ZyXEL Communications ZyXEL ZyWALL USG-1000 Handbuch

ZyWALL USG 1000 Support Notes

ZyWALL USG 1000

Internet Security Appliance

Support Notes

Revision 2.02

August. 2007

ZyWALL USG 1000 Support Notes

INDEX

1. Deploying VPN..........................................................................................................................8

1.1 Extended Intranets..........................................................................................................10

1.1.1 Site to Site VPN solutions (ZyWALL USG 1000 ÙZyWALL USG 1000):....10

1.1.2 Site to Site VPN solutions (ZyWALL USG 1000 ÙZyWALL USG 300):......14

1.2 Extranet Deployment .....................................................................................................19

1.2.1 Site to site VPN solutions (ZyWALL USG 1000 to ZyWALL70).....................20

1.2.2 Interoperability – VPN with other vendors......................................................26

1.2.2.1 ZyWALL with FortiGate VPN Tunneling.............................................26

1.2.2.2 ZyWALL with NetScreen VPN Tunneling ...........................................32

1.2.2.3 ZyWALL with SonicWall VPN Tunneling............................................41

1.3 Remote Access VPN......................................................................................................50

1.3.1 IPSec VPN for Remote Access........................................................................50

1.3.2 SSL VPN Application - Reverse Proxy...........................................................59

1.3.3 Using Two-factor Authentication to Provide Stronger Password Security .....67

1.3.4 L2TP over IPSec Application ..........................................................................77

1.4 Large-scale VPN Deployment .......................................................................................85

1.4.1 Fully Meshed Topology...................................................................................86

1.4.2 Star Topology...................................................................................................87

1.4.3 Star-Mesh Mixed Topology.............................................................................96

1.5 Access via Central Site.................................................................................................112

1.5.1 VPN Tunnel to Central Site (ZyWALL 70 to ZyWALL USG).....................112

1.6 Multiple Entry Point (MEP).........................................................................................124

1.6.1 Deploying MEP..............................................................................................124

1.7 Device HA together with VPN HA..............................................................................163

1.7.1 Device HA......................................................................................................164

1.7.2 VPN HA.........................................................................................................181

1.8 VoIP over VPN............................................................................................................188

2. Security Policy Enforcement..................................................................................................199

2.1 Managing IM/P2PApplications...................................................................................199

2.1.1 Why bother with managing IM/P2P applications? ........................................199

2.1.2 What does ZyWALL USG provide for managing IM/P2P applications?......200

2.1.3 Configuration Example..................................................................................200

2.2 Zone-based Anti-Virus Protection................................................................................209

2.2.1 Applying Zone-Based Anti-Virus to ZyWALL USG.......................................209

ZyWALL USG 1000 Support Notes

2.2.2 Enabling Black and White List.........................................................................215

2.2.3 Enabling Anti-Virus Statistics Report...............................................................217

2.3 Managing WLAN.........................................................................................................218

2.3.1 Why the wireless networks need to be managed?..........................................218

2.3.2 What can we do against the wireless insecurity?...........................................218

2.4 Employee Internet Management (EIM).......................................................................230

2.4.1 Benefits of deploying Employee Internet Management.................................230

2.4.2 EIM on ZyWALL USG .................................................................................230

3. Seamless Incorporation..........................................................................................................240

3.1 Transparent Firewall.....................................................................................................240

3.1.1 Bridge mode & Router (NAT) mode co-exist................................................240

3.1.2 NAT & Virtual Server....................................................................................245

3.2 Zone-based IDP Protection ..........................................................................................249

3.2.1 Applying Zone-Based IDP to ZyWALL USG..................................................249

3.3 Networking Partitioning Using VLAN........................................................................259

3.3.1 Creating VLAN virtual interfaces.....................................................................259

3.3.2 Adding VLAN virtual interfaces to the Zone ...................................................262

3.3.3 Applying firewall policy to the Zone of VLANs..............................................265

3.4 Connecting Multiple ISP Links....................................................................................269

3.4.1 Multiple PPPoE links........................................................................................269

3.4.2 Multiple fixed WAN links ................................................................................280

3.5 Guaranteed Quality of Service.....................................................................................298

3.5.1 Priority & Bandwidth management ..................................................................298

FAQ............................................................................................................................................306

A. Device Management FAQ.............................................................................................306

A01. How can I connect to ZyWALL USG to perform administrator’s tasks?.........306

A02. Why can’t I login into ZyWALL USG?............................................................306

A03. What’s difference between “Admin Service Control” and “User Service

Control” configuration in GUI menu Configuration > System > WWW? ................307

A04. Why ZyWALL USG redirects me to the login page when I am performing the

management tasks in GUI? ........................................................................................307

