ZyXEL Communications ZyXEL ZyWALL 5 Manual

ZyWALL 5
Security Appliance
Support Notes
Version 4.01
Jun. 2006

ZyWALL5 Support Notes
2
INDEX
Application Notes....................................................................................................12
Seamless Incorporation into your network..........................................................12
Using Transparent (Bridge Mode) Firewall ............................................12
Internet Connection...................................................................................17
DHCP server/client/relay + flexible port role configuration..................19
Using NAT/Multi-NAT ..............................................................................23
Optimize network performance & availability....................................................33
Using Bandwidth Management ................................................................33
Secure Connections across the Internet and Wireless LAN.................................47
Site-to-Site VPN (Intranet) Scenario........................................................47
Configure ZyWALLs with Static WAN IPAddress.............................47
Configure ZyWALL with Dynamic WAN IPAddress.........................48
Configure ZyWALL behind NAT Router ............................................50
Mapping multiple Network policy to same gateway policy................52
Using Certificate for Device Authentication........................................57
Using Self-signed Certificates .....................................................58
Online Enroll Certificates............................................................61
Offline Enroll Certificates............................................................70
Using Pre-Shared Key for Device Authentication.............................103
Using VPN routing between branches...............................................104
Never lost your VPN connection (IPSec High Availability)..............114
How to configure the VPN HA..................................................115
Access control and security VPN connection (Security policy
enforcement IPSec)............................................................................117
How to configure access control rule over VPN .......................118
How to configure Security policy (AV/IDP/AS) over VPN......122
How to configure Web filtering rule over VPN – Content Filter124
ZyWALLvs 3rd Party VPN Gateway....................................................125
SonicWALL with ZyWALL VPN Tunneling.............................125
NetScreen with ZyWALL VPN Tunneling................................134
Check Point with ZyWALL VPN Tunneling ............................148
FortiNet with ZyWALL VPN Tunneling ...................................183
Remote Access VPN Scenario.................................................................197
Using xAuth for User Authentication................................................198
ZyXEL VPN Client to ZyWALL Tunneling......................................200
Flexible Wireless Connection and Security...........................................209
Deploy the ZyWALL WLAN security policy....................................210
All contents copyright (c) 2006 ZyXEL Communications Corporation.

ZyWALL5 Support Notes
3
Threat Management...........................................................................................214
To protect computer networks against virus intrusions and attacks
from Internet............................................................................................215
To Control IM/P2PApplications Usage to Increase Employee
Productivity..............................................................................................221
To filter non-work related and unproductive web surfing to mitigate
spyware and phishing threats .................................................................226
To eliminate spam mails to block unwanted messages everyday.........236
Threat Reports....................................................................................................241
Centralized Management...................................................................................246
Using Vantage CNM for Management...................................................246
FAQ ...........................................................................................................................251
A. Product FAQ .................................................................................................251
A01. What is the ZyWALLInternet Access Sharing Router?.............251
A02. Will the ZyWALL work with my Internet connection?...............251
A03. What do I need to use the ZyWALL?............................................251
A04. What is PPPoE? ..............................................................................251
A05. Does the ZyWALLsupport PPPoE?..............................................252
A06. How do I know I am using PPPoE? ..............................................252
A07. Why does my Internet Service Provider use PPPoE?..................252
A08. How can I configure the ZyWALL?..............................................252
A09. What can we do with ZyWALL?...................................................252
A10. Does ZyWALLsupport dynamic IP addressing?.........................252
A11. What is the difference between the internal IP and the real IP
from my ISP?............................................................................................252
A12. How does e-mail work through the ZyWALL?............................253
A13. Is it possible to access a server running behind NAT from the
outside Internet? If possible, how?.........................................................253
A14. What DHCPcapability does the ZyWALL support?...................253
A15. What are the capability of wireless feature of ZyWALL.............253
A16. What is the coverage range of Wireless in ZyWALL?.................253
A17. How do I used the reset button, more over what field of
parameter will be reset by reset button?................................................253
A18. What network interface does the new ZyWALL series support?254
A19. How does the ZyWALLsupport TFTP?.......................................254
A20. Can the ZyWALL support TFTPover WAN?..............................254
A21. How can I upload data to outside Internet over the one-way
cable?.........................................................................................................254
All contents copyright (c) 2006 ZyXEL Communications Corporation.

