ZyXEL Communications ZyWALL 1050 Instruction Manual

www.zyxel.com
ZyWALL (ZLD)
CLI Reference Guide
Version 2.00
7/2007
Edition 1
DEFAULT LOGIN
LAN Port 1
IP Address http://192.168.1.1
User Name admin
Password 1234

About This User's Guide
ZyWALL (ZLD) CLI Reference Guide 3
About This User's Guide
This manual is designed to guide you through the configuration of your ZLD-based ZyWALL
for its various applications using the CLI (Command Line Interface). Generally, it is organized
by feature as outlined in the web configurator.
"See the web configurator User’s Guide for related information on all features.
Intended Audience
This manual is intended for network administrators, or people who have a good knowledge of
TCP/IP networking concepts and topology, who want to want to configure the ZyWALL using
the CLI.
1Read Chapter 1 on page 13 for how to access and use the CLI (Command Line
Interface).
2Read Chapter 2 on page 29 to learn about the CLI user and privilege modes.
3Subsequent chapters are arranged by menu item as defined in the web configurator. Read
each chapter carefully for detailed information on that menu item.
Related Documentation
• Supporting Disk
Refer to the included CD for support documents.
• Quick Start Guide
The Quick Start Guide is designed to help you get up and running right away. It contains a
detailed easy-to-follow connection diagram, default settings, handy checklists and
information on setting up your network and configuring for Internet access.
• Configuration Reference Card
See this handy reference card to see what prerequisites are needed to configure a feature
and how to use this feature in the ZyWALL.
• User’s Guide
The User’s Guide explains how to use the web configurator to configure the ZyWALL.
"Some features cannot be configured in both the web configurator and CLI.
• Web Configurator Online Help
Embedded web help for descriptions of individual screens and supplementary
information.
• ZyXEL Web Site

About This User's Guide
ZyWALL (ZLD) CLI Reference Guide
4
Please go to http://www.zyxel.com for product news, firmware, updated documents, and
other support materials.
User Guide Feedback
Help us help you. Send all User Guide-related comments, questions or suggestions for
improvement to the following address, or use e-mail instead. Thank you!
The Technical Writing Team,
ZyXEL Communications Corp.,
6 Innovation Road II,
Science-Based Industrial Park,
Hsinchu, 300, Taiwan.
E-mail: [email protected]

Document Conventions
ZyWALL (ZLD) CLI Reference Guide 5
Document Conventions
Warnings and Notes
These are how warnings and notes are shown in this User’s Guide.
1Warnings tell you about things that could harm you or your device.
"Notes tell you other important information (for example, other things you may
need to configure or helpful tips) or recommendations.
Syntax Conventions
• The ZLD-based ZyWALL may be referred to as the “ZyWALL”, the “device”, the
“system” or the “product” in this User’s Guide.
• Product labels, screen names, field labels and field choices are all in bold font.
• A key stroke is denoted by square brackets and uppercase text, for example, [ENTER]
means the “enter” or “return” key on your keyboard.
• “Enter” means for you to type one or more characters and then press the [ENTER] key.
“Select” or “choose” means for you to use one of the predefined choices.
• A right angle bracket ( > ) within a screen name denotes a mouse click. For example,
Maintenance > Log > Log Setting means you first click Maintenance in the navigation
panel, then the Log sub menu and finally the Log Setting tab to get to that screen.
• Units of measurement may denote the “metric” value or the “scientific” value. For
example, “k” for kilo may denote “1000” or “1024”, “M” for mega may denote “1000000”
or “1048576” and so on.
• “e.g.,” is a shorthand for “for instance”, and “i.e.,” means “that is” or “in other words”.

Document Conventions
ZyWALL (ZLD) CLI Reference Guide
6
Icons Used in Figures
Figures in this User’s Guide may use the following generic icons. The ZyWALL icon is not an
exact representation of your device.
ZyWALL Computer Notebook computer
Server Firewall Telephone
Switch Router

