ZyXEL Communications ZyWALL 110 Series User manual

1/255
www.zyxel.com
ZyWALL/USG Series
ZyWALL 110 / 310 / 1100
USG40 / USG40W / USG60 / USG60W / USG110 /
USG210 / USG310 / USG1100 / USG1900
Security Firewalls
Firmware Version 4.13 ~ 4.15
Edition 1, 7/2016
Handbook
Default Login Details
LAN Port IP Address
https://192.168.1.1
User Name
admin
Password
1234
Copyright © 2016 ZyXEL Communications Corporation

2/255
www.zyxel.com
Table of Content
How to Configure Site-to-site IPSec VPN with Amazon VPC ....................8
Set Up the IPSec VPN Tunnel on the Amazon VPC .............................. 9
Set Up the IPSec VPN Tunnel on the ZyWALL/USG ............................. 13
Test the IPSec VPN Tunnel....................................................................... 17
What Could Go Wrong? ........................................................................ 18
How to Configure GRE over IPSec VPN Tunnel.........................................20
Set Up the ZyWALL/USG GRE over IPSec VPN Tunnel of Corporate
Network (HQ) ........................................................................................... 21
Set Up the ZyWALL/USG GRE over IPSec VPN Tunnel of Corporate
Network (Branch) .................................................................................... 25
Test the GRE over IPSec VPN Tunnel...................................................... 30
What Could Go Wrong? ........................................................................ 30
How to Configure IPSec Site to Site VPN while one Site is behind a NAT
router............................................................................................................32
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(HQ)........................................................................................................... 33
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(Branch) .................................................................................................... 36
Set Up the NAT Router (Using ZyWALL USG device in this example)40
Test the IPSec VPN Tunnel....................................................................... 42
What Could Go Wrong? ........................................................................ 43
How to Configure L2TP over IPSec VPN while the ZyWALL/USG is behind a
NAT router....................................................................................................45
Set Up the L2TP VPN Tunnel on the ZyWALL/USG_HQ ........................ 46
Set Up the NAT Router (Using ZyWALL USG device in this example)50
Test the L2TP over IPSec VPN Tunnel...................................................... 52
What Could Go Wrong? ........................................................................ 55
How to configure if I want user can only see SSL VPN Login button in web
portal login page........................................................................................57
Set Up the DNS Service............................................................................ 58
Set Up the ZyWALL/USG SSL VPN Setting ............................................ 58
Set Up the ZyWALL/USG System Setting ................................................ 59

3/255
www.zyxel.com
Test the SSL VPN ....................................................................................... 60
How to Configure an SSL VPN Tunnel (with SecuExtender version 4.0.0.1)
on the Windows 10 Operating System......................................................64
Set up the SSL VPN Tunnel with Windows 10 ....................................... 64
What Can Go Wrong? ........................................................................... 68
How to redirect multiple LAN interface traffic to the VPN tunnel ...........70
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(HQ)........................................................................................................... 71
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(Branch) .................................................................................................... 74
Set up the Policy Route (ZyWALL/USG_HQ) ........................................ 77
Set up the Policy Route (ZyWALL/USG_Branch) ................................. 79
Test the IPSec VPN Tunnel....................................................................... 80
What Could Go Wrong? ........................................................................ 82
How to Configure IPSec VPN Failover.......................................................84
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(HQ)........................................................................................................... 85
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(Branch) .................................................................................................... 88
Set up the WAN Trunk (ZyWALL/USG_HQ) ........................................... 92
Set up the Failover Command Line (ZyWALL/USG HQ) .................... 93
Test the IPSec VPN Tunnel....................................................................... 95
What Could Go Wrong? ........................................................................ 96
How to Create VTI and Configure VPN Failover with VTI ........................98
VTI Deployment Flow .............................................................................. 98
Set Up the ZyWALL/USG VTI of Corporate Network (HQ) ................. 99
Set Up the ZyWALL/USG VTI of Corporate Network (Branch) ........ 104
Test the IPSec VPN Tunnel.................................................................... 111
What Can Go Wrong? ......................................................................... 113
How to Import ZyWALL/USG Certificate for L2TP over IPsec in Android
mobile phone............................................................................................115
Set Up the L2TP VPN Tunnel on the ZyWALL/USG .............................. 116
Export a Certificate from ZyWALL/USG and Import it to Android

4/255
www.zyxel.com
Mobile Phone......................................................................................... 120
Set Up the L2TP VPN Tunnel on the Android Mobile Device ........... 121
Test the L2TP over IPSec VPN Tunnel .................................................. 124
What Could Go Wrong? ...................................................................... 126
How to Import ZyWALL/USG Certificate for L2TP over IPsec in IOS mobile
phone.........................................................................................................128
Set Up the L2TP VPN Tunnel on the ZyWALL/USG .............................. 129
Export a Certificate from ZyWALL/USG and Import it to iOS Mobile
Phone...................................................................................................... 133
Set Up the L2TP VPN Tunnel on the iOS Mobile Device.................... 134
Test the L2TP over IPSec VPN Tunnel .................................................. 137
What Could Go Wrong? ...................................................................... 138
How to configure the USG when using a Cloud Based SIP system ......140
Set Up the SIP ALG................................................................................. 141
Test result ................................................................................................ 142
What could go wrong?........................................................................ 142
How to block HTTPS websites by Domain Filter without applying SSL
Inspection..................................................................................................143
Set Up the Content Filter on the ZyWALL/USG.................................. 144
Set Up the Security Policy on the ZyWALL/USG ................................ 146
Set Up the System Policy on the ZyWALL/USG.................................. 146
Test the Result ........................................................................................ 147
How to configure Content Filter 2.0 - Geo IP Blocking..........................149
Set Up the Address Objet with Geo IP on the ZyWALL/USG........... 150
Set Up the Security Policy on the ZyWALL/USG ................................ 151
Test the Result ........................................................................................ 152
What could go wrong .......................................................................... 153
How to block the client accessing to certain country using Geo IP and
Content Filter .............................................................................................154
Check Geo IP License Status on the ZyWALL/USG ........................... 155
Set Up the Address Objet with Geo IP on the ZyWALL/USG........... 155
Set Up the Security Policy on the ZyWALL/USG ................................ 156
Test the Result ........................................................................................ 158

