ZyXEL Communications ZyWALL ATP Series Bedienungsanleitung

1/782

www.zyxel.com

ZyWALL/USG/ATP /VPN Series

ATP100/ ATP100W/ ATP200/ ATP500/ ATP700 / ATP800

USG20-VPN / USG20W-VPN / USG40 / USG40W /

USG60 / USG60W / USG110 / UGS210 / USG310/

USG1100 /USG1900 / USG2200-VPN

USG FLEX 100/ USG FLEX 200/ USG FLEX 500

VPN50 / VPN100 /VPN300 /VPN1000

Security Firewalls

Edition 5, June/2020

Handbook

Default Login Details

LAN Port IP Address

https://192.168.1.1

User Name

admin

Password

1234

2/782

www.zyxel.com

Table of Content

How to Configure Site-to-site IPSec VPN with Amazon VPC.................. 20

Set Up the IPSec VPN Tunnel on the Amazon VPC............................ 21

Set Up the IPSec VPN Tunnel on the ZyWALL/USG............................. 25

Test the IPSec VPN Tunnel ..................................................................... 31

What Could Go Wrong?....................................................................... 32

How to Configure Site-to-site IPSec VPN with Microsoft (MS) Azure ..... 33

Set Up the IPSec VPN Tunnel on the ZyWALL/USG............................. 34

Set Up the IPSec VPN Tunnel on the MS Azure................................... 39

Test the IPSec VPN Tunnel ..................................................................... 46

What Could Go Wrong? ...................................................................... 49

How to Configure GRE over IPSec VPN Tunnel........................................ 50

Set Up the ZyWALL/USG GRE over IPSec VPN Tunnel of Corporate

Network (HQ)......................................................................................... 51

Set Up the ZyWALL/USG GRE over IPSec VPN Tunnel of Corporate

Network (Branch) .................................................................................. 56

Test the GRE over IPSec VPN Tunnel .................................................... 60

What Could Go Wrong?....................................................................... 61

How to Configure Site-to-site IPSec VPN Where the Peer has a Static IP

Address ....................................................................................................... 63

Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network

(Branch).................................................................................................. 68

Test the IPSec VPN Tunnel ..................................................................... 72

What Could Go Wrong? ...................................................................... 73

How to Configure Site-to-site IPSec VPN Where the Peer has a Dynamic

IP Address ................................................................................................... 75

Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network

(HQ) ........................................................................................................ 75

Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network

(Branch has a Dynamic IP Address) ................................................... 79

Test the IPSec VPN Tunnel ..................................................................... 83

3/782

www.zyxel.com

What Could Go Wrong? ...................................................................... 85

How to Configure IPSec Site to Site VPN while one Site is behind a NAT

router ........................................................................................................... 87

Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network

(HQ) ........................................................................................................ 87

Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network

(Branch).................................................................................................. 91

Set Up the NAT Router (Using ZyWALL USG device in this example)95

Test the IPSec VPN Tunnel ..................................................................... 97

What Could Go Wrong?....................................................................... 98

How to Configure Hub-and-Spoke IPSec VPN........................................ 99

Set Up the IPSec VPN Tunnel on the ZyWALL/USG by Using VPN

Concentrator Hub_HQ-to-Branch_A ................................................ 100

Hub_HQ-to-Branch_B.......................................................................... 104

Hub_HQ Concentrator ....................................................................... 108

Spoke_Branch_A ................................................................................. 109

Spoke_Branch_B.................................................................................. 114

Test the IPSec VPN Tunnel ................................................................... 119

What Could Go Wrong? .................................................................... 123

Set Up the IPSec VPN Tunnel of ZyWALL/USG without Using VPN

Concentrator Hub_HQ-to-Branch_A ................................................ 125

Hub_HQ-to-Branch_B.......................................................................... 128

Spoke_Branch_A ................................................................................. 131

Spoke_Branch_B.................................................................................. 134

Test the IPSec VPN Tunnel ................................................................... 137

What Could Go Wrong? .................................................................... 140

How to Use Dual-WAN to Perform Fail-Over on VPN Using the VPN

Concentrator ............................................................................................ 142

