ZyXEL Communications ZyWALL5UTM 4.0 User Manuals

Table of Contents

• ZyWALL 5/35/70 User's Guide

  1
• Copyright

  2
• Federal Communications Commission (FCC) Interference Statement

  3
• Safety Warnings

  5
• ZyXEL Limited Warranty

  6
• Customer Support

  7
• Table of Contents

  10
• List of Figures

  28
• List of Tables

  40
• Preface

  48
• 1. Getting to Know Your ZyWALL

  50
  • 1.1 ZyWALL Internet Security Appliance Overview

    50
  • 1.2 ZyWALL Features

    50
    • 1.2.1 Physical Features

      51
    • 1.2.2 Non-Physical Features

      52
  • 1.3 Applications for the ZyWALL

    58
    • 1.3.1 Secure Broadband Internet Access via Cable or DSL Modem

      58
    • 1.3.2 VPN Application

      58
    • 1.3.3 Front Panel LEDs

      59
• 2. Introducing the Web Configurator

  62
  • 2.1 Web Configurator Overview

    62
  • 2.2 Accessing the ZyWALL Web Configurator

    62
  • 2.3 Resetting the ZyWALL

    63
    • 2.3.1 Procedure To Use The Reset Button

      64
    • 2.3.2 Uploading a Configuration File Via Console Port

      64
  • 2.4 Navigating the ZyWALL Web Configurator

    64
    • 2.4.3 Navigation Panel

      70
• 3. Wizard Setup

  80
  • 3.1 Wizard Setup Overview

    80
    • 3.2.1 ISP Parameters

      80
      • 3.2.1.1 Ethernet

        80
      • 3.2.1.2 PPPoE Encapsulation

        82
      • 3.2.1.3 PPTP Encapsulation

        83
• 4. Registration

  100
  • 4.1 myZyXEL.com overview

    100
    • 4.1.1 Subscription Services Available on the ZyWALL

      100
• 5. LAN Screens

  106
  • 5.1 LAN Overview

    106
  • 5.2 DHCP Setup

    106
    • 5.2.1 IP Pool Setup

      106
  • 5.3 LAN TCP/IP

    106
    • 5.3.1 Factory LAN Defaults

      106
    • 5.3.2 IP Address and Subnet Mask

      107
    • 5.3.3 RIP Setup

      107
    • 5.3.4 Multicast

      108
  • 5.4 DNS Servers

    108
• 6. Bridge Screens

  118
  • 6.1 Bridge Loop

    118
  • 6.2 Spanning Tree Protocol (STP)

    118
    • 6.2.1 Rapid STP

      119
    • 6.2.2 STP Terminology

      119
    • 6.2.3 How STP Works

      119
    • 6.2.4 STP Port States

      120
• 7. WAN Screens

  126
  • 7.1 WAN Overview

    126
  • 7.2 Multiple WAN

    126
  • 7.3 Load Balancing Introduction

    127
  • 7.4 Load Balancing Algorithms

    127
    • 7.4.1 Least Load First

      127
      • 7.4.1.1 Example 1

        128
      • 7.4.1.2 Example 2

        128
    • 7.4.2 Weighted Round Robin

      129
    • 7.4.3 Spillover

      129
  • 7.5 TCP/IP Priority (Metric)

