ZyXEL Communications ZyXEL ZyWALL 35 Manual

ZyWALL 35
Security Appliance
Support Notes
Version 4.03
Sep. 2007

ZyWALL35 Support Notes
2
INDEX
Application Notes....................................................................................................12
Seamless Incorporation into your network..........................................................12
Using Transparent (Bridge Mode) Firewall ............................................12
Internet Connection...................................................................................17
DHCP server/client/relay + flexible port role configuration..................19
Using NAT/Multi-NAT ..............................................................................23
Optimize network performance & availability....................................................33
Using Dual WAN / Load Balancing and policy route .............................33
Using Dual WAN.................................................................................34
WAN backup (Active/Passive mode)...........................................34
Load Balancing (Active/Active Mode)........................................43
Using Policy Route..............................................................................52
Using Bandwidth Management ................................................................53
Secure Connections across the Internet...............................................................67
Site-to-Site VPN (Intranet) Scenario........................................................67
Configure ZyWALLs with Static WAN IPAddress.............................67
Configure ZyWALL with Dynamic WAN IPAddress.........................68
Configure ZyWALL behind NAT Router ............................................70
Mapping multiple Network policy to same gateway policy................72
Using DDNS for VPN Redundancy ....................................................77
Using Certificate for Device Authentication........................................78
Using Self-signed Certificates .....................................................78
Online Enroll Certificates............................................................82
Offline Enroll Certificates............................................................91
Using Pre-Shared Key for Device Authentication.............................124
Using VPN routing between branches...............................................125
NAT over IPSec on ZyNOS...............................................................135
Never lost your VPN connection (IPSec High Availability)..............144
How to configure the VPN HA..................................................145
Access control and security VPN connection (Security policy
enforcement IPSec)............................................................................147
How to configure access control rule over VPN .......................148
How to configure Security policy (AV/IDP/AS) over VPN......152
How to configure Web filtering rule over VPN – Content Filter154
ZyWALLvs 3rd Party VPN Gateway....................................................155
SonicWALL with ZyWALL VPN Tunneling.............................155
NetScreen with ZyWALL VPN Tunneling................................164
All contents copyright (c) 2006 ZyXEL Communications Corporation.

ZyWALL35 Support Notes
3
Check Point with ZyWALL VPN Tunneling ............................178
FortiNet with ZyWALL VPN Tunneling ...................................213
Remote Access VPN Scenario.................................................................227
Using xAuth for User Authentication................................................228
ZyXEL VPN Client to ZyWALL Tunneling......................................230
Flexible Wireless Connection and Security...........................................239
Deploy the ZyWALL WLAN security policy....................................240
Threat Management...........................................................................................244
To protect computer networks against virus intrusions and attacks
from Internet............................................................................................245
To Control IM/P2PApplications Usage to Increase Employee
Productivity..............................................................................................251
To filter non-work related and unproductive web surfing to mitigate
spyware and phishing threats .................................................................256
To eliminate spam mails to block unwanted messages everyday.........266
Threat Reports....................................................................................................271
Centralized Management...................................................................................276
Using Vantage CNM for Management...................................................276
FAQ ...........................................................................................................................281
A. Product FAQ .................................................................................................281
A01. What is the ZyWALLInternet Access Sharing Router?.............281
A02. Will the ZyWALL work with my Internet connection?...............281
A03. What do I need to use the ZyWALL?............................................281
A04. What is PPPoE? ..............................................................................281
A05. Does the ZyWALLsupport PPPoE?..............................................282
A06. How do I know I am using PPPoE? ..............................................282
A07. Why does my Internet Service Provider use PPPoE?..................282
A08. How can I configure the ZyWALL?..............................................282
A09. What can we do with ZyWALL?...................................................282
A10. Does ZyWALLsupport dynamic IP addressing?.........................282
A11. What is the difference between the internal IP and the real IP
from my ISP?............................................................................................282
A12. How does e-mail work through the ZyWALL?............................283
A13. Is it possible to access a server running behind NAT from the
outside Internet? If possible, how?.........................................................283
A14. What DHCPcapability does the ZyWALL support?...................283
A15. What are the capability of wireless feature of ZyWALL.............283
A16. What is the coverage range of Wireless in ZyWALL?.................283
All contents copyright (c) 2006 ZyXEL Communications Corporation.