ZyWALL5 Support Notes
4
A22. My ZyWALLcan not get an IP address from the ISPto connect
to the Internet, what can I do?................................................................254
A23. What is BOOTP/DHCP?................................................................255
A24. What is DDNS?................................................................................255
A25. When do I need DDNS service?.....................................................256
A26. What DDNS servers does the ZyWALLsupport?........................256
A27. What is DDNS wildcard? ...............................................................256
A28. Does the ZyWALLsupport DDNS wildcard?...............................256
A29. Can the ZyWALLNAT handle IPSec packets sent by the VPN
gateway behind ZyWALL? .....................................................................256
A30. How do I setup my ZyWALLfor routing IPSec packets over
NAT? .........................................................................................................256
A31. What is STP(Spanning Tree Protocol) /RSTP (Rapid STP)?.....257
A32. What is the flow ZyWALL handles inbound and outgoing
traffic?.......................................................................................................257
A33. What is “UTM”?.............................................................................257
A34. What are the differences between ZyWALLUTM models and
previous ZyWALL models?.....................................................................257
A35. What are the key new features of ZyWALLUTM?.....................258
B. Firmware Upgrade FAQ................................................................................258
B01. Which ZyWALLmodels are eligible to be upgraded to run
ZyNOS v4.01?...........................................................................................258
B02. Why it’s conditional to upgrade to ZyNOS v4.01 for ZyWALL
70?..............................................................................................................259
B03. What is ZyNOS v3.65 for ZyWALL 70?........................................259
B04. What happens if I wrongfully upgrade firmware of a ZyWALL
70 with only 32MB of RAM to ZyNOS v4.01 directly?........................259
B05. What happened if I upgrade a ZyWALL 70 running ZyNOS
v3.62/3.63/3.64 to v4.01 directly?............................................................260
B06. I am a 32MB ZyWALL70 owner, how can I upgrade to ZyNOS
v4.01 having AV+IDP and AS features?.................................................260
B07. If I were a 32MB ZyWALL 70 owner and a Content Filtering
service subscriber, will my current license status be retained after
joining your ZyWALL 70 trade-in promotion?.....................................260
B08. What’s the firmware upgrade path for my current ZyWALL 5
and ZyWALL 35?.....................................................................................260
B09. After a successful firmware upgrade to ZyNOS v4.01, what’s the
default setting of AV+IDP, AS and CF? .................................................260
All contents copyright (c) 2006 ZyXEL Communications Corporation.

ZyWALL5 Support Notes
5
B10. What happens to my original system configurations after a
successful firmware upgrade to ZyNOS v4.01?....................................261
B11. What’s the downgrade procedure of ZyWALL70 running
ZyNOS v4.01?...........................................................................................261
B12. Can I downgrade a ZyWALL5 or ZyWALL 35 running ZyNOS
v4.01 back to ZyNOS v3.64 (or below)?.................................................261
C. Turbo Card FAQ............................................................................................261
C01. Can I insert the ZyWALLTurbo Card & wireless card
simultaneously into ZyWALL5, ZyWALL 35 or ZyWALL70?..........261
C02. Except ZyWALLTurbo Card is a must when use AV+IDP service,
what exactly I can get benefit from it?...................................................262
C03. Do I must have a ZyWALLTurbo Card inserted if I upgraded to
ZyNOS v4.01? If not, when must I insert a ZyWALLTurbo Card into
my ZyWALL device?...............................................................................262
D. Firewall FAQ.................................................................................................262
D01. What is a network firewall?...........................................................262
D02. What makes ZyWALL secure? .....................................................262
D03. What are the basic types of firewalls?...........................................263
D04. What kind of firewall is the ZyWALL?........................................263
D05. Why do you need a firewall when your router has packet
filtering and NAT built-in?.....................................................................264
D06. What is Denials of Service (DoS)attack?.......................................264
D07. What is Ping of Death attack? .......................................................264
D08. What is Teardrop attack?..............................................................264
D09. What is SYN Flood attack?............................................................265
D10. What is LAND attack? ...................................................................265
D11. What is Brute-force attack?...........................................................265
D12. What is IP Spoofing attack?...........................................................265
D13. What are the default ACL firewall rules in ZyWALL?..............265
D14. In ZyWALL, is DMZ behind NAT or not? ..................................266
D15. Can I use both public and private IP addresses on DMZ?..........266
D16. Why does traffic redirect/static/policy route be blocked by
ZyWALL?.................................................................................................266
D17. How can I protect against IP spoofing attacks?...........................268
E. Security Service licenses FAQ ......................................................................269
E01. What is iCard?.................................................................................269
E02. Where can I buy the iCard and how much does it cost?.............269
E03. How many kinds of iCard does ZyXEL provide? ........................269
All contents copyright (c) 2006 ZyXEL Communications Corporation.