    130
  • 7.7 Configuring Load Balancing

    133
    • 7.7.1 Least Load First

      134
    • 7.7.2 Weighted Round Robin

      135
    • 7.7.3 Spillover

      135
  • 7.9 WAN IP Address Assignment

    138
  • 7.10 DNS Server Address Assignment

    138
  • 7.11 WAN MAC Address

    139
    • 7.12.1 WAN Ethernet Encapsulation

      139
    • 7.12.2 PPPoE Encapsulation

      142
    • 7.12.3 PPTP Encapsulation

      146
  • 7.14 Configuring Traffic Redirect

    150
    • 7.16.1 AT Command Strings

      155
    • 7.16.2 DTR Signal

      155
    • 7.16.3 Response Strings

      155
  • 7.17 Configuring Advanced Modem Setup

    155
• 8. DMZ Screens

  158
  • 8.2 Configuring DMZ

    158
  • 8.5 DMZ Public IP Address Example

    164
  • 8.6 DMZ Private and Public IP Address Example

    165
• 9. Wireless LAN

  170
  • 9.1 Wireless LAN Introduction

    170
    • 9.1.1 Additional Installation Requirements for Using 802.1x

      170
  • 9.6 Wireless Security

    178
    • 9.6.1 Encryption

      179
    • 9.6.2 Authentication

      179
    • 9.6.3 Restricted Access

      180
    • 9.6.4 Hide ZyWALL Identity

      180
  • 9.7 Security Parameters Summary

    180
  • 9.8 WEP Encryption

    180
  • 9.9 802.1x Overview

    181
    • 9.9.1 Introduction to RADIUS

      181
      • 9.9.1.1 Types of RADIUS Messages

        181
    • 9.9.2 EAP Authentication Overview

      182
  • 9.10 Dynamic WEP Key Exchange

    182
  • 9.11 Introduction to WPA

    183
    • 9.11.1 User Authentication

      183
    • 9.11.2 Encryption

      183
  • 9.12 WPA-PSK Application Example

    184
  • 9.13 Introduction to RADIUS

    185
  • 9.14 WPA with RADIUS Application Example

    185
  • 9.15 Wireless Client WPA Supplicants

    186
    • 9.16.1 Static WEP

      188
    • 9.16.2 WPA-PSK

      189
    • 9.16.3 WPA

      191
    • 9.16.4 IEEE 802.1x + Dynamic WEP

      192
    • 9.16.5 IEEE 802.1x + Static WEP

      193
    • 9.16.6 IEEE 802.1x + No WEP

      194
    • 9.16.7 No Access 802.1x + Static WEP

      195
    • 9.16.8 No Access 802.1x + No WEP

      196
• 10. Firewalls

  198
  • 10.1 Firewall Overview

    198
  • 10.2 Types of Firewalls

    198
    • 10.2.1 Packet Filtering Firewalls

      198
    • 10.2.2 Application-level Firewalls

      198
    • 10.2.3 Stateful Inspection Firewalls

      199
  • 10.3 Introduction to ZyXEL’s Firewall

    199
  • 10.4 Denial of Service

    200
    • 10.4.1 Basics

      200
    • 10.4.2 Types of DoS Attacks

      201
      • 10.4.2.1 ICMP Vulnerability

        203
      • 10.4.2.2 Illegal Commands (NetBIOS and SMTP)

        203
      • 10.4.2.3 Traceroute

        204
  • 10.5 Stateful Inspection

    204
    • 10.5.1 Stateful Inspection Process

      205
    • 10.5.2 Stateful Inspection and the ZyWALL

      206
    • 10.5.3 TCP Security

      206
    • 10.5.4 UDP/ICMP Security

      207
    • 10.5.5 Upper Layer Protocols

      207
  • 10.6 Guidelines For Enhancing Security With Your Firewall

    208
  • 10.7 Packet Filtering Vs Firewall

    208
    • 10.7.1 Packet Filtering:

      208
      • 10.7.1.1 When To Use Filtering

        208
    • 10.7.2 Firewall

      209
      • 10.7.2.1 When To Use The Firewall

        209
• 11. Firewall Screens

  210
  • 11.1 Access Methods

    210
  • 11.2 Firewall Policies Overview

    210
  • 11.3 Rule Logic Overview

    212
    • 11.3.1 Rule Checklist

      212
    • 11.3.2 Security Ramifications

      212
    • 11.3.3 Key Fields For Configuring Rules

      212
      • 11.3.3.1 Action

        212
      • 11.3.3.2 Service

        213
      • 11.3.3.3 Source Address

        213
      • 11.3.3.4 Destination Address

        213
  • 11.4 Connection Direction Examples

    213
    • 11.4.1 LAN To WAN Rules

      213
    • 11.4.2 WAN To LAN Rules

      214
  • 11.5 Alerts

    214
    • 11.10.1 Threshold Values

      223
    • 11.10.2 Half-Open Sessions

      223
      • 11.10.2.1 TCP Maximum Incomplete and Blocking Time

        224
    • 11.11.2 Predefined Services

      229
  • 11.12 Example Firewall Rule

    231
• 12. Intrusion Detection and Prevention (IDP)

