ZyXEL Communications ADSL 2+ Security Gateway Instruction Manual

ZyXEL
Firmware Release Note
ZyWALL 2 Plus
Release 4.01(XU.0)
Date: October 16, 2006
Author: Keenboy Xu
Project Leader: Lorin Yeh

ZyXEL ZyWALL 2 Plus Standard Version
Release 4.01(XU.0)
Release Note
Date: October 16, 2006
Supported Platforms:
ZyXEL ZyWALL 2 Plus
Versions:
ZyNOS F/W Version: V4.01(XU.0) | 10/16/2006 19:03:59
BootBase: V1.11 | 07/12/2006 14:20:29
Notes:
1. Restore to Factory Defaults Setting Requirement: No
2. The setting of ignore triangle route is on in default ROMFILE. Triangle route
network topology has potential security crisis. If you are not clear about it, please
refer to Appendix for the triangle route issue.
3. IKE process in phase 2 will check ID information between system and the peer. If
you found that the IPSEC connection is failed, please check your settings.
4. Using Web to configure VPN, the phase 1 algorithms have been fixed to DES +
MD5. If other algorithms are preferred, please use ADVANCE page to configure
them.
5. When firewall turns from "off" to "on", the firewall initialization procedure will
disconnect all connections running through the ZyWALL.
6. SUA/NAT address loopback feature was enabled on ZyWALL by default;
however, if users do not need it, a C/I command "ip nat loopback off" could turn
it off.
7. When UPnP is on, and then reboot the router, Windows XP will not detect UPnP
and refresh “My Network PlacesÆLocal Network”. Plug in network wire again
can solve this problem.
8. In bridge mode, If LAN side DHCP clients want to get DHCP address from WAN
side DHCP server, you may need to turn on the firewall rule for BOOT_CLIENT
service type in WANÆLAN direction.
9. The first entry for static route is reserved for creating WAN default routes and is
READ-ONLY.
10. If you want traffic redirect feature to work, you should turn on WAN ping check
by "sys rn pingcheck 1".
11. The first entry for static route is reserved for creating WAN default route and is
READ-ONLY.
12. If you had activated content filtering service but the registration service state is
"Inactive"after upgrading to 4.00, please click "Service License Refresh" in
"eWC->REGISTRATION->Registration" or wait until device synchronize with

the myzyxel.com.
13. Support Vantage CNM -- revision 2.2.00.61.03
Known Issues:
[UPnP]
1. Sometimes on screen the “Local Area Connection” icon for UPnP disappears. The
icon shows again when restarting PC.
2. When you use MSN messenger, sometimes you fail to open special applications,
such as whiteboard, file transfer and video etc. You have to wait more than 3
minutes and retry these applications.
[Bandwidth Management]
1. Bandwidth management H.323 service does not support Netmeeting H.323
application.
2. Using BWM in PPPoE/PPTP mode, there are two filters for FTP and H323 ALG
(1) If we execute FTP first then H323 cannot pass through ZyWALL.
(2) If we execute H323 before FTP, all functions work properly.
3. In some cases, BWM (Fairness-Based mode) cannot manage bandwidth accurately.
Ex. In WAN interface, there are two subclasses for FTP service, their speed are
100Kbps and 500Kbps, the traffic match the filter which speed is 500Kbps may
only use half of it’s bandwidth.
[Content Filter]
1. Can’t blockActiveX in some case. (Sometime the ActiveX block fails. This is
because the ActiveX is cached in C:\WINNT\Downloaded Program Files\ If you
want to test the ActiveX block functionality. Please clear the cache in windows.)
[Bridge Mode]
1. When device boots in Bridge Mode, some CI command error messages will be
displayed on console. This is because some predefined CI commands in
autoexec.net is forbidden to execute in Bridge Mode.
2. Don’t use CI command “bridge rstp bridge enable” to enable RSTP, it will change
the initial Path Cost value to an incorrect value.
[ALG]
1. Symptom: P2002 can not connect with each other in Peer-to-Peer mode.
Condition:
Topology: P2002--(LAN)ZyWALL_A(WAN, IP=172.21.2.151)--(WAN,
IP=172.21.1.134)ZyWALL_B(LAN)--P2002
(1) In ZyWALL_A and ZyWALL_B, add a "WAN to LAN" firewall rule to pass
traffic with port "5060".
(2) In ZyWALL_A and ZyWALL_B, add a port forwarding rule "5060" to P2002.
(3) In ZyWALL_A and ZyWALL_B, enable SIPALG.
(4) Setup both P2002 to Peer-to-Peer mode.
(5) Making the SIP connection by P2002 will be failed.
(6) Turn off firewall in ZyWALL_A and ZyWALL_B, sometimes the connnection
can be built up if we dial from P2002 which is behind ZyWALL_A.
[MISC]
1. At SMT24.1, the collisions for WAN and LAN port are not really counted.
2. Under PPTP encapsulation mode, we can not access some website like
http://www.kimo.com.tw/
3. In eWC->Statistics, Tx data for Dial Backup is not correct.

