ZyXEL Communications 70 Series User Manuals

Table of Contents

• ZyWALL 5/35/70 User's Guide

  1
• Copyright

  2
• Federal Communications Commission (FCC) Interference Statement

  3
• Safety Warnings

  5
• ZyXEL Limited Warranty

  6
• Customer Support

  7
• Table of Contents

  10
• List of Figures

  32
• List of Tables

  44
• Preface

  52
• 1. Getting to Know Your ZyWALL

  54
  • 1.1 ZyWALL Internet Security Appliance Overview

    54
  • 1.2 ZyWALL Features

    54
    • 1.2.1 Physical Features

      55
    • 1.2.2 Non-Physical Features

      56
  • 1.3 Applications for the ZyWALL

    62
    • 1.3.1 Secure Broadband Internet Access via Cable or DSL Modem

      62
    • 1.3.2 VPN Application

      62
    • 1.3.3 Front Panel LEDs

      63
• 2. Introducing the Web Configurator

  66
  • 2.1 Web Configurator Overview

    66
  • 2.2 Accessing the ZyWALL Web Configurator

    66
  • 2.3 Resetting the ZyWALL

    67
    • 2.3.1 Procedure To Use The Reset Button

      68
    • 2.3.2 Uploading a Configuration File Via Console Port

      68
  • 2.4 Navigating the ZyWALL Web Configurator

    68
    • 2.4.3 Navigation Panel

      74
• 3. Wizard Setup

  84
  • 3.1 Wizard Setup Overview

    84
    • 3.2.1 ISP Parameters

      84
      • 3.2.1.1 Ethernet

        84
      • 3.2.1.2 PPPoE Encapsulation

        86
      • 3.2.1.3 PPTP Encapsulation

        87
• 4. Registration

  104
  • 4.1 myZyXEL.com overview

    104
    • 4.1.1 Subscription Services Available on the ZyWALL

      104
• 5. LAN Screens

  110
  • 5.1 LAN Overview

    110
  • 5.2 DHCP Setup

    110
    • 5.2.1 IP Pool Setup

      110
  • 5.3 LAN TCP/IP

    110
    • 5.3.1 Factory LAN Defaults

      110
    • 5.3.2 IP Address and Subnet Mask

      111
    • 5.3.3 RIP Setup

      111
    • 5.3.4 Multicast

      112
  • 5.4 DNS Servers

    112
• 6. Bridge Screens

  122
  • 6.1 Bridge Loop

    122
  • 6.2 Spanning Tree Protocol (STP)

    122
    • 6.2.1 Rapid STP

      123
    • 6.2.2 STP Terminology

      123
    • 6.2.3 How STP Works

      123
    • 6.2.4 STP Port States

      124
• 7. WAN Screens

  130
  • 7.1 WAN Overview

    130
  • 7.2 Multiple WAN

    130
  • 7.3 Load Balancing Introduction

    131
  • 7.4 Load Balancing Algorithms

    131
    • 7.4.1 Least Load First

      131
      • 7.4.1.1 Example 1

        132
      • 7.4.1.2 Example 2

        132
    • 7.4.2 Weighted Round Robin

      133
    • 7.4.3 Spillover

      133
  • 7.5 TCP/IP Priority (Metric)

