Document Outline

• Copyright
• Federal Communications Commission (FCC) Interference Statement
• Safety Warnings
• ZyXEL Limited Warranty
• Customer Support
• Table of Contents
• List of Figures
• List of Tables
• Preface
• 1. Getting to Know Your ZyWALL
  • 1.1 ZyWALL 5 Internet Security Appliance Overview
  • 1.2 ZyWALL Features
    • 1.2.1 Physical Features
    • 1.2.2 Non-Physical Features
  • 1.3 Applications for the ZyWALL
    • 1.3.1 Secure Broadband Internet Access via Cable or DSL Modem
    • 1.3.2 VPN Application
    • 1.3.3 Front Panel LEDs
• 2. Introducing the Web Configurator
  • 2.1 Web Configurator Overview
  • 2.2 Accessing the ZyWALL Web Configurator
  • 2.3 Resetting the ZyWALL
    • 2.3.1 Procedure To Use The Reset Button
    • 2.3.2 Uploading a Configuration File Via Console Port
  • 2.4 Navigating the ZyWALL Web Configurator
    • 2.4.1 Router Mode
    • 2.4.2 Bridge Mode
    • 2.4.3 Navigation Panel
    • 2.4.4 System Statistics
    • 2.4.5 DHCP Table Screen
    • 2.4.6 VPN Status
• 3. Wizard Setup
  • 3.1 Wizard Setup Overview
  • 3.2 Internet Access
    • 3.2.1 ISP Parameters
      • 3.2.1.1 Ethernet
      • 3.2.1.2 PPPoE Encapsulation
      • 3.2.1.3 PPTP Encapsulation
    • 3.2.2 Internet Access Wizard Setup Complete
  • 3.3 VPN Wizard
    • 3.3.1 Network Setting
    • 3.3.2 IKE Tunnel Setting (IKE Phase 1)
    • 3.3.3 IPSec Setting (IKE Phase 2)
    • 3.3.4 VPN Status Summary
    • 3.3.5 VPN Wizard Setup Complete
• 4. LAN Screens
  • 4.1 LAN Overview
  • 4.2 DHCP Setup
    • 4.2.1 IP Pool Setup
  • 4.3 LAN TCP/IP
    • 4.3.1 Factory LAN Defaults
    • 4.3.2 IP Address and Subnet Mask
    • 4.3.3 RIP Setup
    • 4.3.4 Multicast
  • 4.4 DNS Servers
  • 4.5 Configuring LAN
  • 4.6 Configuring Static DHCP
  • 4.7 Configuring IP Alias
  • 4.8 Configuring Port Roles
• 5. Bridge Screens
  • 5.1 Bridge Loop
  • 5.2 Spanning Tree Protocol (STP)
    • 5.2.1 Rapid STP
    • 5.2.2 STP Terminology
    • 5.2.3 How STP Works
    • 5.2.4 STP Port States
  • 5.3 Configuring Bridge
  • 5.4 Configuring Port Roles
• 6. Wireless LAN
  • 6.1 Introduction
    • 6.1.1 Additional Installation Requirements for Using 802.1x
  • 6.2 Wireless Security
    • 6.2.1 Encryption
    • 6.2.2 Authentication
    • 6.2.3 Restricted Access
    • 6.2.4 Hide ZyWALL Identity
  • 6.3 Security Parameters Summary
  • 6.4 WEP Encryption
  • 6.5 802.1x Overview
    • 6.5.1 Introduction to RADIUS
      • 6.5.1.1 Types of RADIUS Messages
    • 6.5.2 EAP Authentication Overview
  • 6.6 Dynamic WEP Key Exchange
  • 6.7 Introduction to WPA
    • 6.7.1 User Authentication
    • 6.7.2 Encryption
  • 6.8 WPA-PSK Application Example
  • 6.9 WPA with RADIUS Application Example
  • 6.10 Wireless Client WPA Supplicants
  • 6.11 Configuring Wireless LAN
    • 6.11.1 Static WEP
    • 6.11.2 WPA-PSK
    • 6.11.3 WPA
    • 6.11.4 802.1x + Dynamic WEP
    • 6.11.5 802.1x + Static WEP
    • 6.11.6 802.1x + No WEP
    • 6.11.7 No Access 802.1x + Static WEP
    • 6.11.8 No Access 802.1x + No WEP
  • 6.12 Configuring MAC Filter
• 7. WAN Screens
  • 7.1 WAN Overview
    • 7.1.1 WAN IP Address Assignment
    • 7.1.2 WAN MAC Address
  • 7.2 TCP/IP Priority (Metric)