4. Symptom: PC can't ping remote gateway through VPN tunnel under this special
topology.
Condition:
PC------LAN ZyWALL_A WAN-----------------LAN ZyWALL_B
WAN-------Internet
(192.168.1.33）（192.168.100.33）(192.168.100.1) （172.202.77.145)
(1) VPN configuration in ZyWALL_A:
WAN IPAddress=192.168.100.33，WAN IP Subnet Mask=255.255.255.0，
Gateway IPAddress=192.168.100.1.
Gateway policy，Name=IKE1，Remote Gateway Address=192.168.100.1，
Pre-Shared Key=12345678.
Network policy for IKE1，Active=enable，Name=IPSec1，Local Network/Starting
IPAddress=192.168.1.33，Remote Network/Starting IPAddress=0.0.0.0
(2) VPN configuration in ZyWALL_B
WAN IPAddress=172.202.77.145，WAN IP Subnet Mask=255.255.0.0，Gateway
IPAddress=172.202.77.1.
Gateway policy，Name=IKE1，Remote Gateway Address=192.168.100.33，
Pre-Shared Key=12345678.
Network policy for IKE1，Active=enable，Name=IPSec1，Local Network/Starting
IPAddress=0.0.0.0，Remote Network/Starting IPAddress=192.168.1.33.
(3) When we established the VPN tunnel between ZyWALL_A and ZyWALL_B,
we can access ZyWALL_B (192.168.100.1) with the remote management,
such as Telnet, FTP…, this traffic will go through VPN tunnel. However, we can
not ping ZyWALL_B (192.168.100.1) successfully because this ICMP traffic
did not go through VPN tunnel to ZyWALL_B.
[CNM]
1. DES/3DES encryption key doesn’t unique.
2. The 2 check boxes “Log” and “Block” of Matched Web Pages can’t be disabled
on Content Filter/ Categories page when Schedule to Block has set time interval
on Content Filter/General page.
3. Vantage GUI misses to show the NetBIOS port, 445 in Firewall “W2L_Rule_2”
default rule.
4. [Symptom] Device will crash, when Vantage set Dial Back Fixed IP in the same
subnet with WAN to device.
[Condition]
(1). Let device register to Vantage.
(2). Vantage set Dial Backup to enable.
(3). Vantage set Dial Backup Fixed IP in the same subnet as WAN to device.
(4). Device will crash after writing above settings.
5. Change NAT mode from “SUA” to “Full Feature”, device will create 2 address
mapping rules automatically but Vantage Server will not.
6. Vantage and Agent are not consistent at VPN/IPSec/Protocol field. Vantage is a
dropdown list with “Any”, “ICMP”, “TCP”, “UDP” selections and Agent is a
0~999 value range.
7. Vantage and Agent are not consistent at Firewall rule’s log. Vantage has 4
selections “None”, “Match”, “Not-Match”, “Both”. Agent has only a check box.
8. Firewall Default Action can’t select “Permit”, “Drop” and “Reject” via Vantage.
9. Firewall name can’t display on Firewall page on Vantage GUI.