    134
  • 7.7 Configuring Load Balancing

    137
    • 7.7.1 Least Load First

      138
    • 7.7.2 Weighted Round Robin

      139
    • 7.7.3 Spillover

      139
  • 7.9 WAN IP Address Assignment

    142
  • 7.10 DNS Server Address Assignment

    142
  • 7.11 WAN MAC Address

    143
    • 7.12.1 WAN Ethernet Encapsulation

      143
    • 7.12.2 PPPoE Encapsulation

      146
    • 7.12.3 PPTP Encapsulation

      150
  • 7.14 Configuring Traffic Redirect

    154
    • 7.16.1 AT Command Strings

      159
    • 7.16.2 DTR Signal

      159
    • 7.16.3 Response Strings

      159
  • 7.17 Configuring Advanced Modem Setup

    159
• 8. DMZ Screens

  162
  • 8.2 Configuring DMZ

    162
  • 8.5 DMZ Public IP Address Example

    168
  • 8.6 DMZ Private and Public IP Address Example

    169
• 9. Wireless LAN

  174
  • 9.1 Wireless LAN Introduction

    174
    • 9.1.1 Additional Installation Requirements for Using 802.1x

      174
  • 9.6 Wireless Security

    182
    • 9.6.1 Encryption

      183
    • 9.6.2 Authentication

      183
    • 9.6.3 Restricted Access

      184
    • 9.6.4 Hide ZyWALL Identity

      184
  • 9.7 Security Parameters Summary

    184
  • 9.8 WEP Encryption

    184
  • 9.9 802.1x Overview

    185
    • 9.9.1 Introduction to RADIUS

      185
      • 9.9.1.1 Types of RADIUS Messages

        185
    • 9.9.2 EAP Authentication Overview

      186
  • 9.10 Dynamic WEP Key Exchange

    186
  • 9.11 Introduction to WPA

    187
    • 9.11.1 User Authentication

      187
    • 9.11.2 Encryption

      187
  • 9.12 WPA-PSK Application Example

    188
  • 9.13 Introduction to RADIUS

    189
  • 9.14 WPA with RADIUS Application Example

    189
  • 9.15 Wireless Client WPA Supplicants

    190
    • 9.16.1 Static WEP

      192
    • 9.16.2 WPA-PSK

      193
    • 9.16.3 WPA

      195
    • 9.16.4 IEEE 802.1x + Dynamic WEP

      196
    • 9.16.5 IEEE 802.1x + Static WEP

      197
    • 9.16.6 IEEE 802.1x + No WEP

      198
    • 9.16.7 No Access 802.1x + Static WEP

      199
    • 9.16.8 No Access 802.1x + No WEP

      200
• 10. Firewalls

  202
  • 10.1 Firewall Overview

    202
  • 10.2 Types of Firewalls

    202
    • 10.2.1 Packet Filtering Firewalls

      202
    • 10.2.2 Application-level Firewalls

      202
    • 10.2.3 Stateful Inspection Firewalls

      203
  • 10.3 Introduction to ZyXEL’s Firewall

    203
  • 10.4 Denial of Service

    204
    • 10.4.1 Basics

      204
    • 10.4.2 Types of DoS Attacks

      205
      • 10.4.2.1 ICMP Vulnerability

        207
      • 10.4.2.2 Illegal Commands (NetBIOS and SMTP)

        207
      • 10.4.2.3 Traceroute

        208
  • 10.5 Stateful Inspection

    208
    • 10.5.1 Stateful Inspection Process

      209
    • 10.5.2 Stateful Inspection and the ZyWALL

      210
    • 10.5.3 TCP Security

      210
    • 10.5.4 UDP/ICMP Security

      211
    • 10.5.5 Upper Layer Protocols

      211
  • 10.6 Guidelines For Enhancing Security With Your Firewall

    212
  • 10.7 Packet Filtering Vs Firewall

    212
    • 10.7.1 Packet Filtering:

      212
      • 10.7.1.1 When To Use Filtering

        212
    • 10.7.2 Firewall

      213
      • 10.7.2.1 When To Use The Firewall

        213
• 11. Firewall Screens

  214
  • 11.1 Access Methods

    214
  • 11.2 Firewall Policies Overview

    214
  • 11.3 Rule Logic Overview

    216
    • 11.3.1 Rule Checklist

      216
    • 11.3.2 Security Ramifications

      216
    • 11.3.3 Key Fields For Configuring Rules

      216
      • 11.3.3.1 Action

        216
      • 11.3.3.2 Service

        217
      • 11.3.3.3 Source Address

        217
      • 11.3.3.4 Destination Address

        217
  • 11.4 Connection Direction Examples

    217
    • 11.4.1 LAN To WAN Rules

      217
    • 11.4.2 WAN To LAN Rules

      218
  • 11.5 Alerts

    218
    • 11.10.1 Threshold Values

      227
    • 11.10.2 Half-Open Sessions

      227
      • 11.10.2.1 TCP Maximum Incomplete and Blocking Time

        228
    • 11.11.2 Predefined Services

      233
  • 11.12 Example Firewall Rule

    235
• 12. Intrusion Detection and Prevention (IDP)

