ZyXEL Communications SBG Series Manual

SBG Series
Wireless N Fiber WAN Small Business Gateway
(Green Product)
Version 1.00
Edition 1, 04/2014
Copyright © 2014 ZyXEL Communications Corporation
Support Notes

Table of Contents
Chapter 1......................................................................................................................................................3
Introduction .........................................................................................................................................3
Feature/Function Introduction......................................................................................................3
Application Scenario Introduction...............................................................................................3
Chapter 2......................................................................................................................................................4
Multi-WAN connectivity with load balancing and fail over ................................................4
Increased bandwidth and reach ..................................................................................................4
Robust security designs ..................................................................................................................4
Secure business access via VPN..................................................................................................5
Comprehensive management.......................................................................................................5
Chapter 3......................................................................................................................................................6
Scenario 1 –VLAN ............................................................................................................................6
Scenario 2 –Firewall........................................................................................................................7
Scenario 3 –User Access Control ...............................................................................................9
Scenario 4 –3G backup................................................................................................................10
Scenario 5 –NAT .............................................................................................................................11
Scenario 6 –FullFeature NAT .....................................................................................................12
Scenario 7 –Virtual Private Network (VPN) .........................................................................14
Scenario 8 –802.1x.......................................................................................................................17
Scenario 9 –Maintenance Log ...................................................................................................18
Chapter 4....................................................................................................................................................20
Product FAQ: .....................................................................................................................................20
Wireless FAQ......................................................................................................................................28

ZyXEL –SBG Support Notes
Back to Table of Contents
3
Chapter 1
Introduction
The ZyXEL SBG (Small Business Gateway) Series is the ―Multi-WAN
Gateway‖ which provides high speed internet access for business users. It
features not only VDSL2/ADSL2+ functionality, but also one GbE WAN with
SFP interface (SBG3500-N Series only). This comprehensive device can
flexibly offer Multi-WAN connectivity to adopt various Internet connection
interfaces.
Feature/Function Introduction
VDSL/bonding + GbE/SFP (SBG3500-N)
Multi-WAN connectivity with load balancing and failover
Up to 20 concurrent VPN sessions
4*GbE LANs
H/W Packet engines/IPSec engine
External Captive Web Portal
Metal case, Rack-Mountable, Front port
Robust security designs
Secure business access via VPN
Comprehensive management
Application Scenario Introduction
Internet Access
Wireless Access
Firewall defense against
Virtual Private Network (VPN) connection
Virtual Local Area Network (VLAN)
Maintenance Tool

ZyXEL –SBG Support Notes
Back to Table of Contents
4
Chapter 2
Multi-WAN connectivity with load balancing and fail-over
The ZyXEL SBG Series provides multiple WAN interfaces including DSL,
Gigabit Ethernet and 3G WAN backup to establish load balancing or backup
WAN connectivity. Service providers can flexibly offer WAN services of the
highest availability in one single box for small business owners to enjoy.
Powered by the load balancing and fail-over mechanisms among multiple
WANs, it maximizes WAN stability for mission-critical Internet applications
with benefits from the integrated bandwidth.
Increased bandwidth and reach
The SBG3500-N supports ADSL2+/VDSL2 bonding and dual-personality
Ethernet WAN functionalities that enable service providers to increase
bandwidth and extend coverage. With the available copper lines, service
providers can take advantage of ADSL2+/VDSL2 bonding to not only
provide higher speeds for the existing subscribers, but also improve the
reach to users faraway from central sites. If fiber lines are preferred, the
SBG3500-N Series can use the Small Form Pluggable (SFP) interface to
connect Fiber Ethernet that extend distance much longer with Gigabit-level
performance, or simply connect to other Ethernet WAN devices.
Robust security designs
Based on Access Control List (ACL) rules, Stateful Packet Inspection (SPI),
Denial of Service (DoS) and Distributed Denial of Service (DDoS) features,
the ZyXEL SBG Series provides the first-line defense against hackers,
network intruders and other harmful threats. The configurable
Demilitarized Zone (DMZ) is another benefit that provides more flexible
accessibility while preventing external attacks toward the confidential
resources and databases.