ZyWALL 5 Support Notes
6
E04. Is each type of iCard device specific?............................................269
E05. What are the available security service licenses which require
additional purchase and license activation in ZyNOS v4.01?..............269
E06. What kind of iCard should I buy?.................................................270
E07. If I violate the mappings described above, for example, using a
silver iCard for ZyWALL35 or ZyWALL70, what will happen?.......270
E08. Can I try the Content Filtering service for free? How long is the
free trial period of Content Filtering service?.......................................270
E09. Does ZyXELprovide customers free trial forAV+IDP service?
How long is it?..........................................................................................270
E10. Does ZyXELprovide customers free trial forAnti-Spam service?
How long is it?..........................................................................................271
F. Security Service Activation and UpdateFAQ.................................................271
F01. Why do I have to register?..............................................................271
F02. In addition to registration, what can I do with myZyXEL.com?271
F03. Is there anything changed on myZyXEL.com because of the
launch of ZyNOS v4.00? Which ZyWALL models can be registered
via myZyXEL.com?.................................................................................272
F04. What’s the difference between new registration flow and
previous registration? What’s the advantage of new registration flow
over the previous registration flow?.......................................................272
F05. If I were new to myZyXEL.com, what are the required fields
when I register my ZyWALLdevice on myZyXEL.com?....................272
F06. When using the new registration flow of myZyXEL.com for
ZyNOS v4.0, do I have to create a new account if I were already a
registered user on myZyXEL.com?........................................................273
F07. What is mySecurityZone?...............................................................273
F08. What is Update Server?..................................................................273
F09. Who maintains mySecurityZone & Update Server?....................273
F10. What’s the URL for these service portals?....................................274
G. Anti-Virus FAQ..............................................................................................274
G01. Why should I need a gatewayAnti-Virus solution while I already
deployed the Anti-Virus software on each desktop/laptop?.................274
G02. Why does ZyWALLbundle Anti-Virus and IDP feature
together?...................................................................................................274
G03. Can I subscribe to the Anti-Virus service alone or IDP service
alone? ........................................................................................................274
G04. What are the hardware requirements to run AV+IDPsecurity
All contents copyright (c) 2006 ZyXEL Communications Corporation.