  240
  • 12.1 Introduction to IDP

    240
    • 12.1.1 Firewalls and Intrusions

      240
    • 12.1.2 IDS and IDP

      241
    • 12.1.3 Host IDP

      241
    • 12.1.4 Network IDP

      241
    • 12.1.5 Example Intrusions

      242
      • 12.1.5.1 SQL Slammer Worm

        242
      • 12.1.5.2 Blaster W32.Worm

        242
      • 12.1.5.3 Nimda

        242
      • 12.1.5.4 MyDoom

        243
    • 12.1.6 ZyWALL IDP

      243
• 13. Configuring IDP

  244
  • 13.1 Overview

    244
    • 13.1.1 Interfaces

      244
  • 13.2 General Setup

    245
    • 13.3.1 Attack Types

      246
    • 13.3.2 Intrusion Severity

      248
    • 13.3.3 Signature Actions

      248
    • 13.3.4 Configuring IDP Signatures

      249
      • 13.3.5.1 Query Example 1

        251
      • 13.3.5.2 Query Example 2

        253
    • 13.4.1 mySecurity Zone

      254
    • 13.4.2 Configuring IDP Update

      255
• 14. Anti-Virus

  258
  • 14.1.1 Types of Computer Viruses

    258
  • 14.1.2 Computer Virus Infection and Prevention

    258
  • 14.1.3 Types of Anti-Virus Scanner

    259
  • 14.2 Introduction to the ZyWALL Anti-Virus Scanner

    259
    • 14.2.1 How the ZyWALL Anti-Virus Scanner Works

      260
    • 14.2.2 Notes About the ZyWALL Anti-Virus

      260
  • 14.3 General Anti-Virus Setup

    261
    • 14.4.1 mySecurity Zone

      263
    • 14.4.2 Configuring Anti-virus Update

      263
• 15. Anti-Spam

  266
  • 15.1.1 Anti-Spam External Database

    266
    • 15.1.1.1 SpamBulk Engine

      267
    • 15.1.1.2 SpamRepute Engine

      267
    • 15.1.1.3 SpamContent Engine

      267
    • 15.1.1.4 SpamTricks Engine

      268
  • 15.1.2 Spam Threshold

    268
  • 15.1.3 Phishing

    268
  • 15.1.4 Whitelist

    269
  • 15.1.5 Blacklist

    269
  • 15.1.6 SMTP and POP3

    269
  • 15.1.7 MIME Headers

    270
  • 15.2 Anti-Spam General Screen

    270
• 16. Content Filtering Screens

  278
  • 16.1 Content Filtering Overview

    278
    • 16.1.1 Restrict Web Features

      278
    • 16.1.2 Create a Filter List

      278
    • 16.1.3 Customize Web Site Access

      278
  • 16.3 Content Filtering with an External Database

    280
  • 16.6 Customizing Keyword Blocking URL Checking

    290
    • 16.6.1 Domain Name or IP Address URL Checking

      290
    • 16.6.2 Full Path URL Checking

      290
    • 16.6.3 File Name URL Checking

      290
• 17. Content Filtering Reports

  294
  • 17.1 Checking Content Filtering Activation

    294
  • 17.2 Viewing Content Filtering Reports

    294
  • 17.3 Web Site Submission

    299
• 18. Introduction to IPSec

  302
  • 18.1 VPN Overview

    302
    • 18.1.1 IPSec

      302
    • 18.1.2 Security Association

      302
    • 18.1.3 Other Terminology

      302
      • 18.1.3.1 Encryption

        302
      • 18.1.3.2 Data Confidentiality

        303
      • 18.1.3.3 Data Integrity

        303
      • 18.1.3.4 Data Origin Authentication

        303
    • 18.1.4 VPN Applications

      303
      • 18.1.4.1 Linking Two or More Private Networks Together

        303
      • 18.1.4.2 Accessing Network Resources When NAT Is Enabled

        303
      • 18.1.4.3 Unsupported IP Applications

        303
  • 18.2 IPSec Architecture

    304
    • 18.2.1 IPSec Algorithms

      304
    • 18.2.2 Key Management

      304
  • 18.3 Encapsulation

    304
    • 18.3.1 Transport Mode

      305
    • 18.3.2 Tunnel Mode

      305
  • 18.4 IPSec and NAT

    305
• 19. VPN Screens

  308
  • 19.1 VPN/IPSec Overview

    308
  • 19.2 IPSec Algorithms

    308
    • 19.2.1 AH (Authentication Header) Protocol

      308
    • 19.2.2 ESP (Encapsulating Security Payload) Protocol

      308
  • 19.3 My ZyWALL

    309
  • 19.4 Remote Gateway Address

    309
    • 19.4.1 Dynamic Remote Gateway Address

      310
  • 19.5 Nailed Up

    310
  • 19.6 NAT Traversal

    310
    • 19.6.1 NAT Traversal Configuration

      311
  • 19.7 ID Type and Content

    311
    • 19.7.1 ID Type and Content Examples

      312
  • 19.8 IKE Phases

    313
    • 19.8.1 Negotiation Mode

      314
    • 19.8.2 Pre-Shared Key

      314
    • 19.8.3 Diffie-Hellman (DH) Key Groups

      315
    • 19.8.4 Perfect Forward Secrecy (PFS)

