Benutzeranleitung / Produktwartung 10 des Produzenten ZyXEL Communications
Zur Seite of 324
ZyW ALL 10/50 Internet Security Gateway User’s Guide Version 3.50 May 2002.
ZYWALL 10/50 Internet Security Gateway ii Copyright Copyright Copyright © 2 002 by ZyXEL Com munications Corporation. The contents of this publi cation may not be reproduced i n any part or as a whol.
ZYWALL 10/50 Internet Security Gateway FCC iii Federal Communications Commission (FCC) Interference S tatement This device complies with Part 15 of FCC rules. Operation is subject to the following two cond itions: • This device m ay not cause harmful interference.
ZYWALL 10/50 Internet Security Gateway iv Information for Canadian Users Information for Canadian Users The Industry Canada label identifies certified equipmen t. This certification means that the equipment meets certain telecom munications ne twork protect ive operatio n and safety requirem ents.
ZYWALL 10/50 Internet Security Gateway Declaration of Conformity v Declaration of Conformity We, the Manufacturer/Im porter, ZyXEL Communications Corp .
ZYWALL 10/50 Internet Security Gateway vi ZyXEL Limited Warranty ZyXEL Limited W arranty ZyXEL warrants to the original end us er (purchaser) that this product is free from any defects in materials or workmanshi p for a peri od of up t o two years from the date of purchase .
ZYWALL 10/50 Internet Security Gateway Customer Support vii Customer Support Please have th e following i nformation re ady when you cont act customer support. • Product model and serial num ber. • Information in Menu 24.2.1 – System Informat ion .
ZYWALL 10/50 Internet Security Gateway viii Table of Contents T able of Content s Copyright ...................................................................................................................... ...............................ii Federal Communications Commission (FCC) Inte rfer ence S t atement .
ZYWALL 10/50 Internet Security Gateway Table of Contents ix 3.1 Turning On Your ZyWALL ..................................................................................................... .. 3-1 3.1.1 Initia l Screen..................................
ZYWALL 10/50 Internet Security Gateway x Table of Contents 5.3.7 IP Alias................................................................................................................. ............... 5-5 5.4 TCP/IP a nd DHCP Et her net Setu p Menu.
ZYWALL 10/50 Internet Security Gateway Table of Contents xi 9.1.5 NAT Mapp ing Ty pes ........................................................................................................ .. 9-4 9.2 Using NAT .......................................
ZYWALL 10/50 Internet Security Gateway xii Table of Contents 10.5.4 UDP/IC MP Secu rity ....................................................................................................... 10-10 10.5.5 Upper La yer Prot ocols ......................
ZYWALL 10/50 Internet Security Gateway Table of Contents xiii 13.2.1 Rule Checklist .......................................................................................................... ........ 13-1 13.2.2 Security Ramifications ................
.
Getting S t arted I Part I: Getting Started This part is structured as a step-by-step guide to help you connect, inst all and setup your ZyW ALL to operate on your network and access the Internet.
.
ZyW ALL 10/50 Internet Security Gateway Getting to Know Y our ZyW ALL 1-1 Chapter 1 Getting to Know Your ZyWALL This chapter introduces the main features and applications of the Z yWALL.
ZyW ALL 10/50 Internet Security Gateway 1-2 Getting to Know Y our ZyW ALL Y ou can configure most features of th e ZyW ALL via SMT but we recommend you configure the fire wall and Content Filters using the ZyW ALL web configurator .
ZyW ALL 10/50 Internet Security Gateway Getting to Know Y our ZyW ALL 1-3 Network Add ress T ranslation (NA T) NAT (Network Address Trans lation - NAT, RFC 1631) allows the translat ion of an Inter net Protocol a ddress used within one ne twork to a different I P address known within ano ther network.
ZyW ALL 10/50 Internet Security Gateway 1-4 Getting to Know Y our ZyW ALL 1.3 Applications 1.3.1 Secure Broadband Internet Access via Cable or DSL Modem A cable modem or xDSL modem can connect to th e ZyWALL 10/50 for broadba nd Internet access via Ethernet port on the modem .
ZyW ALL 10/50 Internet Security Gateway Getting to Know Y our ZyW ALL 1-5 1.3.2 VPN Application ZyWALL VPN is an ideal cost-effective way to conn ect branch offices and business partner s over the Internet without the need (and expens e) for leased lines between sites.
.
ZyW ALL 10/50 Internet Security Gateway Hardware Installation 2-1 Chapter 2 Hardware Installation This chapter explain s the LEDs and ports as we ll as how to connect the hardware and perform the initial setup. 2.1 Front Panel LEDs and Back Panel Ports 2.
ZyW ALL 10/50 Internet Security Gateway 2-2 Hardware Installation Table 2-1 LED Descriptions LED FUNCTION COLOR ST ATUS MEANING Flashing The 10M LAN is sending/recei ving packets. Off The 100M LAN is not connected. On The ZyWALL is connected to a 100M bps LAN.
ZyW ALL 10/50 Internet Security Gateway Hardware Installation 2-3 Figure 2-2 ZyWALL 10 Rear Panel and Connectio ns.
ZyW ALL 10/50 Internet Security Gateway 2-4 Hardware Installation Figure 2-3 ZyWALL 50 Rear Panel and Connectio ns This section outlines how to conn ect your ZyWALL 10/50 to the LAN and the WAN.
ZyW ALL 10/50 Internet Security Gateway Hardware Installation 2-5 port) of yo ur comput er. You can use an exte nsion RS-23 2 cable if the encl osed one is too short. After t he initial setup, you can modify the configuration remotely throug h telnet connections.
ZyW ALL 10/50 Internet Security Gateway 2-6 Hardware Installation 2.3 Additional Installation Requirement s In addition to the con tents of your package, there are other hardware and software requirements you need before you can install and use your ZyWALL.
ZyW ALL 10/50 Internet Security Gateway Initial Setup 3-1 Chapter 3 Initial Setup This chapter explain s how to perform initial ZyWALL setup and gives an o verview of SMT menus. 3.1 T urning On Y our ZyW ALL At this point, you should have connected the console port, the LAN port, the WAN port and the power por t to the appropriate devices or lines.
ZyW ALL 10/50 Internet Security Gateway 3-2 Initial Setup Figure 3-2 Password Screen 3.2 Navigating the SMT Interface The SMT (System Management Terminal) is the inte rface that you use t o configure you r ZyWALL. Several operations that you should be familiar with before you attempt to modify the configuration are listed in the table below.
ZyW ALL 10/50 Internet Security Gateway Initial Setup 3-3 3.2.1 Main Menu After you enter the password, the SMT displays th e ZyWALL Main Men u , as shown next. Figure 3-3 ZyWALL Main Menu 3.2.2 System Management T erminal Interface Summary Table 3-2 Main Menu Summary NO.
ZyW ALL 10/50 Internet Security Gateway 3-4 Initial Setup Table 3-2 Main Menu Summary NO. MENU TITLE FUNCTION 23 Sy stem Password Change your pass word in this menu (recommended). 24 Sy stem Maintenance From displaying system st atus to uploading firm ware, this menu provides comprehensive system mainte nance.
ZyW ALL 10/50 Internet Security Gateway Initial Setup 3-5 3.2.3 SMT Menus at a Glance Figure 3-4 Getting Started and Advanced Applications SMT Menus.
ZyW ALL 10/50 Internet Security Gateway 3-6 Initial Setup Figure 3-5 Advanced Management SMT Menus.
ZyW ALL 10/50 Internet Security Gateway Initial Setup 3-7 Figure 3-6 IPSec VPN Configuration SMT Menus 3.3 Changing the System Password The first thi ng you sh ould do i s change the default system password by followin g the steps sh own next. Step 1.
ZyW ALL 10/50 Internet Security Gateway 3-8 Initial Setup Step 4. Re-type your new system password for confirmation and press [ENTER] . Note that as y ou type a pa ssword, the sc reen display s an (X) f or each chara cter you type.
ZyW ALL 10/50 Internet Security Gateway Initial Setup 3-9 3.4.2 Procedure T o Use The Reset Button Make sure the SYS led is o n (not bli nking) b efore you be gin this p rocedure. 1. Press the RESET button f or ten seconds , then release i t. If the SYS LED begins to blink, the defaults have been restored an d the ZyWA L L restarts.
.
ZyW ALL 10/50 Internet Security Gateway General and W AN Setup 4-1 Chapter 4 General and WAN Setup Menu 1 - General Setup contains adm inistrative and syst em-relat ed information. Clone a LAN computer MAC addre ss in the Menu 2 - WAN Setup . 4.1 System Name System Name is for i dentificat ion purpose s.
ZyW ALL 10/50 Internet Security Gateway 4-2 General and W AN Setup IP address that changes each time you reconnect. Your friends or relatives will always be able to call you even if they don’t know your IP add ress. First of all, y ou need to ha ve registered a dynami c DNS account wit h www.
ZyW ALL 10/50 Internet Security Gateway General and W AN Setup 4-3 Domain Name Enter the domain name (if you kno w it) here. If you leave this field blank, the ISP may assign a domain name via DHCP. You can go to menu 24.8 and type "sys dom ain name" to see the current domain name used by your router.
ZyW ALL 10/50 Internet Security Gateway 4-4 General and W AN Setup FIELD DESCRIPTION EX AMPLE Active Press [SPACE BAR] to select Yes and then press [ENTER] to make dynamic DNS active. Yes DDNS Type Press [SPACE BAR] and then [ENTER] to select DynamicDN S if you have a dynamic IP address(es).
ZyW ALL 10/50 Internet Security Gateway General and W AN Setup 4-5 If you have a private W AN IP address, then y ou cannot use Dynamic DNS. 4.4 W AN Setup This section describes how to configure the WAN using Menu 2 — WAN Setup . From the m ain menu, enter 2 t o open m enu 2.
ZyW ALL 10/50 Internet Security Gateway 4-6 General and W AN Setup FIELD DESCRIPTION EXAMPLE IP Address This field is applicable onl y if you choose the IP Address attached on LAN method. Enter the IP address of the computer on the LAN whose MAC you are clonin g.
ZyW ALL 10/50 Internet Security Gateway LAN Setup 5-1 Chapter 5 LAN Setup This chapter describes ho w to configure the LAN using Menu 3 – LAN Setup . 5.1 Introduction This section describes how to configure the LAN using Menu 3 — LAN Setup . From the main menu, enter 3 to open m enu 3.
ZyW ALL 10/50 Internet Security Gateway 5-2 LAN Setup 5.3.1 Factory LAN Default s The LAN parameters of the ZyWALL are preset in the factory with the following values: 1. IP address of 192.168.1.1 with su bnet mask of 255.255.25 5.0 (24 bits). 2. DHCP serve r enabled with 32 clie nt IP addre sses starting fr om 192.
