EasyManua.ls Logo

ZyXEL Communications ZyWALL USG100-Plus User Manual

ZyXEL Communications ZyWALL USG100-Plus
140 pages
To Next Page IconTo Next Page
To Next Page IconTo Next Page
Page #1 background imageLoading...
Page #1 background image
www.zyxel.com
www.zyxel.com
ZyWALL USG100-PLUS
Unified Security Gateway
Copyright © 2012
ZyXEL Communications Corporation
Version 3.00
Edition 2, 9/2012
Default Login Details
LAN IP
Address
https://192.168.1.1
User Name admin
Password 1234

Table of Contents

Question and Answer IconNeed help?

Do you have a question about the ZyXEL Communications ZyWALL USG100-Plus and is the answer not in the manual?

ZyXEL Communications ZyWALL USG100-Plus Specifications

General IconGeneral
BrandZyXEL Communications
ModelZyWALL USG100-Plus
CategoryGateway
LanguageEnglish

Summary

Introduction

1.1 Overview

Introduces ZyWALL application scenarios and configuration tutorials.

Security Router

Describes security features like firewall, intrusion detection, anti-virus, and anti-spam.

IPv6 Routing

Explains ZyWALL's IPv6 capabilities, including routing and tunneling methods.

VPN Connectivity

Covers setting up VPN tunnels for secure remote access to the network.

SSL VPN Network Access

Details SSL VPN for remote users accessing the network via web browsers.

User-Aware Access Control

Allows policies to restrict access based on user, sensitive information, and shared resources.

Load Balancing

Explains balancing traffic loads across multiple internet connections.

1.2 Default Zones, Interfaces, and Ports

Describes default configurations for zones, interfaces, and physical ports.

1.3 Management Overview

Outlines the different methods available for managing the ZyWALL.

Web Configurator

Details using the Web Configurator for easy ZyWALL setup and management.

Command-Line Interface (CLI)

Describes using text-based commands for configuring the ZyWALL via remote access.

Vantage CNM

Introduces Vantage CNM for managing multiple devices.

1.4 Web Configurator

Requirements for using the Web Configurator, including browser versions and settings.

1.4.1 Web Configurator Access

Step-by-step guide to accessing the ZyWALL's Web Configurator using default credentials.

1.4.2 Web Configurator Introduction Video

Instructions on how to play a video explaining the Web Configurator.

1.4.3 Web Configurator Screens Overview

Explains the division of the Web Configurator screen into title bar, navigation panel, and main window.

Title Bar

Describes the icons in the title bar and their functions.

1.4.4 Navigation Panel

Details how to use the navigation panel menus to open status and configuration screens.

Dashboard

Describes the dashboard for displaying general device information and status widgets.

Monitor Menu

Explains how monitor menu screens display status and statistics information.

Configuration Menu

Explains using configuration menu screens to set up ZyWALL features.

Maintenance Menu

Covers managing configuration, firmware, diagnostics, and rebooting the ZyWALL.

1.4.5 Tables and Lists

Explains how tables and lists in the Web Configurator are flexible for displaying entries.

1.5 Stopping the ZyWALL

Instructions on safely shutting down the ZyWALL to prevent firmware corruption.

1.6 Rack-mounting

Steps for mounting the ZyWALL on an EIA standard size rack or in a wiring closet.

1.7 Front Panel

Introduces the ZyWALL's front panel.

1.7.1 Front Panel LEDs

Describes the status and meaning of the front panel LEDs.

How to Set Up Your Network

Wizard Overview

Using wizards for quick configuration of Internet and VPN settings, and subscription services.

How to Configure Interfaces, Port Roles, and Zones

Tutorial on configuring Ethernet interfaces, port roles, and zones for network setup.

2.2.1 Configure a WAN Ethernet Interface

Steps to assign a static IP address to the WAN1 interface.

2.2.2 Configure Port Roles

How to assign the P5 port from the lan2 interface to the dmz interface.

2.2.3 Configure Zones

Steps to move a VPN tunnel from one zone to a new zone.

2.3 How to Configure a Cellular Interface

Guide to configuring cellular interfaces for WAN connections using a 3G USB card.