ZyWALL 5 Support Notes
7
service?......................................................................................................275
G05. Now I know that the ZyWALLTurbo Card is a must when use
AV+IDP service; but what exactly I can benefit from the ZyWALL
Turbo Card?.............................................................................................275
G06. How do I keep signatures ofAV+IDP service updated?..............275
G07. How often does ZyXELrelease signatures ofAV+IDPsecurity
service?......................................................................................................275
G08. Will the traffic coming in through the VPN tunnel also be
scanned by Anti-Virus, IDPand Anti-Spam feature in ZyWALL
ZyNOS v4.0?.............................................................................................275
H. IDP FAQ........................................................................................................276
H01. Why does ZyWALLbundle Anti-Virus and IDP feature
together?...................................................................................................276
H02. Can I subscribe to the Anti-Virus service alone or IDP service
alone? ........................................................................................................276
H03. What are the hardware requirements to run AV+IDPsecurity
service?......................................................................................................276
H04. Now I know that the ZyWALLTurbo Card is a must when use
AV+IDP service; but what exactly I can benefit from the ZyWALL
Turbo Card?.............................................................................................276
H05. Could I duplicate the IDP feature’s policy settings from one
ZyWALL device to another?...................................................................276
H06. How do I keep signatures ofAV+IDP service updated?..............277
H07. How often does ZyXELrelease signatures ofAV+IDPsecurity
service?......................................................................................................277
H08. Will the traffic coming in through the VPN tunnel also be
scanned by Anti-Virus, IDPand Anti-Spam feature in ZyWALL
ZyNOS v4.0?.............................................................................................277
I. Anti-Spam FAQ..............................................................................................277
I01. What’s the difference between gatewayAnti-Spam and
client-basedAnti-Spam filter such as Microsoft Outlook’s?................277
I02. A customer already has her/his own exchange server including the
Anti-Spam software from other vendors; is there any good reason for
her/him to use ZyXEL’sAnti-Spam service in addition to the current
solution?....................................................................................................277
I03. What happens when an email with large attachment in size, e.g.
5MB, is downloaded which has virus in it?...........................................278
I04. What happens if the virus is in the last part of the email message
All contents copyright (c) 2006 ZyXEL Communications Corporation.

ZyWALL 5 Support Notes
8
and the email receiver already got a part of the contaminated file in
her/his laptop or desktop?.......................................................................278
I05. Will the traffic coming in through the VPN tunnel also be
scanned by Anti-Virus, IDPand Anti-Spam feature in ZyWALL
ZyNOS v4.0?.............................................................................................278
I06. In ZyWALL’s Anti-Spam feature, what’s your recommendation to
handle identified spam emails?...............................................................278
I07. What’s the specification of Anti-Spam feature in ZyNOS v4.01?279
I08. How do I keep signatures ofAnti-Spam service update? .............279
J. Content Filter FAQ.........................................................................................279
J01. What's the operation between ZyXELappliance and BlueCoat
data center? ..............................................................................................279
J02. How many entries can the cache of Web Site Auto Categorization
keep at most?............................................................................................280
J03. Can I specify the time out value of the query response from
BlueCoat data center? .............................................................................280
J04. Can I decide whether to forward or drop the HTTP response if
the query to BlueCoat data center is timed out?...................................280
J05. How to register for BlueCoat service? ...........................................280
J06. Why can't I make registration successfully?.................................280
J07. What services can I get with Trial Registration?..........................280
J08. What types of content filter does ZyWALL provide?...................280
J09. What are the primary features of ZyXELContent Filtering?.....281
J10. Who needs ZyXELContent Filtering? Is ZyXELContent
Filtering for small companies or for large corporations?....................281
J11. Can I have different policies in effect for different times of the
day or week?.............................................................................................281
J12. How many policies can I create? ....................................................281
J13. Can I create my own categories?....................................................282
J14. Can I override (block or allow) certain URLs regardless of the
rating?.......................................................................................................282
J15. How many URL keywords does ZyWALL support?....................282
J16. How do I keep database of Content Filtering service updated?..282
J17. What is BlueCoat Filter list?...........................................................282
J18. How many ratings does the BlueCoat database contain? ............282
J19. How often does BlueCoat update the database?...........................282
J20. How do I locate sites to block?........................................................283
J21. Do humans review the ratings? ......................................................283
All contents copyright (c) 2006 ZyXEL Communications Corporation.