10. Some pre-define custom service can’t add to firewall rule when configure from
Vantage. For example: AX.25, IPv6, VNC, NTP and so on.
11. The “Mail Sender” field on device/Log settings page hasn’t implement on Vantage
side.
12. [Symptom] Mbuf double free when add firewall rules by using CI commands.
[Condition]
(1). On SMT 24.8, configure firewall rules by using CI commands.
(2). Add DMZ to LAN rule and DUT crashed.
(3). It couldn't be reproduced.
13. [Symptom] Test Bandwidth Manager a period of time, PPTP will be dropped and
reconnected.
[Condition]
PC--- (Lan) DUT (PPTP) ---- PQAlab (192.168.10.X)
(1). Set Encapsulation = PPTP.
(2). Edit web eWC/Firewall/Rule Summary，Packet Direction=WAN to LAN，edit
rule 1，Selected Service(s) = *H.323 (TCP：1720)
(3). Edit web eWC/NAT/Port Forwarding，WAN Interface=WAN1，
index1/Active=enable，Name=H323，Incoming Port(s)=1720-1720，Server IP
Address=192.168.1.33
(4). Edit web eWC/BW MGMT，WAN1/Active=enable，WAN1/Speed
(kbps)=1000，Scheduler=Fairness-Based
(5). Edit web eWC/BW MGMT/Class Setup，Interface=WAN，Add Sub-Class，
Class Name=Custom，Bandwidth Budget=200，Priority=2，Enable Bandwidth
Filter= enable，Service= Custom.
(6). Edit web eWC/BW MGMT/Class Setup，Interface=WAN，Add Sub-Class，
Class Name=FTP，Bandwidth Budget=200，Priority=3，Enable Bandwidth Filter=
enable.
(7). Edit web eWC/BW MGMT/Class Setup，Interface=WAN，Add Sub-Class，
Class Name=H323，Bandwidth Budget=200，Priority=5，Enable Bandwidth
Filter=enable，Service=H.323
(8). Edit web eWC/BW MGMT/Class Setup，Interface=WAN，Add Sub-Class，
Class Name=SIP，Bandwidth Budget=200，Priority=7，Enable Bandwidth
Filter=enable，Service=SIP
(9). Edit web eWC/BW MGMT/Class Setup，Interface=WAN1，move filter 4 to
filter 1.
(10). Edit web eWC/BW MGMT/Class Setup，Interface=WAN1，move filter 4 to
filter 2.
(11). Edit web eWC/BW MGMT/Class Setup，Interface=WAN1，move filter 4 to
filter 3.
(12). FTP upload file from 192.168.1.33 to PQA lab.
(13). Use “TfGen” application to send UDP packet/ 500kbps from 192.168.1.33 to
PQA Lab.
(14). Call Netmeeting (OpenH323) from 192.168.1.34 to 192.168.10.101 and send
voice packet.
(15). Make a SIP phone call from 192.168.1.33 to 192.168.10.100 and send voice
packet.
(16).After a period of time, PPTP will be dropped and reconnected.

14. [Symptom] Block ActiveX & Java Applet via IPSec tunnel fails.
[Condition]
HQ and branch office application scenario
PC1------------Branch_1(ZW2+)-----------HQ(ZW2+)----------Branch_2(ZW35)----
(192.168.2.0) (192.168.1.0)
----------PC2
(192.168.4.0)
DUT1 (HQ)
(1). Register CF service; Enable Content Filter and Content Filter for traffic that
matches IPSec Policy.
(2). CF service blocks "ActiveX, Java Applet, Cookies and Web Proxy".
(3). Edit Denied Access Message & Redirect URL.
(4). Edit web eWC/VPN，add gateway policy，Name=IKE1，Remote Gateway
Address=0.0.0.0，Pre-Shared Key=12345678
(5). Edit web eWC/VPN，add network policy for IKE1，Active=enable，
Name=IPSec1，Local Address Type=Single，Local Network/Starting IP
Address=0.0.0.0，Remote Address Type=Single，Remote Network/Starting IP
Address=0.0.0.0
DUT2 (Branch_1，LAN=192.168.2.0)
(1). Edit web eWC/VPN，add gateway policy，Name=IKE1，Remote Gateway
Address=DUT1 WAN IP address，Pre-Shared Key=12345678
(2). Edit web eWC/VPN，add network policy for IKE1，Active=enable，
Name=IPSec1，Local Address Type=Subnet，Local Network/Starting IP
Address=192.168.2.0，Local Network/End IP Address=255.255.255.0，Remote
Address Type=Single，Remote Network/Starting IP Address=0.0.0.0
Result:
(1). PC1 can't http http://dob.tnc.edu.tw/themes/old/showPage.php?s=152&t=5
with Java Applet example and there is blocked log on DUT1. But there is no
"Denied Access Message" and can't redirect to configured URL.
(2). Setup same configuration on Branch_2 (ZW35). PC2 can't http
http://dob.tnc.edu.tw/themes/old/showPage.php?s=152&t=5 with Java Applet
example and there is blocked log on DUT1. There is "Denied Access Message"
and can redirect to configured URL.
Features:
Modifications in V 4.01(XU.0) | 10/16/2006
1. Formal Release.
Modifications in V 4.01(XU.0)b4 | 10/11/2006
1. [BUG FIX]
Symptom: There is not the help page for IPSec_PortForw_Server.html.
Condition:
1) SECURITY>>VPN, add Gateway Policy.
2) Add Network Policy.
3) Active check box “active” of Virtual Address Mapping Rule.

