ZyXEL Communications ZyWALL 1050 Instruction Manual

1/142
www.zyxel.com
ZyXEL
Firmware Release Note
ZyWALL 1050
Release 2.01(XL.4)
Date: Sep 19, 2008
Author: Xin-Hong Wu
Project Leader: Peter Wang

2/142
www.zyxel.com
ZyXEL ZyWALL 1050
Release 2.01(XL.4)
Release Note
Date: Sep 19, 2008
Supported Platforms:
ZyXEL ZyWALL 1050
Versions:
ZLD Version: 2.01(XL.4) | 2008-09-19
Bootbase: V1.12 | 2007-11-12
Files lists contains in the Release ZIP file
File Name : 201XL4C0.bin
Purpose: This binary firmware image file for normal system update.
Note: The firmware update may take five or more minutes depending on the scale of device
configuration. The more complex the configuration, the longer the update time. Do not turn off or
reset the ZyWALL while the firmware update is in progress. The firmware might get damaged, if
device loss power or you reset the device during the firmware upload. You might need to refer to
User Guide Section 34.8 on page 235 or Appendix 7 of this document to recover the firmware.
File Name : 201XL4C0.conf
Purpose: This ASCII file contains default system configuration commands.
File name : 201XL4C0.db
Purpose: This binary file contains default system signatures.
Note: The file is only needed when doing system recovery from damage.
File name : 201XL4C0.doc
Purpose: This release file.

3/142
www.zyxel.com
File name : 201XL4C0.ri
Purpose: This binary firmware recovery image file is for emergent system firmware damage
recovery.
Note: The ZyWALL firmware could be damaged, for example by the power going off or pressing
Reset button during a firmware update. Refer to ZyWALL ZLD CLI Reference Guide, Section
34.8 for details.
File name : firmware.xml
Purpose: This file is needed by ZyXEL Centralized Network Management (CNM) 3.0 or after.
Read Me First
1. The system default configuration is summarized as below:
zThe default device administration username is “admin”, password is “1234”.
zThe default LAN interface is ge1, which locates on the most left side of front panel. The
default LAN subnet is 192.168.1.0/24.
zBy default, WWW/SSH/SNMP service can only be accessed from LAN subnet.
zThe default WAN interface is ge2, and the secondary WAN interface is ge3. These two
interfaces will automatically get IP address using DHCP by default.
2. It is recommended that user backs up “startup-config.conf file” first before upgrade. The
backup configuration file can be used later when user wants to downgrade to an older firmware
version. Please refer to Appendix I for upgrade / downgrade procedure.
3. If user upgrades from 1.0x version to this version, there is no need to restore to system default
configuration.
4. If user upgrades from 1.0x version to this version, all App. Patrol BWM rules would not be
applied to system. User needs to re-configure BWM related rules. It is because the App. Patrol
BWM design concept is different from 1.0x release. User may refer to following two sections
in User Guide to configure their BWM policy.
zSection 27.4: Bandwidth Management
zSection 27.5: Application Patrol Bandwidth Management Example
5. If user upgrades from 1.0x version to this version and wants to configure L2TP over IPSec,
user needs to create VPN connection for L2TP manually. Refer to the Known Issues list of this
document, L2TP section, for details.
6. It is recommended for user to clear browser cache before configuring the device using GUI. It
helps to avoid confusion that browser cache carries previous release GUI information (popup
java script error, etc).

4/142
www.zyxel.com
7. To reset device to system default, user could press RESET button for 5 seconds and the device
would reset itself to system default configuration and then reboot.
zNote 1: After resetting, the original configuration would be removed. It is recommended
to backup the configuration before performing the operation.
zNote 2: After resetting, if user has subscribed to security licenses, user needs to connect
to internet with myZyXEL.com and refresh license information.
8. If there has problem to reboot successfully after firmware upgrade, please refer to Appendix 7:
Firmware Recovery.