  236
  • 12.1 Introduction to IDP

    236
    • 12.1.1 Firewalls and Intrusions

      236
    • 12.1.2 IDS and IDP

      237
    • 12.1.3 Host IDP

      237
    • 12.1.4 Network IDP

      237
    • 12.1.5 Example Intrusions

      238
      • 12.1.5.1 SQL Slammer Worm

        238
      • 12.1.5.2 Blaster W32.Worm

        238
      • 12.1.5.3 Nimda

        238
      • 12.1.5.4 MyDoom

        239
    • 12.1.6 ZyWALL IDP

      239
• 13. Configuring IDP

  240
  • 13.1 Overview

    240
    • 13.1.1 Interfaces

      240
  • 13.2 General Setup

    241
    • 13.3.1 Attack Types

      242
    • 13.3.2 Intrusion Severity

      244
    • 13.3.3 Signature Actions

      244
    • 13.3.4 Configuring IDP Signatures

      245
      • 13.3.5.1 Query Example 1

        247
      • 13.3.5.2 Query Example 2

        249
    • 13.4.1 mySecurity Zone

      250
    • 13.4.2 Configuring IDP Update

      251
• 14. Anti-Virus

  254
  • 14.1.1 Types of Computer Viruses

    254
  • 14.1.2 Computer Virus Infection and Prevention

    254
  • 14.1.3 Types of Anti-Virus Scanner

    255
  • 14.2 Introduction to the ZyWALL Anti-Virus Scanner

    255
    • 14.2.1 How the ZyWALL Anti-Virus Scanner Works

      256
    • 14.2.2 Notes About the ZyWALL Anti-Virus

      256
  • 14.3 General Anti-Virus Setup

    257
    • 14.4.1 mySecurity Zone

      259
    • 14.4.2 Configuring Anti-virus Update

      259
• 15. Anti-Spam

  262
  • 15.1.1 Anti-Spam External Database

    262
    • 15.1.1.1 SpamBulk Engine

      263
    • 15.1.1.2 SpamRepute Engine

      263
    • 15.1.1.3 SpamContent Engine

      263
    • 15.1.1.4 SpamTricks Engine

      264
  • 15.1.2 Spam Threshold

    264
  • 15.1.3 Phishing

    264
  • 15.1.4 Whitelist

    265
  • 15.1.5 Blacklist

    265
  • 15.1.6 SMTP and POP3

    265
  • 15.1.7 MIME Headers

    266
  • 15.2 Anti-Spam General Screen

    266
• 16. Content Filtering Screens

  274
  • 16.1 Content Filtering Overview

    274
    • 16.1.1 Restrict Web Features

      274
    • 16.1.2 Create a Filter List

      274
    • 16.1.3 Customize Web Site Access

      274
  • 16.3 Content Filtering with an External Database

    276
  • 16.6 Customizing Keyword Blocking URL Checking

    286
    • 16.6.1 Domain Name or IP Address URL Checking

      286
    • 16.6.2 Full Path URL Checking

      286
    • 16.6.3 File Name URL Checking

      286
• 17. Content Filtering Reports

  290
  • 17.1 Checking Content Filtering Activation

    290
  • 17.2 Viewing Content Filtering Reports

    290
  • 17.3 Web Site Submission

    295
• 18. Introduction to IPSec

  298
  • 18.1 VPN Overview

    298
    • 18.1.1 IPSec

      298
    • 18.1.2 Security Association

      298
    • 18.1.3 Other Terminology

      298
      • 18.1.3.1 Encryption

        298
      • 18.1.3.2 Data Confidentiality

        299
      • 18.1.3.3 Data Integrity

        299
      • 18.1.3.4 Data Origin Authentication

        299
    • 18.1.4 VPN Applications

      299
      • 18.1.4.1 Linking Two or More Private Networks Together

        299
      • 18.1.4.2 Accessing Network Resources When NAT Is Enabled

        299
      • 18.1.4.3 Unsupported IP Applications

        299
  • 18.2 IPSec Architecture

    300
    • 18.2.1 IPSec Algorithms

      300
    • 18.2.2 Key Management

      300
  • 18.3 Encapsulation

    300
    • 18.3.1 Transport Mode

      301
    • 18.3.2 Tunnel Mode

      301
  • 18.4 IPSec and NAT

    301
• 19. VPN Screens

  304
  • 19.1 VPN/IPSec Overview

    304
  • 19.2 IPSec Algorithms

    304
    • 19.2.1 AH (Authentication Header) Protocol

      304
    • 19.2.2 ESP (Encapsulating Security Payload) Protocol

      304
  • 19.3 My ZyWALL

    305
  • 19.4 Remote Gateway Address

    305
    • 19.4.1 Dynamic Remote Gateway Address

      306
  • 19.5 Nailed Up

    306
  • 19.6 NAT Traversal

    306
    • 19.6.1 NAT Traversal Configuration

      307
  • 19.7 ID Type and Content

    307
    • 19.7.1 ID Type and Content Examples

      308
  • 19.8 IKE Phases

    309
    • 19.8.1 Negotiation Mode

      310
    • 19.8.2 Pre-Shared Key

      310
    • 19.8.3 Diffie-Hellman (DH) Key Groups

      311
    • 19.8.4 Perfect Forward Secrecy (PFS)

