ZyXEL Communications SBG Series Manual

SBG Series
Wireless N Fiber WAN Small Business Gateway
(Green Product)
Version 1.00
Edition 1, 04/2014
Copyright © 2014 ZyXEL Communications Corporation
Support Notes

Table of Contents
Chapter 1......................................................................................................................................................3
Introduction .........................................................................................................................................3
Feature/Function Introduction......................................................................................................3
Application Scenario Introduction...............................................................................................3
Chapter 2......................................................................................................................................................4
Multi-WAN connectivity with load balancing and fail over ................................................4
Increased bandwidth and reach ..................................................................................................4
Robust security designs ..................................................................................................................4
Secure business access via VPN..................................................................................................5
Comprehensive management.......................................................................................................5
Chapter 3......................................................................................................................................................6
Scenario 1 –VLAN ............................................................................................................................6
Scenario 2 –Firewall........................................................................................................................7
Scenario 3 –User Access Control ...............................................................................................9
Scenario 4 –3G backup................................................................................................................10
Scenario 5 –NAT .............................................................................................................................11
Scenario 6 –FullFeature NAT .....................................................................................................12
Scenario 7 –Virtual Private Network (VPN) .........................................................................14
Scenario 8 –802.1x.......................................................................................................................17
Scenario 9 –Maintenance Log ...................................................................................................18
Chapter 4....................................................................................................................................................20
Product FAQ: .....................................................................................................................................20
Wireless FAQ......................................................................................................................................28

ZyXEL –SBG Support Notes
Back to Table of Contents
3
Chapter 1
Introduction
The ZyXEL SBG (Small Business Gateway) Series is the ―Multi-WAN
Gateway‖ which provides high speed internet access for business users. It
features not only VDSL2/ADSL2+ functionality, but also one GbE WAN with
SFP interface (SBG3500-N Series only). This comprehensive device can
flexibly offer Multi-WAN connectivity to adopt various Internet connection
interfaces.
Feature/Function Introduction
VDSL/bonding + GbE/SFP (SBG3500-N)
Multi-WAN connectivity with load balancing and failover
Up to 20 concurrent VPN sessions
4*GbE LANs
H/W Packet engines/IPSec engine
External Captive Web Portal
Metal case, Rack-Mountable, Front port
Robust security designs
Secure business access via VPN
Comprehensive management
Application Scenario Introduction
Internet Access
Wireless Access
Firewall defense against
Virtual Private Network (VPN) connection
Virtual Local Area Network (VLAN)
Maintenance Tool

ZyXEL –SBG Support Notes
Back to Table of Contents
4
Chapter 2
Multi-WAN connectivity with load balancing and fail-over
The ZyXEL SBG Series provides multiple WAN interfaces including DSL,
Gigabit Ethernet and 3G WAN backup to establish load balancing or backup
WAN connectivity. Service providers can flexibly offer WAN services of the
highest availability in one single box for small business owners to enjoy.
Powered by the load balancing and fail-over mechanisms among multiple
WANs, it maximizes WAN stability for mission-critical Internet applications
with benefits from the integrated bandwidth.
Increased bandwidth and reach
The SBG3500-N supports ADSL2+/VDSL2 bonding and dual-personality
Ethernet WAN functionalities that enable service providers to increase
bandwidth and extend coverage. With the available copper lines, service
providers can take advantage of ADSL2+/VDSL2 bonding to not only
provide higher speeds for the existing subscribers, but also improve the
reach to users faraway from central sites. If fiber lines are preferred, the
SBG3500-N Series can use the Small Form Pluggable (SFP) interface to
connect Fiber Ethernet that extend distance much longer with Gigabit-level
performance, or simply connect to other Ethernet WAN devices.
Robust security designs
Based on Access Control List (ACL) rules, Stateful Packet Inspection (SPI),
Denial of Service (DoS) and Distributed Denial of Service (DDoS) features,
the ZyXEL SBG Series provides the first-line defense against hackers,
network intruders and other harmful threats. The configurable
Demilitarized Zone (DMZ) is another benefit that provides more flexible
accessibility while preventing external attacks toward the confidential
resources and databases.