ZyW ALL 10/50 Internet Security Gateway LAN Setup 5-3 Where you obtain your n etwork number depends on your particular situation. If the ISP or you r network administrat or assigns yo u a block o f registered IP a ddr esses, follow their instructions in selecting the IP addresses and the subnet m ask.
ZyW ALL 10/50 Internet Security Gateway 5-4 LAN Setup Regardless of your p articular situation, do not create an arbitrary IP address; always follow the guidelines above. For more information on address assig nment, please refer to RFC 1597, Address All ocation for Private Internets and RFC 1466, Guidelines for Management of IP Address Space.
ZyW ALL 10/50 Internet Security Gateway LAN Setup 5-5 5.3.7 IP Alias IP Alias allows you to partition a ph ysical network into different logical networks over the same Ethernet interface. The ZyWALL supports three logical LAN in terfa ces via its single physical Ethe rnet interface with the ZyWALL itself as the gat eway for each LAN network.
ZyW ALL 10/50 Internet Security Gateway 5-6 LAN Setup Figure 5-6 Menu 3.2 — TCP/IP and DHCP Ethernet Setup Follow the instructions in the next table on how to con figure the DHCP fields. Table 5-3 DHCP Ethernet Setup Menu Fields FIELD DESCRIPTION EXA MPLE DHCP T his field enables/disables the DHCP server.
ZyW ALL 10/50 Internet Security Gateway LAN Setup 5-7 Table 5-3 DHCP Ethernet Setup Menu Fields FIELD DESCRIPTION EXA MPLE DHCP Server Address If Relay is selected in the DHCP field above, then t ype in the IP address of the actual, remote DHCP server here.
ZyW ALL 10/50 Internet Security Gateway 5-8 LAN Setup Figure 5-7 Menu 3.2.1 — IP Alias Setup Use the instructions in the following table to configure IP Alias parameters. Table 5-5 IP Alias Setup Menu Fields FIELD DESCRIPTION EXAMPLE IP Alias Choose Yes to configure the LAN net work for the ZyWALL.
ZyW ALL 10/50 Internet Security Gateway Internet Access 6-1 Chapter 6 Internet Access This chapter show s you how to configure your ZyWA LL for Internet access. 6.1 Internet Access Setup You will see three different menu 4 screens depending on whether you chose Ethernet, PPTP or PPPoE Encapsulation .
ZyW ALL 10/50 Internet Security Gateway 6-2 Internet Access Table 6-1 Internet Access Setup Menu Fields FIELD DESCRIPTION Encapsulation Press [SPACE BAR] and then press [ENTER] to choose Ethernet . The encapsulation method influences your cho ices for IP Address.
ZyW ALL 10/50 Internet Security Gateway Internet Access 6-3 The ZyW ALL 10/50 support s one PPTP server connection at any given time. 6.1.3 Configuring the PPTP Client T o configure a PPTP client, you m ust configure the My Login and Password fields for a PPP connection and the PPTP pa rameters for a PP TP connection.
ZyW ALL 10/50 Internet Security Gateway 6-4 Internet Access For the se rvice prov ider, PPPo E offers an access a nd authenticatio n method that works with existin g access control system s (e.
ZyW ALL 10/50 Internet Security Gateway Internet Access 6-5 If you need a PPPoE service name to identify and reach the PPPoE server, please go to m enu 11 and enter the PPPoE service name provided to you in the Service Name field.
.
Advanced Applications II Part II: Advanced Applications This part covers Remote Nod e Setup, IP S tat ic Route Setup and Network Address T ranslation..
.
ZyW ALL 10/50 Internet Security Gateway Remote Node Setup 7-1 Chapter 7 Remote Node Setup This chapter show s you how to configure a rem ote node. A remot e node is re quired for placing calls t o a remote gateway. A rem ote node represe nts both t he rem ote gateway and th e network behi nd it across a WAN co nnection.
ZyW ALL 10/50 Internet Security Gateway 7-2 Remo te Node Setu p Figure 7-1 Menu 11.1 — Remote Node Profile for Ethern et Encapsulation Table 7-1 Fields in Menu 11.1 FIELD DESCRIPTION EXAMPLE Rem Node Name Enter a descriptive name for the remote node.
ZyW ALL 10/50 Internet Security Gateway Remote Node Setup 7-3 Table 7-1 Fields in Menu 11.1 FIELD DESCRIPTION EXAMPLE Outgoing My Login Enter the login name ass igned by your ISP when the Z yWALL calls this remote node. Some ISPs append this field to the Service Name field above (e.
ZyW ALL 10/50 Internet Security Gateway 7-4 Remo te Node Setu p Figure 7-2 Menu 11.1 — Remote Node Profile for PPPoE Encapsulation Outgoing Authentication Protocol Generally spea king, you s hould em ploy the st rongest authen tication prot ocol possi ble, for o bvious reaso ns.
ZyW ALL 10/50 Internet Security Gateway Remote Node Setup 7-5 Table 7-2 Fields in Menu 11.1 (PPPoE Encapsulation Specific) FIELD DESCRIPTION EX AMPLE Authen This field sets the authenticati on protocol used for outgoing calls. Options for this field are: CHAP / PA P - Your ZyWALL will accept either CHAP or PA P when requested by this remote node.
ZyW ALL 10/50 Internet Security Gateway 7-6 Remo te Node Setu p Figure 7-3 Menu 11.1 — Remote Node Profile for PPTP Encapsulation The next table sh ows how to co nfigure fields in menu 11.1 not previously d iscussed above. Table 7-3 Fields in Menu 11.
ZyW ALL 10/50 Internet Security Gateway Remote Node Setup 7-7 7.2 Editing TCP/IP Options (with Ethernet Encap sulation) Move the cur sor to the Edit IP fiel d in menu 11.1, pres s [SPACE BAR] to select Yes . Press [ENTER] to open Menu 11.3 - Network Layer Options .
ZyW ALL 10/50 Internet Security Gateway 7-8 Remo te Node Setu p Table 7-4 Remote Node Net work Layer Options Menu Fields FIELD DESCRIPTION EXAMPLE Metric This field is valid only for PPTP/PPPoE encapsulation. The metric represents the “cost” of transmissi on for routing pur poses.
ZyW ALL 10/50 Internet Security Gateway Remote Node Setup 7-9 Figure 7-5 Menu 11.3 — Remote Node Net work Layer Options The next table gives you instructio ns about configu ring remote node network layer options.
ZyW ALL 10/50 Internet Security Gateway 7-10 Remote Node Setup Table 7-5 Remote Node Net work Layer Options Menu Fields FIELD DESCRIPTION EXAMPLE Metric The metric represents the “cost” of transmission for routin g purposes. IP routing uses hop count as the measureme nt of cost, with a minimum of 1 for directly connected net works.
ZyW ALL 10/50 Internet Security Gateway Remote Node Setup 7-1 1 Use menu 11.5 to specify the filter set(s) to apply to the incoming and outgoing traffic between this remote node and the ZyWALL to prevent certain packets from tr iggering calls. You can specify up to 4 filter sets separated by commas, e.
.
ZyW ALL 10/50 Internet Security Gateway IP S tatic Route Setup 8-1 Chapter 8 IP Static Route Setup This chapter shows you how t o configur e static routes with your ZyWALL. Static routes tell the ZyWALL routing informatio n that it ca nnot learn a utomati cally through other means.
ZyW ALL 10/50 Internet Security Gateway 8-2 IP S tatic Route Setup 8.1 IP S t atic Route Setup You confi gure IP static r outes in m enu 12. 1 by selecting on e of the IP st atic routes as shown next .
ZyW ALL 10/50 Internet Security Gateway IP S tatic Route Setup 8-3 The following table describes the IP Static Route Menu fields. Table 8-1 IP Static Route Menu Fields FIELD DESCRIPTION Route # This is the index number of the static route that y ou ch ose in menu 12.
.
ZyW ALL 10/50 Internet Security Gateway NA T 9-1 Chapter 9 Network Address Translation (NAT) This chapter discusses ho w to configure NAT on the ZyWALL. 9.1 Introduction NAT (Network Address Tran slation - NAT, RFC 1631) is the translation of the IP address of a host in a packet, e.
ZyW ALL 10/50 Internet Security Gateway 9-2 NA T Global This refers to the packet address (source or destination) as the packet travels on the WAN. NAT never changes the IP address (either local or global) of an outs ide ho st.
ZyW ALL 10/50 Internet Security Gateway NA T 9-3 Figure 9-1 How NAT Works 9.1.4 NA T Application The following figure illu strates a possible NAT applica tion, where three inside LANs (logical LANs using IP Alias) behind the ZyWALL can communicate with three distinct WA N networks.
ZyW ALL 10/50 Internet Security Gateway 9-4 NA T Figure 9-2 NAT Application With IP Alias 9.1.5 NA T Mapping T ypes NAT supports five types of IP/port m apping. They a re: 1. One to One : In One -to-One m ode, the ZyWALL m aps one local IP ad dress to one gl obal IP address.
ZyW ALL 10/50 Internet Security Gateway NA T 9-5 3. Many to Many Overload : In Many-to-Many Overload mode, the ZyWALL maps the multiple local IP addresses to shared global IP addresses. 4. Many One to One : In Many-One-to-One mode , the ZyWALL m aps the each local IP addresses to unique gl obal IP add resses.
ZyW ALL 10/50 Internet Security Gateway 9-6 NA T 9.2 Using NA T You must create a firewall rule in addition to setting up SUA/NAT, to allow traffic from the WAN to be forwarded through the ZyWALL.
ZyW ALL 10/50 Internet Security Gateway NA T 9-7 The following fi gure shows how you appl y NAT to the rem ote node in menu 11.1 . Step 1. Enter 11 from the main menu. Move the cur sor to the Edit IP field, press [SPACE BAR] to select Yes and then press [ENTER] to bring up Menu 1 1.
ZyW ALL 10/50 Internet Security Gateway 9-8 NA T 9.3 NA T Setup Use the Addre ss Mapping S ets me nus and submenus to creat e the mappin g table used t o assign gl obal addresses to com puters on the LAN. You ca n see two NAT Address Mapp ing sets in m enu 15.
ZyW ALL 10/50 Internet Security Gateway NA T 9-9 SUA Addr ess Mapping Set Enter 255 to display the next screen (see also section 9.2.1) . The fields i n this m enu cannot be cha nged. Figure 9-7 Menu 15.1.1 — SUA Address Mapping Rules The following table explains th e fields in this screen.
ZyW ALL 10/50 Internet Security Gateway 9-10 NA T Table 9-4 SUA Address Mapping Rules FIELD DESCRIPTION EXAMPLE Global End IP This is the ending gl obal IP address (IGA). N/A Type These are the mapping t ypes discussed above (see Table 9-2 ). Server allows us to specify multiple serv ers of different types behind NAT to this machine.