A05. Why do I lose my configuration setting after ZyWALL USG restarts? ...........308

A06. How can I do if the system is keeping at booting up stage for a long time?.....308

B. Registration FAQ...........................................................................................................310

B01. Why do I need to do the Device Registration?..................................................310

B02. Why do I need to activate services?..................................................................310

B03. Why can’t I active trial service?........................................................................310

ZyWALL USG 1000 Support Notes

B04. Will the UTM service registration information be reset once restore

configuration in ZyWALL USG back to manufactory default? ................................310

C. File Manager FAQ.........................................................................................................311

C01. How can ZyWALL USG manage multiple configuration files?.......................311

C02. What are the configuration files like startup-config.conf, system-default.conf

and lastgood.conf?......................................................................................................311

C03. Why can’t I update firmware?...........................................................................311

C04. What is the Shell Scripts for in GUI menu File manager > Shell Scripts? .......312

C05. How to write a shell script?...............................................................................312

C06. Why can’t I run shell script successfully?.........................................................312

D. Object FAQ....................................................................................................................313

D01. Why does ZyWALL USG use objects? ............................................................313

D02. What’s the difference between Trunk and the Zone Object?............................314

D03. What is the difference between the default LDAP and the group LDAP? What

is the difference between the default RADIUS and the group RADIUS?.................314

E. Interface FAQ ................................................................................................................315

E01. How to setup the WAN interface with PPPoE or PPTP?..................................315

E02. How to add a virtual interface (IP alias)?..........................................................315

E03. Why can’t I get IP address via DHCP relay? ....................................................315

E04. Why can’t I get DNS options from ZyWALL’s DHCP server?........................315

E05. Why does the PPP interface dials successfully even its base interface goes

down?.........................................................................................................................315

E06. What is the port grouping used for in ZyWALL USG? ....................................316

E07. What's the maximum VLAN interface supported by ZyWALL USG ?............316

F. Routing and NAT FAQ...................................................................................................317

F01. How to add a policy route?................................................................................317

F02. How to configure local loopback in ZyWALL USG?.......................................317

F03. How to configure a NAT?..................................................................................321

F04. After I installed a HTTP proxy server and set a http redirect rule, I still can’t

access web. Why? ......................................................................................................322

F05. How to limit some application (for example, FTP) bandwidth usage? .............322

F06. What’s the routing order of policy route, dynamic route, and static route and

direct connect subnet table?.......................................................................................322

F07. Why ZyWALL USG cannot ping the Internet host, but PC from LAN side can

browse internet WWW?.............................................................................................323

F08. Why can’t I ping to the, Internet, after I shutdown the primary WAN interface?323

F09. Why the virtual server or port trigger does not work?.......................................323

ZyWALL USG 1000 Support Notes

F10. Why port trigger does not work?.......................................................................323

F11. How do I use the traffic redirect feature in ZyWALL USG? ............................324

F12. Why can’t ZyWALL learn the route from RIP and/or OSPF?..........................324

G. VPN and Certificate.......................................................................................................325

G01. Why can't the VPN connections dial to a remote gateway?..............................325

G02. VPN connections are dialed successfully, but the traffic still cannot go through

the IPsec tunnel..........................................................................................................325

G03. Why ZyWALL USG VPN tunnel had been configured correctly and the VPN

connection status is connected but the traffic still can not reach the remote VPN

subnet?........................................................................................................................325

G04. VPN connections are dialed successfully, and the policy route is set. But the

traffic is lost or there is no response from remote site...............................................326

G05. Why don’t the Inbound/Outbound traffic NAT in VPN work?........................326

H. Firewall FAQ.................................................................................................................327

H01. Why doesn’t my LAN to WAN or WAN to LAN rule work?..........................327

H02. Why does the intra-zone blocking malfunction after I disable the firewall? ....327

H03. Can I have access control rules to the device in firewall? ................................327

I. Application Patrol FAQ...................................................................................................328

I01. What is Application Patrol?................................................................................328

I02. What applications can the Application Patrol function inspect?........................328

I03. Why does the application patrol fail to drop/reject invalid access for some

applications?...............................................................................................................329

I04. What is the difference between “Auto” and “Service Ports” settings in the

Application Patrol configuration page? .....................................................................330

I05. What is the difference between BWM (bandwidth management) in Policy Route

and App. Patrol ?........................................................................................................331

I06. Do I have to purchase iCards specifically for using AppPatrol feature?............332

I07. Can I configure different access level based on application for different users?332

I08. Can I migrate AppPatrol policy and bandwidth management control from

ZLD1.0x to ZLD2.0x? ...............................................................................................332

J. lDP FAQ .........................................................................................................................333