ZyXEL –SBG Support Notes
Back to Table of Contents
5
Secure business access via VPN
The ZyXEL SBG Series allow small businesses to establish stable Virtual
Private Network (VPN) connections with partners as well as branch offices.
Road warriors and telecommuters can use IPsec as well as L2TP or PPTP
VPN to safely access corporate networks without maintaining VPN software
on their PCs. The SBG Series is also designed with VPN HA features to
ensure that the VPN connectivity is always on for the business needs.
Comprehensive management
The ZyXEL SBG Series offer a two-level login privilege mechanism to
differentiate user segments; and the ISP can also define the policies for the
limited account to easily manage them with the integrated profile database.
It also provides TR-069 and Simple Network Management Protocol (SNMP)
for service providers to conduct remote device management tasks.

ZyXEL –SBG Support Notes
Back to Table of Contents
6
Chapter 3
Scenario 1 –VLAN
1.1 Application scenario
Since security is an issue, the IT manager would like to move the server to
a distinct broadcast domain called ServerGroup.
General user cannot access the Server or capture the server packets even
if they plug into same physical LAN.
Besides, both LAN users and the server can still access the Internet
without any issue.
1.2 Configuration Guide
1. Go to Network Setting> Interface Group/VLAN > Click on ―Add New
Interface Group―.
2. Enter the Group Name ServerGroup.
3. Enter the 802.1q number 10.
4. Enable the Port [LAN4] ―Member‖checkbox.
5. Click on ―Apply‖.

ZyXEL –SBG Support Notes
Back to Table of Contents
7
Scenario 2 –Firewall
2.1 Application scenario
SBG Series Firewall has the capability to limit only specific users from
accessing the LAN Server.
The others users‘ access requests will be dropped or rejected.
2.2 Configuration Guide
1. Go to Security> Firewall > Access Control > Click on ―Add new ACL
rule‖.
2. Add ACL rule for to allow specific users to access LAN RDP Server.
1. Enter the Filter Name ForRDP.
2. Select the Order ―1‖.
3. Select direction from WAN to LAN.
4. Select Source Device ―Specific IP Address‖.
5. Enter Source IP address 10.59.3.100.
6. Select Destination Device 192.168.1.50.
7. Select IP Type ―IPv4‖.
8. Select Service ―RDP‖.
9. Select Policy ―ACCEPT‖.
10.Click on ―Apply‖.
3. Add ACL rule to drop untrusted users from accessing the LAN RDP
Server.
1. Enter the Filter Name DropAny.

ZyXEL –SBG Support Notes
Back to Table of Contents
8
2. Select the Order ―2‖.
3. Select direction from ―WAN‖to ―LAN‖.
4. Select Source Device ―Specific IP Address‖.
5. Keep Source IP address empty (It means Any).
6. Select Destination Device ―PC-1(192.168.1.50)‖.
7. Select IP Type ―IPv4‖.
8. Select Service ―Specific Service‖.
9. Keep Protocol empty (means Any).
10.Select Policy ―Drop‖.
11.Click on ―Apply‖.
4. Go to Security> Firewall > General > Click Firewall ―Enable‖> Click on
―Apply‖.

ZyXEL –SBG Support Notes
Back to Table of Contents
9
Scenario 3 –User Access Control
3.1 Application scenario
The SBG Series User Access Control allows the IT manager to arrange
Internet access scheduling to limit specific or all LAN PCs Internet access
usage time.
3.2 Configuration Guide
1. Go to Security> User Access Control.
2. Add a new profile to control users.
1. Click ―Add new profile‖.
2. Check ―Active‖.
3. Enter User Access Control Name (ex: Team-Member).
4. Select Network User ―All‖.
5. Select working Day ―Monday‖, ―Tuesday‖, ―Wednesday‖, ―Thursday‖
and ―Friday‖.
6. Arrange Time ―07:00 till 18:00‖.
7. Click on ―Apply‖.
8. Select User Access Control ―Enable‖.
9. Click on ―Apply‖.

ZyXEL –SBG Support Notes
Back to Table of Contents
10
Scenario 4 –3G Backup
4.1 Application scenario
3G backup allows the SBG Series to keep the Internet connection when the
primary WAN connection has failed.
4.2 Configuration Guide
1. Go to Network Setting> Broadband > 3G WAN.
2. Enter the Username/Password if the ISP requires it.
3. Enter the PIN code if SIM card PIN is enabled.
4. Enter the Dial string.
5. Enter the APN string or number.
6. Select Connection ―Nailed UP‖if you would like to make the dongle
keep the connection.

