ZyXEL Communications ZyXEL ZyWALL 5 User manual

ZyWALL 5
Internet Security Appliance
Quick Start Guide
Version 4.02
Edition 1
12/2006
Copyright © 2006. All rights reserved.
Table of Contents
ENGLISH 1
DEUTSCH 15
ESPAÑOL 31
FRANÇAIS 47
ITALIANO 63
РУССКИЙ 79
SVENSKA 95
简体中文 111
繁體中文 125

ENGLISH
1
Overview
The ZyWALL 5 is a firewall with VPN, bandwidth management, content filtering, anti-spam, anti-virus, IDP
(Intrusion Detection and Protection) and many other features. You can use it as a transparent firewall and not
reconfigure your network nor configure the ZyWALL’s routing features. When the ZyWALL is in router mode,
you can also insert a 3G wireless card to add a second WAN. The ZyWALL increases network security by
adding the option to change port roles from LAN to DMZ for use with publicly accessible servers. This guide
covers the initial connections and configuration needed to start using the ZyWALL in your network.
See the User’s Guide for more information on all features.
You may need your Internet access information.
This guide is divided into the following sections.
1 Hardware Connections
You need the following.
1Hardware Connections
2Accessing the Web Configurator
3Bridge Mode
4Internet Access Setup and Product Registration
5DMZ
6NAT
7Firewall
8VPN Rule Setup
9Troubleshooting
ZyWALL Computer Ethernet Cables Power Adaptor

ENGLISH
2
Do the following to make hardware connections for initial setup.
1Use an Ethernet cable to connect the LAN/DMZ port to a computer. If you configure these ports as DMZ
ports in the LAN or DMZ screen through the web configurator, you can also use Ethernet cables to connect
public servers (web, e-mail, FTP, etc.) to the LAN/DMZ ports.
2Use another Ethernet cable to connect the WAN port to an Ethernet jack with Internet access.
3Insert the ZyWALL Turbo extension card to use the anti-virus and IDP features or insert a wireless LAN
card to use the wireless LAN feature. You can optionally insert a 3G wireless card to access the Internet
wirelessly via a 3G network. See the ZyWALL Turbo Card guide for more information about the extension
card. See the user’s guide about installing a wireless LAN card. At the time of writing, you can only use the
Sierra AC850/860 3G wireless card in the ZyWALL.
4Use the included power adaptor to connect the power socket (on the rear panel) to a power outlet.

ENGLISH
3
5Look at the front panel. The PWR LED turns on. The SYS LED blinks while performing system testing and
then stays on if the testing is successful. The ACT, CARD, LAN/DMZ and WAN LEDs turn on and stay on
if the corresponding connections are properly made.
2 Accessing the Web Configurator
Use this section to configure the WAN 1 interface for Internet access.
5The HOME screen opens.
The ZyWALL is in router mode by default. Continue to the next step if you want to use routing features such as
NAT, DHCP and VPN.
Go to Section 3 if you prefer to use the ZyWALL as a transparent firewall.
6Check the network status table. If the WAN 1 status is not Down and there is an IP address, go to Section
5.
If the WAN 1 status is Down (or there is not an IP address), click the Wizard icon and use Section 4 to
configure WAN 1.
1Launch your web browser. Enter 192.168.1.1 (the
ZyWALL’s default IP address) as the address.
If the login screen does not display, see Section
9.1 to set your computer’s IP address.
2Click Login (the default password 1234 is already
entered).
3Change the login password by entering a new
password and clicking Apply.
4Click Apply to replace the ZyWALL’s default
digital certificate.

ENGLISH
4
Use the NETWORK WAN screens if you need to configure WAN 2. You can also configure load balancing
between the WAN connections.
3 Bridge Mode
When you set the ZyWALL to bridge mode, it functions as a transparent firewall. Do the following to set the
ZyWALL to bridge mode.
4 Internet Access Setup and Product Registration
1Click the Wizard icon ( ) in the HOME screen and then the Internet Access Setup link to open the
Internet access wizard.
1Click MAINTENANCE in the navigation
panel and then Device Mode.
2Select Bridge and configure a (static)
IP address subnet mask and gateway
IP address for the ZyWALL’s LAN,
WAN, DMZ and WLAN interfaces.
3Click Apply. The ZyWALL restarts.
Skip to Section 5 if you have servers that
you need to be accessible from the WAN.

