ZyXEL Communications ZyWALL 110 Series User manual

1/749
www.zyxel.com
ZyWALL/USG Series
ZyWALL 110 / 310 / 1100
USG20-VPN / USG20W-VPN / USG40 / USG40W /
USG60 / USG60W / USG110 / USG210 / USG310 /
USG1100 / USG1900 / USG2200-VPN /
Security Firewalls
Firmware Version 4.25
Edition 2, 4/2017
Handbook
Default Login Details
LAN Port IP Address
https://192.168.1.1
User Name
admin
Password
1234

2/749
www.zyxel.com
copyright © 2017 ZyXEL Communications Corporation
Table of Content
How to Configure Site-to-site IPSec VPN with Amazon VPC ..................17
Set Up the IPSec VPN Tunnel on the Amazon VPC ............................ 18
Set Up the IPSec VPN Tunnel on the ZyWALL/USG ............................. 22
Test the IPSec VPN Tunnel....................................................................... 26
What Could Go Wrong? ........................................................................ 27
How to Configure Site-to-site IPSec VPN with Microsoft (MS) Azure......29
Set Up the IPSec VPN Tunnel on the ZyWALL/USG ............................. 30
Set Up the IPSec VPN Tunnel on the MS Azure.................................... 36
Test the IPSec VPN Tunnel....................................................................... 45
What Could Go Wrong? ........................................................................ 47
How to Configure GRE over IPSec VPN Tunnel.........................................50
Set Up the ZyWALL/USG GRE over IPSec VPN Tunnel of Corporate
Network (HQ)........................................................................................... 51
Set Up the ZyWALL/USG GRE over IPSec VPN Tunnel of Corporate
Network (Branch) .................................................................................... 55
Test the GRE over IPSec VPN Tunnel...................................................... 60
What Could Go Wrong? ........................................................................ 60
How to Configure Site-to-site IPSec VPN Where the Peer has a Static IP
Address........................................................................................................62
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(HQ)........................................................................................................... 62
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(Branch).................................................................................................... 66
Test the IPSec VPN Tunnel....................................................................... 70
What Could Go Wrong? ........................................................................ 71
How to Configure Site-to-site IPSec VPN Where the Peer has a Dynamic
IP Address....................................................................................................73
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(HQ)........................................................................................................... 73
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network

3/749
www.zyxel.com
(Branch has a Dynamic IP Address)..................................................... 77
Test the IPSec VPN Tunnel....................................................................... 81
What Could Go Wrong? ........................................................................ 82
How to Configure IPSec Site to Site VPN while one Site is behind a NAT
router............................................................................................................84
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(HQ)........................................................................................................... 84
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(Branch).................................................................................................... 88
Set Up the NAT Router (Using ZyWALL USG device in this example)91
Test the IPSec VPN Tunnel....................................................................... 93
What Could Go Wrong? ........................................................................ 94
How to Configure Hub-and-Spoke IPSec VPN.........................................96
Set Up the IPSec VPN Tunnel on the ZyWALL/USG by Using VPN
Concentrator Hub_HQ-to-Branch_A.................................................... 97
Hub_HQ-to-Branch_B............................................................................ 101
Hub_HQ Concentrator ......................................................................... 104
Spoke_Branch_A ................................................................................... 106
Spoke_Branch_B.................................................................................... 111
Test the IPSec VPN Tunnel..................................................................... 115
What Could Go Wrong? ...................................................................... 118
Set Up the IPSec VPN Tunnel of ZyWALL/USG without Using VPN
Concentrator Hub_HQ-to-Branch_A.................................................. 119
Hub_HQ-to-Branch_B............................................................................ 122
Spoke_Branch_A ................................................................................... 125
Spoke_Branch_B.................................................................................... 128
Test the IPSec VPN Tunnel..................................................................... 131
What Could Go Wrong? ...................................................................... 133
How to Use Dual-WAN to Perform Fail-Over on VPN Using the VPN
Concentrator.............................................................................................135
Set Up the IPSec VPN Tunnel on the ZyWALL/USG
Hub_HQ-to-Branch_A ........................................................................... 136
Hub_HQ-to-Branch_B............................................................................ 139
Hub_HQ Concentrator ......................................................................... 142

