Document Outline

• User’s Guide
  • About This User's Guide
  • Document Conventions
  • Safety Warnings
  • Contents Overview
  • Table of Contents
  • List of Figures
  • List of Tables
• Introduction and Registration
  • Getting to Know Your ZyWALL
    • 1.1 ZyWALL Internet Security Appliance Overview
    • 1.2 Applications for the ZyWALL
    • 1.2.1 Secure Broadband Internet Access via Cable or DSL Modem
    • 1.2.2 VPN Application
    • 1.3 Ways to Manage the ZyWALL
    • 1.4 Good Habits for Managing the ZyWALL
    • 1.5 LEDs
  • Introducing the Web Configurator
    • 2.1 Web Configurator Overview
    • 2.2 Accessing the ZyWALL Web Configurator
    • 2.3 Resetting the ZyWALL
    • 2.3.1 Procedure To Use The Reset Button
    • 2.3.2 Uploading a Configuration File Via Console Port
    • 2.4 Navigating the ZyWALL Web Configurator
    • 2.4.1 Title Bar
    • 2.4.2 Main Window
      • 2.4.3 HOME Screen: Router Mode
      • 2.4.4 HOME Screen: Bridge Mode
    • 2.4.5 Navigation Panel
      • 2.4.6 Port Statistics
      • 2.4.7 DHCP Table Screen
      • 2.4.8 VPN Status
      • 2.4.9 Bandwidth Monitor
  • Wizard Setup
    • 3.1 Wizard Setup Overview
    • 3.2 Internet Access
    • 3.2.1 ISP Parameters
      • 3.2.2 Internet Access Wizard: Second Screen
      • 3.2.3 Internet Access Wizard: Registration
    • 3.3 VPN Wizard Gateway Setting
    • 3.4 VPN Wizard Network Setting
    • 3.5 VPN Wizard IKE Tunnel Setting (IKE Phase 1)
    • 3.6 VPN Wizard IPSec Setting (IKE Phase 2)
    • 3.7 VPN Wizard Status Summary
    • 3.8 VPN Wizard Setup Complete
  • Tutorials
    • 4.1 Security Settings for VPN Traffic
    • 4.1.1 Firewall Rule for VPN Example
    • 4.1.2 Configuring the VPN Rule
    • 4.1.3 Configuring the Firewall Rules
    • 4.2 Using NAT with Multiple Public IP Addresses
    • 4.2.1 Example Parameters and Scenario
    • 4.2.2 Configuring the WAN Connection with a Static IP Address
    • 4.2.3 Public IP Address Mapping
    • 4.2.4 Forwarding Traffic from the WAN to a Local Computer
    • 4.2.5 Allow WAN-to-LAN Traffic through the Firewall
    • 4.2.6 Testing the Connections
    • 4.3 Using NAT with Multiple Game Players
    • 4.4 How to Manage the ZyWALL’s Bandwidth
    • 4.4.1 Example Parameters and Scenario
    • 4.4.2 Configuring Bandwidth Management Rules
    • 4.5 Configuring Content Filtering
    • 4.5.1 Enable Content Filtering
    • 4.5.2 Block Categories of Web Content
    • 4.5.3 Assign Bob’s Computer a Specific IP Address
    • 4.5.4 Create a Content Filter Policy for Bob
    • 4.5.5 Set the Content Filter Schedule
    • 4.5.6 Block Categories of Web Content for Bob
  • Registration
    • 5.1 myZyXEL.com overview
    • 5.1.1 Content Filtering Subscription Service
    • 5.2 Registration
    • 5.3 Service
• Network
  • LAN Screens
    • 6.1 LAN, WAN and the ZyWALL
    • 6.2 IP Address and Subnet Mask
    • 6.2.1 Private IP Addresses
    • 6.3 DHCP
    • 6.3.1 IP Pool Setup
    • 6.4 RIP Setup
    • 6.5 Multicast
    • 6.6 WINS
    • 6.7 LAN
    • 6.8 LAN Static DHCP
    • 6.9 LAN IP Alias
    • 6.10 LAN Port Roles
  • Bridge Screens
    • 7.1 Bridge Loop
    • 7.2 Spanning Tree Protocol (STP)
    • 7.2.1 Rapid STP
    • 7.2.2 STP Terminology
    • 7.2.3 How STP Works
    • 7.2.4 STP Port States