4) Select Type of Virtual Address Mapping Rule “Many-to-One”.
5) Click button “Port Forwarding Rules”, then click help page.
6) There is not the help page.
2. [BUG FIX]
Symptom: Some information on eWc/Home page is different from ZW5 4.01
Condition:
1) There is on MAC address on System Information. They are moved to
Interfaces and add DMZ/WLAN/WAN MAC address on eWC/Home.
2) Home/System Information/Firmware Version can’t link to maintenance/F/W
Upload Page.
3) Home/Security services/Content Filter Expiration can’t link to
Registration/Service page.
4) Home/Up Time clock is not real-time.
Modifications in V 4.01(XU.0)b3 | 09/23/2006
1. [BUG FIX]
Symptom: LAN DHCP pool size is 128
Condition:
LAN DHCP pool size is 128, it should be 32 according to PS.
2. [BUG FIX]
Symptom: Default romfile is incorrect for DMZ and WLAN in BW
MGMT>>Class Setup page.
Condition:
1) Click BW MGMT->Class Setup page.
2) Select DMZ or WLAN interface.
3) It displays the “Root Class: 0 kbps” in the middle of this page, it is incorrect
and should be “Root Class: 100000 kbps”.
3. [BUG FIX]
Symptom: There are two error title “ZyWALLZyWALLZyWALLLAN” on help
page.
Condition:
1) eWC->NETWORK->LAN->HELP page
2) Help page displays incorrect title “ZyWALLZyWALLZyWALLLAN” instead
of “LAN”.
4. [BUG FIX]
Symptom: Default setting is inconsistent with ZW5
Condition:
1) eWC/Firewall/Threshold/TCP Maximum Incomplete.
ZW2+: 10 ZW5: 30
2) eWC/NAT/Max.Concurrent Sessions Per Host:
ZW2+: 2048 ZW5: 3000.
3) ZW5 has not the following items on eWC/WAN/Dial Backup page
Remote IP Subnet Mask
Remote Node IPAddress
4) eWC/MAINTENANCE/Time and Date/Time Server Address
ZW2+: a.ntp.alphazed.net ZW5: 0.pool.ntp.org.
5) eWC/Firewall/Default Rule:
Default firewall rule LAN to DMZ should be no log.
Default firewall rule WAN to DMZ should be no log.

5. [ENHANCEMENT]
Symptom: Device can accept the blank password of login user.
Condition:
Device can accept the blank password of login user. For example: eWC/
MAINTENANCE/Password, input Old password and let New password and
Retype to Confirm items blank, new password can be applied and it is blank.
Modifications in V 4.01(XU.0)b2 | 09/13/2006
1. [BUG FIX] 060810724
Symptom: Default WLAN firewall rules directions are different from ZW5 V4.01.
Condition:
1) ZW5: LAN to WLAN is Permit with no log , but ZW2 Plus is Drop with log.
2) ZW5: WAN to WLAN is Drop with log, but ZW2 Plus is Permit with no log.
3) ZW5: DMZ to WAN with no log, but ZW2 with log.
4) Based on security, please follow ZW5 behavior.
2. [BUG FIX] 060810725
Symptom: NTP server on LAN sometime will fail without logs when WAN is
disconnected and click sync fail.
Condition:
1) Disconnect WAN interface.
2) To Configure a Time Server Address (ex: 192.168.11.4) which is on LAN port
(192.168.11.70) and click Synchronize Now. If it fails and there is no failed log on
Log page. If it succeed, and there is a log on Log page.
3) This is beta user reported issue and we can reproduce it.
3. [BUG FIX] 060810726
Symptom: Default SNMP Configuration can't be applied.
Condition:
1) Reset DUT.
2) On eWC/ADVANCED/REMOTE MGMT/SNMP, click Apply.
3) It failed and Status show "Invalid IP address".
4) Trap's Destination can't be configured to 0.0.0.0.
4. [BUG FIX] 060810712
Symptom: "System Resources" picture bar can not appeared on HOME page when
using Mozilla Firefox browser.
Condition:
"System Resources" picture bar can not appeared on HOME page when using
Mozilla Firefox browser.(my version v1.5.0.6).
5. [BUG FIX] 060810690
Symptom: CF Denied Access Message and Redirect URL have not limit special
character, it will cause DUT crash.
Condition:
1) eWC CF, Denied Access Message or Redirect URL input %s%s%s and apply,
DUT will be crash.
2) Attached file is crash dump.
3) It is a common bug.
4) It has another security issue, if input a script, like as <script>alert ('XSS
Vulnerability') </script>, when user browsing internet and CF blocked it. The
Denied Access Message will show block message, and then user browser will be