      311
  • 19.9 X-Auth (Extended Authentication)

    311
    • 19.9.1 Authentication Server

      311
    • 19.15.1 Security Parameter Index (SPI)

      327
  • 19.18 Telecommuter VPN/IPSec Examples

    333
    • 19.18.1 Telecommuters Sharing One VPN Rule Example

      333
    • 19.18.2 Telecommuters Using Unique VPN Rules Example

      334
  • 19.19 VPN and Remote Management

    336
• 20. Certificates

  338
  • 20.1 Certificates Overview

    338
    • 20.1.1 Advantages of Certificates

      339
  • 20.2 Self-signed Certificates

    339
  • 20.3 Configuration Summary

    339
    • 20.5.1 Certificate File Formats

      342
  • 20.12 Verifying a Trusted Remote Host’s Certificate

    357
    • 20.12.1 Trusted Remote Host Certificate Fingerprints

      357
• 21. Authentication Server

  366
  • 21.1 Authentication Server Overview

    366
    • 21.1.1 Local User Database

      366
    • 21.1.2 RADIUS

      366
• 22. Network Address Translation (NAT)

  370
  • 22.1 NAT Overview

    370
    • 22.1.1 NAT Definitions

      370
    • 22.1.2 What NAT Does

      371
    • 22.1.3 How NAT Works

      371
    • 22.1.4 NAT Application

      372
    • 22.1.5 Port Restricted Cone NAT

      373
    • 22.1.6 NAT Mapping Types

      373
  • 22.2 Using NAT

    374
    • 22.2.1 SUA (Single User Account) Versus NAT

      374
  • 22.5 Port Forwarding

    379
    • 22.5.1 Default Server IP Address

      380
    • 22.5.2 Port Forwarding: Services and Port Numbers

      380
    • 22.5.3 Configuring Servers Behind Port Forwarding (Example)