    • 7.3 Bridge
    • 7.4 Bridge Port Roles
  • WAN Screens
    • 8.1 WAN Overview
    • 8.2 TCP/IP Priority (Metric)
    • 8.3 WAN Route
    • 8.4 WAN IP Address Assignment
    • 8.5 DNS Server Address Assignment
    • 8.6 WAN MAC Address
    • 8.7 WAN
    • 8.7.1 WAN Ethernet Encapsulation
    • 8.7.2 PPPoE Encapsulation
    • 8.7.3 PPTP Encapsulation
    • 8.8 Traffic Redirect
    • 8.9 Configuring Traffic Redirect
    • 8.10 Configuring Dial Backup
    • 8.11 Advanced Modem Setup
    • 8.11.1 AT Command Strings
    • 8.11.2 DTR Signal
    • 8.11.3 Response Strings
    • 8.12 Configuring Advanced Modem Setup
  • DMZ Screens
    • 9.1 DMZ
    • 9.2 Configuring DMZ
    • 9.3 DMZ Static DHCP
    • 9.4 DMZ IP Alias
    • 9.5 DMZ Public IP Address Example
    • 9.6 DMZ Private and Public IP Address Example
    • 9.7 DMZ Port Roles
  • Wireless LAN
    • 10.1 Wireless LAN Introduction
    • 10.2 Configuring WLAN
    • 10.3 WLAN Static DHCP
    • 10.4 WLAN IP Alias
    • 10.5 WLAN Port Roles
• Security
  • Firewall
    • 11.1 Firewall Overview
    • 11.2 Packet Direction Matrix
    • 11.3 Packet Direction Examples
    • 11.3.1 To VPN Packet Direction
    • 11.3.2 From VPN Packet Direction
    • 11.3.3 From VPN To VPN Packet Direction
    • 11.4 Security Considerations
    • 11.5 Firewall Rules Example
    • 11.6 Asymmetrical Routes
    • 11.6.1 Asymmetrical Routes and IP Alias
    • 11.7 Firewall Default Rule (Router Mode)
    • 11.8 Firewall Default Rule (Bridge Mode)
    • 11.9 Firewall Rule Summary
      • 11.9.1 Firewall Edit Rule
    • 11.10 Anti-Probing
    • 11.11 Firewall Thresholds
    • 11.11.1 Threshold Values
    • 11.12 Threshold Screen
    • 11.13 Service
      • 11.13.1 Firewall Edit Custom Service
    • 11.14 My Service Firewall Rule Example
  • Content Filtering Screens
    • 12.1 Content Filtering Overview
    • 12.1.1 Restrict Web Features
    • 12.1.2 Create a Filter List
    • 12.1.3 Customize Web Site Access
    • 12.2 Content Filtering with an External Database
    • 12.3 Content Filter General Screen
    • 12.4 Content Filter Policy
    • 12.5 Content Filter Policy: General
    • 12.6 Content Filter Policy: External Database
    • 12.7 Content Filter Policy: Customization
    • 12.8 Content Filter Policy: Schedule
    • 12.9 Content Filter Object
    • 12.10 Customizing Keyword Blocking URL Checking
    • 12.10.1 Domain Name or IP Address URL Checking
    • 12.10.2 Full Path URL Checking
    • 12.10.3 File Name URL Checking
    • 12.11 Content Filtering Cache
  • Content Filtering Reports
    • 13.1 Checking Content Filtering Activation
    • 13.2 Viewing Content Filtering Reports
    • 13.3 Web Site Submission
  • IPSec VPN
    • 14.1 IPSec VPN Overview
    • 14.1.1 IKE SA Overview
    • 14.2 VPN Rules (IKE)
    • 14.3 IKE SA Setup
    • 14.3.1 IKE SA Proposal
    • 14.4 Additional IPSec VPN Topics
    • 14.4.1 SA Life Time
    • 14.4.2 IPSec High Availability
    • 14.4.3 Encryption and Authentication Algorithms
    • 14.5 VPN Rules (IKE) Gateway Policy Edit
    • 14.6 IPSec SA Overview
    • 14.6.1 Local Network and Remote Network
    • 14.6.2 Virtual Address Mapping
    • 14.6.3 Active Protocol
    • 14.6.4 Encapsulation
    • 14.6.5 IPSec SA Proposal and Perfect Forward Secrecy