  • 7.3 Configuring Route
  • 7.4 Configuring WAN Setup
    • 7.4.1 Ethernet Encapsulation
    • 7.4.2 PPPoE Encapsulation
    • 7.4.3 PPTP Encapsulation
  • 7.5 Traffic Redirect
  • 7.6 Configuring Traffic Redirect
  • 7.7 Configuring Dial Backup
  • 7.8 Advanced Modem Setup
    • 7.8.1 AT Command Strings
    • 7.8.2 DTR Signal
    • 7.8.3 Response Strings
  • 7.9 Configuring Advanced Modem Setup
• 8. DMZ Screens
  • 8.1 DMZ Overview
  • 8.2 Configuring DMZ
  • 8.3 Configuring IP Alias
  • 8.4 DMZ Public IP Address Example
  • 8.5 DMZ Private and Public IP Address Example
  • 8.6 Configuring Port Roles
• 9. Firewalls
  • 9.1 Firewall Overview
  • 9.2 Types of Firewalls
    • 9.2.1 Packet Filtering Firewalls
    • 9.2.2 Application-level Firewalls
    • 9.2.3 Stateful Inspection Firewalls
  • 9.3 Introduction to ZyXEL’s Firewall
  • 9.4 Denial of Service
    • 9.4.1 Basics
    • 9.4.2 Types of DoS Attacks
      • 9.4.2.1 ICMP Vulnerability
      • 9.4.2.2 Illegal Commands (NetBIOS and SMTP)
      • 9.4.2.3 Traceroute
  • 9.5 Stateful Inspection
    • 9.5.1 Stateful Inspection Process
    • 9.5.2 Stateful Inspection and the ZyWALL
    • 9.5.3 TCP Security
    • 9.5.4 UDP/ICMP Security
    • 9.5.5 Upper Layer Protocols
  • 9.6 Guidelines For Enhancing Security With Your Firewall
  • 9.7 Packet Filtering Vs Firewall
    • 9.7.1 Packet Filtering:
      • 9.7.1.1 When To Use Filtering
    • 9.7.2 Firewall
      • 9.7.2.1 When To Use The Firewall
• 10. Firewall Screens
  • 10.1 Access Methods
  • 10.2 Firewall Policies Overview
  • 10.3 Rule Logic Overview
    • 10.3.1 Rule Checklist
    • 10.3.2 Security Ramifications
    • 10.3.3 Key Fields For Configuring Rules
      • 10.3.3.1 Action
      • 10.3.3.2 Service
      • 10.3.3.3 Source Address
      • 10.3.3.4 Destination Address
  • 10.4 Connection Direction Examples
    • 10.4.1 LAN To WAN Rules
    • 10.4.2 WAN To LAN Rules
  • 10.5 Alerts
  • 10.6 Configuring Firewall
    • 10.6.1 Rule Summary
    • 10.6.2 Configuring Firewall Rules
    • 10.6.3 Configuring Custom Services
  • 10.7 Example Firewall Rule
  • 10.8 Predefined Services
  • 10.9 Anti-Probing
  • 10.10 DoS Thresholds
    • 10.10.1 Threshold Values
    • 10.10.2 Half-Open Sessions
      • 10.10.2.1 TCP Maximum Incomplete and Blocking Time
• 11. Content Filtering Screens
  • 11.1 Content Filtering Overview
    • 11.1.1 Restrict Web Features
    • 11.1.2 Create a Filter List
    • 11.1.3 Customize Web Site Access
  • 11.2 General Content Filter Configuration
  • 11.3 Content Filtering with an External Database
  • 11.4 Categories and Registering
  • 11.5 Customization
  • 11.6 Customizing Keyword Blocking URL Checking
    • 11.6.1 Domain Name or IP Address URL Checking
    • 11.6.2 Full Path URL Checking
    • 11.6.3 File Name URL Checking
  • 11.7 Content Filtering Cache
• 12. Content Filtering Registration and Reports
  • 12.1 Introduction to myZyXEL.com
    • 12.1.1 A Note on myZyXEL.com Numbers
  • 12.2 myZyXEL.com Account Registration
  • 12.3 Registering Your ZyXEL Device
  • 12.4 Content Filtering Registration
  • 12.5 Checking Content Filtering Activation
  • 12.6 Updating Product Registration Information