ZyW ALL 10/50 Internet Security Gateway NA T 9-1 1 Figure 9-8 Menu 15.1.1 — First Set The Type, Local and Global Start/End IPs are configured in menu 15.1.1.1 (described later) and th e values are displayed here. Ordering Y our Rules Ordering y our rules is important because the ZyWALL a pplies the rules in the order that you specify.
ZyW ALL 10/50 Internet Security Gateway 9-12 NA T Table 9-5 Fields in Menu 15.1.1 FIELD DESCRIPTION EXAMPLE Action The default is None . Edit means you want to edit a selected rule (see following field). Insert Before means to insert a rule before the rule selected.
ZyW ALL 10/50 Internet Security Gateway NA T 9-13 Table 9-6 Menu 15.1.1.1 — Editing/Confi guring an Indivi dual Rule in a Set FIELD DESCRIPTION EXAMPLE Type Press [SPACE BAR] to toggle through a total of five t ypes. These are the mapping t ypes discussed in Table 9-2.
ZyW ALL 10/50 Internet Security Gateway 9-14 NA T In addition to the servers for specified services, NAT supports a default server. A service request that does not have a server explicitly design ated for it is forwarded to the default server. If the default is not defined, the service request is simply discarded.
ZyW ALL 10/50 Internet Security Gateway NA T 9-15 Step 2. Enter 2 to go to Menu 15. 2 - NAT Ser ver Setup . Step 3. Enter a port number in an unused Start Port No field. To forward only one por t, enter it again in the End Port No field. To specify a range of ports, e nte r the last port to be forwarded in the End Port No field.
ZyW ALL 10/50 Internet Security Gateway 9-16 NA T Figure 9-11 Multiple Servers Behind NAT Example.
ZyW ALL 10/50 Internet Security Gateway NA T 9-17 9.5 General NA T Examples 9.5.1 Internet Access Only In the following Internet access ex am ple, you only need one rule wh ere all your ILAs (Inside Local addresses) map t o one dynam ic IGA (Insi de Global Ad dress) assigned by your ISP.
ZyW ALL 10/50 Internet Security Gateway 9-18 NA T From m enu 4 shown a bove, sim ply choose the SUA Only option from the Network Address Translation field. This i s the Many -to-One m apping di scussed in secti on 9.5. The SUA Only read-onl y option from the Network Address Translatio n field in m enus 4 an d 11.
ZyW ALL 10/50 Internet Security Gateway NA T 9-19 Figure 9-15 Menu 15.2 — Specifying an Inside Server 9.5.3 Example 3: Multiple Public IP Addresses With Inside Servers In this exam ple, there ar e 3 IGAs from our ISP. T here are many department s but two ha ve their ow n FTP server.
ZyW ALL 10/50 Internet Security Gateway 9-20 NA T The example situation looks so mewhat like this: Figure 9-16 NAT Example 3 Step 1. In this case yo u need to confi gure Address Ma pping Set 1 from Menu 15.1 - Address Mapping Sets. Therefore you must choose the Full Feature option from the Network Address Translation field (in m enu 4 or menu 11.
ZyW ALL 10/50 Internet Security Gateway NA T 9-21 Step 6. Repeat the previous step for rules 2 to 4 as outlined abov e. Step 7. When finis hed, me nu 15.1.1 shoul d look li ke as shown i n Figure 9- 19. Figure 9-17 Example 3: Menu 11.3 The following figure shows ho w to conf igure the first rule.
ZyW ALL 10/50 Internet Security Gateway 9-22 NA T Figure 9-19 Example 3: Final Menu 15.1.1 Now conf igure th e IGA3 to map to our web serv er and ma il serv er on the LA N. Step 8. Enter 15 from the main menu. Step 9. Now enter 2 from this menu and configu re it as shown in Figure 9-20 .
ZyW ALL 10/50 Internet Security Gateway NA T 9-23 9.5.4 Example 4: NA T Unfr iendly Application Programs Some applications do not supp ort NAT Mapping using TC P or UDP port address translation. In this case it is better to use Many -One-to-One m apping as po rt numbers do not change for Many-One-to-One (and One-to-One ) NAT m apping types.
ZyW ALL 10/50 Internet Security Gateway 9-24 NA T Figure 9-22 Example 4: Menu 15. 1.1. 1 — Address Mapping Rule After you’ve configured your rule, you should b e able to check the settings in menu 15.1.1 as shown next. Figure 9-23 Example 4: Menu 15.
Firewall and Content Filters III Part III: Firewall and Content Filters Part III introduces firewalls in general and the ZyW A LL firewall. It also explains custom port s and logs and gives example firewall rules and an overvie w of content filtering.
.
ZyWALL 10/50 Internet Security Gateway Firewalls 10-1 Chapter 10 Firewalls This chapter gives som e background inform ation on firewalls and explai ns how to get started with the ZyWALL firewall.
ZyWALL 10/50 Internet Security Gateway 10-2 Firewalls i. Inform ation hiding prevents the names of int ernal system s from being m ade known via DNS to outside system s, since the app lication gate way is the only host whose name must be m ade known to outside systems.
ZyWALL 10/50 Internet Security Gateway Firewalls 10-3 Figure 10-1 ZyWALL Fire wall Application 10.4 Denial of Service Denials of Service (DoS) attacks are aim ed at devices an d networks wi th a connection to the Internet.
ZyWALL 10/50 Internet Security Gateway 10-4 Firewalls for use over a sing le port, such as Web on por t 80, other ports are also active. If the person configu ring or managing t he computer i s not careful, a hacker coul d attack it over an unpr otected port.
ZyWALL 10/50 Internet Security Gateway Firewalls 10-5 Figure 10-2 Three-Way Handshake Under normal circumstances, the application that initiate s a session sends a SYN (synchronize) packet to the receiving server. The receiver sends back an ACK (ack nowledgment) packet and its own SYN, and then the initiator responds with an ACK (acknowledgment).
ZyWALL 10/50 Internet Security Gateway 10-6 Firewalls 2-b In a LAND Atta ck , hackers flood S YN packets i nto th e network with a spoofed source IP address of the targeted system. Th is makes it appear as if the host computer sent t he packets to itself, making the system unavailable while the target system tries to respond to itself.
ZyWALL 10/50 Internet Security Gateway Firewalls 10-7 Table 10-3 Legal NetBIOS Command s MESSAGE: REQUEST: POSITIVE: NEGATIVE: RETARGET: KEEPALIVE: All SMTP commands are illegal excep t for th ose displayed in the following tables.
ZyWALL 10/50 Internet Security Gateway 10-8 Firewalls Denies all sessions originatin g from the WAN to the LAN. Figure 10-5 Stateful Inspection The previous figure shows the ZyWALL’s default firewall rules in action as well as demonstrates how stateful inspection works.
ZyWALL 10/50 Internet Security Gateway Firewalls 10-9 3. The packet is inspected by a firewall rule to de termine and record information about the state of t he packet's connection. This i nform ation is recorded i n a new stat e table entry created for the new connection.
ZyWALL 10/50 Internet Security Gateway 10-10 Firewalls The ability to define firewall rules is a very powerful tool. Using custom rules, it is possible to disable all firewall protection or block all access to the Internet. Use extreme caution when creating or deleting firewall rules.
ZyWALL 10/50 Internet Security Gateway Firewalls 10-11 little tracking information. For instance, ICMP redirect packets are never allowed in, since they could be used to reroute traffic through attacking machines.
ZyWALL 10/50 Internet Security Gateway 10-12 Firewalls 10.6.1 Security In General You can never be too careful! Factor s outside your fi rewall, filtering or NAT can cause security breach es. Below are som e generalizatio ns about what you can d o to minim ize them.
ZyWALL 10/50 Internet Security Gateway Firewalls 10-13 10.7.1 Packet Filtering: The router filters packets as they pass through the rou ter’s interface according to the filter ru les you designed.
ZyWALL 10/50 Internet Security Gateway 10-14 Firewalls 3. To selectively block/allow inbound or outbound traf fic between insi de host/networks a nd outsi de host/networks. Remember that filters can not distin gu ish traffic originating from an inside host or an outside host by IP address.
ZyWALL 10/50 Internet Security Gateway Introducing the ZyWALL Firewall 11-1 Chapter 11 Introducing the ZyWALL Firewall This chapter show s you how to get started with the Z yWALL firewall. 11.1 Remote Management and the Firewall When SMT menu 24.11 is c onfigured to all ow managem ent from t he WAN, it ove rrides the fire wall.
ZyWALL 10/50 Internet Security Gateway 11-2 Introducing the ZyWALL Firewall Figure 11-2 Menu 21.2 — Fire wall Setup Configure the fire w all rules using the web configurator or CLI commands. 11.3.2 Viewing the Firewall Log In menu 21, enter 3 to view the firewall log.
ZyWALL 10/50 Internet Security Gateway Introducing the ZyWALL Firewall 11-3 Table 11-1 View Firewall Log FIELD DESCRIPTION EXAMPLES # This is the index number of the fire wall log. 128 entries are available number ed from 0 to 127. Once they are all used, the log will wrap around and the ol d logs will be lost.
.
ZyWALL 10/50 Internet Security Gateway Using the ZyWALL Web Configurator 12-1 Chapter 12 Using the ZyWALL Web Configurator This chapter show s you how to configure your fire wall with the web configurator. 12.1 Web Configurator Login and Main Menu Screens Use the ZyWALL we b config urator, to c onfigure you r firewall.
ZyWALL 10/50 Internet Security Gateway 12-2 Usi ng the ZyWA LL Web Configurator 12.2 Enabling the Firewall Click Advanced , Firewall , Confi guration and then the Config tab. Enable (or activate) the firewall by clicking the Fi rewall Enabled check box as seen in the following screen.
ZyWALL 10/50 Internet Security Gateway Using the ZyWALL Web Configurator 12-3 13-4 ) . Whe n an event ge nerates an alert, a message is i mmediately sent t o an e-ma il account specifie d by you.
ZyWALL 10/50 Internet Security Gateway 12-4 Usi ng the ZyWA LL Web Configurator Table 12-1 E-mail FIELD DESCRIPTION OPTIONS Address Info Mail Server Enter the IP address of your mail server i n dotted decimal notation. Your Internet Service Provi der (ISP) should be able to provide this information.
ZyWALL 10/50 Internet Security Gateway Using the ZyWALL Web Configurator 12-5 12.3.3 SMTP Error Messages If there are difficulties in sending e-mail the fo llowing error messages appear. Please see the Support Notes on the include d disk for inf ormation o n other types of error m essages.