2.4 How to Configure Ethernet, PPP, VLAN, Bridge and Policy Routing

Details configuration screens for Ethernet, PPP, VLAN, Bridge, and Policy Routing.

2.5 How to Set Up IPv6 Interfaces For Pure IPv6 Routing

Example of configuring WAN and LAN interfaces for pure IPv6 routing.

2.5.1 Setting Up the WAN IPv6 Interface

Steps to enable interface and IPv6 on the WAN1 interface using SLAAC.

2.5.2 Setting Up the LAN Interface

Steps to configure the LAN1 interface for IPv6 with router advertisement.

2.5.3 Pure IPv6 Routing Video Example

Instructions for playing a video example of pure IPv6 routing.

2.5.4 Prefix Delegation and Router Advertisement Settings

Explains configuring prefix delegation and router advertisement on WAN and LAN.

2.5.4.1 Apply a Network Prefix From Your ISP

How to apply a network prefix from an ISP for IPv6 configuration.

2.5.4.2 Setting Up the WAN IPv6 Interface

Steps to set up the WAN IPv6 interface using DHCPv6 prefix delegation.

2.5.4.3 Setting Up the LAN Interface

Steps to set up the LAN interface for IPv6 with prefix delegation and router advertisement.

2.5.5 Test

Instructions to test the IPv6 configuration by connecting a computer to LAN1.

2.5.6 Prefix Delegation and Router Advertisement Settings Video Example

Instructions for playing a video on prefix delegation and router advertisement.

2.5.7 What Can Go Wrong?

Troubleshooting common issues with IPv6 auto-configuration and prefix delegation.

2.6 How to Set Up an IPv6 6to4 Tunnel

Guide to creating an IPv6 6to4 tunnel for IPv6/IPv4 connectivity.

2.6.1 Configuration Concept

Explains the packet flow for 6to4 tunnel settings.

2.6.2 Setting Up the LAN IPv6 Interface

Steps to set up the LAN IPv6 interface for a 6to4 tunnel.

2.6.3 Setting Up the 6to4 Tunnel

Steps to create a 6to4 tunnel interface with a relay router.

2.6.4 Testing the 6to4 Tunnel

Instructions to test the 6to4 tunnel configuration.

2.6.5 Set Up an IPv6 6to4 Tunnel Video Example

Instructions for playing a video on setting up an IPv6 6to4 tunnel.

2.6.6 What Can Go Wrong?

Troubleshooting common issues with IPv6 6to4 tunnels.

2.7 How to Set Up an IPv6-in-IPv4 Tunnel

Guide to creating an IPv6-in-IPv4 tunnel for secure connectivity.

2.7.1 Configuration Concept

Explains the packet flow for IPv6-in-IPv4 tunnel configurations.

2.7.2 Setting Up the IPv6-in-IPv4 Tunnel

Steps to set up an IPv6-in-IPv4 tunnel interface.

2.7.3 Setting Up the LAN IPv6 Interface

Steps to configure the LAN IPv6 interface for an IPv6-in-IPv4 tunnel.

2.7.4 Setting Up the Policy Route

Steps to set up a policy route for IPv6-in-IPv4 tunnel traffic.

2.7.5 Testing the IPv6-in-IPv4 Tunnel

Instructions to test the IPv6-in-IPv4 tunnel configuration.

2.7.6 Set Up an IPv6-in-IPv4 Tunnel Video Example

Instructions for playing a video on setting up an IPv6-in-IPv4 tunnel.

2.7.7 What Can Go Wrong?

Troubleshooting common issues with IPv6-in-IPv4 tunnels.

Protecting Your Network

3.1 Firewall

Controls traffic between/within zones using rules, application patrol, NAT, and policy routes.

3.1.1 What Can Go Wrong

Troubleshooting firewall rule order, service control, and zone assignment issues.

3.2 User-aware Access Control

Configures policies and security for users, authenticated locally or externally.

3.2.1 What Can Go Wrong

Troubleshooting issues with default admin account, external authentication, and user group assignments.

3.3 Endpoint Security (EPS)

Uses security objects with policies to ensure user computers meet requirements for network access.