ZyWALL 5 Support Notes
9
J22. How can I do if I find a WEB site is mis-categorized?.................283
J23. How many and what categories do you provide? .........................283
J24. How does the ZyXELcontent filtering handle dynamically
generated sites?........................................................................................285
J25. Does BlueCoat have more than one data center? Is the BlueCoat
Web Filter geographically load balanced? ............................................285
J26. Who can generate and view reports on BlueCoat WEB site?......285
J27. How can I get Content Filtering report?.......................................285
J28. Can I change the password for BlueCoat service? .......................286
J29. Which User Name & Password should I input for Content
Filtering report?.......................................................................................286
J30. My device can't get connected to Http://myZyXEL.com, so I can't
get into Registration page. What should I check? ................................286
K. IPSec FAQ.....................................................................................................287
K01. How many VPN tunnels are supported on ZyWALL?................287
K02. How to count my VPN tunnels on ZyWALL?..............................287
K03. What is VPN?..................................................................................288
K04. Why do I need VPN? ......................................................................288
K05. What are most common VPN protocols?......................................289
K06. What is PPTP?................................................................................289
K07. What is L2TP? ................................................................................289
K08. What is IPSec? ................................................................................289
K09. What is SA?.....................................................................................290
K10. What is Pre-Shared Key?...............................................................290
K11. What is Phase 1 ID for?..................................................................290
K12. What are Local ID and Peer ID?...................................................291
K13. Is my ZyWALLready for IPSec VPN?.........................................291
K14. How do I configure ZyWALL VPN?.............................................292
K15. What VPN protocols are supported by ZyWALL?......................292
K16. What types of encryption does ZyWALLVPN support?............292
K17. What types of authentication does ZyWALLVPN support?......292
K18. I am planning my ZyWALL-to-ZyWALLVPN configuration.
What do I need to know?.........................................................................292
K19. Does ZyWALLsupport dynamic secure gateway IP?.................293
K20. What VPN gateway that has been tested with ZyWALL
successfully?..............................................................................................293
K21. What VPN software that has been tested with ZyWALL
successfully?..............................................................................................293
All contents copyright (c) 2006 ZyXEL Communications Corporation.

ZyWALL 5 Support Notes
10
K22. Will ZyXEL support Secure Remote Management?...................294
K23. Does ZyWALLVPN support NetBIOS broadcast?.....................294
K24. Is the host behind NAT allowed to use IPSec?.............................294
K25. How do I configure ZyWALL with NAT for internal servers?...294
K26. I am planning my ZyWALLbehind a NAT router. What do I
need to know?...........................................................................................295
K27. Where can I configure Phase 1 ID in ZyWALL?.........................295
K28. How can I keep a tunnel alive?......................................................296
K29. Single, Range, Subnet, which types of IPaddress does ZyWALL
support in VPN/IPSec?............................................................................296
K30. Does ZyWALLsupport IPSec pass-through? ..............................296
K31. Can ZyWALL behave as a NAT router supporting IPSec pass
through and an IPSec gateway simultaneously?...................................296
K32. Will the traffic coming in through the VPN tunnel also be
scanned by Anti-Virus, IDPand Anti-Spam feature in ZyWALL
ZyNOS v4.0?.............................................................................................296
L. PKI FAQ........................................................................................................297
L01. Basic Cryptography concept..........................................................297
L02. What is PKI?....................................................................................297
L03. What are the security services PKI provides?..............................297
L04. What are the main elements of a PKI?..........................................298
L05. What is a CertificationAuthority? ................................................298
L06. What is a digital certificate?...........................................................298
L07. What are public and private keys, and what is their relationship?299
L08. What are Certificate Policies (CPs)?.............................................299
L09. How does a PKI ensure data confidentiality?...............................299
L10. What is a digital signature?............................................................300
L11. How does a digital signature work?...............................................300
L12. Does ZyXELprovide CAservice?..................................................301
L13. What if customers don't have access to CAservice, but would
like to use PKI function?.........................................................................301
L14. How can I have Self-signed certificate for ZyXEL appliance? ...301
L15. Can I create self-signed certificates in addition to the default
one?............................................................................................................302
L16. Will Self-signed certificate be erased if I reset to default
configuration file?....................................................................................302
L17. Will certificates stored in ZyXELappliance be erased if I reset to
default configuration file?.......................................................................302
All contents copyright (c) 2006 ZyXEL Communications Corporation.