5/142
www.zyxel.com
Known Issues:
INTERFACE:
1. [SPR: 070105290]
[Symptom] Apply aux interface configuration when dialing aux, modem will not
disconnect for 15-20 seconds.
[Workaround] Wait for 15-20 seconds, the modem will be disconnected and back to normal
again.
2. [SPR: 060710491]
[Symptom] When user configures PPTP interfaces as WAN interface and high volume traffic
going through the interface, the CPU usage might stay high.
Device HA:
1. [SPR: 060527709]
[Symptom] In some occasions, backup device might fail to apply configuration after it
synchronize configuration file from master device. However, the backup device might recover
itself in the next sync period.
App. Patrol:
1. [SPR: 070530581]
[Symptom] App. Patrol provides granular control over IM/P2P such as login, file downloading,
voice/video over IP. In current design, if administrators choose to block one of these actions,
the connection for the IM/P2P might be blocked as well.
IDP/ADP:
1. [SPR: 070514576]
[Symptom] It is possible for a packet to match several IDP signatures and if the actions for
those matched signature are different, the most severe one would be taken. The severe level for
each action is reject-both > reject receiver > reject sender > drop > none (pass).
Anti-Virus:
1. [SPR: 061218052]
[Symptom] Question mark ‘?’ is a special character for ZyWALL 1050 and if it is used for
white/black list in CLI mode, it may not work correctly.
[Work around] Please use GUI to configure the feature.
2. [SPR: 070504172]
[Symptom] ZyWALL has the limitation on concurrent sessions for decompression. If the
limitation has been reached, the event would be logged and the action depends on the
checkbox (Destroy compressed files that could not be decompressed) is checked or not. If
checked, compressed files would be destroyed, otherwise, bypassed.
3. [SPR: 080829502]
[Symptom] Send a file named in black list through ZyWALL by SMTP, the device doesn’t
destroy compressed files.

6/142
www.zyxel.com
IPsec VPN:
1. [SPR: 051206484]
[Symptom] ZW1050 does not support DNAT over IPSec with “Many one-to-one” case.
2. [SPR: 060126368]
[Symptom] VPN tunnel could not be established between ZW1050 and Fortinet products if
IKE is configured as x-auth client or server.
3. [SPR: 060327208]
[Symptom] VPN tunnel could not be established when 1) a non ZW1050 peer gateway
reboot and 2) ZW1050 has a previous established Phase 1 with peer gateway, and the Phase 1
is not yet expired. Under those conditions, ZW1050 will continue to use the previous phase 1
SA to negotiate the Phase 2 SA. It would result in phase 2 negotiation to fail.
[Work around] User could disable and re-enable phase 1 rule in ZW1050 or turn on DPD
function to resolve problem.
4. [SPR: 050523482]
[Symptom] PKI does not interoperate with Windows CA server, when using SCEP.
SSL VPN:
1. [SPR: 061205278]
[Symptom] Can not access info web by reverse proxy.
[Work Around] This is because reverse proxy does not support NTLM authentication. Disable
NTLM on web server or use Network Extender to access instead.
2. [SPR: 061219114]
[Symptom] Sometimes, Network Extender has error message and user can not get ppp
interface.
[Work Around] Close all browsers and login again
3. [SPR: 061220176]
[Symptom] Sometimes can’t login SSLVPN. Error page show: Can not load library!
[Work Around] Close all browsers and login again
4. [SPR: 061219115]
[Symptom] File sharing, only file “yyyy” can not be renamed
[Work Around] This is because server refused the rename operation temporarily. Try it again
later can resolve this issue
5. [SPR: 070102075]
[Symptom] To add a folder will cause Application and File Sharing part was hidden
[Work Around] Use Windows 2000 SP4 or later then this issue disappears
6. [SPR: 070326565]
[Symptom] Can not transform mail content from Text to HTML in OpenWebMail
7. [SPR: 070517900]
[Symptom] In CIFS, filename will error after downloading a file with Chinese name and no
file extension when browser is IE
8. [SPR: 070523177]
[Symptom] SSLVPN Reverse Proxy has the problem of page partial load in MAC’s safari
browser
[Work Around] Safari has bug on rendering webpage. Reload the page may solve. Suggest
using FireFox/Camino to access.

7/142
www.zyxel.com
L2TP over IPSec:
1. [SPR: none]
[Symptom] If user upgrades to firmware version 2.00 from 1.0x, he may need to copy and
paste the following configuration in CLI mode to build the required IPSec tunnel for L2TP
connections. Please refer to user guide for more details about how to configure L2TP over
IPSec.
!
enable
!
configure terminal
!
isakmp policy Default_L2TP_VPN_GW
mode main
transform-set 3des-sha 3des-md5 des-sha
lifetime 86400
local-ip interface ge2
peer-ip 0.0.0.0 0.0.0.0
authentication pre-share
keystring 12345678
local-id type ip 0.0.0.0
peer-id type any
xauth type server default deactivate
group2
deactivate
exit
!
crypto map Default_L2TP_VPN_Connection
ipsec-isakmp Default_L2TP_VPN_GW
encapsulation transport
transform-set esp-3des-sha esp-3des-md5 esp-des-sha
set security-association lifetime seconds 86400
set pfs none
deactivate
exit
!
write
!
Diagnostic Tools:
1. [SPR: 060823385]
[Symptom] When user downloads a diagnostic report, the default downloaded filename would
have extra square bracket. For example diaginfo-xxx[1].tar.bz2.
User-Aware Features:
1. [SPR: 060208177]
[Symptom] In some occasions, Outlook Express might be terminated if both ZW1050 force
authentication and https force redirect features are enabled and access user does not login to
ZyWALL first.
[Work around] The access user must be authenticated first
2. [SPR: 070202236]
[Symptom] An access user could gain access right after signing in ZyWALL (if properly
configured) and log out when he don’t need to access the network resources anymore. But
sometimes user stays in signing in state after he closes the access window directly and the
resources could still be accessible.
[Work around] For access users, user logout button to logout instead of closing window
directly. For administrations, enable user lease/idle detection for access users.