      315
  • 19.9 X-Auth (Extended Authentication)

    315
    • 19.9.1 Authentication Server

      315
    • 19.15.1 Security Parameter Index (SPI)

      331
  • 19.18 Telecommuter VPN/IPSec Examples

    337
    • 19.18.1 Telecommuters Sharing One VPN Rule Example

      337
    • 19.18.2 Telecommuters Using Unique VPN Rules Example

      338
  • 19.19 VPN and Remote Management

    340
• 20. Certificates

  342
  • 20.1 Certificates Overview

    342
    • 20.1.1 Advantages of Certificates

      343
  • 20.2 Self-signed Certificates

    343
  • 20.3 Configuration Summary

    343
    • 20.5.1 Certificate File Formats

      346
  • 20.12 Verifying a Trusted Remote Host’s Certificate

    361
    • 20.12.1 Trusted Remote Host Certificate Fingerprints

      361
• 21. Authentication Server

  370
  • 21.1 Authentication Server Overview

    370
    • 21.1.1 Local User Database

      370
    • 21.1.2 RADIUS

      370
• 22. Network Address Translation (NAT)

  374
  • 22.1 NAT Overview

    374
    • 22.1.1 NAT Definitions

      374
    • 22.1.2 What NAT Does

      375
    • 22.1.3 How NAT Works

      375
    • 22.1.4 NAT Application

      376
    • 22.1.5 Port Restricted Cone NAT

      377
    • 22.1.6 NAT Mapping Types

      377
  • 22.2 Using NAT

    378
    • 22.2.1 SUA (Single User Account) Versus NAT

      378
  • 22.5 Port Forwarding

    383
    • 22.5.1 Default Server IP Address

      384
    • 22.5.2 Port Forwarding: Services and Port Numbers

      384
    • 22.5.3 Configuring Servers Behind Port Forwarding (Example)