ZyXEL –SBG Support Notes
Back to Table of Contents
5
Secure business access via VPN
The ZyXEL SBG Series allow small businesses to establish stable Virtual
Private Network (VPN) connections with partners as well as branch offices.
Road warriors and telecommuters can use IPsec as well as L2TP or PPTP
VPN to safely access corporate networks without maintaining VPN software
on their PCs. The SBG Series is also designed with VPN HA features to
ensure that the VPN connectivity is always on for the business needs.
Comprehensive management
The ZyXEL SBG Series offer a two-level login privilege mechanism to
differentiate user segments; and the ISP can also define the policies for the
limited account to easily manage them with the integrated profile database.
It also provides TR-069 and Simple Network Management Protocol (SNMP)
for service providers to conduct remote device management tasks.

ZyXEL –SBG Support Notes
Back to Table of Contents
6
Chapter 3
Scenario 1 –VLAN
1.1 Application scenario
Since security is an issue, the IT manager would like to move the server to
a distinct broadcast domain called ServerGroup.
General user cannot access the Server or capture the server packets even
if they plug into same physical LAN.
Besides, both LAN users and the server can still access the Internet
without any issue.
1.2 Configuration Guide
1. Go to Network Setting> Interface Group/VLAN > Click on ―Add New
Interface Group―.
2. Enter the Group Name ServerGroup.
3. Enter the 802.1q number 10.
4. Enable the Port [LAN4] ―Member‖checkbox.
5. Click on ―Apply‖.

ZyXEL –SBG Support Notes
Back to Table of Contents
7
Scenario 2 –Firewall
2.1 Application scenario
SBG Series Firewall has the capability to limit only specific users from
accessing the LAN Server.
The others users‘ access requests will be dropped or rejected.
2.2 Configuration Guide
1. Go to Security> Firewall > Access Control > Click on ―Add new ACL
rule‖.
2. Add ACL rule for to allow specific users to access LAN RDP Server.
1. Enter the Filter Name ForRDP.
2. Select the Order ―1‖.
3. Select direction from WAN to LAN.
4. Select Source Device ―Specific IP Address‖.
5. Enter Source IP address 10.59.3.100.
6. Select Destination Device 192.168.1.50.
7. Select IP Type ―IPv4‖.
8. Select Service ―RDP‖.
9. Select Policy ―ACCEPT‖.
10.Click on ―Apply‖.
3. Add ACL rule to drop untrusted users from accessing the LAN RDP
Server.
1. Enter the Filter Name DropAny.

ZyXEL –SBG Support Notes
Back to Table of Contents
8
2. Select the Order ―2‖.
3. Select direction from ―WAN‖to ―LAN‖.
4. Select Source Device ―Specific IP Address‖.
5. Keep Source IP address empty (It means Any).
6. Select Destination Device ―PC-1(192.168.1.50)‖.
7. Select IP Type ―IPv4‖.
8. Select Service ―Specific Service‖.
9. Keep Protocol empty (means Any).
10.Select Policy ―Drop‖.
11.Click on ―Apply‖.
4. Go to Security> Firewall > General > Click Firewall ―Enable‖> Click on
―Apply‖.

ZyXEL –SBG Support Notes
Back to Table of Contents
9
Scenario 3 –User Access Control
3.1 Application scenario
The SBG Series User Access Control allows the IT manager to arrange
Internet access scheduling to limit specific or all LAN PCs Internet access
usage time.
3.2 Configuration Guide
1. Go to Security> User Access Control.
2. Add a new profile to control users.
1. Click ―Add new profile‖.
2. Check ―Active‖.
3. Enter User Access Control Name (ex: Team-Member).
4. Select Network User ―All‖.
5. Select working Day ―Monday‖, ―Tuesday‖, ―Wednesday‖, ―Thursday‖
and ―Friday‖.
6. Arrange Time ―07:00 till 18:00‖.
7. Click on ―Apply‖.
8. Select User Access Control ―Enable‖.
9. Click on ―Apply‖.

ZyXEL –SBG Support Notes
Back to Table of Contents
10
Scenario 4 –3G Backup
4.1 Application scenario
3G backup allows the SBG Series to keep the Internet connection when the
primary WAN connection has failed.
4.2 Configuration Guide
1. Go to Network Setting> Broadband > 3G WAN.
2. Enter the Username/Password if the ISP requires it.
3. Enter the PIN code if SIM card PIN is enabled.
4. Enter the Dial string.
5. Enter the APN string or number.
6. Select Connection ―Nailed UP‖if you would like to make the dongle
keep the connection.