Set Up the IPSec VPN Tunnel on the ZyWALL/USG Hub_HQ-to-

Branch_A.............................................................................................. 143

Hub_HQ-to-Branch_B.......................................................................... 146

Hub_HQ Concentrator ....................................................................... 149

Spoke_Branch_A ................................................................................. 150

Spoke_Branch_B.................................................................................. 153

4/782

www.zyxel.com

Test the IPSec VPN Tunnel................................................................... 157

What Could Go Wrong? .................................................................... 160

How to Configure IPSec VPN with ZyWALL IPSec VPN Client ............... 161

Set Up the ZyWALL/USG IPSec VPN Tunnel ....................................... 162

Set Up the ZyWALL IPSec VPN Client ................................................. 166

Test the IPSec VPN Tunnel ................................................................... 169

What Can Go Wrong?........................................................................ 171

How to Configure Site-to-site IPSec VPN with FortiGate....................... 173

Set Up the IPSec VPN Tunnel on the ZyWALL/USG........................... 174

Set Up the IPSec VPN Tunnel on the FortiGate................................. 177

Test the IPSec VPN Tunnel ................................................................... 182

What Could Go Wrong? .................................................................... 183

How to Configure Site-to-site IPSec VPN with WatchGuard ................ 185

Set Up the IPSec VPN Tunnel on the ZyWALL/USG........................... 186

Set Up the IPSec VPN Tunnel on the WatchGuard.......................... 189

Test the IPSec VPN Tunnel ................................................................... 195

What Could Go Wrong? .................................................................... 196

How to Configure Site-to-site IPSec VPN with Cisco............................. 198

Set Up the IPSec VPN Tunnel on the ZyWALL/USG........................... 199

Set Up the IPSec VPN Tunnel on the Cisco ....................................... 204

Test the IPSec VPN Tunnel ................................................................... 209

What Could Go Wrong? .................................................................... 211

How to Configure Site-to-site IPSec VPN with a SonicWALL router ..... 212

Set Up the IPSec VPN Tunnel on the ZyWALL/USG........................... 213

Set Up the IPSec VPN Tunnel on the SonicWALL .............................. 220

Test the IPSec VPN Tunnel ................................................................... 224

What Could Go Wrong? .................................................................... 226

How to Configure IPSec VPN Failover .................................................... 229

Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network

(HQ) ...................................................................................................... 230

Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network

(Branch)................................................................................................ 233

Set up the WAN Trunk (ZyWALL/USG_HQ) ........................................ 238

5/782

www.zyxel.com

Set up the Failover Command Line (ZyWALL/USG HQ).................. 239

Test the IPSec VPN Tunnel ................................................................... 240

What Could Go Wrong? .................................................................... 242

How to Configure L2TP over IPSec VPN while the ZyWALL/USG is behind

a NAT router.............................................................................................. 244

Set Up the L2TP VPN Tunnel on the ZyWALL/USG_HQ...................... 245

Set Up the NAT Router (Using ZyWALL USG device in this example)

............................................................................................................... 249

Test the L2TP over IPSec VPN Tunnel .................................................. 252

What Could Go Wrong?..................................................................... 255

How to Configure L2TP VPN with Android 5.0 Mobile Devices ............ 257

Set Up the L2TP VPN Tunnel on the ZyWALL/USG ............................. 258

Set Up the L2TP VPN Tunnel on the Android Device........................ 262

Test the L2TP over IPSec VPN Tunnel ................................................. 265

What Could Go Wrong? .................................................................... 267

How to Configure L2TP VPN with iOS 8.4 Mobile Devices..................... 269

Set Up the L2TP VPN Tunnel on the ZyWALL/USG ............................. 269

Set Up the L2TP VPN Tunnel on the iOS Device ................................ 275

Test the L2TP over IPSec VPN Tunnel ................................................. 276

What Could Go Wrong? .................................................................... 279

How to Import ZyWALL/USG Certificate for L2TP over IPsec in Windows 10

................................................................................................................... 281

Set Up the L2TP VPN Tunnel on the ZyWALL/USG ............................. 281

Export a Certificate from ZyWALL/USG and Import it to Windows 10

Operating System ............................................................................... 286