      380
    • 22.5.4 NAT and Multiple WAN

      381
    • 22.5.5 Port Translation

      381
• 23. Static Route

  388
  • 23.2 IP Static Route

    388
• 24. Policy Route

  392
  • 24.2 Benefits

    392
  • 24.3 Routing Policy

    392
  • 24.4 IP Routing Policy Setup

    393
• 25. Bandwidth Management

  398
  • 25.2 Bandwidth Classes and Filters

    398
  • 25.3 Proportional Bandwidth Allocation

    399
  • 25.4 Application-based Bandwidth Management

    399
  • 25.5 Subnet-based Bandwidth Management

    399
  • 25.6 Application and Subnet-based Bandwidth Management

    400
  • 25.7 Scheduler

    400
    • 25.7.1 Priority-based Scheduler

      400
    • 25.7.2 Fairness-based Scheduler

      400
    • 25.7.3 Maximize Bandwidth Usage

      400
    • 25.7.4 Reserving Bandwidth for Non-Bandwidth Class Traffic

      401
    • 25.7.5 Maximize Bandwidth Usage Example

      401
      • 25.7.5.1 Priority-based Allotment of Unused and Unbudgeted Bandwidth

        402
      • 25.7.5.2 Fairness-based Allotment of Unused and Unbudgeted Bandwidth

        402
  • 25.8 Bandwidth Borrowing

    403
    • 25.8.1 Bandwidth Borrowing Example

      403
  • 25.9 Maximize Bandwidth Usage With Bandwidth Borrowing

    404
  • 25.10 Configuring Summary

    404
• 26. DNS

  414
  • 26.2 DNS Server Address Assignment

    414
  • 26.3 DNS Servers

    414
  • 26.4 Address Record

    415
    • 26.4.1 DNS Wildcard

      415
  • 26.5 Name Server Record

    415
    • 26.5.1 Private DNS Server

      415
  • 26.6 System Screen

    416
  • 26.8 Configure DNS Cache

    421
    • 26.10.1 DYNDNS Wildcard

      424
    • 26.10.2 High Availability

      424
  • 26.11 Configuring Dynamic DNS

    424
• 27. Remote Management

  428
  • 27.1 Remote Management Overview

    428
    • 27.1.1 Remote Management Limitations

      428
    • 27.1.2 System Timeout

      429
  • 27.2 Introduction to HTTPS

    429
  • 27.4 HTTPS Example

    432
    • 27.4.1 Internet Explorer Warning Messages

      432
    • 27.4.2 Netscape Navigator Warning Messages

      433
    • 27.4.3 Avoiding the Browser Warning Messages

      434
    • 27.4.4 Login Screen

      434
  • 27.6 How SSH works

    437
  • 27.7 SSH Implementation on the ZyWALL

    438
    • 27.7.1 Requirements for Using SSH

      439
  • 27.8 Configuring SSH

    439
  • 27.9 Secure Telnet Using SSH Examples

    440
    • 27.9.1 Example 1: Microsoft Windows

      440
    • 27.9.2 Example 2: Linux

      440
  • 27.10 Secure FTP Using SSH Example

    441
  • 27.12 Configuring TELNET

    442
    • 27.14.1 Supported MIBs

      446
    • 27.14.2 SNMP Traps

      446
    • 27.14.3 REMOTE MANAGEMENT: SNMP

      446
  • 27.17 Configuring CNM

    449
• 28. UPnP

  452
  • 28.1.1 How Do I Know If I'm Using UPnP?

    452
  • 28.1.2 NAT Traversal

    452
  • 28.1.3 Cautions with UPnP

    452
  • 28.1.4 UPnP and ZyXEL

    453
  • 28.2 Configuring UPnP

    453
  • 28.4 Installing UPnP in Windows Example

    455
    • 28.4.1 Installing UPnP in Windows Me

      456
    • 28.4.2 Installing UPnP in Windows XP

      457
  • 28.5 Using UPnP in Windows XP Example

    457
    • 28.5.1 Auto-discover Your UPnP-enabled Network Device

      458
    • 28.5.2 Web Configurator Easy Access

      459
• 29. ALG Screen

  462
  • 29.1.1 ALG and NAT

    462
  • 29.1.2 ALG and the Firewall

    462
  • 29.1.3 ALG and Multiple WAN

    462
  • 29.2 FTP

    463
  • 29.3 H.323

    463
  • 29.4 RTP

    463
    • 29.4.1 H.323 ALG Details

      463
  • 29.5 SIP

    465
    • 29.5.1 STUN

      465
    • 29.5.2 SIP ALG Details

      465
    • 29.5.3 SIP Signaling Session Timeout

      466
    • 29.5.4 SIP Audio Session Timeout

      466
  • 29.6 ALG Screen

    466
• 30. Logs Screens

  468
  • 30.2 Log Description Example

    469
    • 30.2.1 Certificate Not Trusted Log Note

      470
    • 30.4.1 Viewing Web Site Hits

      476
    • 30.4.2 Viewing Protocol/Port

      476
    • 30.4.3 Viewing Host IP Address

      478
    • 30.4.4 Reports Specifications

      479
• 31. Maintenance

  480
  • 31.1 Maintenance Overview

    480
  • 31.2 General Setup

    480
    • 31.2.1 General Setup and System Name

      480
  • 31.5 Pre-defined NTP Time Servers List

    485
    • 31.5.1 Resetting the Time

      485
    • 31.5.2 Time Server Synchronization

      485
  • 31.6 Introduction To Transparent Bridging

    487
  • 31.7 Transparent Firewalls

    487
    • 31.11.1 Backup Configuration

      493
    • 31.11.2 Restore Configuration

      493
    • 31.11.3 Back to Factory Defaults

      495
• 32. Introducing the SMT

  496
  • 32.1 Introduction to the SMT

    496
  • 32.2 Accessing the SMT via the Console Port

    496
    • 32.2.1 Initial Screen

      496
    • 32.2.2 Entering the Password

      497
  • 32.3 Navigating the SMT Interface

    497
    • 32.3.1 Main Menu

      498
    • 32.3.2 SMT Menus Overview

      500
  • 32.4 Changing the System Password

    502
  • 32.5 Resetting the ZyWALL

    503
• 33. SMT Menu 1 - General Setup

  504
  • 33.1 Introduction to General Setup

    504
  • 33.2 Configuring General Setup

    504
    • 33.2.1 Configuring Dynamic DNS

      506
      • 33.2.1.1 Editing DDNS Host

        506
• 34. WAN and Dial Backup Setup

  510
  • 34.1 Introduction to WAN and Dial Backup Setup

    510
  • 34.2 WAN Setup

    510
  • 34.3 Dial Backup

    511
  • 34.4 Configuring Dial Backup in Menu 2

    511
  • 34.5 Advanced WAN Setup

    512
  • 34.6 Remote Node Profile (Backup ISP)