      384
    • 22.5.4 NAT and Multiple WAN

      385
    • 22.5.5 Port Translation

      385
• 23. Static Route

  392
  • 23.2 IP Static Route

    392
• 24. Policy Route

  396
  • 24.2 Benefits

    396
  • 24.3 Routing Policy

    396
  • 24.4 IP Routing Policy Setup

    397
• 25. Bandwidth Management

  402
  • 25.2 Bandwidth Classes and Filters

    402
  • 25.3 Proportional Bandwidth Allocation

    403
  • 25.4 Application-based Bandwidth Management

    403
  • 25.5 Subnet-based Bandwidth Management

    403
  • 25.6 Application and Subnet-based Bandwidth Management

    404
  • 25.7 Scheduler

    404
    • 25.7.1 Priority-based Scheduler

      404
    • 25.7.2 Fairness-based Scheduler

      404
    • 25.7.3 Maximize Bandwidth Usage

      404
    • 25.7.4 Reserving Bandwidth for Non-Bandwidth Class Traffic

      405
    • 25.7.5 Maximize Bandwidth Usage Example

      405
      • 25.7.5.1 Priority-based Allotment of Unused and Unbudgeted Bandwidth

        406
      • 25.7.5.2 Fairness-based Allotment of Unused and Unbudgeted Bandwidth

        406
  • 25.8 Bandwidth Borrowing

    407
    • 25.8.1 Bandwidth Borrowing Example

      407
  • 25.9 Maximize Bandwidth Usage With Bandwidth Borrowing

    408
  • 25.10 Configuring Summary

    408
• 26. DNS

  418
  • 26.2 DNS Server Address Assignment

    418
  • 26.3 DNS Servers

    418
  • 26.4 Address Record

    419
    • 26.4.1 DNS Wildcard

      419
  • 26.5 Name Server Record

    419
    • 26.5.1 Private DNS Server

      419
  • 26.6 System Screen

    420
  • 26.8 Configure DNS Cache

    425
    • 26.10.1 DYNDNS Wildcard

      428
    • 26.10.2 High Availability

      428
  • 26.11 Configuring Dynamic DNS

    428
• 27. Remote Management

  432
  • 27.1 Remote Management Overview

    432
    • 27.1.1 Remote Management Limitations

      432
    • 27.1.2 System Timeout

      433
  • 27.2 Introduction to HTTPS

    433
  • 27.4 HTTPS Example

    436
    • 27.4.1 Internet Explorer Warning Messages

      436
    • 27.4.2 Netscape Navigator Warning Messages

      437
    • 27.4.3 Avoiding the Browser Warning Messages

      438
    • 27.4.4 Login Screen

      438
  • 27.6 How SSH works

    441
  • 27.7 SSH Implementation on the ZyWALL

    442
    • 27.7.1 Requirements for Using SSH

      443
  • 27.8 Configuring SSH

    443
  • 27.9 Secure Telnet Using SSH Examples

    444
    • 27.9.1 Example 1: Microsoft Windows

      444
    • 27.9.2 Example 2: Linux

      444
  • 27.10 Secure FTP Using SSH Example

    445
  • 27.12 Configuring TELNET

    446
    • 27.14.1 Supported MIBs

      450
    • 27.14.2 SNMP Traps

      450
    • 27.14.3 REMOTE MANAGEMENT: SNMP

      450
  • 27.17 Configuring CNM

    453
• 28. UPnP

  456
  • 28.1.1 How Do I Know If I'm Using UPnP?

    456
  • 28.1.2 NAT Traversal

    456
  • 28.1.3 Cautions with UPnP

    456
  • 28.1.4 UPnP and ZyXEL

    457
  • 28.2 Configuring UPnP

    457
  • 28.4 Installing UPnP in Windows Example

    459
    • 28.4.1 Installing UPnP in Windows Me

      460
    • 28.4.2 Installing UPnP in Windows XP

      461
  • 28.5 Using UPnP in Windows XP Example

    461
    • 28.5.1 Auto-discover Your UPnP-enabled Network Device

      462
    • 28.5.2 Web Configurator Easy Access

      463
• 29. ALG Screen

  466
  • 29.1.1 ALG and NAT

    466
  • 29.1.2 ALG and the Firewall

    466
  • 29.1.3 ALG and Multiple WAN

    466
  • 29.2 FTP

    467
  • 29.3 H.323

    467
  • 29.4 RTP

    467
    • 29.4.1 H.323 ALG Details

      467
  • 29.5 SIP

    469
    • 29.5.1 STUN

      469
    • 29.5.2 SIP ALG Details

      469
    • 29.5.3 SIP Signaling Session Timeout

      470
    • 29.5.4 SIP Audio Session Timeout

      470
  • 29.6 ALG Screen

    470
• 30. Logs Screens

  472
  • 30.2 Log Description Example

    473
    • 30.2.1 Certificate Not Trusted Log Note

      474
    • 30.4.1 Viewing Web Site Hits

      480
    • 30.4.2 Viewing Protocol/Port

      480
    • 30.4.3 Viewing Host IP Address

      482
    • 30.4.4 Reports Specifications

      483
• 31. Maintenance

  484
  • 31.1 Maintenance Overview

    484
  • 31.2 General Setup

    484
    • 31.2.1 General Setup and System Name

      484
  • 31.5 Pre-defined NTP Time Servers List

    489
    • 31.5.1 Resetting the Time

      489
    • 31.5.2 Time Server Synchronization

      489
  • 31.6 Introduction To Transparent Bridging

    491
  • 31.7 Transparent Firewalls

    491
    • 31.11.1 Backup Configuration

      497
    • 31.11.2 Restore Configuration

      497
    • 31.11.3 Back to Factory Defaults

      499
• 32. Introducing the SMT

  500
  • 32.1 Introduction to the SMT

    500
  • 32.2 Accessing the SMT via the Console Port

    500
    • 32.2.1 Initial Screen

      500
    • 32.2.2 Entering the Password

      501
  • 32.3 Navigating the SMT Interface

    501
    • 32.3.1 Main Menu

      502
    • 32.3.2 SMT Menus Overview

      504
  • 32.4 Changing the System Password

    506
  • 32.5 Resetting the ZyWALL

    507
• 33. SMT Menu 1 - General Setup

  508
  • 33.1 Introduction to General Setup

    508
  • 33.2 Configuring General Setup

    508
    • 33.2.1 Configuring Dynamic DNS

      510
      • 33.2.1.1 Editing DDNS Host

        510
• 34. WAN and Dial Backup Setup

  514
  • 34.1 Introduction to WAN and Dial Backup Setup

    514
  • 34.2 WAN Setup

    514
  • 34.3 Dial Backup

    515
  • 34.4 Configuring Dial Backup in Menu 2

    515
  • 34.5 Advanced WAN Setup

    516
  • 34.6 Remote Node Profile (Backup ISP)