ZyWALL 10/50 Internet Security Gateway 12-6 Usi ng the ZyWA LL Web Configurator Figure 12-3 E-mail Log 12.4 Att ack Alert Attack alerts are the first defe nse against DOS attacks. In the Attack Alert screen, shown later, you may choose to gene rate an alert whenever an attack is de tected.
ZyWALL 10/50 Internet Security Gateway Using the ZyWALL Web Configurator 12-7 2. The minim um capacity of ser ver backlog in your LAN net work. 3. The CPU power of server s in your LAN network. 4. Network bandwidth . 5. Type of traf fic for certain serv ers.
ZyWALL 10/50 Internet Security Gateway 12-8 Usi ng the ZyWA LL Web Configurator 2. If the Blocking Time timeout is gr eater than 0, then the ZyWALL blocks all new connection requests to the host givi ng the server ti me to handle t he present con nections.
ZyWALL 10/50 Internet Security Gateway Using the ZyWALL Web Configurator 12-9 Table 12-3 Attack Alert FIELD DESCRIPTION DEF AULT VALUES Denial of Service Thresholds One Minute Low This is the rate of new half-open sessions that causes the firewall to stop deleting half-open sessions.
ZyWALL 10/50 Internet Security Gateway 12-10 Using the ZyWA LL Web Configurator Table 12-3 Attack Alert FIELD DESCRIPTION DEF AULT VALUES Incomplete host IP address that causes the firewall to start dropping half-open sessi ons to that same destination host IP address.
ZyWALL 10/50 Internet Security Gateway Creating Custom Rules 13-1 Chapter 13 Creating Custom Rules This chapter contains in structions for defining both Local Netwo rk and Internet rules. 13.1 Rules Overview Firewall rules are subdivided into “Local Network” and “Internet”.
ZyWALL 10/50 Internet Security Gateway 13-2 Creating Custom Rules 2. Is the intent of the rule to forward or b lock traffic? 3. What is the direction c onnection: fr om the LAN to the Internet, or from the Internet to the LAN ? 4. What IP services will be affected? 5.
ZyWALL 10/50 Internet Security Gateway Creating Custom Rules 13-3 Source Address What is the connection’s source addres s; is it on the LAN or WAN? Is it a single IP, a range of IPs or a subnet? Destination Address What is the connection’s destination add ress; is it on the LAN or WAN? Is it a single IP, a range of IPs or a subnet? 13.
ZyWALL 10/50 Internet Security Gateway 13-4 Creating Custom Rules 13.3.2 W AN to LAN Rules The default rule for WAN to LAN traffic blocks all in coming conn ections (WAN to LAN). If you wish to allow certain WAN users to have access to your LAN, you will need to create custom rules to allow it.
ZyWALL 10/50 Internet Security Gateway Creating Custom Rules 13-5 Figure 13-3 Fire wall Rules Summary — First Screen The following table describes the fields in this screen. Table 13-1 Firewall Rules Summary — First Screen FIELD DESCRIPTION OPTIONS General Name This is the name of the firewall rule set.
ZyWALL 10/50 Internet Security Gateway 13-6 Creating Custom Rules Table 13-1 Firewall Rules Summary — First Screen FIELD DESCRIPTION OPTIONS Default Policy Log Click this chec k box to log all matched rules i n the ACL default set. The following fields summariz e the rules you have cr eated.
ZyWALL 10/50 Internet Security Gateway Creating Custom Rules 13-7 13.5 Predefined Services The Available Services list box in the Rule Config (uration) screen (see Figure 13-4) displays all predefin ed services that the ZyWALL already s upports. Next to the na me of the servi ce, two fiel ds appear in brackets.
ZyWALL 10/50 Internet Security Gateway 13-8 Creating Custom Rules Table 13-2 Predefined Services SERVICE DESCRIPTION IPSEC_TUNNEL(ESP:0) This service is used by th e IPSec ESP (Encapsulation Securit y Protocol) tunneling protocol. IRC(TCP/UDP:6667) T his is another popular Internet chat progr am.
ZyWALL 10/50 Internet Security Gateway Creating Custom Rules 13-9 Table 13-2 Predefined Services SERVICE DESCRIPTION SNMP(TCP/UDP:161) Simple Network Management Program.
ZyWALL 10/50 Internet Security Gateway 13-10 Creating Custom Rules 13.5.1 Creating/Editing Firewall Rules To create a new rule, click a num ber ( No. ) then click Edi t in the last screen shown to display the following screen.
ZyWALL 10/50 Internet Security Gateway Creating Custom Rules 13-11 Table 13-3 Creating/Editing A Fire wall Rule FIELD DESCRIPTION OPTIONS Destination Address Click De stAdd to add a new address, Dest Edit to edit an existing one or DestDelete to del ete one.
ZyWALL 10/50 Internet Security Gateway 13-12 Creating Custom Rules Figure 13-5 Adding/Editing Source a nd Destination Addresses.
ZyWALL 10/50 Internet Security Gateway Creating Custom Rules 13-13 Table 13-4 Adding/Editing Source and Destination Addresse s FIELD DESCRIPTION OPTIONS Address Type Do you want your rule to apply to packets with a particula r (single) IP address, a range of IP addresses (e.
ZyWALL 10/50 Internet Security Gateway 13-14 Creating Custom Rules Figure 13-6 Timeout Screen.
ZyWALL 10/50 Internet Security Gateway Creating Custom Rules 13-15 Table 13-5 Timeout Menu FIELD DESCRIPTION DEFA ULT VA LU E TCP Timeout Values Connection Timeout This is the length of time the ZyWALL waits for a TCP session to reach the estab lished state befor e dropping the session.
.
ZyWALL 10/50 Internet Security Gateway Custom Ports 14-1 Chapter 14 Custom Ports This chapter covers creating, viewing and editing custom ports. 14.1 Introduction Configure cust omized po rt s for services not predefi ned by the ZyWALL (see Figure 13-4 ) .
ZyWALL 10/50 Internet Security Gateway 14-2 Custom Ports Table 14-1 Custom Ports FIELD DESCRIPTION Customized Services No. T his is the number of your customized p ort. Status Indicates whether ports have alre ad y been configured or are still empt y.
ZyWALL 10/50 Internet Security Gateway Custom Ports 14-3 14.2 Creating/Editing A Custom Port Click Edit in the previous screen to create a new custom port or edit an exi sting o ne. This action displays t he following screen. Figure 14-2 Creating/Editing A Custo m Port The next tabl e describes the fi elds in this sc reen.
ZyWALL 10/50 Internet Security Gateway 14-4 Custom Ports Table 14-2 Creating/Editing A Custo m Port FIELD DESCRIPTION OPTIONS Service Name Enter a unique name for your custom port. Service Type Choose the IP port ( TCP , UDP or TCP/UDP ) that defines your customized po rt from the drop do wn list box.
ZyWALL 10/50 Internet Security Gateway Logs 15-1 Chapter 15 Logs This chapter contains info rmation about using the log screen to view the result s of the rules you have configured. 15.1 Log Screen When you co nfigure a ne w rule y ou also hav e the option to log events th at match, don’t match (or both) this rule (see Figure 13-4).
ZyWALL 10/50 Internet Security Gateway 15-2 Logs Table 15-1 Log Screen FIELD DESCRIPTION EXAMPLES No. This is the index number of the fire wall log. 128 entries are available numbere d from 0 to 127. Once they are all used, the log will wrap around and the old logs will be lost.
ZyWALL 10/50 Internet Security Gateway Example Firewall Rules 16-1 Chapter 16 Example Firewall Rules This chapter gives e xamples for config uring various rules fo r WAN to LAN and LAN to WAN.
ZyWALL 10/50 Internet Security Gateway 16-2 Example Firewall Rule s Step 1. Activate the firewall. You may activate the firewa ll throug h the web configurator as shown next (click Configurati on , the Config tab, then click the Firewall Enabled check box) or through SMT menu 21.
ZyWALL 10/50 Internet Security Gateway Example Firewall Rules 16-3 Step 2. Go to the E-mail screen by cl icking Advanced , Firewall , Configur ation , then the E-mail tab. Configure the E-mail screen as follows. Figure 16-2 Example 1: E-Mail Screen Enter 10.
ZyWALL 10/50 Internet Security Gateway 16-4 Example Firewall Rule s Step 3. Configure you r firewall rule as shown in the fo llowing screen. The default firewall blocks all Internet traffic entering our local network, but you want to create a hole for web service from the Internet.
ZyWALL 10/50 Internet Security Gateway Example Firewall Rules 16-5 Step 4. Click DestAdd in the previous screen to configure the destinatio n address as the IP of your server on the LAN. Figure 16-4 Example 1: Destinatio n Address for Traffic Originating from the Internet 10.
ZyWALL 10/50 Internet Security Gateway 16-6 Example Firewall Rule s Step 5. When you have finished configuring your rules, the Rule Summary screen should look like th is. Click Apply in this screen to save your configuration back to th e ZyWALL. Figure 16-5 Example 1: Rule Summary Screen 16.
ZyWALL 10/50 Internet Security Gateway Example Firewall Rules 16-7 i. A mail server with an IP of 192.168 .10.2. ii. Two FTP servers. You want FTP server 1 (IP of 192.168.10.3) to be acce ssible from the Internet, but FTP server 2 (192.168.10.4) ma y only be accessed by internal users, i.
ZyWALL 10/50 Internet Security Gateway 16-8 Example Firewall Rule s Step 3. Now you want to restrict access to t he Internet except for the HTTP pr oxy server and your mail server. First you need to c reate a custom port for POP3. POP (P ost Office Prot oc ol) is an Internet mail server pr otocol that p rovides an i ncoming m essage storage system.
ZyWALL 10/50 Internet Security Gateway Example Firewall Rules 16-9 Network to see the Rule Summary screen. Now click an available No. (rule number) button, then click Edit to bring up the next screen. Step 5. Click SrcAdd under the Source Address box and enter the IP address of the mail server (192.
ZyWALL 10/50 Internet Security Gateway 16-10 Example Firewall Rules Step 7. The Rule Summary screen should look like Figure 16-9 . Don’t forget to click Apply when you have finished configuring your rule(s) to save your setting s back to the ZyWALL.
ZyWALL 10/50 Internet Security Gateway Example Firewall Rules 16-11 screen. Now click on the DestAdd butt on under the Destination Address box and enter the IP of FTP server On e (192.168.1 0.3). Step 9. On completing the procedure the Rule Summary for th is Internet firewall rule should look like the following screen.
ZyWALL 10/50 Internet Security Gateway 16-12 Example Firewall Rules 16.1.3 Example 3: DHCP Negotiation and Syslog Connection from the Internet The following are some Internet firewall rule examples that allow DHCP negotiation between the ISP and the ZyWALL and allow a syslog connection 1 from the Internet.