3.3.1 What Can Go Wrong

Troubleshooting EPS failures related to Java installation and multiple endpoint security objects.

3.4 Device and Service Registration

Tutorial for creating a myZyXEL.com account and registering the ZyWALL for service activation.

3.5 Anti-Virus Policy Configuration

Guide to configuring an Anti-Virus policy for scanning traffic for viruses.

3.5.1 What Can Go Wrong

Lists file/traffic types not scanned by Anti-Virus and potential issues.

3.6 IDP Profile Configuration

Protects against intrusions by detecting malicious packets and suspicious traffic flows.

3.6.1 Procedure To Create a New Profile

Steps to create a new Intrusion Detection and Prevention (IDP) profile.

3.7 ADP Profile Configuration

Protects against anomalies by analyzing protocol violations and abnormal traffic.

3.7.1 Procedure To Create a New ADP Profile

Steps to create a new Anomaly Detection and Prevention (ADP) profile.

3.8 Content Filter Profile Configuration

Controls web site access and content filtering using external databases.

3.8.1 Content Filtering Video Example

Instructions for playing a video on content filtering.

3.9 Viewing Content Filter Reports

Guide to viewing content filtering statistics and charts after registering your iCard.

3.10 Anti-Spam Policy Configuration

Configures Anti-Spam policies using Mail Scan functions and DNS Black List.

Create Secure Connections Across the Internet

4.1 IPSec VPN

Covers configuring IPSec VPN tunnels using quick setup wizard or specific screens.

4.1.1 Test the VPN Connection

Steps to test the VPN connection after configuring gateway and connection settings.

4.1.2 Configure Security Policies for the VPN Tunnel

How to set up security policies for the IPSec VPN tunnel based on zones.

4.1.3 What Can Go Wrong

Troubleshooting common issues with IPSec tunnel setup and configuration.

4.2 VPN Concentrator Example

Example of using a VPN concentrator for hub-and-spoke topology to combine multiple IPSec VPNs.

4.2.1 What Can Go Wrong

Troubleshooting common issues when using a VPN concentrator.

4.3 Hub-and-spoke IPSec VPN Without VPN Concentrator

Example of hub-and-spoke VPN without using the concentrator feature.

4.3.1 What Can Go Wrong

Troubleshooting considerations for implementing a hub-and-spoke VPN.

4.4 ZyWALL IPSec VPN Client Configuration Provisioning

Automates VPN rule settings for ZyWALL IPSec VPN Client users.

4.4.1 Overview of What to Do

Outlines the process of creating VPN rules and configuring the client.

4.4.2 Configuration Steps

Detailed steps for setting up VPN configuration provisioning for the IPSec VPN Client.

4.4.3 ZyWALL IPSec VPN Client Configuration Provisioning Video Example

Instructions for playing a video on IPSec VPN client configuration provisioning.

4.4.4 What Can Go Wrong

Troubleshooting VPN rule violations and login problems for IPSec VPN Client.

4.5 SSL VPN

Provides easy VPN access for remote users via web browsers.

4.5.1 SSL VPN Video Example

Instructions for playing a video on SSL VPN.

4.5.2 What Can Go Wrong

Troubleshooting issues with SSL VPN logo display, resource links, and user accounts.

4.6 L2TP VPN with Android, iOS, and Windows

Guides configuring L2TP VPN on remote user devices for secure network connections.

4.6.1 L2TP VPN Example

Example of setting up L2TP VPN for a sales representative connecting via laptop.

4.6.2 Configuring Policy Routing

Configuring policy routes to allow remote users access to network resources.

4.6.3 Configuring L2TP VPN on the ZyWALL Video Example

Instructions for playing a video on configuring L2TP VPN on the ZyWALL.

4.6.4 Configuring L2TP VPN in Android

Steps to configure L2TP VPN on an Android device.

4.6.5 Configuring L2TP VPN in iOS

Steps to configure L2TP VPN on an iOS device.

4.6.6 Configuring L2TP VPN in Windows

Covers configuring L2TP VPN on Windows 7, Vista, or XP computers.