4/749
www.zyxel.com
Spoke_Branch_A ................................................................................... 143
Spoke_Branch_B.................................................................................... 147
Test the IPSec VPN Tunnel .................................................................... 151
What Could Go Wrong? ...................................................................... 153
How to Configure IPSec VPN with ZyWALL IPSec VPN Client................156
Set Up the ZyWALL/USG IPSec VPN Tunnel ........................................ 157
Set Up the ZyWALL IPSec VPN Client .................................................. 161
Test the IPSec VPN Tunnel..................................................................... 165
What Can Go Wrong? ......................................................................... 166
How to Configure Site-to-site IPSec VPN with FortiGate .......................169
Set Up the IPSec VPN Tunnel on the ZyWALL/USG ........................... 169
Set Up the IPSec VPN Tunnel on the FortiGate ................................. 173
Test the IPSec VPN Tunnel..................................................................... 178
What Could Go Wrong? ...................................................................... 179
How to Configure Site-to-site IPSec VPN with WatchGuard .................181
Set Up the IPSec VPN Tunnel on the ZyWALL/USG ........................... 182
Set Up the IPSec VPN Tunnel on the WatchGuard .......................... 185
Test the IPSec VPN Tunnel..................................................................... 192
What Could Go Wrong? ...................................................................... 194
How to Configure Site-to-site IPSec VPN with Cisco .............................196
Set Up the IPSec VPN Tunnel on the ZyWALL/USG ........................... 197
Set Up the IPSec VPN Tunnel on the Cisco ........................................ 203
Test the IPSec VPN Tunnel..................................................................... 208
What Could Go Wrong? ...................................................................... 210
How to Configure Site-to-site IPSec VPN with a SonicWALL router ......212
Set Up the IPSec VPN Tunnel on the ZyWALL/USG ........................... 213
Set Up the IPSec VPN Tunnel on the SonicWALL............................... 220
Test the IPSec VPN Tunnel..................................................................... 224
What Could Go Wrong? ...................................................................... 226
How to Configure IPSec VPN Failover.....................................................229
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(HQ)......................................................................................................... 230
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network

5/749
www.zyxel.com
(Branch).................................................................................................. 233
Set up the WAN Trunk (ZyWALL/USG_HQ) ......................................... 237
Set up the Failover Command Line (ZyWALL/USG HQ) .................. 238
Test the IPSec VPN Tunnel..................................................................... 240
What Could Go Wrong? ...................................................................... 241
How to Configure L2TP over IPSec VPN while the ZyWALL/USG is behind a
NAT router..................................................................................................243
Set Up the L2TP VPN Tunnel on the ZyWALL/USG_HQ ...................... 244
Set Up the NAT Router (Using ZyWALL USG device in this example)
................................................................................................................. 248
Test the L2TP over IPSec VPN Tunnel.................................................... 251
What Could Go Wrong? ...................................................................... 254
How to Configure L2TP VPN with Android 5.0 Mobile Devices .............256
Set Up the L2TP VPN Tunnel on the ZyWALL/USG.............................. 257
Set Up the L2TP VPN Tunnel on the Android Device ........................ 261
Test the L2TP over IPSec VPN Tunnel .................................................. 265
What Could Go Wrong? ...................................................................... 267
How to Configure L2TP VPN with iOS 8.4 Mobile Devices .....................269
Set Up the L2TP VPN Tunnel on the ZyWALL/USG.............................. 269
Set Up the L2TP VPN Tunnel on the iOS Device ................................. 275
Test the L2TP over IPSec VPN Tunnel .................................................. 276
What Could Go Wrong? ...................................................................... 279
How to Import ZyWALL/USG Certificate for L2TP over IPsec in Windows 10
....................................................................................................................281
Set Up the L2TP VPN Tunnel on the ZyWALL/USG.............................. 281
Export a Certificate from ZyWALL/USG and Import it to Windows 10
Operating System ................................................................................. 286
Set Up the L2TP VPN Tunnel on the Windows 10 ............................... 292
Test the L2TP over IPSec VPN Tunnel .................................................. 296
What Could Go Wrong? ...................................................................... 298
How to Import ZyWALL/USG Certificate for L2TP over IPsec in IOS mobile
phone.........................................................................................................300
Set Up the L2TP VPN Tunnel on the ZyWALL/USG.............................. 300