ZyWALL 10/50 Internet Security Gateway Example Firewall Rules 16-13 Custom port s sho w up with an “*” before their names in the Services list box and the Rule Summary list box. Click Apply after y ou’ve created your custom port. Step 2. Follow the procedures outlined in th e previous ex amples to configure all your rules.
ZyWALL 10/50 Internet Security Gateway 16-14 Example Firewall Rules Step 3. On completing the configur ation procedure for these Internet firewall rules, the Rule Summary screen should look lik e the following. Don ’t forget to click Apply whe n you ha ve finis hed configuring your rule(s) to sav e your settings back to the ZyWALL.
ZyWALL 10/50 Internet Security Gateway Content Filtering 17-1 Chapter 17 Content Filtering This chapter provides a brief overview o f content filtering using the web embedded configurator. For more detailed informa tion, consult the embedded HTML help.
ZyWALL 10/50 Internet Security Gateway 17-2 Content Filtering 17.4 Customizing Customize the content filter list by adding or removing specific sites from the filter list . 17.5 Keywords The ZyWALL can al so be config ured to bloc k certain Web sites by u sing URL key words.
Advanced Management V Part IV: Advanced Management This part prov ides information on Filter Configur ation, SNMP Configuration, System Information and Diagnosis, Firmware a nd Configuration File Maint enance, System Maintenance a nd Information and Remote Manageme nt.
.
ZyW ALL 10/50 Internet Security Gateway Filter Configuration 18-1 Chapter 18 Filter Configuration This chapter shows you how to create and appl y filters. 18.1 About Fil tering Your ZyWALL uses filters to decide whether to allow pa ssage of a data packet and/or to make a call.
ZyW ALL 10/50 Internet Security Gateway 18-2 Filter Configuration Figure 18-1 Outgoing Packet Filtering Process For incoming packets, your ZyWALL ap plies data f ilters only. Packets are pro cessed depending up on whether a match is found. The following sections describ e how to configure filter sets.
ZyW ALL 10/50 Internet Security Gateway Filter Configuration 18-3 Start Fetch First Filter Set Fetch First Filter Rule Active? Execute Filter Rule Fetch Next Filter Rule Next filter Rule Available? Fe.
ZyW ALL 10/50 Internet Security Gateway 18-4 Filter Configuration You can apply up to four filter sets to a particular port to block multiple typ es of packets. With each filter set having up to six rules, you can have a maximum of 24 rules active for a single por t.
ZyW ALL 10/50 Internet Security Gateway Filter Configuration 18-5 Figure 18-5 Menu 21.1 — Filter Set Configuration Step 3. Select the filter set you wish to configure (1 -12) and press [ENTER] . Step 4. Enter a descriptive name or comment in the Edit Comments field and press [ENTER] .
ZyW ALL 10/50 Internet Security Gateway 18-6 Filter Configuration 18.2.1 Filter Rules Summary Menu This screen shows the summary of th e existing rules in the filter set. The following tables contain a brief description of t he abbreviat ions used in t he previous m enus.
ZyW ALL 10/50 Internet Security Gateway Filter Configuration 18-7 Table 18-2 Rule Abbreviations Used ABBREVIATION DESCRIPTION DP Destination Port number GEN Off Offset Len Length Refer to the next section for information on configuring the filter ru les.
ZyW ALL 10/50 Internet Security Gateway 18-8 Filter Configuration Figure 18-7 Menu 21.1.1.1 — TCP/IP Filter Rule The following table describes how to con figure your TCP/IP filter rule. Table 18-3 TCP/IP Filter Rule Menu Fields FIELD DESCRIPTION OPTIONS Active Yes activates the filter rule and No deactivates it.
ZyW ALL 10/50 Internet Security Gateway Filter Configuration 18-9 Table 18-3 TCP/IP Filter Rule Menu Fields FIELD DESCRIPTION OPTIONS Port # Comp Select the comparison to apply to the desti nation port in the packet against the value given in Destination: Port # .
ZyW ALL 10/50 Internet Security Gateway 18-10 Filter Configuration Table 18-3 TCP/IP Filter Rule Menu Fields FIELD DESCRIPTION OPTIONS Drop Action Not Matched Select the action for a packet not matching the rule. Check Next Rule Forward Drop Press [SPACE BAR] to select properties for fiel ds that do not need to be typed in.
ZyW ALL 10/50 Internet Security Gateway Filter Configuration 18-1 1 Packet into IP Filter Matched Matched Yes Action Matched Action Not Matched More? No Filter Active? Check IP Protocol Drop Drop Pack.
ZyW ALL 10/50 Internet Security Gateway 18-12 Filter Configuration 18.2.4 Generic Filter Rule This section shows you how to configu re a generic filter rule. The purpose of generic rules is to allow you to filter non-IP packets. For IP, it is generally easier to use the IP rules directly.
ZyW ALL 10/50 Internet Security Gateway Filter Configuration 18-13 Table 18-4 Generic Filter Rule Menu Fields FIELD DESCRIPTION OPTIONS Filter # This is the filter set, filter rule co-ordinates, i.e., 2,3 refers to the second filter set and the third rule of that set.
ZyW ALL 10/50 Internet Security Gateway 18-14 Filter Configuration Table 18-4 Generic Filter Rule Menu Fields FIELD DESCRIPTION OPTIONS Once you have completed filling in Menu 21.4.1.1 - Generic Filter Rule , press [ENTER] at the message “Press ENTER to Confirm” to save y our configuration, or press [ESC] to cancel.
ZyW ALL 10/50 Internet Security Gateway Filter Configuration 18-15 Step 4. Enter a descriptive name or comment in the Edit Comments field and press [ENTER]. Step 5. Press [ENTER] at the message [Press ENTER to confirm] to open Menu 21.1 .3 - Filter Rules Summary .
ZyW ALL 10/50 Internet Security Gateway 18-16 Filter Configuration When you press [ENTER] to confirm, you will see the following sc reen. Note that there is only one filter rule in this set. Figure 18-12 Example Filter Rules Summary — Menu 21.1.3 After you’ve created the filter set, you must apply it.
ZyW ALL 10/50 Internet Security Gateway Filter Configuration 18-17 18.4 Filter T ypes and NA T There are two classe s of filter rules, Generic Filter (Device) rules and Protocol Filter ( TCP/I P ) rules. Generic Filter rules act on the raw data from/to LAN and WAN.
ZyW ALL 10/50 Internet Security Gateway 18-18 Filter Configuration 18.6 Applying a Filter and Factory Default s This section shows you wh ere to apply the filter(s) af ter you design it (them).
ZyW ALL 10/50 Internet Security Gateway Filter Configuration 18-19 numbers separated by commas. See the append ix on filter commands for information on the factory default NetBIOS filter.
.
ZyW ALL 10/50 Internet Security Gateway SNMP 19-1 Chapter 19 SNMP Configuration This chapter discusses SNMP for network management and monitoring. 19.1 About SNMP SNMP (Sim ple Network M anageme nt Protocol) i s a prot ocol used f or exchanging m anagem ent informati on between netw ork devices.
ZyW ALL 10/50 Internet Security Gateway 19-2 SNMP Figure 19-1 SNMP Management Mod el An SNMP m anaged network consists of t wo mai n components: a gents and a m anager. An agent is a managem ent software m odule that resides i n a managed device (the Zy WALL).
ZyW ALL 10/50 Internet Security Gateway SNMP 19-3 Table 19-1 General SNMP Commands COMMAND DESCRIPTION Get Allows the manager to retrieve an object variable from the ag ent. GetNext Allo ws the manager to retrieve the next objec t variable from a table or list within an agent.
ZyW ALL 10/50 Internet Security Gateway 19-4 SNMP Figure 19-2 Menu 22 — SNMP Configuration The following table d escribes the SNMP configu ration parameters.
ZyW ALL 10/50 Internet Security Gateway SNMP 19-5 19.4 SNMP T rap s The ZyWALL will send traps to the SNMP manager when any one of the following events o ccurs: Table 19-3 SNMP Traps TRAP # TR AP NAME DESCRIPTION 0 coldStart (defin ed in RFC-1215 ) A trap is sent after booting (power on).
.
ZyW ALL 10/50 Internet Security Gateway System Information & Diagnosis 20-1 Chapter 20 System Information & Diagnosis This chapter cove rs SMT menus 24.1 to 24.4. This chapter covers the diagnostic tools th at help you to maintain your ZyWALL.
ZyW ALL 10/50 Internet Security Gateway 20-2 System Information & Diagnosis Step 2. In this menu, enter 1 to open System Maintenance - Status . Step 3. There are three comm ands in Menu 24.1 - System Mainte nance - Status . Entering 1 drop s the WAN connecti on, 9 resets the counters and [ESC] takes yo u back to the previ ous screen.
ZyW ALL 10/50 Internet Security Gateway System Information & Diagnosis 20-3 Table 20-1 System Maintenance — Status M enu Fields FIELD DESCRIPTION Tx B/s Shows the transmission speed in Bytes per second on this port. Rx B/s Shows the reception speed in Bytes per second on this port.
ZyW ALL 10/50 Internet Security Gateway 20-4 System Information & Diagnosis Figure 20-3 Menu 24.2 — Sy stem Information and Console Port Speed 20.2.1 System Information System Information gives you in formation abou t your system as shown below.
ZyW ALL 10/50 Internet Security Gateway System Information & Diagnosis 20-5 Table 20-2 Fields in System Maintenance — Inform ation FIELD DESCRIPTION IP Address This is the IP address of the ZyWALL in dotted decimal notation. IP Mask This shows the IP mask of the ZyWALL.
ZyW ALL 10/50 Internet Security Gateway 20-6 System Information & Diagnosis Step 1. Select option 2 4 from t he main menu t o open Menu 24 - System Maintenance . Step 2. From me nu 24, select opt ion 3 to ope n Menu 24. 3 - System Mainten ance - Log and Tr ace .
ZyW ALL 10/50 Internet Security Gateway System Information & Diagnosis 20-7 20.3.2 UNIX Syslog The ZyWALL uses the UNIX syslog facility to log the CDR (Call Detail Record) and system messages to a syslog server. Syslog and ac counting can be confi gured in Menu 24.
ZyW ALL 10/50 Internet Security Gateway 20-8 System Information & Diagnosis Table 20-3 System Maintenance Men u Syslog Parameters PARAMETER DESCRIPTION Filter log No filters are logged when this field is set to No . Filters with the individual filter Log Filter field set to Yes (Menu 21.
ZyW ALL 10/50 Internet Security Gateway System Information & Diagnosis 20-9 Data=4500003c100100001f010004c0a 86614ca849a7b08004a5c020001006 162636465666768696a6b6c6d6e6f7071727374 Jul 19 11:28:56 192.