4.6.6.1 Configuring L2TP in Windows 7 or Windows Vista

Steps to establish an L2TP VPN connection on Windows 7 or Vista.

4.6.6.2 Configuring L2TP VPN in Windows 7 Video Example

Instructions for playing a video on configuring L2TP VPN in Windows 7.

4.6.6.3 Configuring L2TP in Windows XP

Steps to configure L2TP VPN on Windows XP.

4.6.7 What Can Go Wrong

Troubleshooting common issues with L2TP VPN connections.

4.7 One-Time Password Version 2 (OTPv2)

Explains two-factor authentication using OTPv2 for secure logins.

4.7.1 What Can Go Wrong

Troubleshooting issues with OTPv2 password reuse and authentication server availability.

Managing Traffic

5.1 How to Configure Bandwidth Management

Explains how to manage bandwidth when applications compete for limited resources.

5.1.1 Bandwidth Allocation Example

Example of allocating bandwidth for different applications in a 10-person office.

5.1.2 Setting the Interface’s Bandwidth

How to set the upstream egress bandwidth for the WAN1 interface.

5.1.3 SIP Bandwidth Management

Best practices for ensuring SIP call quality through bandwidth management.

5.1.4 SIP Any-to-WAN and WAN-to-Any Bandwidth Management Example

Example of managing SIP traffic bandwidth for WAN connections.

5.1.5 HTTP Any-to-WAN Bandwidth Management Example

Example of managing HTTP traffic bandwidth from LAN/DMZ to WAN.

5.1.6 FTP WAN-to-DMZ Bandwidth Management Example

Example of limiting WAN1 to DMZ FTP traffic to avoid interfering with other services.

5.1.7 FTP LAN-to-DMZ Bandwidth Management Example

Example of managing FTP traffic bandwidth from LAN1 to DMZ with lower priority.

5.1.8 Bandwidth Management Video Example

Instructions for playing a video on bandwidth management.

5.1.9 What Can Go Wrong?

Troubleshooting common issues with bandwidth management settings.

5.2 How to Configure a Trunk for WAN Load Balancing

Shows how to configure a trunk for two WAN connections to balance load.

5.2.1 Set Up Available Bandwidth on Ethernet Interfaces

How to set a limit on outgoing traffic for WAN interfaces.

5.2.2 Configure the WAN Trunk

Steps to configure a WAN trunk with load balancing algorithms and weights.

5.3 How to Use Multiple Static Public WAN IP Addresses for LAN-to-WAN Traffic

Configures policy routes to use static public WAN IPs for outbound LAN traffic.

5.3.1 Create the Public IP Address Range Object

Creates an address object for a range of static public IP addresses.

5.3.2 Configure the Policy Route

Configures a policy route to use public IP addresses as source for WAN to LAN traffic.

5.4 How to Configure DNS Inbound Load Balancing

Configures DNS inbound load balancing to distribute queries to the least loaded interface.

5.4.1 What Can Go Wrong?

Troubleshooting issues with DNS inbound load balancing effectiveness and custom member IP configuration.

5.5 How to Allow Public Access to a Web Server

Makes an HTTP web server in the DMZ accessible from the Internet via WAN.

5.5.1 Configure NAT

Creates NAT rules to send HTTP traffic from WAN IP to the web server's private IP.

5.5.2 Set Up a Firewall Rule

Creates a firewall rule to allow public HTTP traffic to the web server.

5.5.3 What Can Go Wrong

Troubleshooting firewall rules for web server access.

5.6 How to Manage Voice Traffic

Examples for allowing H.323 and SIP traffic through the ZyWALL.

5.6.1 How to Allow Incoming H.323 Peer-to-peer Calls

Allows H.323 devices on LAN to receive peer-to-peer calls from the WAN.

5.6.1.1 Turn On the ALG

Enables H.323 ALG and transformations for voice traffic.

5.6.1.2 Set Up a NAT Policy For H.323

Sets up NAT policy to forward H.323 traffic to the H.323 device's LAN IP.

5.6.1.3 Set Up a Firewall Rule For H.323

Creates a firewall rule to allow H.323 traffic to the H.323 device.