run that script show "XSS Vulnerability" message box. This is like as XSS
vulnerability issue.
Note: Step 4 is decided by administrator. Currently it is not controlled.
6. [BUG FIX] 060811833
Symptom: Message to display when a site is blocked failed but there are web sites
blocked log on log page.
Condition:
1) Register and enable content filter.
2) On Message to display when a site is blocked, edit Denied Access Message to
kkkkkkkkkk and Redirect URL to tw.yahoo.com.
3) On Categories, Select All Categories.
4) Open www.gamble.com on PC and the website can't be opened. There is no
blocked message appeared and don't redirect website to tw.yahoo.com.
5) There is a web site blocked log on log page showed
"www.gameble.com:Gambling 192.168.1.33:4368 198.173.81.173:80 WEB
BLOCK"
7. [BUG FIX] 060814876
Symptom: CERTIFICATES log url page can not found.
Condition:
1) CERTIFICATES error log like as "2006-08-14 15:59:43 Due to error code(10),
cert noRecv:[ID][CER][SIG][NOTFY:INIT_CONT567A6AFE CERT
MANAGER", the url at "code(10)".
2) Click this url will be redirect to http://DUT IP/h_Certificate_Code.html, but
this page can not found.
8. [BUG FIX] 060814878
Symptom: Bridge mode VPN "Adjust TCP Maximum Segment Size" can not
work.
Condition:
1) DUT1 in bridge mode, create a VPN1 rule.
2) VPN Global Setting Adjust TCP Maximum Segment Size=1000.
3) DUT2 in router mode, Create a VPN2 rule.
4) Ftp from DUT2 PC2 (ftp client) to DUT1 PC1 (ftp server).
5) Sniffer package, always show ftp data size is 536 bytes.
9. [BUG FIX] 060815943
Symptom: Bandwidth Management's Number of classes can not add to 10 rules.
Condition:
1) Bandwidth Management's Number of classes can not add to 10 rules, it just can
add 9 rules.
2) And then edit anyone rule click apply, GUI will be show message of "Number
of classes reaches the upper bound" and can not save rule.
10. [BUG FIX] 060817043
Symptom: The difference between ZW5/35/70 v4.01 and ZW2 Plus
Condition:
1) LAN/DMZ/WAN/Windows Networking(NetBIOS over TCP/IP)
2) LAN/DMZ/Static DHCP: MAC format is 00:00:00:00:00:01, ZW5:
000000000001
3) Firewall/Service/Custom Service, ZW2 Plus no default settings.
4) VPN/Global Setting, VPN rules skip applying to the overlap range of local and
remote IP addresses default is disable on ZW5.
5) BWM/Edit Class/ Filter Configuration/Custom/Destination Port &Source Port

can set Start port to End port on ZW5.
6) SMT WLAN Zone is different
11. [BUG FIX] 060817054
Symptom: ZW2 Plus V4.01(XU.0)b1 behind the zywall 35 (V4.01) ip alias, VPN
tunnel can not work.
Topology:
pc1---(L)zw2-1(W)---(L)zw35(L)---(W)zw2-2(L)---pc2
zw35 lan ip:
ip alias1:10.10.10.1
ip alias2:172.172.172.1
zw2-1 wan ip:10.10.10.200 (bridge mode)
pc1 ip:10.10.10.100
zw2-2 wan ip:172.172.172.200 (route mode)
pc2 ip:192.168.1.33
Condition:
1) Create a VPN rule on zw2-1 and zw2-2.
2) Pc1 ping pc2 and triggered this VPN rule.
3) VPN tunnel will be connected but pc1 ping or ftp to pc2 fail.
12. [ENHANCEMENT]
Add ci command for WAN port Ethernet speed. Steps are the following:
1) ether edit load
2) load <ether no(1:lan).>
3) ether edit load 2
4) ether edit speed (speed <auto|10/half|10/full|100/half|100/full>)
5) ether edit speed auto
6) ether edit save
13. [ENHANCEMENT]
Microsoft cryptographic library supports only odd-sized keys for generating the
RSA-modulus.
Let the key number of creator primes be odd-size.
14. [BUG FIX]
Symptom: Import certificate fail.
Condition:
1) Goto eWC>SECURITY>CERTIFICATES>My Certificates page, export the
ZyWALL's self-signed auto_generated_self_signed_cert certificate in PKCS#12
format.
2) Import the same certificate file to ZyWALL. The ZyWALL will show the
error message "The certificate name cannot be blank".
15. [ENHANCEMENT]
Add PKCS12 for ZyNOS.
16. [ENHANCEMENT]
Add second time schedule setting in content filtering.
17. [BUG FIX]
Symptom: Device crashes because of memory double free in Content Filter.
Condition:
1) Enable Content Filter and Web site customization.
2) After a while, the device will crash sometimes.
18. [ENHANCEMENT]
Enhance the CI command "ip ifconfig".