6/749
www.zyxel.com
Export a Certificate from ZyWALL/USG and Import it to iOS Mobile
Phone...................................................................................................... 304
Set Up the L2TP VPN Tunnel on the iOS Mobile Device.................... 305
Test the L2TP over IPSec VPN Tunnel .................................................. 308
What Could Go Wrong? ...................................................................... 309
How to Import ZyWALL/USG Certificate for L2TP over IPsec in Android
mobile phone............................................................................................311
Set Up the L2TP VPN Tunnel on the ZyWALL/USG.............................. 311
Export a Certificate from ZyWALL/USG and Import it to Android
Mobile Phone......................................................................................... 316
Set Up the L2TP VPN Tunnel on the Android Mobile Device ........... 317
Test the L2TP over IPSec VPN Tunnel .................................................. 320
What Could Go Wrong? ...................................................................... 322
How to Configure the L2TP VPN with Apple MAC OS X 10.11 Operating
System........................................................................................................324
Set Up the L2TP VPN Tunnel on the ZyWALL/USG.............................. 324
Set Up the L2TP VPN Tunnel on the Apple MAC OS X 10.11 El Capitan
Operating System ................................................................................. 330
Test the L2TP over IPSec VPN Tunnel .................................................. 332
What Could Go Wrong? ...................................................................... 334
How to configure if I want user can only see SSL VPN Login button in web
portal login page......................................................................................336
Set Up the DNS Service.......................................................................... 337
Set Up the ZyWALL/USG SSL VPN Setting............................................. 337
Set Up the ZyWALL/USG System Setting .............................................. 338
Test the SSL VPN ..................................................................................... 339
How to Deploy SSL VPN with Windows 10 Operating System ...............343
Set Up the SSL VPN Tunnel on the ZyWALL/USG ................................ 344
Set Up the SSL VPN Tunnel on the Windows 10 Operating System 348
Test the SSL VPN Tunnel......................................................................... 352
What Could Go Wrong? ...................................................................... 353
How to Deploy SSL VPN with Apple Mac OS X 10.10 Operating System
....................................................................................................................354

7/749
www.zyxel.com
Set Up the SSL VPN Tunnel on the ZyWALL/USG ................................ 355
Set Up the SSL VPN Tunnel on the Apple MAC OS X 10.10 Operating
System ..................................................................................................... 360
Test the SSL VPN Tunnel......................................................................... 364
What Could Go Wrong? ...................................................................... 367
How To Configure SSL VPN for Remote Access Mobile Devices..........369
Set Up the SSL VPN Tunnel on the ZyWALL/USG ................................ 369
Test the SSL VPN Tunnel......................................................................... 372
What Could Go Wrong? ...................................................................... 375
How to Configure an SSL VPN Tunnel (with SecuExtender version 4.0.0.1)
on the Windows 10 Operating System....................................................376
Set up the SSL VPN Tunnel with Windows 10 ..................................... 376
What Can Go Wrong? ......................................................................... 380
How to redirect multiple LAN interface traffic to the VPN tunnel .........382
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(HQ)......................................................................................................... 383
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(Branch).................................................................................................. 386
Set up the Policy Route (ZyWALL/USG_HQ) ...................................... 389
Set up the Policy Route (ZyWALL/USG_Branch) ............................... 390
Test the IPSec VPN Tunnel..................................................................... 391
What Could Go Wrong? ...................................................................... 393
How to Create VTI and Configure VPN Failover with VTI ......................395
VTI Deployment Flow ............................................................................ 395
Set Up the ZyWALL/USG VTI of Corporate Network (HQ) ............... 396
Set Up the ZyWALL/USG VTI of Corporate Network (Branch) ........ 401
Test the IPSec VPN Tunnel.................................................................... 407
What Can Go Wrong? ......................................................................... 409
How to configure the USG when using a Cloud Based SIP system ......411
Set Up the SIP ALG................................................................................. 412
Test result ................................................................................................ 413
What could go wrong?........................................................................ 413

8/749
www.zyxel.com
How to block HTTPS websites by Domain Filter without applying SSL
Inspection..................................................................................................414
Set Up the Content Filter on the ZyWALL/USG.................................. 415
Set Up the Security Policy on the ZyWALL/USG ................................ 417
Set Up the System Policy on the ZyWALL/USG.................................. 417
Test the Result ........................................................................................ 418
How to Configure Content Filter 2.0 with Geo IP Blocking....................420
Set Up the Address Objet with Geo IP on the ZyWALL/USG........... 421
Set Up the Security Policy on the ZyWALL/USG ................................ 422
Test the Result ........................................................................................ 423
What Could Go Wrong? ...................................................................... 424
How to Configure Content Filter 2.0 with HTTPs Domain Filter...............425
Application Scenario............................................................................ 425
Set Up the Content Filter on the ZyWALL/USG................................... 425
Set Up the Security Policy on the ZyWALL/USG ................................ 427
Set Up the System Policy on the ZyWALL/USG.................................. 428
Test the Result ........................................................................................ 429
What Could Wrong?............................................................................. 430
How to block the client accessing to certain country using Geo IP and
Content Filter .............................................................................................431
Check Geo IP License Status on the ZyWALL/USG ........................... 432
Set Up the Address Objet with Geo IP on the ZyWALL/USG........... 432
Set Up the Security Policy on the ZyWALL/USG ................................ 433
Test the Result ........................................................................................ 434
How to set up Link Aggregation Group (LAG) .......................................437
Set up the Active-backup, 802.3ad, Balance-alb........................... 437
Set up the active-backup mode. ...................................................... 441
Test the Result ........................................................................................ 443
What can go wrong ............................................................................. 443
How to Restrict Web Portal access from the Internet ............................444
Set Up the ZyWALL/USG System Setting .............................................. 445
Test the Web Access............................................................................. 446
How to Setup and Configure Daily Report .............................................448