Set Up the L2TP VPN Tunnel on the Windows 10............................... 291

Test the L2TP over IPSec VPN Tunnel ................................................. 296

What Could Go Wrong? .................................................................... 298

How to Import ZyWALL/USG Certificate for L2TP over IPsec in IOS mobile

phone........................................................................................................ 300

Set Up the L2TP VPN Tunnel on the ZyWALL/USG ............................. 300

Export a Certificate from ZyWALL/USG and Import it to iOS Mobile

Phone ................................................................................................... 305

6/782

www.zyxel.com

Set Up the L2TP VPN Tunnel on the iOS Mobile Device ................... 305

Test the L2TP over IPSec VPN Tunnel ................................................. 308

What Could Go Wrong? .................................................................... 310

How to Import ZyWALL/USG Certificate for L2TP over IPsec in Android

mobile phone........................................................................................... 311

Set Up the L2TP VPN Tunnel on the ZyWALL/USG ............................. 312

Export a Certificate from ZyWALL/USG and Import it to Android

Mobile Phone ...................................................................................... 316

Set Up the L2TP VPN Tunnel on the Android Mobile Device........... 317

Test the L2TP over IPSec VPN Tunnel ................................................. 320

What Could Go Wrong? .................................................................... 322

How to Configure the L2TP VPN with Apple MAC OS X 10.11 Operating

System....................................................................................................... 324

Set Up the L2TP VPN Tunnel on the ZyWALL/USG ............................. 324

Set Up the L2TP VPN Tunnel on the Apple MAC OS X 10.11 El

Capitan Operating System ................................................................ 329

Test the L2TP over IPSec VPN Tunnel ................................................. 332

What Could Go Wrong? .................................................................... 334

How to configure if I want user can only see SSL VPN Login button in

web portal login page............................................................................. 336

Set Up the DNS Service........................................................................ 337

Set Up the ZyWALL/USG SSL VPN Setting............................................ 337

Set Up the ZyWALL/USG System Setting ............................................. 338

Test the SSL VPN ................................................................................... 339

How to Deploy SSL VPN with Apple Mac OS X 10.10 Operating System

................................................................................................................... 343

Set Up the SSL VPN Tunnel on the ZyWALL/USG ............................... 344

Set Up the SSL VPN Tunnel on the Apple MAC OS X 10.10 Operating

System................................................................................................... 347

Test the SSL VPN Tunnel....................................................................... 351

What Could Go Wrong? .................................................................... 354

How To Configure SSL VPN for Remote Access Mobile Devices ......... 356

Set Up the SSL VPN Tunnel on the ZyWALL/USG ............................... 357

7/782

www.zyxel.com

Test the SSL VPN Tunnel....................................................................... 360

What Could Go Wrong? .................................................................... 362

How to Configure an SSL VPN Tunnel (with SecuExtender version 4.0.0.1)

on the Windows 10 Operating System ................................................... 363

Set up the SSL VPN Tunnel with Windows 10 .................................... 363

What Can Go Wrong? ....................................................................... 367

How to redirect multiple LAN interface traffic to the VPN tunnel ........ 369

Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network

(HQ) ...................................................................................................... 370

Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network

(Branch)................................................................................................ 373

Set up the Policy Route (ZyWALL/USG_HQ) ..................................... 377

Set up the Policy Route (ZyWALL/USG_Branch) .............................. 378

Test the IPSec VPN Tunnel ................................................................... 380

What Could Go Wrong? .................................................................... 381

How to Create VTI and Configure VPN Failover with VTI...................... 383

VTI Deployment Flow .......................................................................... 383

Set Up the ZyWALL/USG VTI of Corporate Network (HQ) ............... 384

Set Up the ZyWALL/USG VTI of Corporate Network (Branch) ........ 389

Test the IPSec VPN Tunnel .................................................................. 395

What Can Go Wrong? ....................................................................... 397

How to configure the USG when using a Cloud Based SIP system ..... 399

Set Up the SIP ALG............................................................................... 400

Test result .............................................................................................. 400

What could go wrong? ...................................................................... 401

How to block HTTPS websites by Domain Filter without applying SSL

Inspection ................................................................................................. 401