ZyWALL35 Support Notes
4
A17. How do I used the reset button, more over what field of
parameter will be reset by reset button?................................................283
A18. What network interface does the new ZyWALL series support?284
A19. How does the ZyWALLsupport TFTP?.......................................284
A20. Can the ZyWALL support TFTPover WAN?..............................284
A21. How can I upload data to outside Internet over the one-way
cable?.........................................................................................................284
A22. My ZyWALLcan not get an IP address from the ISPto connect
to the Internet, what can I do?................................................................284
A23. What is BOOTP/DHCP?................................................................285
A24. What is DDNS?................................................................................285
A25. When do I need DDNS service?.....................................................286
A26. What DDNS servers does the ZyWALLsupport?........................286
A27. What is DDNS wildcard? ...............................................................286
A28. Does the ZyWALLsupport DDNS wildcard?...............................286
A29. Can the ZyWALLNAT handle IPSec packets sent by the VPN
gateway behind ZyWALL? .....................................................................286
A30. How do I setup my ZyWALLfor routing IPSec packets over
NAT? .........................................................................................................286
A31. What is STP(Spanning Tree Protocol) /RSTP (Rapid STP)?.....287
A32. What is the flow ZyWALL handles inbound and outgoing
traffic?.......................................................................................................287
A33. What is “UTM”?.............................................................................287
A34. What are the differences between ZyWALLUTM models and
previous ZyWALL models?.....................................................................287
A35. What are the key new features of ZyWALLUTM?.....................288
B. Firmware Upgrade FAQ................................................................................288
B01. Which ZyWALLmodels are eligible to be upgraded to run
ZyNOS v4.01?...........................................................................................288
B02. Why it’s conditional to upgrade to ZyNOS v4.01 for ZyWALL
70?..............................................................................................................289
B03. What is ZyNOS v3.65 for ZyWALL 70?........................................289
B04. What happens if I wrongfully upgrade firmware of a ZyWALL
70 with only 32MB of RAM to ZyNOS v4.01 directly?........................289
B05. What happened if I upgrade a ZyWALL 70 running ZyNOS
v3.62/3.63/3.64 to v4.01 directly?............................................................290
B06. I am a 32MB ZyWALL70 owner, how can I upgrade to ZyNOS
v4.01 having AV+IDP and AS features?.................................................290
All contents copyright (c) 2006 ZyXEL Communications Corporation.

ZyWALL35 Support Notes
5
B07. If I were a 32MB ZyWALL 70 owner and a Content Filtering
service subscriber, will my current license status be retained after
joining your ZyWALL 70 trade-in promotion?.....................................290
B08. What’s the firmware upgrade path for my current ZyWALL 5
and ZyWALL 35?.....................................................................................290
B09. After a successful firmware upgrade to ZyNOS v4.01, what’s the
default setting of AV+IDP, AS and CF? .................................................290
B10. What happens to my original system configurations after a
successful firmware upgrade to ZyNOS v4.01?....................................291
B11. What’s the downgrade procedure of ZyWALL 70 running
ZyNOS v4.01?...........................................................................................291
B12. Can I downgrade a ZyWALL5 or ZyWALL 35 running ZyNOS
v4.01 back to ZyNOS v3.64 (or below)?.................................................291
C. Turbo Card FAQ............................................................................................291
C01. Can I insert the ZyWALLTurbo Card & wireless card
simultaneously into ZyWALL5, ZyWALL 35 or ZyWALL70?..........291
C02. Except ZyWALLTurbo Card is a must when use AV+IDP service,
what exactly I can get benefit from it?...................................................292
C03. Do I must have a ZyWALLTurbo Card inserted if I upgraded to
ZyNOS v4.01? If not, when must I insert a ZyWALLTurbo Card into
my ZyWALL device?...............................................................................292
D. Firewall FAQ.................................................................................................292
D01. What is a network firewall?...........................................................292
D02. What makes ZyWALL secure? .....................................................292
D03. What are the basic types of firewalls?...........................................293
D04. What kind of firewall is the ZyWALL?........................................293
D05. Why do you need a firewall when your router has packet
filtering and NAT built-in?.....................................................................294
D06. What is Denials of Service (DoS)attack?.......................................294
D07. What is Ping of Death attack? .......................................................294
D08. What is Teardrop attack?..............................................................294
D09. What is SYN Flood attack?............................................................295
D10. What is LAND attack? ...................................................................295
D11. What is Brute-force attack?...........................................................295
D12. What is IP Spoofing attack?...........................................................295
D13. What are the default ACL firewall rules in ZyWALL?..............295
D14. In ZyWALL, is DMZ behind NAT or not? ..................................296
D15. Can I use both public and private IP addresses on DMZ?..........296
All contents copyright (c) 2006 ZyXEL Communications Corporation.