    • 14.7 VPN Rules (IKE) Network Policy Edit
    • 14.8 Network Policy Port Forwarding
    • 14.9 Network Policy Move
    • 14.10 IPSec SA Using Manual Keys
    • 14.10.1 IPSec SA Proposal Using Manual Keys
    • 14.10.2 Authentication and the Security Parameter Index (SPI)
    • 14.11 VPN Rules (Manual)
    • 14.12 VPN Rules (Manual) Edit
    • 14.13 VPN SA Monitor
    • 14.14 VPN Global Setting
    • 14.14.1 Local and Remote IP Address Conflict Resolution
    • 14.15 Telecommuter VPN/IPSec Examples
    • 14.15.1 Telecommuters Sharing One VPN Rule Example
    • 14.15.2 Telecommuters Using Unique VPN Rules Example
    • 14.16 VPN and Remote Management
    • 14.17 Hub-and-spoke VPN
    • 14.17.1 Hub-and-spoke VPN Example
    • 14.17.2 Hub-and-spoke Example VPN Rule Addresses
    • 14.17.3 Hub-and-spoke VPN Requirements and Suggestions
  • Certificates
    • 15.1 Certificates Overview
    • 15.1.1 Advantages of Certificates
    • 15.2 Self-signed Certificates
    • 15.3 Verifying a Certificate
    • 15.3.1 Checking the Fingerprint of a Certificate on Your Computer
    • 15.4 Configuration Summary
    • 15.5 My Certificates
    • 15.6 My Certificate Details
    • 15.7 My Certificate Export
    • 15.7.1 Certificate File Export Formats
    • 15.8 My Certificate Import
    • 15.8.1 Certificate File Formats
    • 15.9 My Certificate Create
    • 15.10 Trusted CAs
    • 15.11 Trusted CA Details
    • 15.12 Trusted CA Import
    • 15.13 Trusted Remote Hosts
    • 15.14 Trusted Remote Host Certificate Details
    • 15.15 Trusted Remote Hosts Import
    • 15.16 Directory Servers
    • 15.17 Directory Server Add or Edit
  • Authentication Server
    • 16.1 Authentication Server Overview
    • 16.1.1 Local User Database
    • 16.1.2 RADIUS
    • 16.1.3 Types of RADIUS Messages
    • 16.2 Local User Database
    • 16.3 RADIUS
• Advanced
  • Network Address Translation (NAT)
    • 17.1 NAT Overview
    • 17.1.1 NAT Definitions
    • 17.1.2 What NAT Does
    • 17.1.3 How NAT Works
    • 17.1.4 NAT Application
    • 17.1.5 Port Restricted Cone NAT
    • 17.1.6 NAT Mapping Types
    • 17.2 Using NAT
    • 17.2.1 SUA (Single User Account) Versus NAT
    • 17.3 NAT Overview Screen
    • 17.4 NAT Address Mapping
    • 17.4.1 What NAT Does
      • 17.4.2 NAT Address Mapping Edit
    • 17.5 Port Forwarding
    • 17.5.1 Default Server IP Address
    • 17.5.2 Port Forwarding: Services and Port Numbers
    • 17.5.3 Configuring Servers Behind Port Forwarding (Example)
    • 17.5.4 Port Translation
    • 17.6 Port Forwarding Screen
    • 17.7 Port Triggering
  • Static Route
    • 18.1 IP Static Route
    • 18.2 IP Static Route
      • 18.2.1 IP Static Route Edit
  • Bandwidth Management
    • 19.1 Bandwidth Management Overview
    • 19.2 Bandwidth Classes and Filters
    • 19.3 Proportional Bandwidth Allocation
    • 19.4 Application-based Bandwidth Management
    • 19.5 Subnet-based Bandwidth Management
    • 19.6 Application and Subnet-based Bandwidth Management
    • 19.7 Scheduler
    • 19.7.1 Priority-based Scheduler
    • 19.7.2 Fairness-based Scheduler
    • 19.7.3 Maximize Bandwidth Usage
    • 19.7.4 Reserving Bandwidth for Non-Bandwidth Class Traffic
    • 19.7.5 Maximize Bandwidth Usage Example
    • 19.8 Bandwidth Borrowing