J01. Why doesn’t the IDP work? Why has the signature updating failed?................333

J02. When I use a web browser to configure the IDP, sometimes it will popup

"wait data timeout".....................................................................................................333

J03. When I want to configure the packet inspection (signatures), the GUI becomes

very slow....................................................................................................................333

J04. After I select "Auto Update" for IDP, when will it update the signatures?........333

ZyWALL USG 1000 Support Notes

J05. If I want to use IDP service, will it is enough if I just complete the registration

and turn on IDP? ........................................................................................................333

J06. What are the major design differences in IDP in ZLD1.0x and latest IDP/ADP

in ZLD2.0x?...............................................................................................................333

J07. Does IDP subscription have anything to do with AppPatrol?............................334

J08. How to get a detailed description of an IDP signature?.....................................335

J09. After an IDP signature updated, does it require ZyWALL to reboot to make

new signatures take effect? ........................................................................................335

K. Content Filtering FAQ...................................................................................................336

K01. Why can’t I enable external web filtering service? Why does the external web

filtering service seem not to be working?..................................................................336

K02. Why can’t I use MSN after I enabled content filter and allowed trusted

websites only?............................................................................................................336

L. Device HA FAQ.............................................................................................................337

L01. What does the “Preempt” mean?.......................................................................337

L02. What is the password in Synchronization?........................................................337

L03. What is “Link Monitor” and how to enable it?..................................................337

L04. Can Link Monitor of Device HA be used in backup VRRP interfaces? ...........338

L05. Why do both the VRRP interfaces of master ZW USG and backup ZW USG

are activated at the same time?...................................................................................338

M. User Management FAQ................................................................................................339

M01. What is the difference between user and guest account? .................................339

M02. What is the “re-authentication time” and “lease time”?...................................339

M03. Why can’t I sign in to the device?....................................................................339

M04. Why is the TELNET/SSH/FTP session to the device disconnected? Why is the

GUI redirected to login page after I click a button/link? ...........................................339

M05. What is AAA? ..................................................................................................340

M06. What are ldap-users and radius-users used for? ...............................................340

M07. What privileges will be given for ldap-users and radius-users?.......................340

N. Centralized Log FAQ ....................................................................................................342

N01. Why can’t I enable e-mail server in system log settings?.................................342

N02. After I have the entire required field filled, why can’t I receive the log mail?.342

O. Traffic Statistics FAQ....................................................................................................343

O01. When I use "Flush Data" in Report, not all the statistic data are cleared..........343

O02. Why isn't the statistic data of "Report" exact?..................................................343

O03. Does Report collect the traffic from/to ZyWALL itself?..................................343

ZyWALL USG 1000 Support Notes

O04. Why cannot I see the connections from/to ZyWALL itself?............................343

P. Anti-Virus FAQ ..............................................................................................................344

P01. Is there any file size or amount of concurrent files limitation with ZyWALL

USG Anti-Virus engine?............................................................................................344

P02. Does ZyWALL USG Anti-Virus support compressed file scanning?...............344

P03. What is the maximum concurrent session of ZyWALL USG Anti-Virus engine344

P04. How many type of viruses can be recognized by the ZyWALL USG?.............344

P05. How frequent the AV signature will be updated?..............................................344

P06. How to retrieve the virus information in detail?................................................345

P07. I cannot download a file from Internet through ZyWALL USG because the

Anti-Virus engine considers this file has been infected by the virus; however, I am

very sure this file is not infected because the file is nothing but a plain text file. How

do I resolve this problem?..........................................................................................345

P08. Does ZyWALL USG Anti-Virus engine support Passive FTP?........................345

P09. What kinds of protocol are currently supported on ZyWALL USG Anti-Virus

engine? .......................................................................................................................345

P10. If the Anti-Virus engine detects a virus, what action it may take? Can it cure

the file?.......................................................................................................................345

ZyWALL USG 1000 Support Notes

1. Deploying VPN

VPN (Virtual Private Network) allows you to establish a virtual direct connection to remote

locations or for the telecommuters to access the internal network in the office. VPN is a

replacement for the traditional site-to-site lease lines like T1 or ISDN. Through the VPN

applications, it reduces setup cost, works for various types of Internet connection devices

(ISDN modem, ADSL modem and FTTX…) and is easy to troubleshoot.

VPN gives you site-to-site connection flexibility. However, with multiple VPN connections

between sites, it can become more difficult to maintain. Typically, an administrator has to

configure many site-to-site VPN connections to allow a truly global VPN network.