1) Add a new argument "mss" to configure the MSS value.
2) After finishing the configuration, the interface information will be displayed.
Usage: ip ifconfig [iface] [ipaddr</mask bits>] <broadcast [addr]> <mtu [value]>
<mss [value]> <dynamic> <showoff>
Ex: ip ifconfig enif1 192.168.70.222/24 broadcast 192.168.70.250 mtu 1500 mss
1460.
19. [BUG FIX]
Symptom: The packet will be dropped if the device does not have the ARP entry
of the receiver of this packet.
Condition:
1) Clear ARP table by "CI>ip arp flush".
2) Send a ping to 168.95.1.1, but the PC will not get a response in the first ICMP
Echo Request.
3) After the first ping, the rest of pings can get responses.
Modifications in V 4.01(XU.0)b1 | 08/08/2006
1. Based on V4.00(XU.2)C0, first release.
Main changes:
1) add DMZ/WLAN zone interface
2) upgrade concurrent active vpn tunnel number to 5 (originally 2)
3) upgrade port forwarding entry number to 20
4) add Firewall/BWM/CF/NAT over IPSec
5) add 4.01 uniform home page
6) add TR069 enhancement

Appendix 1 Remote Management Enhancement (Add SNMP & DNS
Control)
New function
(1) You can change the server port.
(2) You can set the security IP address for each type of server.
(3) You can define the rule for server access. (WAN only/LAN only, None, ALL).
(4) The secure IP and port of the SNMP server is read only
(5) The port of the SNMP and DNS server is read only.
(6) The default server access of the SNMP and DNS is ALL.
Modification
(1) The default value for Server access rule is ALL.
(2) Under the default setting: You can setup the Menu 15 to forwarding the server to
LAN IP address. Thus you can configure the router through the WAN and you
don’t need to modify the server management or filter.
Menu 24.11 - Remote Management Control
TELNET Server: Port = 23 Access = ALL
Secured Client IP = 0.0.0.0
FTP Server: Port = 21 Access = ALL
Secured Client IP = 0.0.0.0
Web Server: Port = 80 Access = ALL
Secured Client IP = 0.0.0.0
SNMP server: Port = 161 Access = ALL
Secured Client IP = 0.0.0.0
DNS server: Port = 53 Access = ALL
Secured Client IP = 0.0.0.0
Press ENTER to Confirm or ESC to Cancel:

Appendix 2 Trigger Port
Introduction
Some routers try to get around this "one port per customer" limitation by
using "triggered" maps. Triggered maps work by having the router watch
outgoing data for a specific port number and protocol. When the router finds a
match, it remembers the IP address of the computer that sent the matching
data. When the requested data wants to come back in through the firewall, the
router uses the port mapping rules that are linked to the trigger, and the IP
address of the computer that "pulled" the trigger, to get the data back to the
proper computer.
These triggered events can be timed so that they erase the port mapping
as soon as they are done with the data transfer, so that the port mapping can be
triggered by another Client computer. This gives the illusion that multiple
computers can use the same port mapping at the same time, but the computers
are really just taking turns using the mapping.
How to use it Following table is a configuration table.
Name Incoming Trigger
Napster 6699 6699
Quicktime 4 Client 6970-32000 554
Real Audio 6970-7170 7070
User 1001-1100 1-100
How it works
For example, you are running a FTP Server on port 21 of machine A. And
you may want this server accessible from the Internet without enabling
NAT-based firewall. There are one Web Server on port 80 of machine B and
another client C on the Internet.
(1) As Prestige receives a packet from a local client Adestined for the outside Internet
machine B, it will check the destination port in the TCP/UDP header to see if it
matches the setting in "Trigger Port" (80). If it matches, Prestige records the
source IP of A (192.168.1.33) in its internal table.
(2) Now client C (or client B) tries to access the FTP server in machine A. When
Prestige to forward any un-requested traffic generated from Internet, it will first
check the rules in port forwarding set. When no matches are found, it will then
check the "Incoming Port". If it matches, Prestige will forward the packet to the
recorded IP address in the internal table for this port. (This behavior is the same as

we did for port forwarding.)
(3) The recorded IP in the internal table will be cleared if machine A disconnect from
the sessions that matches the "Trigger Port".
Notes
(1) Trigger events can't happen on data coming from outside the firewall because the
NAT router's sharing function doesn't work in that direction.
(2) Only one computer can use a port or port range at a time on a given real (ISP
assigned) IP address.