    • 19.8.1 Bandwidth Borrowing Example
    • 19.9 Maximize Bandwidth Usage With Bandwidth Borrowing
    • 19.10 Over Allotment of Bandwidth
    • 19.11 Configuring Summary
    • 19.12 Configuring Class Setup
      • 19.12.1 Bandwidth Manager Class Configuration
      • 19.12.2 Bandwidth Management Statistics
    • 19.13 Bandwidth Manager Monitor
  • DNS
    • 20.1 DNS Overview
    • 20.2 DNS Server Address Assignment
    • 20.3 DNS Servers
    • 20.4 Address Record
    • 20.4.1 DNS Wildcard
    • 20.5 Name Server Record
    • 20.5.1 Private DNS Server
    • 20.6 System Screen
      • 20.6.1 Adding an Address Record
      • 20.6.2 Inserting a Name Server Record
    • 20.7 DNS Cache
    • 20.8 Configure DNS Cache
    • 20.9 Configuring DNS DHCP
    • 20.10 Dynamic DNS
    • 20.10.1 DYNDNS Wildcard
    • 20.11 Configuring Dynamic DNS
  • Remote Management
    • 21.1 Remote Management Overview
    • 21.1.1 Remote Management Limitations
    • 21.1.2 System Timeout
    • 21.2 WWW (HTTP and HTTPS)
    • 21.3 WWW Configuration
    • 21.4 HTTPS Example
    • 21.4.1 Internet Explorer Warning Messages
    • 21.4.2 Netscape Navigator Warning Messages
    • 21.4.3 Avoiding the Browser Warning Messages
    • 21.4.4 Login Screen
    • 21.5 SSH
    • 21.6 How SSH Works
    • 21.7 SSH Implementation on the ZyWALL
    • 21.7.1 Requirements for Using SSH
    • 21.8 Configuring SSH
    • 21.9 Secure Telnet Using SSH Examples
    • 21.9.1 Example 1: Microsoft Windows
    • 21.9.2 Example 2: Linux
    • 21.10 Secure FTP Using SSH Example
    • 21.11 Telnet
    • 21.12 Configuring TELNET
    • 21.13 FTP
    • 21.14 SNMP
    • 21.14.1 Supported MIBs
    • 21.14.2 SNMP Traps
    • 21.14.3 REMOTE MANAGEMENT: SNMP
    • 21.15 DNS
    • 21.16 Introducing Vantage CNM
    • 21.17 Configuring CNM
    • 21.17.1 Additional Configuration for Vantage CNM
  • UPnP
    • 22.1 Universal Plug and Play Overview
    • 22.1.1 How Do I Know If I'm Using UPnP?
    • 22.1.2 NAT Traversal
    • 22.1.3 Cautions with UPnP
    • 22.1.4 UPnP and ZyXEL
    • 22.2 Configuring UPnP
    • 22.3 Displaying UPnP Port Mapping
    • 22.4 Installing UPnP in Windows Example
    • 22.4.1 Installing UPnP in Windows Me
    • 22.4.2 Installing UPnP in Windows XP
    • 22.5 Using UPnP in Windows XP Example
    • 22.5.1 Auto-discover Your UPnP-enabled Network Device
    • 22.5.2 Web Configurator Easy Access
  • Custom Application
    • 23.1 Custom Applicaton
    • 23.2 Custom Applicaton Configuration
  • ALG Screen
    • 24.1 ALG Introduction
    • 24.1.1 ALG and NAT
    • 24.1.2 ALG and the Firewall
    • 24.2 FTP
    • 24.3 H.323
    • 24.4 RTP
    • 24.4.1 H.323 ALG Details
    • 24.5 SIP
    • 24.5.1 STUN
    • 24.5.2 SIP ALG Details
    • 24.5.3 SIP Signaling Session Timeout
    • 24.5.4 SIP Audio Session Timeout
    • 24.6 ALG Screen
• Logs and Maintenance
  • Logs Screens
    • 25.1 Configuring View Log
    • 25.2 Log Description Example
    • 25.2.1 About the Certificate Not Trusted Log
    • 25.3 Configuring Log Settings
    • 25.4 Configuring Reports
    • 25.4.1 Viewing Web Site Hits
    • 25.4.2 Viewing Host IP Address
    • 25.4.3 Viewing Protocol/Port
    • 25.4.4 System Reports Specifications
    • 25.5 Log Descriptions
    • 25.6 Syslog Logs
  • Maintenance