8/142
www.zyxel.com
3. [SPR: 070719071]
[Symptom] Device supports authenticating user remotely by creating AAA method which
includes AAA servers (LDAP/AD/Radius). If a user uses an account which exists in 2 AAA
server and supplies correct password for the latter AAA server in AAA method, the
authentication result depends on what the former AAA server is. If the former server is Radius,
the authentication would be granted, otherwise, it would be rejected.
[Work around] Avoid having the same account in AAA servers within a method.
Built-in Services:
1. [SPR: 061208576]
[Symptom] If users change port for built-in services (FTP/HTTP/SSH/TELNET) and the port
conflicts with other service or internal service, the service might not be brought up
successfully. The internal service ports include 10443/1723/2601-2604.
[Work around] Users should avoid using these internal ports for built-in services.
2. [SPR: 071001053]
[Symptom] HTTP service will be disappeared in rare condition, this make user could not
access device via HTTP or HTTPS.
[Work around]If user cannot login ZW1050 via HTTP or HTTPS, use CLI “ip http server” to
turn on HTTP service or reboot device.

9/142
www.zyxel.com
Features:
Modifications in 2.01(XL.4) - 2008/09/19
Modify for formal release.
Modifications in 2.01(XL.4)b1 – 2008/09/02
1. [ENHANCEMENT]
Collect SW Watch Dog log buffer in Diagnostic file:
Device collects SW Watch Dog log buffer in Diagnostic file. In diagnostic file, it contains
more detailed system information for developer.
2. [ENHANCEMENT]
Add debug command to temporarily enable/disable NetBIOS Broadcast packet handling:
Syntax of this debug command is “debug ipsec netbios-in enable/disable”. Enable this debug
command, NetBIOS broadcast packets will be handled by device, so the Cpu usage should be
higher. If we disable this command, packets won’t be handled, so the Cpu usage should be
lower.
3. [ENHANCEMENT]
App. Patrol Link from service (IM/P2P) to MyZyXEL.COM:
Go to ZyWALL > AppPatrol > Instant Messenger or ZyWALL > AppPatrol > Peer to Peer.
This enhancement adds a note under the table, and user can click the hyperlink to connect
ZyXEL official address to see support list for IM/P2P application.
4. [ENHANCEMENT] SPR ID: 080714924
Add error message when the Interface IP and Gateway IP is the same:
In order to prevent user setting incorrect IP address. So if the Interface IP and Gateway IP are
the same, the pop-up warning message will show “Interface IP address and gateway IP address
cannot be the same”.
5. [ENHANCEMENT]
Remove unnecessary firewall debug log.
6. [ENHANCEMENT]
Log Enhancement for improving the Logging Performance Condition:
If triangle route existed in the ZyWALL deployed network environment, ZyWALL will try to
generate lots of debug logs and that will cause CPU high sometimes.

10/142
www.zyxel.com
7. [ENHANCEMENT]
Log Counter Enhancement:
Add the counter to calculate the number of each log category when this log sent from kernel to
user space.This is the statistic information of logging status and can help us debug when
something abnormal happened. To use the debug command, just type “debug logging show
log-statistic” in enable mode.
8. [ENHANCEMENT]
Configurable MSS (Maximum Segment Size):
This enhancement can allow user to configure MSS for each interface. This function is only
configurable via CLI command. This enhancement only applied to non-IPSec traffic. For
IPSec traffic, we won’t modify the mss value with the configuration. Please take the following
example as a reference. (We take configuration on interface ge5 as example). The mss value of
those packets out from ge5 will be modified to 1000 if its original mss is bigger than 1000 in
this example
Router (config)# interface ge5
Router (config-if-ge)# mss 1000
Router (config)# show interface ge5
Active: yes
Interface name: ge5
Description:
IP type: static
…
mss: 1000
9. [ENHANCEMENT]
Add IPSec performance enhancement of NetBIOS Broadcast packet handling.
10.[BUG FIX] SPR ID: 080605404
Symptom:
Forward locally generated ICMP Redirect packets.
Condition:
1. Use system default configuration
2. Create ge1:1 and assign IP 192.168.11.1
3. PING 192.168.11.2 from LAN PC
4. Locally generated ICMP redirect packet will be dropped and log displayed.