Appendix 3 Hard-coded packet filter for "NetBIOS overTCP/IP" (NBT)
The new set C/I commands is under "sys filter netbios" sub-command. Default values
of any direction are “Forward”, and trigger dial is “Disabled”.
There are two CI commands:
(1) "sys filter netbios disp": It will display the current filter mode.
Example ouput:
=============== NetBIOS Filter Status ===============
LANtoWAN: Block
WANtoLAN: Forward
IPSecPackets: Forward
TriggerDial: Disabled
(2) "sys filter netbios config <type> {on|off}": To configure the filter mode for each
type.
Current filter types and their description are:
Type Description Default mode
0 LAN to WAN Forward
1 WAN to LAN Forward
6 IPSec pass through Forward
7 Trigger dial Disabled
Example commands:
sys filter netbios config 0 on => block LAN to WAN NBT packets
sys filter netbios config 1 on => block WAN to LAN NBT packets
sys filter netbios config 6 on => block IPSec NBT packets
sys filter netbios config 7 off => disable trigger dail

Appendix 4 Traffic Redirect/Static RouteApplication Note
Why traffic redirect/static route be blocked by ZyWALL
ZyWALL is the ideal secure gateway for all data passing between the Internet
and the LAN. For some reasons (load balance or backup line), users want traffics be
re-routed to another Internet access devices while still be protected by ZyWALL. The
network topology is the most important issue. Here is the common example that
people misemploy the LAN traffic redirect and static route.
Figure 4-1 Triangle Route
Figure 5-1 indicates the triangle route topology. It works fine with turn off
firewall. Let’s take a look into the perspective toward this situation.
Step 1. PC sends outgoing traffics through ZyWALL because default gateway
assigned to it.
Step 2. Then, ZyWALL will redirect the traffics to another gateway (ISDN/Router) as
we expect.
Step 3. But the return traffics do not go through ZyWALL because the gateway (say,
P201) and the PC are on the same IP network. Any traffic will easily inject
into the protected network area through the unprotected gateway.
Step 4. When firewall turns on, it could be worse. ZyWALL will check the outgoing
traffics by ACL and create dynamic sessions to allow legal return traffics. For
Anti-DoS reason, ZyWALL will send RST packets to the PC and the peer
because it never received TCP SYN/ACK packet.
That causes all of outgoing TCP traffics being reset!
How traffic redirect/static route works under protection - Solutions
(1) Gateway on alias IP network
IP alias allows you to partition a physical network into different logical IP
networks over the same Ethernet interface. The ZyWALL supports three logical LAN
interfaces via its single physical Ethernet interface with the ZyWALL itself as the
gateway for each LAN network. Division of protected LAN and the other gateway
into different subnets will trigger the incoming traffic back to ZyWALL and it can
work as normal function.

Figure 4-2 Gateway on alias IP network
(2) Gateway on WAN side
A working topology is suggested as below.
Figure 4-3 Gateway on WAN side

Appendix 5 IPSec FQDN support
ZyWALLA-------------Router C (with NAT) ------------ZyWALL B
(WAN) (WAN) (LAN) (WAN)
If ZyWALL A wants to build a VPN tunnel with ZyWALL B by passing through
Router C with NAT, A can not see B. It has to secure gateway as C. However,
ZyWALL B will send it packet with its own IP and its ID to ZyWALL A. The IP will
be NATed by Router C, but the ID will remain as ZyWALL B sent.
In FQDN design, all three types, IP, DNS, E-Mail, can set ID content. For ID type
is DNS or E-mail, the behavior is simple. ZyWALL A and ZyWALL B only checks
the ID contents are consistent and they can connect.
Basically the story is the same when ID type is IP. If user configures ID content,
then ZyWALL will use it as a check. So the ID content also has to match each other.
For example, ID type and ID content of incoming packets must match “Peer ID Type”
and “Peer ID content”. Or ZyWALL will reject the connection.
However, user can leave “ID content” blank if the ID type is IP. ZyWALL will put
proper value in it during IKE negotiation. This appendix describes all combinations
and behaviors of ZyWALL.
We can put all combinations in to these two tables:
(Local ID Type is IP):
Configuration **Run-timestatus
My IPAddr Local ID Content My IP
Addr Local ID Content
0.0.0.0 *blank or 0.0.0.0 My WAN
IP My WAN IP
0.0.0.0 a.b.c.d (NOT
0.0.0.0) My WAN IP a.b.c.d
a.b.c.d (not
0.0.0.0) *blank or 0.0.0.0 a.b.c.d a.b.c.d
a.b.c.d (not
0.0.0.0) e.f.g.h (NOT 0.0.0.0) a.b.c.d e.f.g.h
*Blank: User can leave this field as empty, doesn’t put anything here.
**Runtime status: During IKE negotiation, ZyWALL will use “My IPAddr” field as
source IP of IKE packets, and put “Local ID Content” in the ID payload.
(Peer ID Type is IP):
Configuration
Secure
Gateway
Addr
Peer ID
Content *Run-time check
0.0.0.0 Blank or
0.0.0.0 Just check ID types of incoming packet and machine’s peer ID type. If the peer’s ID is