Set Up the Content Filter on the ZyWALL/USG................................. 402

Set Up the Security Policy on the ZyWALL/USG ............................... 405

Set Up the System Policy on the ZyWALL/USG................................. 405

Test the Result ...................................................................................... 405

How to Configure Content Filter 2.0 with Geo IP Blocking................... 408

Set Up the Address Objet with Geo IP on the ZyWALL/USG........... 409

8/782

www.zyxel.com

Set Up the Security Policy on the ZyWALL/USG ............................... 409

Test the Result ...................................................................................... 410

What Could Go Wrong? .................................................................... 411

How to Configure Content Filter 2.0 with HTTPs Domain Filter .............. 412

Application Scenario.......................................................................... 412

Set Up the Content Filter on the ZyWALL/USG .................................. 413

Set Up the Security Policy on the ZyWALL/USG ............................... 415

Set Up the System Policy on the ZyWALL/USG................................. 416

Test the Result ...................................................................................... 417

What Could Wrong?........................................................................... 417

How to block the client accessing to certain country using Geo IP and

Content Filter ............................................................................................ 418

Check Geo IP License Status on the ZyWALL/USG........................... 419

Set Up the Address Objet with Geo IP on the ZyWALL/USG........... 420

Set Up the Security Policy on the ZyWALL/USG ............................... 421

Test the Result ...................................................................................... 422

How to Restrict Web Portal access from the Internet ........................... 425

Set Up the ZyWALL/USG System Setting ............................................. 425

Test the Web Access ........................................................................... 426

How to Setup and Configure Daily Report............................................. 429

Set Up the ZyWALL/USG Email Daily Report Setting........................... 430

Test the Daily Log Report .................................................................... 431

What Could Go Wrong? .................................................................... 433

How to Setup and Configure Email Logs ............................................... 434

Set Up the ZyWALL/USG Email Logs Setting........................................ 435

Test the Email Log ................................................................................ 436

What Could Go Wrong? .................................................................... 437

How to Setup and send logs to a Syslog Server.................................... 438

Set Up the Syslog Server (Use Papertrail syslog in this example) ....... 438

Set Up the ZyWALL/USG Remote Server Setting ................................ 441

Test the Remote Server ....................................................................... 442

What Could Go Wrong? .................................................................... 443

How to Setup and send logs to a Vantage Reports Server.................. 444

9/782

www.zyxel.com

Set Up the VRPT Server ........................................................................ 445

Set Up the ZyWALL/USG Remote Server Setting ................................ 448

Test the Remote Server ....................................................................... 449

What Could Go Wrong? .................................................................... 449

How to Setup and send logs to the USB storage................................... 450

Set Up the USB System Settings ........................................................... 451

Set Up the USB Log Storage ................................................................ 452

Check the USG Log Files .................................................................... 453

How to Setup IPv6 Interfaces for Pure IPv6 Routing .............................. 454

Setting Up the IPv6 Interface ............................................................. 455

Set up the Prefix Delegation and Router Advertisement ............... 457

Test ........................................................................................................ 461

What Can Go Wrong? ....................................................................... 462

Test ........................................................................................................ 464

How to Perform and Use the Packet Capture Feature on the

ZyWALL/USG ............................................................................................. 464

Set Up the Packet Capture Feature................................................... 465

Check the Capture Files..................................................................... 468

How to Automatically Reboot the ZyWALL/USG by Schedule............. 469

Set Up the Shell Script .......................................................................... 470

Set Up the Schedule Run..................................................................... 471

Check the Reboot Status................................................................... 473

How To Schedule YouTube Access........................................................ 475

Set Up the Schedule on the ZyWALL/USG......................................... 475

Create the Application Objects on the ZyWALL/USG ..................... 476

Set Up SSL Inspection on the ZyWALL/USG........................................ 476

Set Up the Security Policy on the ZyWALL/USG................................. 477

Export Certificate from ZyWALL/USG and Import it to Windows 7

Operation System ............................................................................... 478

Test the Result ...................................................................................... 484

What Could Go Wrong? .................................................................... 484

How to continuously run a ZySH script ................................................... 486

Set Up the Shell Script .......................................................................... 486

10/782

www.zyxel.com

Set Up the Schedule Run..................................................................... 488