    514
  • 34.7 Editing PPP Options

    516
  • 34.8 Editing TCP/IP Options

    517
  • 34.9 Editing Login Script

    519
  • 34.10 Remote Node Filter

    521
• 35. LAN Setup

  522
  • 35.1 Introduction to LAN Setup

    522
  • 35.2 Accessing the LAN Menus

    522
  • 35.3 LAN Port Filter Setup

    522
  • 35.4 TCP/IP and DHCP Ethernet Setup Menu

    523
    • 35.4.1 IP Alias Setup

      526
• 36. Internet Access

  528
  • 36.1 Introduction to Internet Access Setup

    528
  • 36.2 Ethernet Encapsulation

    528
  • 36.3 Configuring the PPTP Client

    530
  • 36.4 Configuring the PPPoE Client

    530
  • 36.5 Basic Setup Complete

    531
• 37. DMZ Setup

  532
  • 37.1 Configuring DMZ Setup

    532
  • 37.2 DMZ Port Filter Setup

    532
  • 37.3 TCP/IP Setup

    532
    • 37.3.1 IP Address

      533
    • 37.3.2 IP Alias Setup

      534
• 38. Route Setup

  536
  • 38.1 Configuring Route Setup

    536
  • 38.2 Route Assessment

    536
  • 38.3 Traffic Redirect

    537
  • 38.4 Route Failover

    538
• 39. Wireless Setup

  540
  • 39.1 Wireless LAN Setup

    540
    • 39.1.1 MAC Address Filter Setup

      542
  • 39.2 TCP/IP Setup

    543
    • 39.2.1 IP Address

      543
    • 39.2.2 IP Alias Setup

      544
• 40. Remote Node Setup

  546
  • 40.1 Introduction to Remote Node Setup

    546
  • 40.2 Remote Node Setup

    546
  • 40.3 Remote Node Profile Setup

    547
    • 40.3.1 Ethernet Encapsulation

      547
    • 40.3.2 PPPoE Encapsulation

      549
      • 40.3.2.1 Outgoing Authentication Protocol

        549
      • 40.3.2.2 Nailed-Up Connection

        549
      • 40.3.2.3 Metric

        550
    • 40.3.3 PPTP Encapsulation

      550
  • 40.4 Edit IP

    551
  • 40.5 Remote Node Filter

    553
  • 40.6 Traffic Redirect

    554
• 41. IP Static Route Setup

  556
  • 41.1 IP Static Route Setup

    556
• 42. Network Address Translation (NAT)