IP, then we accept it.
0.0.0.0 a.b.c.d
(NOT
0.0.0.0)
System checks both type and content
a.b.c.d Blank 1. System will check the ID type and the
content.
2. The contents will match only if the ID
content of coming packet is a.b.c.d because
system will put Secure Gateway Address as
Peer ID content.
a.b.c.d e.f.g.h 1. System will check the ID type and the
content.
2. The contents will match only if the ID
content of coming packet is e.f.g.h.
*Runtime Check: During IKE negotiation, we will check ID of incoming packet and
see if it matches our setting of “Peer ID Type” and “Peer ID Content”.
Summary:
1. When Local ID Content is blank or 0.0.0.0, during IKE negotiation, my ID
content will be “My IPAddr” (if it’s not 0.0.0.0) or local’s WAN IP.
2. When “Peer ID Content” is not blank or 0.0.0.0, ID of incoming packet has to
match our setting. Or the connection request will be rejected.
3. When “Secure Gateway IP Addr” is 0.0.0.0 and “Peer ID Content” is blank or
0.0.0.0, system can only check ID type. This is a kind of “dynamic rule” which
means it accepts incoming request from any IP, and these requests’ ID type is IP.
So if user put such a kind of rule in top of rule list, it may be matched first. To
avoid this problem, we will enhance it in the future.

Appendix 6 DNS servers for IPSec VPN Note
DNS Domain Names
DNS (Domain Name System), a system for naming computers and network
services that is organized into hierarchy of domain. DNS services provided by the
DNS server can resolve the name to other information associated with the name, such
as an IP address. The ZyWALL can be configured as a DHCP server. For most cases,
your computer connected to the LAN of the ZyWALL can get IP settings (IP address,
network mask, gateway address and DNS server address) from the ZyWALL DHCP
server automatically.
There are three ways the ZyWALL’s DHCP server assigns DNS servers
addressed to its DHCP client computers.
(1) If the administrator has setup DNS servers on the ZyWALL’s DHCP setting, the
ZyWALL will tell the client those DNS server addresses.
(2) If the DNS server has not been setup on the ZyWALL DHCP server, but the
ZyWALL has gotten the public DNS servers from the ISP; the ZyWALL will
assign those public DNS servers address.
(3) The ZyWALL gives its own LAN IP address and acts as a DNS server proxy.
But the above are not enough for IPSec VPN applications.
How to access the private network by using domain names
On the IPSec VPN application, the user on the LAN of the ZyWALL, wants to
access remote private networks. He must use the IP address to identify the
remote site he wants to access. But at the modern intranet applications, we still
want to have the DNS service for private network access. For example, there
is a private Web server installed at the headquarters of your computer. You can
access this Web server inside your company, or from your home by way of the
ZyWALL’s IPSec tunnel. The IP address of the private Web server is also
private. You can’t use the Internet public DNS servers to resolve those domain
names that belong to your company’s private network. You must setup those
private DNS servers on your computer manually if you want to access the
private network by using domain names.
ZyWALL DNS Servers for IPSec VPN
The ZyWALL has added DNS Server on each IPSec policy setup. When you setup
the IPSec rule, you can give the DNS server if there exists a DNS Server that provides
DNS service for this private network. The DHCP client (on ZyWALL’s LAN)
requests the IP information from your ZyWALL, the ZyWALL assigns additional
DNS servers for IPSec VPN to the client, if the assigned IP address belongs to the
range of local addresses of the IPSec rule.