  • 12.7 Viewing Content Filtering Reports
  • 12.8 Configuration File
• 13. Introduction to IPSec
  • 13.1 VPN Overview
    • 13.1.1 IPSec
    • 13.1.2 Security Association
    • 13.1.3 Other Terminology
      • 13.1.3.1 Encryption
      • 13.1.3.2 Data Confidentiality
      • 13.1.3.3 Data Integrity
      • 13.1.3.4 Data Origin Authentication
    • 13.1.4 VPN Applications
      • 13.1.4.1 Linking Two or More Private Networks Together
      • 13.1.4.2 Accessing Network Resources When NAT Is Enabled
      • 13.1.4.3 Unsupported IP Applications
  • 13.2 IPSec Architecture
    • 13.2.1 IPSec Algorithms
    • 13.2.2 Key Management
  • 13.3 Encapsulation
    • 13.3.1 Transport Mode
    • 13.3.2 Tunnel Mode
  • 13.4 IPSec and NAT
• 14. VPN Screens
  • 14.1 VPN/IPSec Overview
  • 14.2 IPSec Algorithms
    • 14.2.1 AH (Authentication Header) Protocol
    • 14.2.2 ESP (Encapsulating Security Payload) Protocol
  • 14.3 My ZyWALL
  • 14.4 Remote Gateway Address
    • 14.4.1 Dynamic Remote Gateway Address
  • 14.5 Nailed Up
  • 14.6 NAT Traversal
    • 14.6.1 NAT Traversal Configuration
  • 14.7 ID Type and Content
    • 14.7.1 ID Type and Content Examples
  • 14.8 IKE Phases
    • 14.8.1 Negotiation Mode
    • 14.8.2 Pre-Shared Key
    • 14.8.3 Diffie-Hellman (DH) Key Groups
    • 14.8.4 Perfect Forward Secrecy (PFS)
  • 14.9 X-Auth (Extended Authentication)
    • 14.9.1 Authentication Server
  • 14.10 Icons Key
  • 14.11 IPSec Summary Fields
  • 14.12 IKE VPN Rule Summary Screen
    • 14.12.1 Configuring an IKE Gateway Policy
    • 14.12.2 Configuring an IKE Network Policy
      • 14.12.2.1 Associating a Network Policy to a Gateway Policy
  • 14.13 Manual VPN Rule Summary Screen
    • 14.13.1 Security Parameter Index (SPI)
    • 14.13.2 Editing Manual VPN Rules
  • 14.14 Viewing SA Monitor
  • 14.15 Configuring Global Setting
  • 14.16 Telecommuter VPN/IPSec Examples
    • 14.16.1 Telecommuters Sharing One VPN Rule Example
    • 14.16.2 Telecommuters Using Unique VPN Rules Example
  • 14.17 VPN and Remote Management
• 15. Certificates
  • 15.1 Certificates Overview
    • 15.1.1 Advantages of Certificates
  • 15.2 Self-signed Certificates
  • 15.3 Configuration Summary
  • 15.4 My Certificates
  • 15.5 Certificate File Formats
  • 15.6 Importing a Certificate
  • 15.7 Creating a Certificate
  • 15.8 My Certificate Details
  • 15.9 Trusted CAs
  • 15.10 Importing a Trusted CA’s Certificate
  • 15.11 Trusted CA Certificate Details
  • 15.12 Trusted Remote Hosts
  • 15.13 Verifying a Trusted Remote Host’s Certificate
    • 15.13.1 Trusted Remote Host Certificate Fingerprints
  • 15.14 Importing a Trusted Remote Host’s Certificate
  • 15.15 Trusted Remote Host Certificate Details
  • 15.16 Directory Servers
  • 15.17 Add or Edit a Directory Server
• 16. Authentication Server
  • 16.1 Authentication Server Overview
  • 16.2 Local User Database
  • 16.3 RADIUS
  • 16.4 Configuring Local User Database
  • 16.5 Configuring RADIUS
• 17. Network Address Translation (NAT)
  • 17.1 NAT Overview
    • 17.1.1 NAT Definitions
    • 17.1.2 What NAT Does
    • 17.1.3 How NAT Works
    • 17.1.4 NAT Application
    • 17.1.5 Port Restricted Cone NAT