Safety Warnings
ZyWALL (ZLD) CLI Reference Guide 7
Safety Warnings
1For your safety, be sure to read and follow all warning notices and instructions.
• Do NOT use this product near water, for example, in a wet basement or near a swimming
pool.
• Do NOT expose your device to dampness, dust or corrosive liquids.
• Do NOT store things on the device.
• Do NOT install, use, or service this device during a thunderstorm. There is a remote risk
of electric shock from lightning.
• Connect ONLY suitable accessories to the device.
• Do NOT open the device or unit. Opening or removing covers can expose you to
dangerous high voltage points or other risks. ONLY qualified service personnel should
service or disassemble this device. Please contact your vendor for further information.
• Make sure to connect the cables to the correct ports.
• Place connecting cables carefully so that no one will step on them or stumble over them.
• Always disconnect all cables from this device before servicing or disassembling.
• Use ONLY an appropriate power adaptor or cord for your device. Connect it to the right
supply voltage (for example, 110V AC in North America or 230V AC in Europe).
• Do NOT allow anything to rest on the power adaptor or cord and do NOT place the
product where anyone can walk on the power adaptor or cord.
• Do NOT use the device if the power adaptor or cord is damaged as it might cause
electrocution.
• If the power adaptor or cord is damaged, remove it from the device and the power source.
• Do NOT attempt to repair the power adaptor or cord. Contact your local vendor to order a
new one.
• Do not use the device outside, and make sure all the connections are indoors. There is a
remote risk of electric shock from lightning.
• CAUTION: RISK OF EXPLOSION IF BATTERY (on the motherboard) IS REPLACED
BY AN INCORRECT TYPE. DISPOSE OF USED BATTERIES ACCORDING TO
THE INSTRUCTIONS. Dispose them at the applicable collection point for the recycling
of electrical and electronic equipment. For detailed information about recycling of this
product, please contact your local city office, your household waste disposal service or the
store where you purchased the product.
• Do NOT obstruct the device ventilation slots, as insufficient airflow may harm your
device.
This product is recyclable. Dispose of it properly.

Safety Warnings
ZyWALL (ZLD) CLI Reference Guide
8

Contents Overview
ZyWALL (ZLD) CLI Reference Guide 9
Contents Overview
Introduction ............................................................................................................................11
Command Line Interface ........................................................................................................... 13
User and Privilege Modes ......................................................................................................... 29
Status ........................................................................................................................................ 33
Registration ............................................................................................................................... 37
Network ...................................................................................................................................45
Interfaces ................................................................................................................................... 47
Trunks ........................................................................................................................................ 65
Route ......................................................................................................................................... 69
Routing Protocol ........................................................................................................................ 75
Zones ......................................................................................................................................... 79
DDNS ........................................................................................................................................ 83
Virtual Servers ........................................................................................................................... 85
HTTP Redirect ........................................................................................................................... 87
ALG ........................................................................................................................................... 89
Firewall and VPN ....................................................................................................................91
Firewall ...................................................................................................................................... 93
IPSec VPN ................................................................................................................................. 99
SSL VPN ................................................................................................................................. 107
L2TP VPN .................................................................................................................................111
Application Patrol & Anti-X .................................................................................................119
Application Patrol ..................................................................................................................... 121
Anti-Virus ................................................................................................................................. 129
IDP Commands ....................................................................................................................... 137
Content Filtering ...................................................................................................................... 155
Device HA & Objects ...........................................................................................................165
Device HA ................................................................................................................................ 167
User/Group .............................................................................................................................. 171
Addresses ................................................................................................................................ 177
Services ...................................................................................................................................181
Schedules ................................................................................................................................ 185
AAA Server .............................................................................................................................. 187
Authentication Objects ............................................................................................................. 193

Contents Overview
ZyWALL (ZLD) CLI Reference Guide
10
Certificates ............................................................................................................................... 195
ISP Accounts ........................................................................................................................... 201
SSL Application .......................................................................................................................203
System ..................................................................................................................................205
System ..................................................................................................................................... 207
System Remote Management ..................................................................................................211
Maintenance and Index .......................................................................................................225
File Manager ............................................................................................................................ 227
Logs .........................................................................................................................................245
Reports and Reboot ................................................................................................................ 251
Session Timeout ...................................................................................................................... 253
Diagnostics ............................................................................................................................. 255
Maintenance Tools ................................................................................................................... 257
Watchdog Timer .......................................................................................................................261