ZyWALL 35 Support Notes
6
D16. Why does traffic redirect/static/policy route be blocked by
ZyWALL?.................................................................................................296
D17. How can I protect against IP spoofing attacks?...........................298
E. Security Service licenses FAQ ......................................................................299
E01. What is iCard?.................................................................................299
E02. Where can I buy the iCard and how much does it cost?.............299
E03. How many kinds of iCard does ZyXEL provide? ........................299
E04. Is each type of iCard device specific?............................................299
E05. What are the available security service licenses which require
additional purchase and license activation in ZyNOS v4.01?..............299
E06. What kind of iCard should I buy?.................................................300
E07. If I violate the mappings described above, for example, using a
silver iCard for ZyWALL35 or ZyWALL70, what will happen?.......300
E08. Can I try the Content Filtering service for free? How long is the
free trial period of Content Filtering service?.......................................300
E09. Does ZyXELprovide customers free trial forAV+IDP service?
How long is it?..........................................................................................300
E10. Does ZyXELprovide customers free trial forAnti-Spam service?
How long is it?..........................................................................................301
F. Security Service Activation and UpdateFAQ.................................................301
F01. Why do I have to register?..............................................................301
F02. In addition to registration, what can I do with myZyXEL.com?301
F03. Is there anything changed on myZyXEL.com because of the
launch of ZyNOS v4.00? Which ZyWALL models can be registered
via myZyXEL.com?.................................................................................302
F04. What’s the difference between new registration flow and
previous registration? What’s the advantage of new registration flow
over the previous registration flow?.......................................................302
F05. If I were new to myZyXEL.com, what are the required fields
when I register my ZyWALLdevice on myZyXEL.com?....................302
F06. When using the new registration flow of myZyXEL.com for
ZyNOS v4.0, do I have to create a new account if I were already a
registered user on myZyXEL.com?........................................................303
F07. What is mySecurityZone?...............................................................303
F08. What is Update Server?..................................................................303
F09. Who maintains mySecurityZone & Update Server?....................303
F10. What’s the URL for these service portals?....................................304
G. Anti-Virus FAQ..............................................................................................304
All contents copyright (c) 2006 ZyXEL Communications Corporation.