  558
  • 42.1 Using NAT

    558
    • 42.1.1 SUA (Single User Account) Versus NAT

      558
    • 42.1.2 Applying NAT

      558
  • 42.2 NAT Setup

    560
    • 42.2.1 Address Mapping Sets

      561
      • 42.2.1.1 SUA Address Mapping Set

        561
      • 42.2.1.2 User-Defined Address Mapping Sets

        562
      • 42.2.1.3 Ordering Your Rules

        563
  • 42.3 Configuring a Server behind NAT

    565
  • 42.4 General NAT Examples

    568
    • 42.4.1 Internet Access Only

      568
    • 42.4.2 Example 2: Internet Access with an Default Server

      570
    • 42.4.3 Example 3: Multiple Public IP Addresses With Inside Servers

      570
    • 42.4.4 Example 4: NAT Unfriendly Application Programs

      574
  • 42.5 Trigger Port Forwarding

    575
    • 42.5.1 Two Points To Remember About Trigger Ports

      575
• 43. Introducing the ZyWALL Firewall

  578
  • 43.1 Using ZyWALL SMT Menus

    578
    • 43.1.1 Activating the Firewall

      578
• 44. Filter Configuration

  580
  • 44.1 Introduction to Filters

    580
    • 44.1.1 The Filter Structure of the ZyWALL

      581
  • 44.2 Configuring a Filter Set

    583
    • 44.2.1 Configuring a Filter Rule

      584
    • 44.2.2 Configuring a TCP/IP Filter Rule

      585
    • 44.2.3 Configuring a Generic Filter Rule

      587
  • 44.3 Example Filter

    589
  • 44.4 Filter Types and NAT

    591
  • 44.5 Firewall Versus Filters

    591
  • 44.6 Applying a Filter

    592
    • 44.6.1 Applying LAN Filters

      592
    • 44.6.2 Applying DMZ Filters

      592
    • 44.6.3 Applying Remote Node Filters

      593
• 45. SNMP Configuration

  594
  • 45.1 SNMP Configuration

    594
  • 45.2 SNMP Traps

    595
• 46. System Information & Diagnosis

  596
  • 46.1 Introduction to System Status

    596
  • 46.2 System Status

    596
  • 46.3 System Information and Console Port Speed

    598
    • 46.3.1 System Information

      598
    • 46.3.2 Console Port Speed

      599
  • 46.4 Log and Trace

    600
    • 46.4.1 Viewing Error Log

      600
    • 46.4.2 Syslog Logging

      601
    • 46.4.3 Call-Triggering Packet

      604
  • 46.5 Diagnostic

    604
    • 46.5.1 WAN DHCP

      605
• 47. Firmware and Configuration File Maintenance

  608
  • 47.1 Introduction

    608
  • 47.2 Filename Conventions

    608
  • 47.3 Backup Configuration

    609
    • 47.3.1 Backup Configuration

      609
    • 47.3.2 Using the FTP Command from the Command Line

      610
    • 47.3.3 Example of FTP Commands from the Command Line

      611
    • 47.3.4 GUI-based FTP Clients

      611
    • 47.3.5 File Maintenance Over WAN

      611
    • 47.3.6 Backup Configuration Using TFTP

      612
    • 47.3.7 TFTP Command Example

      612
    • 47.3.8 GUI-based TFTP Clients

      613
    • 47.3.9 Backup Via Console Port

      613
  • 47.4 Restore Configuration

    614
    • 47.4.1 Restore Using FTP

      614
    • 47.4.2 Restore Using FTP Session Example

      616
    • 47.4.3 Restore Via Console Port

      616
  • 47.5 Uploading Firmware and Configuration Files

    617
    • 47.5.1 Firmware File Upload

      617
    • 47.5.2 Configuration File Upload

      618
    • 47.5.3 FTP File Upload Command from the DOS Prompt Example

      619
    • 47.5.4 FTP Session Example of Firmware File Upload

      619
    • 47.5.5 TFTP File Upload

      619
    • 47.5.6 TFTP Upload Command Example

      620
    • 47.5.7 Uploading Via Console Port

      620
    • 47.5.8 Uploading Firmware File Via Console Port

      620
    • 47.5.9 Example Xmodem Firmware Upload Using HyperTerminal

      621
    • 47.5.10 Uploading Configuration File Via Console Port

      621
    • 47.5.11 Example Xmodem Configuration Upload Using HyperTerminal

      622
• 48. System Maintenance Menus 8 to 10

  624
  • 48.1 Command Interpreter Mode

    624
    • 48.1.1 Command Syntax

      624
    • 48.1.2 Command Usage

      625
  • 48.2 Call Control Support

    626
    • 48.2.1 Budget Management

      626
    • 48.2.2 Call History

      627
  • 48.3 Time and Date Setting

    628
• 49. Remote Management

  632
  • 49.1 Remote Management

    632
    • 49.1.1 Remote Management Limitations

      634
• 50. IP Policy Routing

  636
  • 50.1 IP Routing Policy Summary

    636
  • 50.2 IP Routing Policy Setup

    637
    • 50.2.1 Applying Policy to Packets

      639
  • 50.3 IP Policy Routing Example

    640
• 51. Call Scheduling

  644
  • 51.1 Introduction to Call Scheduling

    644
• 52. Troubleshooting

  648
  • 52.1 Problems Starting Up the ZyWALL

    648
  • 52.2 Problems with the LAN Interface

    648
  • 52.3 Problems with the DMZ Interface

    649
  • 52.4 Problems with the WAN Interface

    649
  • 52.5 Problems Accessing the ZyWALL

    650
    • 52.5.1 Pop-up Windows, JavaScripts and Java Permissions

      650
      • 52.5.1.1 Internet Explorer Pop-up Blockers

        651
      • 52.5.1.2 JavaScripts

        654
      • 52.5.1.3 Java Permissions

        656
  • 52.6 Packet Flow

    658
• A. Product Specifications

  660
  • Specification Tables

    660
  • Compatible ZyXEL WLAN Cards

    664
  • WLAN Card and ZyWALL Turbo Card Installation

    664
  • Cable Pin Assignments

    665
• B. Hardware Installation

  668
  • General Installation Instructions

    668
  • Desktop Installation

    668
  • Rack-mounted Installation Requirements

    669
  • Rack-Mounted Installation

    669
• C. Removing and Installing a Fuse

  672
  • Removing a Fuse

    672
  • Installing a Fuse

    672
• D. C. Removing and Installing a Fuse

  674
  • Windows 95/98/Me

    674
    • Installing Components

      675
    • Configuring

      676
    • Verifying Settings

      677
  • Windows 2000/NT/XP

    677
    • Verifying Settings

      682
  • Macintosh OS 8/9

    682
    • Verifying Settings

      684
  • Macintosh OS X

    684
    • Verifying Settings

      685
  • Linux

    685
    • Using the K Desktop Environment (KDE)

      686
    • Using Configuration Files

      687
    • Verifying Settings

      689
• E. IP Subnetting

  690
  • IP Addressing

    690
  • IP Classes

    690
  • Subnet Masks

    691
  • Subnetting

    691
  • Example: Two Subnets

    692
  • Example: Four Subnets

    694
  • Example Eight Subnets

    695
  • Subnetting With Class A and Class B Networks.