11
PART I
Introduction
Command Line Interface (13)
User and Privilege Modes (29)
Registration (37)

12

ZyWALL (ZLD) CLI Reference Guide 13
CHAPTER 1
Command Line Interface
This chapter describes how to access and use the CLI (Command Line Interface).
1.1 Overview
If you have problems with your ZyWALL, customer support may request that you issue some
of these commands to assist them in troubleshooting.
1Use of undocumented commands or misconfiguration can damage the
ZyWALL and possibly render it unusable.
1.1.1 The Configuration File
When you configure the ZyWALL using either the CLI (Command Line Interface) or the web
configurator, the settings are saved as a series of commands in a configuration file on the
ZyWALL. You can store more than one configuration file on the ZyWALL. However, only
one configuration file is used at a time.
You can perform the following with a configuration file:
• Back up ZyWALL configuration once the ZyWALL is set up to work in your network.
• Restore ZyWALL configuration.
• Save and edit a configuration file and upload it to multiple ZyWALLs (of the same model)
in your network to have the same settings.
"You may also edit a configuration file using a text editor.
1.2 Accessing the CLI
You can access the CLI using a terminal emulation program on a computer connected to the
console port, from the web configurator or access the ZyWALL using Telnet or SSH (Secure
SHell).

Chapter 1 Command Line Interface
ZyWALL (ZLD) CLI Reference Guide
14
"The ZyWALL might force you to log out of your session if reauthentication
time, lease time, or idle timeout is reached. See Chapter 23 on page 171 for
more information about these settings.
1.2.1 Console Port
The default settings for the console port are as follows.
When you turn on your ZyWALL, it performs several internal tests as well as line
initialization. You can view the initialization information using the console port.
• Garbled text displays if your terminal emulation program’s speed is set lower than the
ZyWALL’s.
• No text displays if the speed is set higher than the ZyWALL’s.
• If changing your terminal emulation program’s speed does not get anything to display,
restart the ZyWALL.
• If restarting the ZyWALL does not get anything to display, contact your local customer
support.
Figure 1 Console Port Power-on Display
After the initialization, the login screen displays.
Table 1 Managing the ZyWALL: Console Port
SETTING VALUE
Speed 115200 bps
Data Bits 8
Parity None
Stop Bit 1
Flow Control Off
Main Processor : Intel Pentium(R) 4 2.80GHz(133x21.0)
Memory Testing : 346432K OK
Press DEL to enter SETUP60, ESC to skip memory test

Chapter 1 Command Line Interface
ZyWALL (ZLD) CLI Reference Guide 15
Figure 2 Login Screen
Enter the user name and password at the prompts.
"The default login username is admin and password is 1234. The username
and password are case-sensitive.
1.2.2 Web Configurator Console
"Before you can access the CLI through the web configurator, make sure your
computer supports the Java Runtime Environment. You will be prompted to
download and install the Java plug-in if it is not already installed.
When you access the CLI using the web console, your computer establishes a SSH (Secure
SHell) connection to the ZyWALL. Follow the steps below to access the web console.
1Log into the web configurator.
2Click the Console icon in the top-right corner of the web configurator screen.
3If the Java plug-in is already installed, skip to step 4.
Otherwise, you will be prompted to install the Java plug-in. If the prompt does not
display and the screen remains gray, you have to download the setup program.
4The web console starts. This might take a few seconds. One or more security screens
may display. Click Yes or Always.
Welcome to ZyWALL 1050
Username:

Chapter 1 Command Line Interface
ZyWALL (ZLD) CLI Reference Guide
16
Figure 3 Web Console: Security Warnings
Finally, the User Name screen appears.
Figure 4 Web Console: User Name
5Enter the user name you want to use to log in to the console. The console begins to
connect to the ZyWALL.
"The default login username is admin. It is case-sensitive.

Chapter 1 Command Line Interface
ZyWALL (ZLD) CLI Reference Guide 17
Figure 5 Web Console: Connecting
Then, the Password screen appears.
Figure 6 Web Console: Password
6Enter the password for the user name you specified earlier, and click OK. If you enter
the password incorrectly, you get an error message, and you may have to close the
console window and open it again. If you enter the password correctly, the console
screen appears.
Figure 7 Web Console
7To use most commands in this User’s Guide, enter configure terminal. The prompt
should change to Router(config)#.
1.2.3 Telnet
Use the following steps to Telnet into your ZyWALL.