ZyWALL 35 Support Notes
7
G01. Why should I need a gatewayAnti-Virus solution while I already
deployed the Anti-Virus software on each desktop/laptop?.................304
G02. Why does ZyWALLbundle Anti-Virus and IDP feature
together?...................................................................................................304
G03. Can I subscribe to the Anti-Virus service alone or IDP service
alone? ........................................................................................................304
G04. What are the hardware requirements to run AV+IDPsecurity
service?......................................................................................................305
G05. Now I know that the ZyWALLTurbo Card is a must when use
AV+IDP service; but what exactly I can benefit from the ZyWALL
Turbo Card?.............................................................................................305
G06. How do I keep signatures ofAV+IDP service updated?..............305
G07. How often does ZyXELrelease signatures ofAV+IDPsecurity
service?......................................................................................................305
G08. Will the traffic coming in through the VPN tunnel also be
scanned by Anti-Virus, IDPand Anti-Spam feature in ZyWALL
ZyNOS v4.0?.............................................................................................305
H. IDP FAQ........................................................................................................306
H01. Why does ZyWALLbundle Anti-Virus and IDP feature
together?...................................................................................................306
H02. Can I subscribe to the Anti-Virus service alone or IDP service
alone? ........................................................................................................306
H03. What are the hardware requirements to run AV+IDPsecurity
service?......................................................................................................306
H04. Now I know that the ZyWALLTurbo Card is a must when use
AV+IDP service; but what exactly I can benefit from the ZyWALL
Turbo Card?.............................................................................................306
H05. Could I duplicate the IDP feature’s policy settings from one
ZyWALL device to another?...................................................................306
H06. How do I keep signatures ofAV+IDP service updated?..............307
H07. How often does ZyXELrelease signatures ofAV+IDPsecurity
service?......................................................................................................307
H08. Will the traffic coming in through the VPN tunnel also be
scanned by Anti-Virus, IDPand Anti-Spam feature in ZyWALL
ZyNOS v4.0?.............................................................................................307
I. Anti-Spam FAQ..............................................................................................307
I01. What’s the difference between gatewayAnti-Spam and
client-basedAnti-Spam filter such as Microsoft Outlook’s?................307
All contents copyright (c) 2006 ZyXEL Communications Corporation.

ZyWALL 35 Support Notes
8
I02. A customer already has her/his own exchange server including the
Anti-Spam software from other vendors; is there any good reason for
her/him to use ZyXEL’sAnti-Spam service in addition to the current
solution?....................................................................................................308
I03. What happens when an email with large attachment in size, e.g.
5MB, is downloaded which has virus in it?...........................................308
I04. What happens if the virus is in the last part of the email message
and the email receiver already got a part of the contaminated file in
her/his laptop or desktop?.......................................................................308
I05. Will the traffic coming in through the VPN tunnel also be
scanned by Anti-Virus, IDPand Anti-Spam feature in ZyWALL
ZyNOS v4.0?.............................................................................................308
I06. In ZyWALL’sAnti-Spam feature, what’s your recommendation to
handle identified spam emails?...............................................................309
I07. What’s the specification of Anti-Spam feature in ZyNOS v4.01?309
I08. How do I keep signatures ofAnti-Spam service update? .............309
J. Content Filter FAQ.........................................................................................310
J01. What's the operation between ZyXELappliance and BlueCoat
data center? ..............................................................................................310
J02. How many entries can the cache of Web Site Auto Categorization
keep at most?............................................................................................310
J03. Can I specify the time out value of the query response from
BlueCoat data center? .............................................................................310
J04. Can I decide whether to forward or drop the HTTP response if
the query to BlueCoat data center is timed out?...................................310
J05. How to register for BlueCoat service? ...........................................310
J06. Why can't I make registration successfully?.................................310
J07. What services can I get with Trial Registration?..........................311
J08. What types of content filter does ZyWALL provide?...................311
J09. What are the primary features of ZyXELContent Filtering?.....311
J10. Who needs ZyXELContent Filtering? Is ZyXELContent
Filtering for small companies or for large corporations?....................311
J11. Can I have different policies in effect for different times of the
day or week?.............................................................................................312
J12. How many policies can I create? ....................................................312
J13. Can I create my own categories?....................................................312
J14. Can I override (block or allow) certain URLs regardless of the
rating?.......................................................................................................312
All contents copyright (c) 2006 ZyXEL Communications Corporation.