    518
  • 34.7 Editing PPP Options

    520
  • 34.8 Editing TCP/IP Options

    521
  • 34.9 Editing Login Script

    523
  • 34.10 Remote Node Filter

    525
• 35. LAN Setup

  526
  • 35.1 Introduction to LAN Setup

    526
  • 35.2 Accessing the LAN Menus

    526
  • 35.3 LAN Port Filter Setup

    526
  • 35.4 TCP/IP and DHCP Ethernet Setup Menu

    527
    • 35.4.1 IP Alias Setup

      530
• 36. Internet Access

  532
  • 36.1 Introduction to Internet Access Setup

    532
  • 36.2 Ethernet Encapsulation

    532
  • 36.3 Configuring the PPTP Client

    534
  • 36.4 Configuring the PPPoE Client

    534
  • 36.5 Basic Setup Complete

    535
• 37. DMZ Setup

  536
  • 37.1 Configuring DMZ Setup

    536
  • 37.2 DMZ Port Filter Setup

    536
  • 37.3 TCP/IP Setup

    536
    • 37.3.1 IP Address

      537
    • 37.3.2 IP Alias Setup

      538
• 38. Route Setup

  540
  • 38.1 Configuring Route Setup

    540
  • 38.2 Route Assessment

    540
  • 38.3 Traffic Redirect

    541
  • 38.4 Route Failover

    542
• 39. Wireless Setup

  544
  • 39.1 Wireless LAN Setup

    544
    • 39.1.1 MAC Address Filter Setup

      546
  • 39.2 TCP/IP Setup

    547
    • 39.2.1 IP Address

      547
    • 39.2.2 IP Alias Setup

      548
• 40. Remote Node Setup

  550
  • 40.1 Introduction to Remote Node Setup

    550
  • 40.2 Remote Node Setup

    550
  • 40.3 Remote Node Profile Setup

    551
    • 40.3.1 Ethernet Encapsulation

      551
    • 40.3.2 PPPoE Encapsulation

      553
      • 40.3.2.1 Outgoing Authentication Protocol

        553
      • 40.3.2.2 Nailed-Up Connection

        553
      • 40.3.2.3 Metric

        554
    • 40.3.3 PPTP Encapsulation

      554
  • 40.4 Edit IP

    555
  • 40.5 Remote Node Filter

    557
  • 40.6 Traffic Redirect

    558
• 41. IP Static Route Setup

  560
  • 41.1 IP Static Route Setup

    560
• 42. Network Address Translation (NAT)