ZyW ALL 10/50 Internet Security Gateway 20-10 System Information & Diagnosis Proto = LCP / ATCP / BACP / BCP / CBCP / CCP / CHAP/ PAP / IPCP / IPXCP Jul 19 11:42:44 19 2.168.102.2 ZyXEL: pp p:LCP Closing Jul 19 11:42:49 192.168.102.2 ZyXEL: ppp:IPCP Closing Jul 19 11:42:54 192.
ZyW ALL 10/50 Internet Security Gateway System Information & Diagnosis 20-1 1 Figure 20-9 Call-Triggering Packet Example 20.4 Diagnostic The diagnostic facility allows you to test the diffe rent aspects of your ZyWALL to determine if it is working properly.
ZyW ALL 10/50 Internet Security Gateway 20-12 System Information & Diagnosis Figure 20-10 Menu 24.4 — Sy stem Maintenance — Diagnosti c Follow the procedure below to get to Menu 24.4 - System Maintenance – Diagnostic. Step 1. From the m ain menu, select option 24 to open Menu 24 - System Maintenance .
ZyW ALL 10/50 Internet Security Gateway System Information & Diagnosis 20-13 Figure 20-11 WAN & LAN DHCP The following table describes the diagnostic tests av ailable in menu 24.
.
ZyW ALL 10/50 Internet Security Gateway Firmware and Configuration File Mainte nance 21-1 Chapter 21 Firmware and Configuration Maintenance This chapter tells you how to back up an d restor e your configuration file as well as upload new firmware and a new config uration file.
ZyW ALL 10/50 Internet Security Gateway 21-2 Firmware and Configuration File Maintenance you have upl oaded the c orrect firm ware version . The AT com mand is the c ommand you e nter after y ou press “y” whe n prompted i n the SMT m enu to go i nto debug m ode.
ZyW ALL 10/50 Internet Security Gateway Firmware and Configuration File Mainte nance 21-3 Figure 21-1 Telnet into Menu 24.5 21.2.2 Using the FTP Command from the Command Line Step 1. Launch the FTP client on your com puter. Step 2. Enter “open”, followed by a space and the IP addres s of your ZyWALL .
ZyW ALL 10/50 Internet Security Gateway 21-4 Firmware and Configuration File Maintenance Figure 21-2 FTP Session Example 21.2.4 GUI-Based FTP Client s The followin g table describes some of t he comma nds that you may see in GUI-Based FT P clients.
ZyW ALL 10/50 Internet Security Gateway Firmware and Configuration File Mainte nance 21-5 • There is an SM T console sessi on running . • The firewall is active. The default firewall policies bl ock all traffic from the WAN, so to enable TFTP over the WAN, you must turn the firewall off (m enu 21.
ZyW ALL 10/50 Internet Security Gateway 21-6 Firmware and Configuration File Maintenance TFTP [-i] host get rom-0 config.rom where “i” specifies binary image tra nsfer mode (use t his mode when tr.
ZyW ALL 10/50 Internet Security Gateway Firmware and Configuration File Mainte nance 21-7 Step 2. The following screen indicates that t he Xmodem download has started.
ZyW ALL 10/50 Internet Security Gateway 21-8 Firmware and Configuration File Maintenance FTP is the pre ferred m ethods for restoring you r current com puter confi guration to you r ZyWALL sinc e it is faster. Please note that you m ust wait for the system to automatically restart after the file transfer is complete.
ZyW ALL 10/50 Internet Security Gateway Firmware and Configuration File Mainte nance 21-9 Step 3. Press [ENTER] when prom pted for a use rname. Step 4. Enter your pas sword as re quested (the default is “12 34”). Step 5. Enter “bin” to set transfer mode to binary.
ZyW ALL 10/50 Internet Security Gateway 21-10 Firmware and Configuration File Maintenan ce Figure 21-10 System Mainten ance — Starting Xmodem Do wnload Screen Step 3. Run the Hype rTermi nal program by clicki ng Transfer , then Receive File as shown in the following screen.
ZyW ALL 10/50 Internet Security Gateway Firmware and Configuration File Mainte nance 21-1 1 WA R N I N G ! DO NOT INTERUPT THE FILE TRAN SFER PROCESS AS THIS MA Y PERMANENTL Y DAMAGE YOUR ZY W ALL. 21.4.1 Firmware File Upload FTP is the pre ferred me thod for uploa ding the fi rmware and confi guration.
ZyW ALL 10/50 Internet Security Gateway 21-12 Firmware and Configuration File Maintenan ce Figure 21-14 Telnet into Menu 24.7.2 — Sy stem Maintenance To upload the firmware and the conf iguration file, follow these examples 21.4.3 FTP File Upload Command from the Command Line Example Step 1.
ZyW ALL 10/50 Internet Security Gateway Firmware and Configuration File Mainte nance 21-13 Step 7. Enter “quit” to exit the FTP prom pt. 21.4.4 FTP Session Example of Fir mware File Upload Figure 21-15 FTP Session Example of Firmware File Upload More command s (found in GUI-Based FTP clie nts) are listed earlier in this chap ter.
ZyW ALL 10/50 Internet Security Gateway 21-14 Firmware and Configuration File Maintenan ce Step 4. Launch the TFTP client on your computer a nd co nnect to the ZyWALL. Set the transfer mode to binary be fore starting data transfe r. Step 5. Use the TFTP client (see the exam ple below) to transfer files bet ween the ZyWALL and the computer.
ZyW ALL 10/50 Internet Security Gateway Firmware and Configuration File Mainte nance 21-15 Figure 21-16 Menu 24.7.1 Using the Console Port Step 2. After the "St arting Xm odem uploa d" message appears , activate the Xmodem protocol o n your computer.
ZyW ALL 10/50 Internet Security Gateway 21-16 Firmware and Configuration File Maintenan ce 21.4.10 Uploading a Configurat ion File Via Console Port Step 1. Select 2 from Menu 24.7 – System Maint enance – Upload Firmware to d ispla y Menu 24.7.2 - System Mai ntenance - Up load System C onfiguration File .
ZyW ALL 10/50 Internet Security Gateway Firmware and Configuration File Mainte nance 21-17 Figure 21-19 Example Xmodem Upload After the co nfiguration upload process has c ompleted, rest art the ZyWA LL by ente ring “at go”. Type the configuration file’s location, or click Browse to search for it.
.
ZyW ALL 10/50 Internet Security Gateway System Maintenance & Information 22-1 Chapter 22 System Maintenance & Information This chapter leads yo u through SMT menus 24.8 to 24.11. 22.1 Command Interpreter Mode The Command I nterpreter (CI) is a part o f the main system firmware.
ZyW ALL 10/50 Internet Security Gateway 22-2 System Maint enance & Information Figure 22-2 Valid Commands 22.2 Call Control Support The ZyWALL pr ovides two cal l control func tions: bud get managem ent and call histo ry. Please note t hat this menu is only applicable when Encapsulation is set to PPPoE or PPTP in m enu 4 or menu 11.
ZyW ALL 10/50 Internet Security Gateway System Maintenance & Information 22-3 22.2.1 Budget Management Menu 24.9.1 shows the budget management statistics for ou tgoing calls. Enter 1 from Menu 24. 9 - System Maintenance - Call Contro l to br ing up th e fo llow ing menu .
ZyW ALL 10/50 Internet Security Gateway 22-4 System Maint enance & Information 22.2.2 Call History This is the second option in Menu 24.9 - System Main tenance - Call C ontrol . It displ ays inform ation about past incom ing and outgoing calls. Ent er 2 from Menu 24.
ZyW ALL 10/50 Internet Security Gateway System Maintenance & Information 22-5 on your Zy WALL. Menu 24. 10 allows you to update t he time and date settings of y our ZyWALL. The real time is then displayed in the ZyWALL error l ogs and fire wall logs.
ZyW ALL 10/50 Internet Security Gateway 22-6 System Maint enance & Information Table 22-3 Time and Date Setting Fields FIELD DESCRIPTION Enter the time service protocol that your time server sends when you turn on the ZyWALL.
ZyW ALL 10/50 Internet Security Gateway System Maintenance & Information 22-7 ii. When the ZyWALL starts up, if there is a time server configured in menu 24.
.
ZyW ALL 10/50 Internet Security Gateway Remote Management 23-1 Chapter 23 Remote Management This chapter cove rs remote management found in SMT m enu 24.11. 23.1 T elnet The only way t o configure the ZyWALL for remote management is t hrough an SMT session usin g the console port.
ZyW ALL 10/50 Internet Security Gateway 23-2 Remote Management 23.3 Web You can use the ZyWALL’s e mbedded we b configurat or for con figuration an d file m anagement. See th e Using the ZyW ALL Web Conf igurator chapter for an introduction to the web configurator.
ZyW ALL 10/50 Internet Security Gateway Remote Management 23-3 Figure 23-2 Menu 24.11 – Remote Manageme nt Control Table 23-1 Menu 24.11 – Remote Managemen t Control FIELD DESCRIPTION EXAMPLE TELNET Server FTP Server Web Server SNMP Server DNS Server These read-only labels de note t he kind of server that you may remotely manage.
ZyW ALL 10/50 Internet Security Gateway 23-4 Remote Management FIELD DESCRIPTION EXAMPLE Secured Client IP The default value for Secured Client IP is 0.
ZyW ALL 10/50 Internet Security Gateway Remote Management 23-5 Use the ZyWALL’s LAN IP address wh en configu ring from the LAN . 23.6 System Timeout There is a syst em tim eout of five m inutes (three hundred seconds) for eith er the console port or telnet/web/FTP connections.
.
Call Scheduling and VPN/IPSec V Part V: Call Scheduling and VPN/IPSec Part V provides information about Call Scheduling and VPN/IPSec..
.
ZyW ALL 10/50 Internet Security Gateway Call Scheduling 24-1 Chapter 24 Call Scheduling Call scheduling allows you to dictate when a remote node sho uld be called and for how lo ng. 24.1 Introduction The call schedul ing feature allows t he ZyWALL to m anage a remote node and dictate w hen a remote node should be called and fo r how long.
ZyW ALL 10/50 Internet Security Gateway 24-2 Call Scheduling T o delete a schedule set, enter the set number and press [SP ACE BAR] or [DELETE] in the Edit Name field. To setup a schedul e set select the sc hedule set y ou want to set up from menu 2 6 (1-12) and p ress [ ENTER ] to see Menu 26.
ZyW ALL 10/50 Internet Security Gateway Call Scheduling 24-3 Table 24-1 Schedule Set Setup Fields FIELD DESCRIPTION OPTION Once: Date If you selected Once in the How Often field above, then enter the date the set should activate here in year-month-date format.