    • 26.1 Maintenance Overview
    • 26.2 General Setup and System Name
      • 26.2.1 General Setup
    • 26.3 Configuring Password
    • 26.4 Time and Date
    • 26.5 Pre-defined NTP Time Server Pools
    • 26.5.1 Resetting the Time
    • 26.5.2 Time Server Synchronization
    • 26.6 Introduction To Transparent Bridging
    • 26.7 Transparent Firewalls
    • 26.8 Configuring Device Mode (Router)
    • 26.9 Configuring Device Mode (Bridge)
    • 26.10 F/W Upload Screen
    • 26.11 Backup and Restore
    • 26.11.1 Backup Configuration
    • 26.11.2 Restore Configuration
    • 26.11.3 Back to Factory Defaults
    • 26.12 Restart Screen
    • 26.13 Diagnostics
• SMT
  • Introducing the SMT
    • 27.1 Introduction to the SMT
    • 27.2 Accessing the SMT via the Console Port
    • 27.2.1 Initial Screen
    • 27.2.2 Entering the Password
    • 27.3 Navigating the SMT Interface
    • 27.3.1 Main Menu
    • 27.3.2 SMT Menus Overview
    • 27.4 Changing the System Password
    • 27.5 Resetting the ZyWALL
  • SMT Menu 1 - General Setup
    • 28.1 Introduction to General Setup
    • 28.2 Configuring General Setup
    • 28.2.1 Configuring Dynamic DNS
  • WAN and Dial Backup Setup
    • 29.1 Introduction to WAN and Dial Backup Setup
    • 29.2 WAN Setup
    • 29.3 Dial Backup
    • 29.4 Configuring Dial Backup in Menu 2
    • 29.5 Advanced WAN Setup
    • 29.6 Remote Node Profile (Backup ISP)
    • 29.7 Editing TCP/IP Options
    • 29.8 Editing Login Script
    • 29.9 Remote Node Filter
  • LAN Setup
    • 30.1 Introduction to LAN Setup
    • 30.2 Accessing the LAN Menus
    • 30.3 LAN Port Filter Setup
    • 30.4 TCP/IP and DHCP Ethernet Setup Menu
    • 30.4.1 IP Alias Setup
  • Internet Access
    • 31.1 Introduction to Internet Access Setup
    • 31.2 Ethernet Encapsulation
    • 31.3 Configuring the PPTP Client
    • 31.4 Configuring the PPPoE Client
    • 31.5 Basic Setup Complete
  • DMZ Setup
    • 32.1 Configuring DMZ Setup
    • 32.2 DMZ Port Filter Setup
    • 32.3 TCP/IP Setup
    • 32.3.1 IP Address
    • 32.3.2 IP Alias Setup
  • Wireless Setup
    • 33.1 TCP/IP Setup
    • 33.1.1 IP Address
    • 33.1.2 IP Alias Setup
  • Remote Node Setup
    • 34.1 Introduction to Remote Node Setup
    • 34.2 Remote Node Setup
    • 34.3 Remote Node Profile Setup
    • 34.3.1 Ethernet Encapsulation
    • 34.3.2 PPPoE Encapsulation
    • 34.3.3 PPTP Encapsulation
    • 34.4 Edit IP
    • 34.5 Remote Node Filter
    • 34.6 Traffic Redirect
  • IP Static Route Setup
    • 35.1 IP Static Route Setup
  • Network Address Translation (NAT)
    • 36.1 Using NAT
    • 36.1.1 SUA (Single User Account) Versus NAT
    • 36.1.2 Applying NAT
    • 36.2 NAT Setup
    • 36.2.1 Address Mapping Sets
    • 36.3 Configuring a Server behind NAT
    • 36.4 General NAT Examples
    • 36.4.1 Internet Access Only
    • 36.4.2 Example 2: Internet Access with a Default Server
    • 36.4.3 Example 3: Multiple Public IP Addresses With Inside Servers
    • 36.4.4 Example 4: NAT Unfriendly Application Programs
    • 36.5 Trigger Port Forwarding
    • 36.5.1 Two Points To Remember About Trigger Ports
  • Introducing the ZyWALL Firewall
    • 37.1 Using ZyWALL SMT Menus
    • 37.1.1 Activating the Firewall
  • Filter Configuration
    • 38.1 Introduction to Filters