    696
• F. PPPoE

  698
  • PPPoE in Action

    698
  • Benefits of PPPoE

    698
  • Traditional Dial-up Scenario

    698
  • How PPPoE Works

    699
  • ZyWALL as a PPPoE Client

    699
• G. PPTP

  700
  • What is PPTP?

    700
    • How can we transport PPP frames from a computer to a broadband modem over Ethernet?

      700
  • PPTP and the ZyWALL

    700
  • PPTP Protocol Overview

    701
  • Control & PPP Connections

    701
    • Call Connection

      701
    • PPP Data Connection

      702
• H. Wireless LANs

  704
  • Wireless LAN Topologies

    704
    • Ad-hoc Wireless LAN Configuration

      704
    • BSS

      704
    • ESS

      705
  • Channel

    706
  • RTS/CTS

    706
  • Fragmentation Threshold

    707
  • Preamble Type

    708
  • IEEE 802.1x

    709
  • RADIUS

    709
    • Types of RADIUS Messages

      709
  • EAP Authentication

    710
  • Types of Authentication

    711
    • EAP-MD5 (Message-Digest Algorithm 5)

      711
    • EAP-TLS (Transport Layer Security)

      711
    • EAP-TTLS (Tunneled Transport Layer Service)

      711
    • PEAP (Protected EAP)

      712
    • LEAP

      712
    • WEP Encryption

      712
  • WEP Authentication Steps

    712
    • Dynamic WEP Key Exchange

      713
  • WPA

    714
    • User Authentication

      714
    • Encryption

      714
  • Security Parameters Summary

    715
  • Roaming

    715
    • Requirements for Roaming

      717
• I. Triangle Route

  718
  • The Ideal Setup

    718
  • The “Triangle Route” Problem

    718
  • The “Triangle Route” Solutions

    719
  • IP Aliasing

    719
  • Gateways on the WAN Side

    720
  • Configuring Triangle Route via Commands

    720
• J. Windows 98 SE/Me Requirements for Anti-Virus Message Display

  722
• K. VPN Setup

  726
  • General Notes

    726
    • Dynamic IPSec Rule

      726
    • Full Feature NAT Mode

      726
  • VPN Configuration

    727
    • Dialing the VPN Tunnel via Web Configurator

      732
  • VPN Troubleshooting

    734
    • VPN Log

      734
    • IPSec Debug

      736
  • Use a VPN Tunnel

    737
    • FTP Example

      737
• L. Importing Certificates

  738
  • Import ZyWALL Certificates into Netscape Navigator

    738
  • Importing the ZyWALL’s Certificate into Internet Explorer

    738
  • Enrolling and Importing SSL Client Certificates

    742
    • Installing the CA’s Certificate

      743
    • Installing Your Personal Certificate(s)

      744
  • Using a Certificate When Accessing the ZyWALL Example

    747
• M. Command Interpreter

  750
  • Command Syntax

    750
  • Command Usage

    750
• N. Firewall Commands

  752
• O. NetBIOS Filter Commands

  758
  • Introduction

    758
  • Display NetBIOS Filter Settings

    758
  • NetBIOS Filter Configuration

    759
• P. Certificates Commands

  762
• Q. Brute-Force Password Guessing Protection

  766
  • Example

    766
• R. Boot Commands

  768
• S. Log Descriptions

  770
  • Syslog Logs

    790
  • Log Commands

    792
    • Configuring What You Want the ZyWALL to Log

      792
    • Displaying Logs

      792
  • Log Command Example

    793
• Index

  794
  • Numerics

    794
  • A

    794
  • B

    794
  • C

    795
  • D

    795
  • E

    796
  • F

    796
  • G

    797
  • H

    797
  • I

    797
  • J

    798
  • K

    798
  • L

    798
  • M

    798
  • N

    799
  • O

    799
  • P

    799
  • Q

    800
  • R

    800
  • S

    801
  • T

    802
  • U

    802
  • V

    803
  • W

    803
  • X

    803
  • Z

    803