ZyW ALL 10/50 Internet Security Gateway 24-4 Call Scheduling Figure 24-3 Applying Schedule Set( s) to a Remote Node (PPPoE) You can ap ply up to 4 schedule sets, se parated by com mas, for one remote no de. Change t he schedule set numbers to your prefe rence(s).
ZyW ALL 10/50 Internet Security Gateway Introduction to IPSec 25-1 Chapter 25 Introduction to IPSec This chapter introduces the basics of IPSec VPNs. 25.1 Introduction 25.1.1 VPN A VPN (Virt ual Private Net work) provi des secure com munications between site s without t he expense of leased site-to-site lines.
ZyW ALL 10/50 Internet Security Gateway 25-2 Introduction to IPSec Figure 25-1 Encryption and Dec ryption Data Confidentiality The IPSec sender can enc rypt packets befo re transm itting them across a network.
ZyW ALL 10/50 Internet Security Gateway Introduction to IPSec 25-3 Figure 25-2 VPN Application 25.2 IPSec Architecture The overall IPSec architect ure is shown as follows.
ZyW ALL 10/50 Internet Security Gateway 25-4 Introduction to IPSec Figure 25-3 IPSec Architecture 25.2.1 IPSec Algorithms The ESP (Encapsulati ng Security Payl oad) Protocol (RFC 2406) and AH (Aut hen.
ZyW ALL 10/50 Internet Security Gateway Introduction to IPSec 25-5 25.3 Encap sulation The two modes of ope ration for IPSec VPNs are Transpor t mode and Tu nnel mode.
ZyW ALL 10/50 Internet Security Gateway 25-6 Introduction to IPSec A NAT device in between the IPSec endpoints will rewrite either the source or des tination address with one of its own choosing.
ZyW ALL 10/50 Internet Security Gateway VPN/IPSec Setup 26-1 Chapter 26 VPN/IPSec Setup This chapter introduces the VPN SMT menus. 26.1 VPN/IPSec Setup The VPN/IPSe c main SMT me nu has three m ain submenus.
ZyW ALL 10/50 Internet Security Gateway 26-2 VPN/IPSec Setup Figure 26-2 Menu 27 — VPN/IPSec Setup 26.2 IPSec Algorithms The ESP and AH protocols are necessary to create a Securi ty Association (SA), the fo undatio n of an IPSec VPN. An SA is built from the authentication provid ed by the AH and ESP protocols.
ZyW ALL 10/50 Internet Security Gateway VPN/IPSec Setup 26-3 Table 26-1 AH and ESP ESP AH Select DES for minimal security and 3DES for maximum. Select NULL to set up a tunnel without encryption. Select MD5 for minimal security and SHA-1 for maximum security.
ZyW ALL 10/50 Internet Security Gateway 26-4 VPN/IPSec Setup 26.3.1 My IP Address My IP Addr is the WAN IP a ddress of the Z yWALL. If this fi eld is confi gured as 0.0.0. 0, then the Zy WALL will use the current ZyWALL WAN IP address (static or dynamic) to set up the VPN tunnel.
ZyW ALL 10/50 Internet Security Gateway VPN/IPSec Setup 26-5 Figure 26-4 Telecommuter’s ZyWALL Configur ation Figure 26-5 Headquarter s ZyWALL Configuration The Secure Gateway IP Address may be configured as 0.0.0.0 only when using IKE key management and not Manual key management.
ZyW ALL 10/50 Internet Security Gateway 26-6 VPN/IPSec Setup Figure 26-6 Menu 27.1 — IPSec Summary Table 26-3 Menu 27.1 — IPSec Summary FIELD DESCRIPTION EX AMPLE # T his is the VPN policy index number. 1 Name T his field displays the unique iden tification na me for this VPN rule.
ZyW ALL 10/50 Internet Security Gateway VPN/IPSec Setup 26-7 Table 26-3 Menu 27.1 — IPSec Summary FIELD DESCRIPTION EX AMPLE Local Addr End When the Addr Type field in Menu 27.1.1 IPSec Setup is configured to Single , this is the same (static) IP address as in the Local A ddr Star t field.
ZyW ALL 10/50 Internet Security Gateway 26-8 VPN/IPSec Setup Table 26-3 Menu 27.1 — IPSec Summary FIELD DESCRIPTION EX AMPLE field in SMT 27.1.1 to 0.0.0.0. Remote Addr End When the Addr Type field in Menu 27.1.1 IPSec Setup is configured to Single , this is the same (static) IP address as in the Remote A ddr Star t field.
ZyW ALL 10/50 Internet Security Gateway VPN/IPSec Setup 26-9 26.4 IPSec Setup Select Edit in the Select Command field, type the index num ber of a rule in the Select Rule field and press [ENTER] to edit the VPN us ing the m enu shown next. Figure 26-7 Menu 27.
ZyW ALL 10/50 Internet Security Gateway 26-10 VPN/IPSec Setup Table 26-4 Menu 27.1.1 — IPSec Setup FIELD DESCRIPTION EX AMPLE My IP Addr Enter the WAN IP address of your ZyWALL. The ZyWALL uses its current WAN IP address (static or dynamic) in setting up the VPN tunn el if you leave this field as 0.
ZyW ALL 10/50 Internet Security Gateway VPN/IPSec Setup 26-1 1 Table 26-4 Menu 27.1.1 — IPSec Setup FIELD DESCRIPTION EX AMPLE Port Start 0 is the default and signifies any port.
ZyW ALL 10/50 Internet Security Gateway 26-12 VPN/IPSec Setup Table 26-4 Menu 27.1.1 — IPSec Setup FIELD DESCRIPTION EX AMPLE Port Start 0 is the default and signifies any port. Type a port number from 0 to 65535. Some of the most common IP ports are: 21, FTP; 53, DNS; 23, Telnet; 80, HTTP; 25, SMTP; 110, POP3.
ZyW ALL 10/50 Internet Security Gateway VPN/IPSec Setup 26-13 Figure 26-8 T wo Phases to set up the IPSec SA In phase 1 you m ust: Choose a negot iation m ode. Authenticate the connection by en tering a pre-shar ed key. Choo se an en cryption a lgorith m.
ZyW ALL 10/50 Internet Security Gateway 26-14 VPN/IPSec Setup Aggressive Mode is quicker than Main Mode because it elim inates several steps when the communicating parties are negotiating authenticati on (phase 1). However the trade-of f is that faster speed limits its nego tiating power and it also does not pro vide identit y protection.
ZyW ALL 10/50 Internet Security Gateway VPN/IPSec Setup 26-15 Figure 26-9 Menu 27.1.1.1 — IKE Setup Table 26-5 Menu 27.1.1.1 — IKE Setup FIELD DESCRIPTION EXAMPLE Phase 1 Negotiation Mode Press [SPACE BAR] to choose from Main or Aggressive and then press [ENTER].
ZyW ALL 10/50 Internet Security Gateway 26-16 VPN/IPSec Setup Table 26-5 Menu 27.1.1.1 — IKE Setup FIELD DESCRIPTION EXAMPLE Encryption ALgorithm When DES is used for data communications, both sende.
ZyW ALL 10/50 Internet Security Gateway VPN/IPSec Setup 26-17 Table 26-5 Menu 27.1.1.1 — IKE Setup FIELD DESCRIPTION EXAMPLE Perfect Forward Secrecy (PFS) Perfect Forward Secrecy (PFS) is disabled ( None ) by default in phase 2 IPSec SA setup. This allows faster IPSe c setup, but is not so secure.
ZyW ALL 10/50 Internet Security Gateway 26-18 VPN/IPSec Setup Figure 26-10 Menu 27.1.1.2 — Manual Setup Table 26-7 Menu 27.1.1.2 — Manual Setup FIELD DESCRIPTION EXAMPLE Active Protocol Press [SPACE BAR] to choose from ESP Tunnel , ESP Transport , AH Tunnel or AH Transport and then press [ENTER].
ZyW ALL 10/50 Internet Security Gateway VPN/IPSec Setup 26-19 Table 26-7 Menu 27.1.1.2 — Manual Setup FIELD DESCRIPTION EXAMPLE Authentication ALgorithm Press [SPACE BAR] to choose from MD5 or SHA1 and then press [ENTER]. MD5 Key Enter the authentication key to be used by IPSec if applicable.
.
ZyW ALL 10/50 Internet Security Gateway SA Monitor 27-1 Chapter 27 SA Monitor This chapter teaches you h ow to manage your SAs by usi ng the SA Monitor in SMT menu 27.2. 1.1. Introduction A Security Association (SA) is the group of security settings related to a specific VPN tunnel.
ZyW ALL 10/50 Internet Security Gateway 27-2 SA Monitor Table 27-1 Menu 27.2 — SA Monitor FIELD DESCRIPTION EXAMPLE # This is the security association ind ex number. Name This field displays th e identification name for this VPN policy. This name i s unique for each connection where the secure gateway IP address is a public static IP address.
ZyW ALL 10/50 Internet Security Gateway SA Monitor 27-3 Table 27-1 Menu 27.2 — SA Monitor FIELD DESCRIPTION EXAMPLE configuration, or press [ESC] at any time to cancel.
.
ZyW ALL 10/50 Internet Security Gateway IPSec Log 28-1 Chapter 28 IPSec Log This chapter i nterprets com mon IPSec log m essages. 28.1 VPN Initiator IPSec Log To view the IPSec and IKE connection log, type 3 in menu 27 and pr ess [ENTE R] to display the IPSec lo g as shown next.
ZyW ALL 10/50 Internet Security Gateway 28-2 IPSec Log 28.2 VPN Responder IPSec Log The following f igure shows a typical log from the VPN c onnection pee r. Figure 28-2 Example VPN Responde r IPSec Log This menu is useful for t roubleshoot ing. A lo g index num ber, the date and time the log was created and a log message are di splayed.
ZyW ALL 10/50 Internet Security Gateway IPSec Log 28-3 Table 28-1 Sample IKE Key Exchange Logs LOG MESSAGE DESCRIPTION Send:<Symbol><Symbol> Recv:<Symbol><Symbol> IKE uses the ISAKMP protoc ol (refer to RFC2408 – ISAKMP) to transmit data.
ZyW ALL 10/50 Internet Security Gateway 28-4 IPSec Log Table 28-1 Sample IKE Key Exchange Logs LOG MESSAGE DESCRIPTION !! IKE Packet Retransmit The ZyWALL did not receive a respons e from the peer and so retransmits the last packet sent. !! Failed to send IKE Packet The ZyWALL cann ot send IKE packets due to a network error.
ZyW ALL 10/50 Internet Security Gateway IPSec Log 28-5 Table 28-3 RFC-2408 ISAKMP Payload Ty pes LOG DISPLAY P AYLOA D TYPE TRANS T ransform KE Key Exchange ID Identification CER Certificate CER_REQ C.