Check the Result ................................................................................. 488

How To Register Your Device and Services at myZyXEL.com ............. 489

Account Creation............................................................................... 490

Device Registration............................................................................. 492

Service Registration (In the Case of Standard License) ................. 493

Device Management (In the Case of Registering Bundled Licenses)

............................................................................................................... 494

Refresh Service .................................................................................... 495

What Could Go Wrong? .................................................................... 495

How To Exempt Specific Users From Security Control .......................... 497

Set Up the Security Policy on the ZyWALL/USG for Employees ....... 498

Set Up the Security Policy on the ZyWALL/USG for Executives........ 500

Test the Result ...................................................................................... 502

What Could Go Wrong? .................................................................... 503

How To Detect and Prevent TCP Port Scanning with ADP .................... 504

Set Up the ADP Profile on the ZyWALL/USG ...................................... 505

Test the Result ...................................................................................... 508

What Could Go Wrong? .................................................................... 509

How To Block Facebook ......................................................................... 510

Set Up the Content Filter on the ZyWALL/USG .................................. 511

Set Up the SSL Inspection on the ZyWALL/USG ................................. 511

Set Up the Security Policy on the ZyWALL/USG................................. 513

Export Certificate from ZyWALL/USG and Import it to Windows 7

Operation System ............................................................................... 514

Test the Result ...................................................................................... 519

What Could Go Wrong? .................................................................... 520

How To Exempt Specific Users From a Blocked Website ..................... 521

Set Up the Security Policy on the ZyWALL/USG for Employees ....... 522

Set Up the Security Policy on the ZyWALL/USG for Executives........ 524

Test the Result ...................................................................................... 527

What Could Go Wrong? .................................................................... 528

How To Control Access To Google Drive............................................... 529

Dieses Handbuch passt für folgende Modelle

Inhaltsverzeichnis

Andere ZyXEL Communications Netzwerk-Hardware Handbücher

ZyXEL Communications

ZyXEL Communications FTU2000 Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications FMG3010-R20A Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications GS1900 Series Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications ZyXEL ZyWALL P1 Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications FMG Series Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications UNS2300 Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications NSA-2401 Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications NSA-2400 Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications ZyAIR B-320 Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications Prestige 2602R Series Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications PLX-111 Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications UNS2300 Handbuch

ZyXEL Communications

ZyXEL Communications P-660HW-D1 Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications ZyWALL SSL 10 Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications NSA-220 Plus Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications IES-1248-51V Handbuch

ZyXEL Communications

ZyXEL Communications POE-12 Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications IES-6000 - ANNEXE 749 Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications VPN Series Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications POE-12 Referenzhandbuch

ZyXEL Communications

ZyXEL Communications NSA-220 Plus Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications Network Device P-2602 Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications WAP6405 Bedienungsanleitung

ZyXEL Communications

ZyXEL Communications IES-22A - Bedienungsanleitung

Beliebte Netzwerk-Hardware Handbücher anderer Marken

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Bedienungsanleitung

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Bedienungsanleitung

Yudor

Yudor YDS-16 Bedienungsanleitung

D-Link

D-Link ShareCenter DNS-320L Bedienungsanleitung

Samsung

Samsung ES1642dc Gebrauchsanweisung

Honeywell Home

Honeywell Home LTEM-PV Montageanleitung

evertz

evertz 7700 Series Bedienungsanleitung

D-Link

D-Link ShareCenter DNS-343 Bedienungsanleitung

Asante

Asante AsanteBridge 1012 Bedienungsanleitung

FireBrick

FireBrick FB2700 Bedienungsanleitung

Audiovox Electronics

Audiovox Electronics ARWH2T Bedienungsanleitung

ADC

ADC DSX-1 Handbuch

NetComm

NetComm NF2 Bedienungsanleitung

Alcatel-Lucent

Alcatel-Lucent 5620 Bedienungsanleitung

Dell EMC

Dell EMC XC6420 Series Bedienungsanleitung

Lanner

Lanner NCA-1020A Bedienungsanleitung

Allied Telesis

Allied Telesis AT-TN121-A Bedienungsanleitung

Lanner

Lanner NCA-1525 Bedienungsanleitung