5.6.2 How to Use an IPPBX on the DMZ

Makes an IPPBX in DMZ accessible from Internet for SIP calls.

5.6.2.1 Turn On the ALG

Enables SIP ALG and transformations for IPPBX traffic.

5.6.2.2 Set Up a NAT Policy for the IPPBX

Sets up NAT policy to forward IPPBX SIP traffic from WAN to DMZ.

5.6.2.3 Set Up a WAN to DMZ Firewall Rule for SIP

Creates a firewall rule to allow public SIP traffic to the IPPBX.

5.6.2.4 Set Up a DMZ to LAN Firewall Rule for SIP

Creates a firewall rule to allow IPPBX SIP traffic to LAN clients.

5.6.3 What Can Go Wrong

Troubleshooting firewall rules for DMZ to LAN SIP traffic.

5.7 How to Limit Web Surfing and MSN to Specific People

Uses AppPatrol to enforce web surfing and MSN policies for specific user groups.

5.7.1 Set Up Web Surfing Policies

Steps to set up web surfing policies, restricting access to authorized users.

5.7.2 Set Up MSN Policies

Sets up recurring schedules and policies to allow specific departments to use MSN.

5.7.3 AppPatrol Video Example

Instructions for playing a video on AppPatrol.

5.7.4 What Can Go Wrong

Troubleshooting issues if AppPatrol service is not subscribed.

Maintenance

6.1 How to Allow Management Service from WAN

Allows remote management access via WWW, SSH, Telnet, FTP, and SNMP.

6.1.1 Check Service Control

Verifies service control settings for remote management access.

6.1.2 Check Firewall Settings

Checks firewall rules to ensure management service traffic is not blocked.

6.2 How to Use a RADIUS Server to Authenticate User Accounts based on Groups

Authenticates user accounts based on groups using a RADIUS server.

6.3 How to Use SSH for Secure Telnet Access

Provides examples for accessing the ZyWALL using SSH client programs.

6.3.1 Example 1: Microsoft Windows

Accessing ZyWALL via Secure Shell Client program on Windows.

6.3.2 Example 2: Linux

Accessing ZyWALL using OpenSSH client program on Linux.

6.4 How to Manage ZyWALL Configuration Files

Backing up and restoring ZyWALL configuration files via the Configuration File screen.

6.5 How to Manage ZyWALL Firmware

Checking firmware version and uploading new firmware to the ZyWALL.

6.6 How to Download and Upload a Shell Script

Editing, uploading, and running shell scripts for ZyWALL automation.

6.6.1 What Can Go Wrong

Troubleshooting issues when running shell scripts.

6.7 How to Save System Logs to a USB Storage Device

Saving ZyWALL system logs to a USB storage device.

6.7.1 What Can Go Wrong?

Troubleshooting issues with saving system logs to USB storage.

6.8 How to Get the ZyWALL’s Diagnostic File

Generating a file with configuration and diagnostic info for customer support.

6.9 How to Capture Packets on the ZyWALL

Tracing IPv4 and IPv6 packets for troubleshooting network issues.

6.10 How to Get the ZyWALL’s Core Dump File

Downloading core dump files generated when a process fails for customer support.

6.11 How to Use Packet Flow Explore for Troubleshooting

Using packet flow explore to resolve routing or NAT problems.

Legal Information

Copyright

Copyright notice for the publication.

Disclaimer

ZyXEL's disclaimer regarding application or use of described products/software.

Certifications (Class B)

Compliance statements for FCC and ICES-003 standards.

FCC Radiation Exposure Statement

Statement regarding transmitter co-location and RF exposure compliance.

Notices

Information on changes/modifications and compliance with Canadian ICES-003.

Viewing Certifications

Instructions on how to view certifications on the ZyXEL website.

ZyXEL Limited Warranty

Details ZyXEL's warranty for product defects in material or workmanship.

Registration

Instructions for registering products online for firmware upgrades and information.

Open Source Licenses

Information on free software licenses and obtaining source code.

Safety Warnings

Essential safety precautions for using the device to prevent hazards.

Related product manuals