ZyXEL –SBG Support Notes
Back to Table of Contents
11
7. Click on ―Apply‖.
Scenario 5 –NAT
5.1 Application scenario
NAT provides system administrators with an easy solution to create a
private IP network for security and IP management. Powered by NAT
technology, the SBG Series supports complete NAT mapping and most
popular Internet multimedia applications. This functionality is best
demonstrated with the NAT port forwarding feature implemented in the
CPE. In a scenario shown in the above diagram, we have an RDP server
installed behind the SBG Series with an IP assigned by the local DHCP
server (192.168.1.100). How should we configure the SBG Series, so that
the notebook at the WAN site can access the RDP server? The following
step-by-step guide illustrates the setup procedure.
5.2 Configuration Guide
5.2.1 Port Forwarding
1. Go to Network Setting> NAT > Port Forwarding.
2. Click on ―Add new rule‖.
3. Enable the ―Active‖checkbox.
4. Enter Service Name (ex: ForRDP).
5. Select current WAN Interface (ex: ADSL).
6. Enter Start Port 3389.
7. Enter End Port 3389.
8. Enter Translation Port 3389.
9. Enter Translation Port 3389.
10.Enter Server IP Address 192.168.1.100.

ZyXEL –SBG Support Notes
Back to Table of Contents
12
11.Select Protocol ―TCP‖.
12.Click on ―Apply‖.
5.2.2 Applications
1. Go to Network Setting> NAT > Applications.
2. Click on ―Add new application‖.
3. Select current WAN Interface (ex: ADSL).
4. Enter Server IP Address 192.168.1.100.
5. Select Application Category Applications.
6. Select Application Forwarded Remote Desktop Connection.
7. Click on ―OK‖.
Scenario 6 –FullFeature NAT
6.1 Application scenario
Another common question from customers is that they want to use
multiple public IP addresses on prestige routers and would NAT them their
internal IP addresses on one-to-one or many-to-one basis. This process is
very simple and explained below.
The scenario is Multiple Global IP addresses for clients and servers
(One-to-One, Many-to-One, Server Set mapping types are used).

ZyXEL –SBG Support Notes
Back to Table of Contents
13
In this case, we have 2 IP addresses from an ISP via ADSL.
We have a very busy internal FTP server and also LAN users.
In this case, we want to assign the 2 IP addresses by the following way
using 2 NAT rules.
-Rule 1 (One-to-One type) to map the FTP Server with LAN-IP1
(192.168.1.10) to WAN-IP1 (200.0.0.10).
-Rule 2 (Many-to-One type) to map the other clients
(192.168.1.20~192.168.1.100) to WAN-IP2 (200.0.0.20).
6.2 Configuration Guide
Activate FullFeature NAT of a specific WAN interface
1. Go to Network Setting> Broadband > WAN Interface ―ADSL‖> Click on
―Edit‖.
2. Select ―NAT Enable‖.
3. Select ―FullFeature NAT Enable‖.
4. Select NatSet number (ex: 1).
5. Click on ―Apply‖.
Remove FullFeature WAN interface from Multi-WAN rules
1. Go to Network Setting> Broadband > Multi-WAN >WAN Interface
―ADSL‖> Click on ―Delete‖.
2. Click on ―Yes‖.
Configure NAT Address Mapping rule for Server
1. Select Type NAT ―One-to-One‖
2. Enter Local Start IP 192.168.1.10.
3. Enter Global Start IP 200.0.0.10.
4. Select Set number 1.
5. Click on ―OK‖.
Configure NAT Address Mapping rule for General Users
1. Select Type NAT ―Many-to-One‖
2. Enter Local Start IP 192.168.1.20.
3. Enter Local End IP 192.168.1.100.
4. Enter Global Start IP 200.0.0.20.