    • 38.1.1 The Filter Structure of the ZyWALL
    • 38.2 Configuring a Filter Set
    • 38.2.1 Configuring a Filter Rule
    • 38.2.2 Configuring a TCP/IP Filter Rule
    • 38.2.3 Configuring a Generic Filter Rule
    • 38.3 Example Filter
    • 38.4 Filter Types and NAT
    • 38.5 Firewall Versus Filters
    • 38.5.1 Packet Filtering:
    • 38.5.2 Firewall
    • 38.6 Applying a Filter
    • 38.6.1 Applying LAN Filters
    • 38.6.2 Applying DMZ Filters
    • 38.6.3 Applying Remote Node Filters
  • SNMP Configuration
    • 39.1 SNMP Configuration
    • 39.2 SNMP Traps
  • System Information & Diagnosis
    • 40.1 Introduction to System Status
    • 40.2 System Status
    • 40.3 System Information and Console Port Speed
    • 40.3.1 System Information
    • 40.3.2 Console Port Speed
    • 40.4 Log and Trace
    • 40.4.1 Viewing Error Log
    • 40.4.2 Syslog Logging
    • 40.4.3 Call-Triggering Packet
    • 40.5 Diagnostic
    • 40.5.1 WAN DHCP
  • Firmware and Configuration File Maintenance
    • 41.1 Introduction
    • 41.2 Filename Conventions
    • 41.3 Backup Configuration
    • 41.3.1 Backup Configuration
    • 41.3.2 Using the FTP Command from the Command Line
    • 41.3.3 Example of FTP Commands from the Command Line
    • 41.3.4 GUI-based FTP Clients
    • 41.3.5 File Maintenance Over WAN
    • 41.3.6 Backup Configuration Using TFTP
    • 41.3.7 TFTP Command Example
    • 41.3.8 GUI-based TFTP Clients
    • 41.3.9 Backup Via Console Port
    • 41.4 Restore Configuration
    • 41.4.1 Restore Using FTP
    • 41.4.2 Restore Using FTP Session Example
    • 41.4.3 Restore Via Console Port
    • 41.5 Uploading Firmware and Configuration Files
    • 41.5.1 Firmware File Upload
    • 41.5.2 Configuration File Upload
    • 41.5.3 FTP File Upload Command from the DOS Prompt Example
    • 41.5.4 FTP Session Example of Firmware File Upload
    • 41.5.5 TFTP File Upload
    • 41.5.6 TFTP Upload Command Example
    • 41.5.7 Uploading Via Console Port
    • 41.5.8 Uploading Firmware File Via Console Port
    • 41.5.9 Example Xmodem Firmware Upload Using HyperTerminal
    • 41.5.10 Uploading Configuration File Via Console Port
    • 41.5.11 Example Xmodem Configuration Upload Using HyperTerminal
  • System Maintenance Menus 8 to 10
    • 42.1 Command Interpreter Mode
    • 42.1.1 Command Syntax
    • 42.1.2 Command Usage
    • 42.2 Call Control Support
    • 42.2.1 Budget Management
    • 42.2.2 Call History
    • 42.3 Time and Date Setting
  • Remote Management
    • 43.1 Remote Management
    • 43.1.1 Remote Management Limitations
  • Call Scheduling
    • 44.1 Introduction to Call Scheduling
• Troubleshooting and Specifications
  • Troubleshooting
    • 45.1 Power, Hardware Connections, and LEDs
    • 45.2 ZyWALL Access and Login
    • 45.3 Internet Access
    • 45.4 Wireless Router/AP Troubleshooting
    • 45.5 UPnP
  • Product Specifications
    • 46.1 General ZyWALL Specifications
    • 46.2 Cable Pin Assignments
    • 46.3 Wall-mounting Instructions
• Appendices and Index
  • Setting up Your Computer’s IP Address
  • Pop-up Windows, JavaScripts and Java Permissions
  • IP Addresses and Subnetting
  • Common Services
  • Importing Certificates
  • Legal Information
  • Customer Support
  • Index