9/749
www.zyxel.com
Set Up the ZyWALL/USG Email Daily Report Setting ........................... 449
Test the Daily Log Report...................................................................... 450
What Could Go Wrong? ...................................................................... 451
How to Setup and Configure Email Logs ................................................452
Set Up the ZyWALL/USG Email Logs Setting ........................................ 452
Test the Email Log.................................................................................. 454
What Could Go Wrong? ...................................................................... 455
How to Setup and send logs to a Syslog Server ....................................456
Set Up the Syslog Server (Use Papertrail syslog in this example) ....... 456
Set Up the ZyWALL/USG Remote Server Setting................................. 459
Test the Remote Server......................................................................... 460
What Could Go Wrong? ...................................................................... 461
How to Setup and send logs to a Vantage Reports Server...................462
Set Up the VRPT Server .......................................................................... 463
Set Up the ZyWALL/USG Remote Server Setting................................. 466
Test the Remote Server......................................................................... 466
What Could Go Wrong? ...................................................................... 467
How to Setup and send logs to the USB storage....................................468
Set Up the USB System Settings............................................................. 469
Set Up the USB Log Storage.................................................................. 469
Check the USG Log Files ...................................................................... 470
How to Activate a Free Access Hotspot.................................................471
Set up the Free Access Hotspot.......................................................... 472
Test the User Agreement and Advertisement Webpage............... 474
What could Go Wrong?....................................................................... 475
Set up Enable the Free Time Feature ................................................. 476
Test Free Time Feature.......................................................................... 481
What Can Go Wrong? ......................................................................... 484
How to Setup IPv6 Interfaces for Pure IPv6 Routing ...............................486
Setting Up the IPv6 Interface............................................................... 487
Set up the Prefix Delegation and Router Advertisement ............... 489
Test........................................................................................................... 493
What Can Go Wrong? ......................................................................... 493

10/749
www.zyxel.com
Test........................................................................................................... 495
How to Perform and Use the Packet Capture Feature on the ZyWALL/USG
....................................................................................................................496
Set Up the Packet Capture Feature.................................................... 497
Check the Capture Files ...................................................................... 499
How to Automatically Reboot the ZyWALL/USG by Schedule .............501
Set Up the Shell Script............................................................................ 502
Set Up the Schedule Run ...................................................................... 503
Check the Reboot Status..................................................................... 504
How To Schedule YouTube Access.........................................................506
Set Up the Schedule on the ZyWALL/USG.......................................... 506
Create the Application Objects on the ZyWALL/USG...................... 507
Set Up the Application Patrol Profile on the ZyWALL/USG................ 508
Set Up SSL Inspection on the ZyWALL/USG......................................... 509
Set Up the Security Policy on the ZyWALL/USG ................................. 509
Export Certificate from ZyWALL/USG and Import it to Windows 7
Operation System ................................................................................. 510
Test the Result ........................................................................................ 516
What Could Go Wrong? ...................................................................... 516
How to continuously run a ZySH script....................................................518
Set Up the Shell Script............................................................................ 519
Set Up the Schedule Run ...................................................................... 520
Check the Result ................................................................................... 521
How To Register Your Device and Services at myZyXEL.com ..............523
Account Creation................................................................................. 524
Device Registration............................................................................... 526
Service Registration (In the Case of Standard License).................. 527
Device Management (In the Case of Registering Bundled Licenses)
................................................................................................................. 528
Refresh Service ...................................................................................... 529
What Could Go Wrong? ...................................................................... 529
How To Exempt Specific Users From Security Control ...........................531
Set Up the Security Policy on the ZyWALL/USG for Employees ....... 532