ENGLISH
5
Enter the Internet access information exactly as given to you.
If you were given an IP address to use, select Static in the IP Address Assignment drop-down list box and
enter the information provided.
"The fields vary depending on what you select in the Encapsulation field. Fill them in with the
information provided by the ISP or network administrator.
Click Apply when you are done.
•PPP over Ethernet or PPTP Encapsulation
Select Nailed-Up when you want your connection up all the time (this could be expensive if your ISP bills you
for Internet usage time instead of a flat monthly fee).
•Ethernet Encapsulation
Configure a Roadrunner service in the
NETWORK WAN screens (use the WAN
tab).

ENGLISH
6
To not have the connection up all the time, specify an idle time-out period (in seconds) in Idle Timeout.
2Click Next to display the screen where you can
register your ZyWALL with myZyXEL.com
(ZyXEL’s online services center) and activate the
free content filtering, anti-spam, anti-virus and IDP
trial applications. Otherwise, click Skip and then
Close to complete Internet access setup.
"Make sure you have installed the ZyWALL Turbo Card before you activate the IDP and anti-
virus subscription services.
Turn the ZyWALL off before you install or remove the ZyWALL Turbo Card.

ENGLISH
7
3If you already have an account at
myZyXEL.com, select Existing myZyXEL.com
account and enter account information.
Otherwise, select New myZyXEL.com account
and fill in the fields below to create a new
account and register your ZyWALL. Click Next.
4Wait for the registration progress to finish.
5The following screen displays if the registration
was not successful. Click Return to go back to
the Device Registration screen and check your
settings.
6Click Close to leave the wizard screen when
the registration and activation are done.

ENGLISH
8
"If you want to activate a standard service with your iCard’s PIN number (license key), use the
REGISTRATION Service screen. See the user’s guide for details.
5 DMZ
The DeMilitarized Zone (DMZ) allows public servers (web, e-mail, FTP, etc.) to be visible to the outside world
and still have firewall protection from DoS (Denial of Service) attacks.
You can assign TCP/IP configuration via DHCP to computers connected to the DMZ ports. Otherwise,
configure the computers with static IP addresses (in the same subnet as the DMZ port's IP address) and DNS
server addresses. Use the ZyWALL's DMZ IP address as the default gateway.
Do the following to configure the DMZ if the ZyWALL is in routing mode.
"You do not need to configure DMZ with bridge mode, skip to Section 7.
1Click NETWORK > DMZ in the navigation panel.
2Specify an IP address and subnet mask for the
DMZ interface.
If you use private IP addresses on the DMZ, use
NAT to make the servers publicly accessible (see
Section 6).
A public IP address must be on a separate subnet
from the WAN port’s public IP address. If you do
not configure NAT for the public IP addresses on
the DMZ, the ZyWALL routes traffic to the public IP
addresses on the DMZ without performing NAT.
This may be useful for hosting servers for NAT
unfriendly applications.
3Click Apply.
4By default, LAN/DMZ ports 1 to 4 are all LAN ports.
To configure a port as a DMZ port, click the Port
Roles tab, select its radio button next to DMZ and
click Apply.

ENGLISH
9
6 NAT
NAT (Network Address Translation - NAT, RFC 1631) means the translation of an IP address in one network
to a different IP address in another. You can use the NAT Address Mapping screens to have the ZyWALL
translate multiple public IP addresses to multiple private IP addresses on your LAN (or DMZ).
The following example allows access from the WAN1 to an HTTP (web) server on the DMZ. The server has a
private IP address of 10.0.0.20.
1Click ADVANCED > NAT in the
navigation panel and then Port
Forwarding.
2Select the WAN connection (WAN1) for
which you want to configure port
forwarding rules.
3Select the Active check box.
4Type a name for the rule.
5Type the port number that the service
uses.
6Type the HTTP server’s IP address.
7Click Apply.
7 Firewall
You can use the ZyWALL without configuring the firewall.
The ZyWALL’s firewall is pre-configured to protect your LAN from attacks from the Internet. By default, no
traffic can enter your LAN unless a request was generated on the LAN first. The ZyWALL allows access to the
DMZ from the WAN or LAN, but blocks traffic from the DMZ to the LAN.
If you are using the ZyWALL in router mode, continue with the next section. For bridge mode, skip to Section
9.