  562
  • 42.1 Using NAT

    562
    • 42.1.1 SUA (Single User Account) Versus NAT

      562
    • 42.1.2 Applying NAT

      562
  • 42.2 NAT Setup

    564
    • 42.2.1 Address Mapping Sets

      565
      • 42.2.1.1 SUA Address Mapping Set

        565
      • 42.2.1.2 User-Defined Address Mapping Sets

        566
      • 42.2.1.3 Ordering Your Rules

        567
  • 42.3 Configuring a Server behind NAT

    569
  • 42.4 General NAT Examples

    572
    • 42.4.1 Internet Access Only

      572
    • 42.4.2 Example 2: Internet Access with an Default Server

      574
    • 42.4.3 Example 3: Multiple Public IP Addresses With Inside Servers

      574
    • 42.4.4 Example 4: NAT Unfriendly Application Programs

      578
  • 42.5 Trigger Port Forwarding

    579
    • 42.5.1 Two Points To Remember About Trigger Ports

      579
• 43. Introducing the ZyWALL Firewall

  582
  • 43.1 Using ZyWALL SMT Menus

    582
    • 43.1.1 Activating the Firewall

      582
• 44. Filter Configuration

  584
  • 44.1 Introduction to Filters

    584
    • 44.1.1 The Filter Structure of the ZyWALL

      585
  • 44.2 Configuring a Filter Set

    587
    • 44.2.1 Configuring a Filter Rule

      588
    • 44.2.2 Configuring a TCP/IP Filter Rule

      589
    • 44.2.3 Configuring a Generic Filter Rule

      591
  • 44.3 Example Filter

    593
  • 44.4 Filter Types and NAT

    595
  • 44.5 Firewall Versus Filters

    595
  • 44.6 Applying a Filter

    596
    • 44.6.1 Applying LAN Filters

      596
    • 44.6.2 Applying DMZ Filters

      596
    • 44.6.3 Applying Remote Node Filters

      597
• 45. SNMP Configuration

  598
  • 45.1 SNMP Configuration

    598
  • 45.2 SNMP Traps

    599
• 46. System Information & Diagnosis

  600
  • 46.1 Introduction to System Status

    600
  • 46.2 System Status

    600
  • 46.3 System Information and Console Port Speed

    602
    • 46.3.1 System Information

      602
    • 46.3.2 Console Port Speed

      603
  • 46.4 Log and Trace

    604
    • 46.4.1 Viewing Error Log

      604
    • 46.4.2 Syslog Logging

      605
    • 46.4.3 Call-Triggering Packet

      608
  • 46.5 Diagnostic

    608
    • 46.5.1 WAN DHCP

      609
• 47. Firmware and Configuration File Maintenance

  612
  • 47.1 Introduction

    612
  • 47.2 Filename Conventions

    612
  • 47.3 Backup Configuration

    613
    • 47.3.1 Backup Configuration

      613
    • 47.3.2 Using the FTP Command from the Command Line

      614
    • 47.3.3 Example of FTP Commands from the Command Line

      615
    • 47.3.4 GUI-based FTP Clients

      615
    • 47.3.5 File Maintenance Over WAN

      615
    • 47.3.6 Backup Configuration Using TFTP

      616
    • 47.3.7 TFTP Command Example

      616
    • 47.3.8 GUI-based TFTP Clients

      617
    • 47.3.9 Backup Via Console Port

      617
  • 47.4 Restore Configuration

    618
    • 47.4.1 Restore Using FTP

      618
    • 47.4.2 Restore Using FTP Session Example

      620
    • 47.4.3 Restore Via Console Port

      620
  • 47.5 Uploading Firmware and Configuration Files

    621
    • 47.5.1 Firmware File Upload

      621
    • 47.5.2 Configuration File Upload

      622
    • 47.5.3 FTP File Upload Command from the DOS Prompt Example

      623
    • 47.5.4 FTP Session Example of Firmware File Upload

      623
    • 47.5.5 TFTP File Upload

      623
    • 47.5.6 TFTP Upload Command Example

      624
    • 47.5.7 Uploading Via Console Port

      624
    • 47.5.8 Uploading Firmware File Via Console Port

      624
    • 47.5.9 Example Xmodem Firmware Upload Using HyperTerminal

      625
    • 47.5.10 Uploading Configuration File Via Console Port

      625
    • 47.5.11 Example Xmodem Configuration Upload Using HyperTerminal

      626
• 48. System Maintenance Menus 8 to 10

  628
  • 48.1 Command Interpreter Mode

    628
    • 48.1.1 Command Syntax

      628
    • 48.1.2 Command Usage

      629
  • 48.2 Call Control Support

    630
    • 48.2.1 Budget Management

      630
    • 48.2.2 Call History

      631
  • 48.3 Time and Date Setting

    632
• 49. Remote Management

  636
  • 49.1 Remote Management

    636
    • 49.1.1 Remote Management Limitations

      638
• 50. IP Policy Routing

  640
  • 50.1 IP Routing Policy Summary

    640
  • 50.2 IP Routing Policy Setup

    641
    • 50.2.1 Applying Policy to Packets

      643
  • 50.3 IP Policy Routing Example

    644
• 51. Call Scheduling

  648
  • 51.1 Introduction to Call Scheduling

    648
• 52. Troubleshooting

  652
  • 52.1 Problems Starting Up the ZyWALL

    652
  • 52.2 Problems with the LAN Interface

    652
  • 52.3 Problems with the DMZ Interface

    653
  • 52.4 Problems with the WAN Interface

    653
  • 52.5 Problems Accessing the ZyWALL

    654
    • 52.5.1 Pop-up Windows, JavaScripts and Java Permissions

      654
      • 52.5.1.1 Internet Explorer Pop-up Blockers

        655
      • 52.5.1.2 JavaScripts

        658
      • 52.5.1.3 Java Permissions

        660
  • 52.6 Packet Flow

    662
• A. Product Specifications

  664
  • Specification Tables

    664
  • Compatible ZyXEL WLAN Cards

    668
  • WLAN Card and ZyWALL Turbo Card Installation

    668
  • Cable Pin Assignments

    669
• B. Hardware Installation

  672
  • General Installation Instructions

    672
  • Desktop Installation

    672
  • Rack-mounted Installation Requirements

    673
  • Rack-Mounted Installation

    673
• C. Removing and Installing a Fuse

  676
  • Removing a Fuse

    676
  • Installing a Fuse

    676
• D. Setting up Your Computer’s IP Address

  678
  • Windows 95/98/Me

    678
    • Installing Components

      679
    • Configuring

      680
    • Verifying Settings

      681
  • Windows 2000/NT/XP

    681
    • Verifying Settings

      686
  • Macintosh OS 8/9

    686
    • Verifying Settings

      688
  • Macintosh OS X

    688
    • Verifying Settings

      689
  • Linux

    689
    • Using the K Desktop Environment (KDE)

      690
    • Using Configuration Files

      691
    • Verifying Settings

      693
• E. IP Subnetting

  694
  • IP Addressing

    694
  • IP Classes

    694
  • Subnet Masks

    695
  • Subnetting

    695
  • Example: Two Subnets

    696
  • Example: Four Subnets

    698
  • Example Eight Subnets

    699
  • Subnetting With Class A and Class B Networks.

