure you have the physical connection properly set up as described in the hardware installation chapter. In addition to the contents of your package, you need a computer equipped with communications software configured to the following parameters: VT100 terminal emulation. 9600 Baud. No parity, 8 data bits, 1 stop bit, flow control set to none. 4.2.1 Initial Screen When you turn on your ZyWALL, it performs several internal tests as well as line initialization. After the tests, the ZyWALL asks you to press [ENTER] to continue, as shown next. Copyright (c) 1994 - 2002 ZyXEL Communications Corp. initialize ch =0, ethernet address: 00:a0:c5:41:51:61 initialize ch =1, ethernet address: 00:a0:c5:41:51:62 Press ENTER to continue... Figure 4-1 Initial Screen 4.2.2 Entering the Password The login screen appears after you press [ENTER], prompting you to enter the password, as shown below. For your first login, enter the default password "1234". As you type the password, the screen displays an "X" for each character you type. Introducing the SMT 4-1 ZyWALL 2 and ZyWALL 2WE Please note that if there is no activity for longer than five minutes after you log in, your ZyWALL automatically logs you out and displays a blank screen. If you see a blank screen, press [ENTER] to bring up the login screen again. Enter Password : XXXX Figure 4-2 Password Screen 4.3 Navigating the SMT Interface The SMT (System Management Terminal) is the interface that you use to configure your ZyWALL. Several operations that you should be familiar with before you attempt to modify the configuration are listed in the table below. OPERATION Move down to another menu Move up to a previous menu Move to a "hidden" menu DESCRIPTION To move forward to a submenu, type in the number of the desired submenu and press [ENTER]. Press the [ESC] key to move back to the previous menu. Fields beginning with "Edit" lead to hidden menus and have a default setting of No. Press [SPACE BAR] to change No to Yes, and then press [ENTER] to go to a "hidden" menu. Move the cursor Within a menu, press [ENTER] to move to the next field. You can also use the [UP]/[DOWN] arrow keys to move to the previous and the next field, respectively. Entering information You need to fill in two types of fields. The first requires you to type in the appropriate information. The second allows you to cycle through the available choices by pressing [SPACE BAR], and then pressing [ENTER] to select your choice and move to the next field. All fields with the symbol or ChangeMe must be filled in order be able to save the new configuration. Some of the fields in the SMT will show a . This symbol refers to an option that is Not Applicable. Save your configuration by pressing [ENTER] at the message "Press ENTER to confirm or ESC to cancel". Saving the data on the screen will take you, in most cases to the previous menu. Type 99 at the main menu prompt and press [ENTER] to exit the SMT interface. Required fields N/A fields Save your configuration Exit the SMT 4-2 Introducing the SMT ZyWALL 2 and ZyWALL 2WE 4.3.1 Main Menu After you enter the password, the SMT displays the ZyWALL Main Menu, as shown next. Copyright (c) 1994 - 2001 ZyXEL Communications Corp. ZyWALL 2WE Main Menu Getting Started Advanced Management 1. General Setup 21. Filter and Firewall Setup 2. WAN Setup 22. SNMP Configuration 3. LAN Setup 23. System Password 24. System Maintenance 4. Internet Access Setup 26. Schedule Setup 27. VPN/IPSec Setup Advanced Applications 11. Remote Node Setup 12. Static Routing Setup 15. NAT Setup 99. Exit Enter Menu Selection Number: Figure 4-3 Main Menu (ZyWALL 2WE) 4.3.2 NO. 1 2 3 4 11 12 15 21 22 System Management Terminal Interface Summary Table 4-1 Main Menu Summary MENU TITLE General Setup WAN Setup LAN Setup Internet Access Setup Remote Node Setup Static Routing Setup NAT Setup Filter and Firewall Setup SNMP Configuration FUNCTION Use this menu to set up dynamic DNS and administrative information. Use this menu to clone a MAC address from a computer on your LAN. Use this menu to apply LAN filters, configure LAN DHCP and TCP/IP settings and configure the wireless LAN port (not available on all models). Configure your Internet Access setup (Internet address, gateway, login, etc.) with this menu. Use this menu to configure detailed remote node settings (your ISP is also a remote node) as well as apply WAN filters. Configure IP static routes in this menu. Use this menu to configure Network Address Translation. Configure filters, activate/deactivate the firewall and view the firewall log. Use this menu to configure SNMP-related parameters. Introducing the SMT 4-3 ZyWALL 2 and ZyWALL 2WE Table 4-1 Main Menu Summary NO. 23 24 26 27 99 MENU TITLE System Password System Maintenance Schedule Setup VPN /IPSec Setup Exit FUNCTION Change your password in this menu (recommended). From displaying system status to uploading firmware, this menu provides comprehensive system maintenance. Use this menu to schedule outgoing calls. Use this menu to configure VPN connections. Use this menu to exit (necessary for remote configuration). 4.3.3 SMT Menus at a Glance The available SMT screens vary by ZyWALL model. The wireless LAN SMT menus apply to the ZyWALL 2WE. 4-4 Introducing the SMT