Chapter 1 Command Line Interface
ZyWALL (ZLD) CLI Reference Guide
18
1If your computer is connected to the ZyWALL over the Internet, skip to the next step.
Make sure your computer IP address and the ZyWALL IP address are on the same
subnet.
2In Windows, click Start (usually in the bottom left corner) and Run. Then type telnet
and the ZyWALL’s IP address. For example, enter telnet 192.168.1.1 (the default
management IP address).
3Click OK. A login screen displays. Enter the user name and password at the prompts.
"The default login username is admin and password is 1234. The username
and password are case-sensitive.
1.2.4 SSH (Secure SHell)
You can use an SSH client program to access the CLI. The following figure shows an example
using a text-based SSH client program. Refer to the documentation that comes with your SSH
program for information on using it.
"The default login username is admin and password is 1234. The username
and password are case-sensitive.
Figure 8 SSH Login Example
1.3 How to Find Commands in this Guide
You can simply look for the feature chapter to find commands. In addition, you can use one of
the following to look up specific commands.
C:\>ssh2 [email protected]
Host key not found from database.
Key fingerprint:
xolor-takel-fipef-zevit-visom-gydog-vetan-bisol-lysob-cuvun-muxex
You can get a public key's fingerprint by running
% ssh-keygen -F publickey.pub
on the keyfile.
Are you sure you want to continue connecting (yes/no)? yes
Host key saved to C:/Documents and Settings/user/Application Data/SSH/
hostkeys/
ey_22_192.168.1.1.pub
host key for 192.168.1.1, accepted by user Tue Aug 09 2005 07:38:28
admin's password:
Authentication successful.

Chapter 1 Command Line Interface
ZyWALL (ZLD) CLI Reference Guide 19
•Commands in Order of Appearance right after this chapter. This section lists the
commands in the order that they appear in this guide.
•List of Commands (Alphabetical) at the end of the guide. This section lists the commands
in alphabetical order that they appear in this guide.
If you are looking at the CLI Reference Guide electronically, you might have additional
options (for example, bookmarks or Find...) as well.
1.4 How Commands Are Explained
Each chapter explains the commands for one keyword. The chapters are divided into the
following sections.
1.4.1 Background Information (Optional)
"See the User’s Guide for background information about most features.
This section provides background information about features that you cannot configure in the
web configurator. In addition, this section identifies related commands in other chapters.
1.4.2 Command Input Values (Optional)
This section lists common input values for the commands for the feature in one or more tables
1.4.3 Command Summary
This section lists the commands for the feature in one or more tables.
1.4.4 Command Examples (Optional)
This section contains any examples for the commands in this feature.
1.4.5 Command Syntax
The following conventions are used in this User’s Guide.
• A command or keyword in courier new must be entered literally as shown. Do not
abbreviate.
• Values that you need to provide are in italics.
• Required fields that have multiple choices are enclosed in curly brackets {}.
• A range of numbers is enclosed in angle brackets <>.
• Optional fields are enclosed in square brackets [].
•The
|symbol means OR.

Chapter 1 Command Line Interface
ZyWALL (ZLD) CLI Reference Guide
20
For example, look at the following command to create a TCP/UDP service object.
service-object object-name {tcp | udp} {eq <1..65535> | range <1..65535>
<1..65535>}
1Enter service-object exactly as it appears.
2Enter the name of the object where you see object-name.
3Enter tcp or udp, depending on the service object you want to create.
4Finally, do one of the following.
•Enter
eq exactly as it appears, followed by a number between 1 and 65535.
•Enter
range exactly as it appears, followed by two numbers between 1 and 65535.
1.4.6 Changing the Password
It is highly recommended that you change the password for accessing the ZyWALL. See
Section 23.2 on page 172 for the appropriate commands.
1.5 CLI Modes
You run CLI commands in one of several modes.
Table 2 CLI Modes
USER PRIVILEGE CONFIGURATION SUB-COMMAND
What Guest users
can do Unable to access Unable to access Unable to access Unable to access
What User users
can do • Look at (but not
run) available
commands
Unable to access Unable to access Unable to access
What Limited-
Admin users can
do
• Look at system
information (like
Status screen)
• Run basic
diagnostics
• Look at system
information (like
Status screen)
• Run basic
diagnostics
Unable to access Unable to access
What Admin
users can do • Look at system
information (like
Status screen)
• Run basic
diagnostics
• Look at system
information (like
Status screen)
• Run basic
diagnostics
• Configure simple
features (such as
an address
object)
• Create or remove
complex parts
(such as an
interface)
• Configure
complex parts
(such as an
interface) in the
ZyWALL
How you enter it Log in to the ZyWALL Type enable in User
mode Type configure terminal in User or
Privilege mode
Type the command
used to create the
specific part in
Configuration mode
What the prompt
looks like Router> Router# Router(config)# (varies by part)
Router(zone)#
Router(config-
if-ge)#
...
How you exit it Type exit Type disable Type exit Type exit