ZyWALL 35 Support Notes
9
J15. How many URL keywords does ZyWALL support?....................312
J16. How do I keep database of Content Filtering service updated?..312
J17. What is BlueCoat Filter list?...........................................................312
J18. How many ratings does the BlueCoat database contain? ............312
J19. How often does BlueCoat update the database?...........................313
J20. How do I locate sites to block?........................................................313
J21. Do humans review the ratings? ......................................................313
J22. How can I do if I find a WEB site is mis-categorized?.................314
J23. How many and what categories do you provide? .........................314
J24. How does the ZyXELcontent filtering handle dynamically
generated sites?........................................................................................315
J25. Does BlueCoat have more than one data center? Is the BlueCoat
Web Filter geographically load balanced? ............................................316
J26. Who can generate and view reports on BlueCoat WEB site?......316
J27. How can I get Content Filtering report?.......................................316
J28. Can I change the password for BlueCoat service? .......................316
J29. Which User Name & Password should I input for Content
Filtering report?.......................................................................................316
J30. My device can't get connected to Http://myZyXEL.com, so I can't
get into Registration page. What should I check? ................................317
K. IPSec FAQ.....................................................................................................317
K01. How many VPN tunnels are supported on ZyWALL?................317
K02. How to count my VPN tunnels on ZyWALL?..............................318
K03. What is VPN?..................................................................................318
K04. Why do I need VPN? ......................................................................319
K05. What are most common VPN protocols?......................................319
K06. What is PPTP?................................................................................319
K07. What is L2TP? ................................................................................319
K08. What is IPSec? ................................................................................320
K09. What is SA?.....................................................................................320
K10. What is Pre-Shared Key?...............................................................320
K11. What is Phase 1 ID for?..................................................................321
K12. What are Local ID and Peer ID?...................................................321
K13. Is my ZyWALLready for IPSec VPN?.........................................322
K14. How do I configure ZyWALL VPN?.............................................322
K15. What VPN protocols are supported by ZyWALL?......................322
K16. What types of encryption does ZyWALLVPN support?............322
K17. What types of authentication does ZyWALLVPN support?......322
All contents copyright (c) 2006 ZyXEL Communications Corporation.

ZyWALL 35 Support Notes
10
K18. I am planning my ZyWALL-to-ZyWALLVPN configuration.
What do I need to know?.........................................................................323
K19. Does ZyWALLsupport dynamic secure gateway IP?.................323
K20. What VPN gateway that has been tested with ZyWALL
successfully?..............................................................................................323
K21. What VPN software that has been tested with ZyWALL
successfully?..............................................................................................324
K22. Will ZyXEL support Secure Remote Management?...................324
K23. Does ZyWALLVPN support NetBIOS broadcast?.....................324
K24. Is the host behind NAT allowed to use IPSec?.............................324
K25. How do I configure ZyWALL with NAT for internal servers?...325
K26. I am planning my ZyWALLbehind a NAT router. What do I
need to know?...........................................................................................325
K27. Where can I configure Phase 1 ID in ZyWALL?.........................325
K28. How can I keep a tunnel alive?......................................................326
K29. Single, Range, Subnet, which types of IPaddress does ZyWALL
support in VPN/IPSec?............................................................................326
K30. Does ZyWALLsupport IPSec pass-through? ..............................326
K31. Can ZyWALL behave as a NAT router supporting IPSec pass
through and an IPSec gateway simultaneously?...................................327
K32. Will the traffic coming in through the VPN tunnel also be
scanned by Anti-Virus, IDPand Anti-Spam feature in ZyWALL
ZyNOS v4.0?.............................................................................................327
L. PKI FAQ........................................................................................................327
L01. Basic Cryptography concept..........................................................327
L02. What is PKI?....................................................................................328
L03. What are the security services PKI provides?..............................328
L04. What are the main elements of a PKI?..........................................328
L05. What is a CertificationAuthority? ................................................329
L06. What is a digital certificate?...........................................................329
L07. What are public and private keys, and what is their relationship?329
L08. What are Certificate Policies (CPs)?.............................................329
L09. How does a PKI ensure data confidentiality?...............................330
L10. What is a digital signature?............................................................330
L11. How does a digital signature work?...............................................330
L12. Does ZyXELprovide CAservice?..................................................331
L13. What if customers don't have access to CAservice, but would
like to use PKI function?.........................................................................332
All contents copyright (c) 2006 ZyXEL Communications Corporation.