ZyXEL –SBG Support Notes
Back to Table of Contents
14
5. Select Set number 1.
6. Click on ―OK‖.
Scenario 7 –Virtual Private Network (VPN)
7.1 Application scenario
VPN provides business users a highly secure path to transmit data. The
following two scenarios describe the general usage of VPNs.
-IPSec VPN (Site-to-Site):
-L2TP VPN:
7.2 Configuration Guide
7.2.1 IPSec VPN
SBG1:
Configure General information
1. Go to VPN > IPSec VPN > Setup.
2. Click on ―Add New Entry‖.
3. Check ―Enable‖.
4. Enter Connection Name (ex: VPNtoSBG2).
5. Enable the ―Nailed-up‖checkbox.
6. Enable the ―NAT Traversal (NAT-T)‖checkbox.

ZyXEL –SBG Support Notes
Back to Table of Contents
15
7. Select Application Scenario ―Site-to-Site‖.
8. Select My Address ―ADSL‖.
9. Enter Primary Peer Gateway Address 10.59.3.20.
Configure Authentication information
1. Select Key Exchange Mode ―Auto‖.
2. Select Pre-Shared Key and enter 12345678.
Configure Phase 1
1. Enter SA Life Time 86400.
2. Select Negotiation Mode ―Main‖.
3. Select Encryption ―AES192‖.
4. Select Authentication ―SHA1‖.
5. Select Key Group ―DH2‖.
6. Enable the Dead Peer Detection (DPD) checkbox.
Configure Phase 2
1. Enter SA Life Time 86400.
2. Select Tunnel Mode ―ESP‖.
3. Select Encapsulation ―Tunnel‖.
4. Select Encryption ―AES192‖.
5. Select Authentication ―SHA1‖.
6. Enable Perfect Forward Secrecy (PFS) and select ―DH2‖.
Configure Policy
1. Select Local IP Type ―Subnet‖.
2. Enter Local IP Address 192.168.1.0.
3. Enter Local Subnet Mask 255.255.255.0.
4. Select Remote IP Type ―Subnet‖.
5. Enter Remote IP Address 172.16.0.0.
6. Enter Remote Subnet Mask 255.255.0.0.
7. Click on ―Apply‖.
SBG2:
Configure General information
1. Go to VPN > IPSec VPN > Setup.
2. Click on ―Add New Entry‖.
3. Check ―Enable‖.

ZyXEL –SBG Support Notes
Back to Table of Contents
16
4. Enter Connection Name (ex: VPNtoSBG1).
5. Enable the ―Nailed-up‖checkbox.
6. Enable the ―NAT Traversal (NAT-T)‖checkbox.
7. Select Application Scenario ―Site-to-Site‖.
8. Select My Address ―ADSL‖.
9. Enter Primary Peer Gateway Address 10.59.3.10.
Configure Authentication information
1. Select Key Exchange Mode ―Auto‖.
2. Select Pre-Shared Key and enter 12345678.
Configure Phase 1
1. Enter SA Life Time 86400.
2. Select Negotiation Mode ―Main‖.
3. Select Encryption ―AES192‖.
4. Select Authentication ―SHA1‖.
5. Select Key Group ―DH2‖.
6. Enable the Dead Peer Detection (DPD) checkbox.
Configure Phase 2
1. Enter SA Life Time 86400.
2. Select Tunnel Mode ―ESP‖.
3. Select Encapsulation ―Tunnel‖.
4. Select Encryption ―AES192‖.
5. Select Authentication ―SHA1‖.
6. Enable Perfect Forward Secrecy (PFS) and select ―DH2‖.
Configure Policy
1. Select Local IP Type ―Subnet‖.
2. Enter Local IP Address 172.16.0.0.
3. Enter Local Subnet Mask 255.255.0.0.
4. Select Remote IP Type ―Subnet‖.
5. Enter Remote IP Address 192.168.1.0.
6. Enter Remote Subnet Mask 255.255.255.0.
7. Click on ―Apply‖.
7.2.2 L2TP/PPTP VPN
Active L2TP VPN default rule

ZyXEL –SBG Support Notes
Back to Table of Contents
17
1. Go to VPN > IPSec VPN > Setup.
2. Click Default_L2TPVPN ―Edit‖.
3. Check ―Enable‖.
4. Pre-Shared Key is 12345678 by default.
5. Click on ―Apply‖.
Configure L2TP/PPTP Policy
1. Go to VPN > L2TP VPN/PPTP VPN > Setup.
2. Check Enable.
3. Enter IP Address Pool 10.2.1.1 –10.2.1.32.
4. Click on ―Apply‖.
Scenario 8 –802.1x
8.1 Application scenario
SBG series supports 802.1x. This feature provides IT managers with a
solution to control the enterprise wireless environment. The wireless users
require RADIUS authentication when they connect to the SBG SSID.
8.2 Configuration Guide
Disable WPS
1. Go to Network Setting > Wireless > WPS.