.
Troubleshooting, Appendices, Glossary and Index VI Part VI: Troubleshooting, Appendices and Index This part provides T roubles hooting, followed by some Appendices and an Index.
.
ZyWALL 10/50 Internet Security Gateway Troubleshooting 29-1 Chapter 29 Troubleshooting This chapter cove rs potential problem s and possible remedies. After ea ch problem description, some instructions are p rovided to help you to diagnose and to sol ve the problem.
ZyWALL 10/50 Internet Security Gateway 29-2 Troubleshooting 29.2 Problems with the LAN Interface Table 29-2 Troubleshooti ng the LAN Inter face PROBLEM CORRECTIVE ACTION Check the 10M/100M LEDs on the front panel. One of these LEDs should be on. If they are both off, check the cables between your ZyWALL and hub or the station.
ZyWALL 10/50 Internet Security Gateway Troubleshooting 29-3 Table 29-3 Troubleshooti ng the WAN interface PROBLEM CORRECTIVE ACTION Can’t connect to a remote node or ISP. Check menu 24.1 to verify th e line status. If it indicates Down , then refer to the section on the line problems.
ZyWALL 10/50 Internet Security Gateway 29-4 Troubleshooting 29.6 Problems with Remote Management Table 29-6 Troubleshooti ng Remote Management PROBLEM CORRECTIVE ACTION Refer to the Remote Management Li mitations section for scenarios when remote management may not be possibl e.
ZyWALL 10/50 Internet Security Gateway The Big Picture A Appendix A The Big Picture The following figure g ives an overview of how filtering, the firewall, VPN and NAT are related.
.
ZyWALL 10/50 Internet Security Gateway PPPoE C Appendix B PPPoE PPPoE in Action An ADSL m odem bridges a PPP session over Ether net (PPP ove r Ethernet , RFC 2516) from your PC to an ATM PVC (Permanent Virt ual Circuit) that connects to a xDSL Access Conce ntrator where the PPP session terminates (see the next fig ure).
ZyWALL 10/50 Internet Security Gateway D PPPoE How PPPoE Works The PPPoE driver m akes the Ethernet appear as a serial link to the PC and the PC runs PPP over it, while the modem bridges the Et hernet frames to the Access Conce n trator (AC).
ZyWALL 10/50 Internet Security Gateway PPTP E Appendix C PPTP What is PPTP? PPTP (Point -to-Point T unneling Pr otocol) is a Microsoft proprietary protocol (RFC 2637 for PPTP is informational only) to tunnel PPP frames.
ZyWALL 10/50 Internet Security Gateway F PPTP PPTP is very si milar t o L2TP, since L2T P is based on both PPTP a nd L2F (C isco’s Layer 2 Forwarding) . Conceptually, there are three parties in PPTP, name ly the PNS (PPTP Network Serve r), the PAC (PPTP Access Concentrator) and the PPTP user.
ZyWALL 10/50 Internet Security Gateway PPTP G PPP Data Connection The PPP frames are tunneled betwee n the PNS and PAC over GRE (General Ro uting Encapsulation, RFC 1701, 1702). The individual calls within a tu nnel are distinguishe d using the Call ID field in the GRE header.
.
ZyWALL 10/50 Internet Security Gateway Hardware specifications I Appendix D Hardware S pecifications Power Specification I/P AC 120V / 60Hz ; O/P DC 12V 1200 mA MTBF 10000 0 hrs Operation Temperature .
.
ZyWALL 10/50 Internet Security Gateway Important Safety Instructions K Appendix E Import ant Safety Instructions The following safety instructions apply to the ZyWALL. 1. Be sure to read and follow all warning notices and instructions. 2. The maxim um recomm ended ambi ent temperat ure for the Z yWALL is 40º Celsi us (104º Fahrenheit).
.
ZyWALL 10/50 Internet Security Gateway Boot Commands M Appendix F Boot Commands The BootMod ule AT comm ands execute from within the ro uter’s bootu p software, whe n debug mode i s selected before the main system firmware (ZyNOS) is star ted.
ZyWALL 10/50 Internet Security Gateway N Boot Commands Diagram 8 Boot Module Commands ======= Debug Command Listing ======= AT just answer OK ATHE print help ATBAx change baudrate.
ZyWALL 10/50 Internet Security Gateway Command Interpreter O Appendix G Command Interpreter The following describes how to use the command interpreter. Enter 24 in the main menu to bring up the system m aintenance m enu. Ente r 8 to go to Menu 24.8 - Comm and Interpreter Mode .
.
ZyWALL 10/50 Internet Security Gateway Firewall Commands Q Appendix H Firewall Commands The following descri bes the firewall com mands. See the Command Interpreter appendix for in formation on the command structure.
ZyWALL 10/50 Internet Security Gateway R Firewall Commands FUNCTION COMMAND DESCRIPTION config display firewall ? This command shows all of the available firewall sub commands.
ZyWALL 10/50 Internet Security Gateway Firewall Commands S FUNCTION COMMAND DESCRIPTION config edit firewall attack block <yes | no> Set this command to yes to block new traffic after the tcp-max-incomplete threshold is exceeded. Set it to no to delete the oldest half-open session when traffic exceeds the tcp-ma x-incomplete threshold.
ZyWALL 10/50 Internet Security Gateway T Firewall Commands FUNCTION COMMAND DESCRIPTION Config edit firewall set <set #> icmp-timeout <seconds> This command sets the time period to allow an ICMP session to wait for the ICMP response.
ZyWALL 10/50 Internet Security Gateway Firewall Command s U FUNCTION COMMAND DESCRIPTION Config edit firewall set <set #> rule <rule #> log <none | match | not-match | both> This command sets the ZyWALL to log traffic that matches the rule, doesn't match, both or neither.
ZyWALL 10/50 Internet Security Gateway V Firewall Commands FUNCTION COMMAND DESCRIPTION config edit firewall set <set #> rule <rule #> TCP destport-range <start port #> <end port #> This command sets a rule to have the ZyWALL check for TCP traffic with a destination port in this range.
ZyWALL 10/50 Internet Security Gateway NetBIOS Filter Commands W Appendix I NetBIOS Filter Commands The following describes the NetBIOS packet filter commands.
ZyWALL 10/50 Internet Security Gateway X NetBIOS Filter Commands The filter types and their default settings are as follows. NAME DESCRIPTION DEF AULT LAN to WAN T his field displays whether NetBIOS packets are blocked or forwarded from the LAN to the WAN.
ZyWALL 10/50 Internet Security Gateway NetBIOS Filter Commands Y Command: sys filter netbios config 1 off This comm and forwards LA N to DMZ Net BIOS packets Command: sys filter netbios config 2 on This comm and blocks IP Sec NetBIOS packets Command: sys filter netbios config 3 off This command stops NetBIOS commands from initiatin g calls.
.
ZyWALL 10/50 Internet Security Gateway Index AA Index A Action for Matched Packets ......................... 13-11 Activate The Firewall..................................... 16-3 Alert Schedule................................................ 12-4 Application-level Firewalls .
ZyWALL 10/50 Internet Security Gateway BB Index Custom Ports Creating/Editin g ......................................... 14-3 Introduction ............................................... 14-1 Customer Support ..........................................
ZyWALL 10/50 Internet Security Gateway Index CC Filters Executing a Filt er Rule .............................. 18-2 Logic Flow of an IP Filter ........................ 18-10 Firewall Access Methods ......................................... 11-1 Activating .
ZyWALL 10/50 Internet Security Gateway DD Index Internet Access via Cable or xDSL Modem .... 1-4 Internet Assigned Numbers Authority .. See IANA Internet Cont rol Message Protocol (ICM P) ... 10-6 Internet Secur ity Gate way ..........................
ZyWALL 10/50 Internet Security Gateway Index EE O One Minute High ........................................... 12-9 One Minute Low ............................................ 12-9 One-Minute High ........................................... 12-7 Online Registration .
ZyWALL 10/50 Internet Security Gateway FF Index Source and Destination Addresses ........... 13-11 Summary.................................................... 13-4 Timeout.................................................... 13-13 S SA Monitor ........
ZyWALL 10/50 Internet Security Gateway Index GG TCP Security ................................................ 10-10 TCP/IP ... 5-1, 5-2, 5-5, 5-7, 7-7 , 7-10, 10-3, 10-4 , 18-7, 18-8 , 18-10, 18-13, 18-1 7, 23-1 TCP/IP filter rule.....................
ZyWALL 10/50 Internet Security Gateway HH Index Introduction ............................................... 10-2.
Ein wichtiger Punkt beim Kauf des Geräts ZyXEL Communications 10 (oder sogar vor seinem Kauf) ist das durchlesen seiner Bedienungsanleitung. Dies sollten wir wegen ein paar einfacher Gründe machen:
Wenn Sie ZyXEL Communications 10 noch nicht gekauft haben, ist jetzt ein guter Moment, um sich mit den grundliegenden Daten des Produkts bekannt zu machen. Schauen Sie zuerst die ersten Seiten der Anleitung durch, die Sie oben finden. Dort finden Sie die wichtigsten technischen Daten für ZyXEL Communications 10 - auf diese Weise prüfen Sie, ob das Gerät Ihren Wünschen entspricht. Wenn Sie tiefer in die Benutzeranleitung von ZyXEL Communications 10 reinschauen, lernen Sie alle zugänglichen Produktfunktionen kennen, sowie erhalten Informationen über die Nutzung. Die Informationen, die Sie über ZyXEL Communications 10 erhalten, werden Ihnen bestimmt bei der Kaufentscheidung helfen.
Wenn Sie aber schon ZyXEL Communications 10 besitzen, und noch keine Gelegenheit dazu hatten, die Bedienungsanleitung zu lesen, sollten Sie es aufgrund der oben beschriebenen Gründe machen. Sie erfahren dann, ob Sie die zugänglichen Funktionen richtig genutzt haben, aber auch, ob Sie keine Fehler begangen haben, die den Nutzungszeitraum von ZyXEL Communications 10 verkürzen könnten.
Jedoch ist die eine der wichtigsten Rollen, die eine Bedienungsanleitung für den Nutzer spielt, die Hilfe bei der Lösung von Problemen mit ZyXEL Communications 10. Sie finden dort fast immer Troubleshooting, also die am häufigsten auftauchenden Störungen und Mängel bei ZyXEL Communications 10 gemeinsam mit Hinweisen bezüglich der Arten ihrer Lösung. Sogar wenn es Ihnen nicht gelingen sollte das Problem alleine zu bewältigen, die Anleitung zeigt Ihnen die weitere Vorgehensweise – den Kontakt zur Kundenberatung oder dem naheliegenden Service.