VPN connection management is made easily using the VPN concentrator. The VPN

ZyWALL USG 1000 Support Notes

concentrator routes VPN traffic across multiple remote sites without complex setting, thus

reduces the configuration overhead and the possibility of improper configuration. The VPN

concentrator is also a centralized management tool for administrators because all the traffic

sent between remote sites has to go through the central office first and administrators can set

up different access control rules. These are based on the source address, remote address, user

and schedule to enhance VPN security. To help to reduce network intrusion attacks,

administrators can configure the built-in IDP engine to inspect VPN traffic. For easy

troubleshooting and monitoring, the VPN concentrator logs and stores system information and

network status for further easy troubleshooting and analysis.

The VPN concentrator enhances the VPN routing ability and helps network administrators

in setting up a global VPN network with less effort but stronger security and management

possibilities.

For SMB customer, ZyXEL provides a total VPN solution from a personal client to a 500+

people firewall where all of these devices have the VPN connection ability.

The benefit from deployment of ZyXELVPN solutions

‧Security and Reliability

‧Improved communications

‧Increased flexibility

‧Lower cost

ZyWALL USG 1000 Support Notes

1.1 Extended Intranets

The ZyXEL VPN solutions primarily can be used to extend the intranet and deliver

increased connectivity between operation sites. The branch office subnet will be considered a

part of main office internet. Therefore, user behind branch office also can use the internal

network resources as if he was in the main office. Because of the VPN connection, user will

feel like he is using a local LAN even though he is accessing the network resources via

Internet. Use of a VPN for smaller branch offices, franchise sites and remote workers provides

nearly the same level of connectivity and reliability as a private network. The remote

connection cost also can decrease by leveraging the Internet connections to replace expensive

leased lines.

1.1.1 Site to Site VPN solutions (ZyWALL USG 1000ÙZyWALL USG 1000):

Site to Site VPN is the basic VPN solution between local and remote gateway. This type of

VPN connection is used to extend and join local networks of both sites into a single intranet.

There are two kinds of connection interface. Static IP and dynamic DNS.

Configure ZyWALL USG with Static IP address:

ZyWALL USG uses the static IP address for VPN connection. The topology is shown on the

following figure.

Andere Handbücher für ZyXEL ZyWALL USG-1000

Inhaltsverzeichnis

Andere ZyXEL Communications Tor Handbücher

ZyXEL Communications

ZyXEL Communications ZyXEL ZyWALL 35 Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications P-2302HW-P1 Series Referenzhandbuch

ZyXEL Communications

ZyXEL Communications P-870HW-I Series Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications P-660HN-51 - Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications Prestige 316 Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications P-793H 601156 Referenzhandbuch

ZyXEL Communications

ZyXEL Communications PMG5622GA Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications ZyWALL 1050 Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications LTE6100 Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications VMG4927-B50A Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications Internet Security Gateway ZyWALL 100 Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications P-870H-51a v2 Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications P-660HW-D Series Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications VFG6005 Kurzanleitung

ZyXEL Communications

ZyXEL Communications ADSL 2+ Security Gateway Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications P-660HNT1 Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications P-660HN-51 - V1.10 Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications Unified Security Gateway ZyWALL 1000 Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications NSG Series Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications VMG1312-B Series Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications LTE6101 Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications PRESTIGE 334 Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications p-661hw series Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications P-660HWP-D1 Bedienungsanleitung

Beliebte Tor Handbücher anderer Marken

LST

LST M500RFE-AS Bedienungsanleitung

Kinnex

Kinnex Media Gateway Bedienungsanleitung

2N Telekomunikace

2N Telekomunikace 2N StarGate Bedienungsanleitung

Mitsubishi Heavy Industries

Mitsubishi Heavy Industries Superlink SC-WBGW256 Bedienungsanleitung

Telsey

Telsey CPVA 500 - SIP Bedienungsanleitung

RTA

RTA 460A-NNA4 Technisches Datenblatt

Shaw

Shaw Gateway HDPVR Bedienungsanleitung

ABB

ABB VSN900 Kurzanleitung

Commander

Commander Pulse Bedienungsanleitung

2N Telekomunikace

2N Telekomunikace ATEUS EasyGate 501309E Bedienungsanleitung

NETGEAR

NETGEAR C6300BD Bedienungsanleitung

Amit

Amit CDW531AM Bedienungsanleitung

HMS

HMS Netbiter EasyConnect EC150 Bedienungsanleitung

Huawei

Huawei EchoLife HG620 Bedienungsanleitung

AT&T

AT&T U-verse 3801 Gebrauchs- und Pflegehandbuch

Logic IO

Logic IO RTCU MX2 turbo Bedienungsanleitung

Suttle

Suttle MediaMAX MXM-521 Bedienungsanleitung

RTA

RTA 460MCBC-N2E Technisches Datenblatt