    • 17.1.6 NAT Mapping Types
  • 17.2 Using NAT
    • 17.2.1 SUA (Single User Account) Versus NAT
  • 17.3 Configuring NAT Overview
  • 17.4 Configuring Address Mapping
    • 17.4.1 Address Mapping Edit
  • 17.5 Port Forwarding
    • 17.5.1 Default Server IP Address
    • 17.5.2 Port Forwarding: Services and Port Numbers
    • 17.5.3 Configuring Servers Behind Port Forwarding (Example)
    • 17.5.4 Port Translation
  • 17.6 Configuring Port Forwarding
  • 17.7 Configuring Trigger Port
• 18. Static Route
  • 18.1 Static Route Overview
  • 18.2 Configuring IP Static Route
    • 18.2.1 Configuring a Static Route Entry
• 19. Bandwidth Management
  • 19.1 Bandwidth Management Overview
  • 19.2 Bandwidth Classes and Filters
  • 19.3 Proportional Bandwidth Allocation
  • 19.4 Application-based Bandwidth Management
  • 19.5 Subnet-based Bandwidth Management
  • 19.6 Application and Subnet-based Bandwidth Management
  • 19.7 Scheduler
    • 19.7.1 Priority-based Scheduler
    • 19.7.2 Fairness-based Scheduler
  • 19.8 Maximize Bandwidth Usage
    • 19.8.1 Reserving Bandwidth for Non-Bandwidth Class Traffic
    • 19.8.2 Maximize Bandwidth Usage Example
      • 19.8.2.1 Priority-based Allotment of Unused and Unbudgeted Bandwidth
      • 19.8.2.2 Fairness-based Allotment of Unused and Unbudgeted Bandwidth
  • 19.9 Bandwidth Borrowing
    • 19.9.1 Bandwidth Borrowing Example
    • 19.9.2 Maximize Bandwidth Usage With Bandwidth Borrowing
  • 19.10 Configuring Summary
  • 19.11 Configuring Class Setup
    • 19.11.1 Bandwidth Manager Class Configuration
    • 19.11.2 Bandwidth Management Statistics
  • 19.12 Configuring Monitor
• 20. DNS
  • 20.1 DNS Overview
  • 20.2 DNS Server Address Assignment
  • 20.3 DNS Servers
  • 20.4 Address Record
    • 20.4.1 DNS Wildcard
  • 20.5 Name Server Record
    • 20.5.1 Private DNS Server
  • 20.6 The System Screen
    • 20.6.1 Adding an Address Record
    • 20.6.2 Inserting a Name Server record
  • 20.7 DNS Cache
  • 20.8 Configure DNS Cache
  • 20.9 Configuring DNS LAN
  • 20.10 Dynamic DNS
    • 20.10.1 DYNDNS Wildcard
  • 20.11 Configuring Dynamic DNS
• 21. Remote Management
  • 21.1 Remote Management Overview
    • 21.1.1 Remote Management Limitations
    • 21.1.2 Remote Management and NAT
    • 21.1.3 System Timeout
  • 21.2 Introduction to HTTPS
  • 21.3 Configuring WWW
  • 21.4 HTTPS Example
    • 21.4.1 Internet Explorer Warning Messages
    • 21.4.2 Netscape Navigator Warning Messages
    • 21.4.3 Avoiding the Browser Warning Messages
    • 21.4.4 Login Screen
  • 21.5 SSH Overview
  • 21.6 How SSH works
  • 21.7 SSH Implementation on the ZyWALL
    • 21.7.1 Requirements for Using SSH
  • 21.8 Configuring SSH
  • 21.9 Secure Telnet Using SSH Examples
    • 21.9.1 Example 1: Microsoft Windows
    • 21.9.2 Example 2: Linux
  • 21.10 Secure FTP Using SSH Example
  • 21.11 Telnet
  • 21.12 Configuring TELNET
  • 21.13 Configuring FTP
  • 21.14 Configuring SNMP
    • 21.14.1 Supported MIBs
    • 21.14.2 SNMP Traps
    • 21.14.3 REMOTE MANAGEMENT: SNMP
  • 21.15 Configuring DNS
• 22. UPnP
  • 22.1 Universal Plug and Play Overview
    • 22.1.1 How Do I Know If I'm Using UPnP?