5/255
www.zyxel.com
How to set up Link Aggregation Group (LAG) .......................................160
Set up the Active-backup, 802.3ad, Balance-alb........................... 160
Set up the active-backup mode. ...................................................... 164
Test the Result ........................................................................................ 166
What can go wrong ............................................................................. 166
How to Restrict Web Portal access from the Internet ............................167
Set Up the ZyWALL/USG System Setting .............................................. 168
Test the Web Access............................................................................. 169
How to Setup and Configure Daily Report .............................................171
Set Up the ZyWALL/USG Email Daily Report Setting ........................... 172
Test the Daily Log Report...................................................................... 173
What Could Go Wrong? ...................................................................... 174
How to Setup and Configure Email Logs ................................................175
Set Up the ZyWALL/USG Email Logs Setting ........................................ 176
Test the Email Log .................................................................................. 178
What Could Go Wrong? ...................................................................... 178
How to setup and send logs to a Syslog Server.....................................179
Set Up the Syslog Server (Use Papertrail syslog in this example) ....... 180
Set Up the ZyWALL/USG Remote Server Setting ................................. 182
Test the Remote Server ......................................................................... 183
What Could Go Wrong? ...................................................................... 184
How to setup and send logs to a Vantage Reports Server...................185
Set Up the VRPT Server .......................................................................... 186
Set Up the ZyWALL/USG Remote Server Setting ................................. 189
Test the Remote Server ......................................................................... 189
What Could Go Wrong? ...................................................................... 190
How to enable and send logs to the USB storage .................................191
Set Up the USB System Settings............................................................. 192
Set Up the USB Log Storage .................................................................. 192
Check the USG Log Files ...................................................................... 193
How to create a Wi-Fi VLAN interfaces to separate staff network and
Guest network...........................................................................................194

6/255
www.zyxel.com
Set up Wi-Fi VLAN interfaces ............................................................... 195
Test result. ............................................................................................... 202
What could go wrong .......................................................................... 203
How to Activate a Free Access Hotspot.................................................205
Set up the Free Access Hotspot.......................................................... 206
Test the User Agreement and Advertisement Webpage............... 208
What could Go Wrong?....................................................................... 209
Set up Enable the Free Time Feature ................................................. 210
Test Free Time Feature.......................................................................... 215
What Can Go Wrong? ......................................................................... 218
How to Enable Device HA Pro .................................................................220
Device HA Pro License ......................................................................... 221
Behavior of the Device HA Pro ........................................................... 222
Suggestions ............................................................................................ 224
How do I Configure Device HA Pro in My Current Environment? . 224
What can go wrong ............................................................................. 229
How to Set Up IPv6 Interfaces For Pure IPv6 Routing .............................231
Setting Up the IPv6 Interface............................................................... 232
Set up the Prefix Delegation and Router Advertisement ............... 234
Test........................................................................................................... 238
What Can Go Wrong? ......................................................................... 238
Test........................................................................................................... 240
How to Perform and Use the Packet Capture Feature on the ZyWALL/USG
....................................................................................................................241
Set Up the Packet Capture Feature .................................................... 242
Check the Capture Files ...................................................................... 244
How to Automatically Reboot the ZyWALL/USG by Schedule .............246
Set Up the Shell Script ............................................................................ 247
Set Up the Schedule Run ...................................................................... 248
Check the Reboot Status..................................................................... 249
How to continuously run a ZySH script....................................................251
Set Up the Shell Script ............................................................................ 252

7/255
www.zyxel.com
Set Up the Schedule Run ...................................................................... 253
Check the Result ................................................................................... 254

8/255
www.zyxel.com
How to Configure Site-to-site IPSec VPN with Amazon VPC
This example shows how to use the VPN Setup Wizard to create a site-to-site VPN
between a ZyWALL/USG and an Amazon VPC platform. The example instructs
how to configure the VPN tunnel between each site. When the VPN tunnel is
configured, each site can be accessed securely.
Figure 1ZyWALL/USG Site-to-site IPSec VPN with Amazon VPC
Note:
All network IP addresses and subnet masks are used as examples in this article.
Please replace them with your actual network IP addresses and subnet masks.
This example was tested using USG110 (Firmware Version: ZLD 4.15) and Amazon
VPC (June, 2016).

9/255
www.zyxel.com
Set Up the IPSec VPN Tunnel on the Amazon VPC
1Sign into the Amazon AWS Management Console. Go to Networking > VPC.
Figure 2Amazon AWS Management Console > Networking > VPC
2In the upper left-hand of the screen, click Start VPC Wizard.
Figure 3 Amazon VPC Management Console > Networking > VPC > Start VPC
Wizard
3Select a VPC Configuration, select VPC with a Private Subnet Only and Hardware
VPN Access, and then click Select.

10/255
www.zyxel.com
Figure 4Select a VPC Configuration > VPC with a Private Subnet Only and Hardware
VPN Access
4VPC with a Private Subnet Only and Hardware VPN, add your IP CIDR block and
Private subnet. Click Next.
Figure 5VPC with a Private Subnet Only and Hardware VPN