    700
• F. PPPoE

  702
  • PPPoE in Action

    702
  • Benefits of PPPoE

    702
  • Traditional Dial-up Scenario

    702
  • How PPPoE Works

    703
  • ZyWALL as a PPPoE Client

    703
• G. PPTP

  704
  • What is PPTP?

    704
    • How can we transport PPP frames from a computer to a broadband modem over Ethernet?

      704
  • PPTP and the ZyWALL

    704
  • PPTP Protocol Overview

    705
  • Control & PPP Connections

    705
    • Call Connection

      705
    • PPP Data Connection

      706
• H. Wireless LANs

  708
  • Wireless LAN Topologies

    708
    • Ad-hoc Wireless LAN Configuration

      708
    • BSS

      708
    • ESS

      709
  • Channel

    710
  • RTS/CTS

    710
  • Fragmentation Threshold

    711
  • Preamble Type

    712
  • IEEE 802.1x

    713
  • RADIUS

    713
    • Types of RADIUS Messages

      713
  • EAP Authentication

    714
  • Types of Authentication

    715
    • EAP-MD5 (Message-Digest Algorithm 5)

      715
    • EAP-TLS (Transport Layer Security)

      715
    • EAP-TTLS (Tunneled Transport Layer Service)

      715
    • PEAP (Protected EAP)

      716
    • LEAP

      716
    • WEP Encryption

      716
  • WEP Authentication Steps

    716
    • Dynamic WEP Key Exchange

      717
  • WPA

    718
    • User Authentication

      718
    • Encryption

      718
  • Security Parameters Summary

    719
  • Roaming

    719
    • Requirements for Roaming

      721
• I. Triangle Route

  722
  • The Ideal Setup

    722
  • The “Triangle Route” Problem

    722
  • The “Triangle Route” Solutions

    723
  • IP Aliasing

    723
  • Gateways on the WAN Side

    724
  • Configuring Triangle Route via Commands

    724
• J. Windows 98 SE/Me Requirements for Anti-Virus Message Display

  726
• K. VPN Setup

  730
  • General Notes

    730
    • Dynamic IPSec Rule

      730
    • Full Feature NAT Mode

      730
  • VPN Configuration

    731
    • Dialing the VPN Tunnel via Web Configurator

      736
  • VPN Troubleshooting

    738
    • VPN Log

      738
    • IPSec Debug

      740
  • Use a VPN Tunnel

    741
    • FTP Example

      741
• L. Importing Certificates

  742
  • Import ZyWALL Certificates into Netscape Navigator

    742
  • Importing the ZyWALL’s Certificate into Internet Explorer

    742
  • Enrolling and Importing SSL Client Certificates

    746
    • Installing the CA’s Certificate

      747
    • Installing Your Personal Certificate(s)

      748
  • Using a Certificate When Accessing the ZyWALL Example

    751
• M. Command Interpreter

  754
  • Command Syntax

    754
  • Command Usage

    754
• N. Firewall Commands

  756
• O. NetBIOS Filter Commands

  762
  • Introduction

    762
  • Display NetBIOS Filter Settings

    762
  • NetBIOS Filter Configuration

    763
• P. Certificates Commands

  766
• Q. Brute-Force Password Guessing Protection

  770
  • Example

    770
• R. Boot Commands

  772
• S. Log Descriptions

  774
  • Syslog Logs

    794
  • Log Commands

    796
    • Configuring What You Want the ZyWALL to Log

      796
    • Displaying Logs

      796
  • Log Command Example

    797
• Index

  798
  • Numerics

    798
  • A

    798
  • B

    798
  • C

    799
  • D

    799
  • E

    800
  • F

    800
  • G

    801
  • H

    801
  • I

    801
  • J

    802
  • K

    802
  • L

    802
  • M

    802
  • N

    803
  • O

    803
  • P

    803
  • Q

    804
  • R

    804
  • S

    805
  • T

    806
  • U

    806
  • V

    807
  • W

    807
  • X

    807
  • Z

    807