    • 22.1.2 NAT Traversal
    • 22.1.3 Cautions with UPnP
  • 22.2 UPnP and ZyXEL
  • 22.3 Configuring UPnP
  • 22.4 Displaying UPnP Port Mapping
  • 22.5 Installing UPnP in Windows Example
    • 22.5.1 Installing UPnP in Windows Me
    • 22.5.2 Installing UPnP in Windows XP
  • 22.6 Using UPnP in Windows XP Example
    • 22.6.1 Auto-discover Your UPnP-enabled Network Device
    • 22.6.2 Web Configurator Easy Access
• 23. Logs Screens
  • 23.1 Configuring View Log
  • 23.2 Log Description Example
  • 23.3 Configuring Log Settings
  • 23.4 Configuring Reports
    • 23.4.1 Viewing Web Site Hits
    • 23.4.2 Viewing Protocol/Port
    • 23.4.3 Viewing LAN IP Address
    • 23.4.4 Reports Specifications
• 24. Maintenance
  • 24.1 Maintenance Overview
  • 24.2 General Setup
    • 24.2.1 General Setup and System Name
    • 24.2.2 Domain Name
  • 24.3 Configuring Password
  • 24.4 Pre-defined NTP Time Servers List
  • 24.5 Configuring Time and Date
    • 24.5.1 Resetting the Time
    • 24.5.2 Time Server Synchronization
  • 24.6 Introduction to Transparent Bridging
  • 24.7 Transparent Firewalls
  • 24.8 Configuring Device Mode
  • 24.9 F/W Upload Screen
  • 24.10 Configuration Screen
    • 24.10.1 Backup Configuration
    • 24.10.2 Restore Configuration
    • 24.10.3 Back to Factory Defaults
  • 24.11 Restart Screen
• 25. Introducing the SMT
  • 25.1 Introduction to the SMT
  • 25.2 Accessing the SMT via the Console Port
    • 25.2.1 Initial Screen
    • 25.2.2 Entering the Password
  • 25.3 Navigating the SMT Interface
    • 25.3.1 Main Menu
    • 25.3.2 SMT Menus Overview
  • 25.4 Changing the System Password
  • 25.5 Resetting the ZyWALL
• 26. SMT Menu 1 - General Setup
  • 26.1 Introduction to General Setup
  • 26.2 Configuring General Setup
    • 26.2.1 Configuring Dynamic DNS
      • 26.2.1.1 Editing DDNS Host
• 27. WAN and Dial Backup Setup
  • 27.1 Introduction to WAN and Dial Backup Setup
  • 27.2 WAN Setup
  • 27.3 Dial Backup
  • 27.4 Configuring Dial Backup in Menu 2
  • 27.5 Advanced WAN Setup
  • 27.6 Remote Node Profile (Backup ISP)
  • 27.7 Editing PPP Options
  • 27.8 Editing TCP/IP Options
  • 27.9 Editing Login Script
  • 27.10 Remote Node Filter
• 28. LAN Setup
  • 28.1 Introduction to LAN Setup
  • 28.2 Accessing the LAN Menus
  • 28.3 LAN Port Filter Setup
  • 28.4 TCP/IP and DHCP Ethernet Setup Menu
    • 28.4.1 IP Alias Setup
  • 28.5 Wireless LAN Setup
    • 28.5.1 MAC Address Filter Setup
• 29. Internet Access
  • 29.1 Introduction to Internet Access Setup
  • 29.2 Ethernet Encapsulation
  • 29.3 Configuring the PPTP Client
  • 29.4 Configuring the PPPoE Client
  • 29.5 Basic Setup Complete
• 30. DMZ Setup
  • 30.1 Configuring DMZ Setup
  • 30.2 DMZ Port Filter Setup
  • 30.3 TCP/IP Setup
    • 30.3.1 IP Address
    • 30.3.2 IP Alias Setup
• 31. Remote Node Setup
  • 31.1 Introduction to Remote Node Setup
  • 31.2 Remote Node Setup
  • 31.3 Remote Node Profile Setup
    • 31.3.1 Ethernet Encapsulation
    • 31.3.2 PPPoE Encapsulation
      • 31.3.2.1 Outgoing Authentication Protocol
      • 31.3.2.2 Nailed-Up Connection
      • 31.3.2.3 Metric
    • 31.3.3 PPTP Encapsulation
  • 31.4 Edit IP
  • 31.5 Remote Node Filter
  • 31.6 Traffic Redirect
• 32. IP Static Route Setup
  • 32.1 IP Static Route Setup
• 33. Network Address Translation (NAT)
  • 33.1 Using NAT
    • 33.1.1 SUA (Single User Account) Versus NAT
    • 33.1.2 Applying NAT

  • Related manuals for Guardrail