ZyXEL –SBG Support Notes
Back to Table of Contents
18
2. Select WPS ―Disable‖.
3. Click on ―Apply‖.
Configure 802.1x
1. Go to Network Setting > Wireless > General.
2. Select Wireless ―Enable‖.
3. Enter Wireless Network Name (SSID) (ex: ZyXEL).
4. Enter Max Clients (ex: 32).
5. Select Security Mode ―WPA/WPA2‖.
6. Enter IP Address 10.59.0.50(RADIUS Server).
7. Enter Port Number 1812.
8. Enter Shared Secret 12345678.
9. Click on ―Apply‖.
Scenario 9 –Maintenance Log
9.1 Application Scenario
Log file is an important method for IT Managers to monitor the device
status. SBG Series has the capability to save the log to Local database,
Remote Syslog Server and also Email inform user.

ZyXEL –SBG Support Notes
Back to Table of Contents
19
9.2 Configuration Guide
9.2.1 Local File
1. Go to Maintenance > Log Setting.
2. Select Syslog Logging ―Enable‖.
3. Select Mode ―Local File‖.
4. Check Active Log and Alert ―Items (System, DHCP Client, etc.)‖.
5. Click on ―Apply‖.
9.2.2 Remote/Local File and Remote
1. Go to Maintenance > Log Setting.
2. Select Syslog Logging ―Enable‖.
3. Select Mode ―Remote‖.
4. Enter Syslog Server 10.59.3.100.
5. Enter UDP Port 514.
6. Check Active Log and Alert ―Items (System, DHCP Client, etc.)‖.
7. Click on ―Apply‖.
9.2.3 E-mail Log Settings
Configure Email Notification
1. Go to Maintenance > Email Notification.
2. Click on ―Add New Email‖.
3. Enter Mail Server mail.zyxel.com.tw.
4. Enter Authentication Username test.
5. Enter Authentication Password 1234.
6. Enter Account Email Address [e-mail].
7. Click on ―Apply‖.
Configure Log Setting
1. Go to Maintenance > Log Setting.
2. Select Syslog Logging ―Enable‖.
3. Enter Mail Server mail.zyxel.com.tw.
4. Enter System Log Mail Subject SBG - System Log.
5. Enter Security Log Mail Subject SBG - Security Log.
6. Enter Send Log to [e-mail].
7. Enter Send Alarm to [e-mail].
8. Check Active Log and Alert ―Items (System, DHCP Client…etc)‖.
9. Click on ―Apply‖.

ZyXEL –SBG Support Notes
Back to Table of Contents
20
Chapter 4
Product FAQ:
Will the device work with my Internet connection?
SBG Series is designed to be compatible with major ISPs that utilize ADSL
as a broadband service. SBG Series offers Ethernet ports to connect to
your computer so the device is placed in the line between the computer
and your ISP.
Why do I need to use SBG Series?
If you need an ADSL/VDSL modem/router to use with an ADSL/VDSL line,
SBG Series is an ideal device for such application. The device has 4
Ethernet ports (LAN ports) and ADSL/VDSL WAN port. You should connect
your computer to the LAN port and connect the ADSL/VDSL line to the
WAN port. If the ISP uses PPPoE or PPPoA, you need a user account and
password to access the Internet.
What is PPPoE?
PPPoE stands for Point-to-Point Protocol over Ethernet; it is an IETF draft
standard specifying how a computer interacts with a broadband modem
(i.e. xDSL, cable, wireless, etc.) to achieve access to the high-speed data
networks via a familiar PPP dialer such as 'Dial-Up Networking' user
interface. PPPoE supports a broad range of existing applications and
services including authentication, accounting, secure access and
configuration management. There are many service providers running of
PPPoE today. Before configuring PPPoE in the device, please make sure
your ISP supports PPPoE.
Does the SBG Series support PPPoE?
Yes. All SBG Series supports PPPoE.
What is PPPoA?