ZyXEL Communications USG60 User manual

The advancements in how people work and collaborate have brought three major challenges to
small businesses. With the BYOD trend, small businesses today need to provide more Wi-Fi for an
exploding amount of smart devices. The use of cloud-based social and productivity applications
not only requires small businesses to be able to control, prioritize and block dierent applications
to stay productive, but also opens doors to new Web attacks. As threats evolve and these
business challenges diversify, IT costs will only continue to grow, which is a real problem for small
businesses with limited IT resources.
The new ZyXEL USG Performance Series are all-in-one Next Generation
Firewalls (NGFW) specically designed to fulll the demands BYOD,
malware protection, application regulation, and budget control in
small business environments. The built-in wireless AP (USG40W
and USG60W) and WLAN controller oer instant wireless hotspot
capability and future WLAN scalability. Comprehensive UTM
features and application intelligence technology provides deep,
extensive protection, while keeping businesses in control of
how Web applications are used. The all-in-one design integrates
everything small businesses need, delivering easier, more
centralized management and lower total cost of ownership (TCO).
Benets
Spend less, get more
The ZyXEL USG Performance Series oers small businesses the lowest total cost of ownership. The all-
in-one design provides everything small businesses need: anti-malware protection, VPN connectivity,
integrated WLAN controller, and built-in wireless access point. This truly integrated security solution
eliminates the need to purchase multiple appliances for dierent functions, and allows small businesses
to connect, protect and manage with just one device.
Peace of mind security
The ZyXEL USG Performance Series delivers enterprise-grade Next Generation Firewall security without
the hefty price tag. It provides deep, extensive protection and eective control of Web applications—like
Facebook, Google Apps and Netix—with such anti-malware protection mechanisms as rewall, anti-
virus, anti-spam, content ltering, IDP and application intelligence. No longer do small businesses need
to worry about threats, spam or social networking sites decreasing productivity.
• All-in-one Next Generation
Firewall (NGFW) for small
businesses
• Anti-malware protection with
rewall, anti-virus, anti-spam,
content ltering, IDP, and
next-generation application
intelligence
• Robust SSL, IPSec and L2TP over
IPSec VPN connectivity
• Integrated single-radio (USG40W)
or dual-radio (USG60W) wireless
access point
• Built-in WLAN controller for
centralized management of up to
10 APs
USG60/60W/40/40W
Unied Security Gateway—
Performance Series
Truly Integrated Security for Remote Ofces,
Retail Locations and Small Businesses

2
Wi-Fi where you need it
Addressing the trend of BYOD, the ZyXEL USG Performance Series helps small businesses provide Wi-Fi wherever there is demand. The USG40W and
USG60W feature built-in single-radio and dual-radio wireless access points that can provide Wi-Fi for small oces straight out of the box. With an
integrated WLAN controller, the USG Performance Series enables businesses to easily provide Wi-Fi in multiple other areas like reception areas and
meeting rooms when Wi-Fi demand grows.
Single point of management
Designed specically for businesses with limited IT resources, the ZyXEL USG Performance Series helps users connect, protect and manage with reduced
complexity. The unied security policy design oers easier, more unied and streamlined management of all the security features; while the integrated
WLAN controller provides centralized management of up to 10 APs. All this is integrated into a single solution, making it easy for users to manage VPN,
wireless and security all from one device.
Model List
USG60
Unied Security Gateway
USG40
Unied Security Gateway
USG60W
Unied Security Gateway
USG40W
Unied Security Gateway
• 6 x GbE RJ-45, 2 x USB (dual-WAN & mobile broadband)
• 1,000 Mbps rewall throughput
• 180 Mbps VPN throughput
• 120 Mbps IDP throughput
• 90 Mbps AV throughput
• 90 Mbps AV and IDP throughput
• 5 x GbE RJ-45, 1 x USB (dual-WAN & mobile broadband)
• 400 Mbps rewall throughput
• 100 Mbps VPN throughput
• 55 Mbps IDP throughput
• 50 Mbps AV throughput
• 50 Mbps AV and IDP throughput
• 6 x GbE RJ-45, 2 x USB (dual-WAN & mobile broadband)
• Built-in dual-radio AP (802.11 a/b/g/n)
• 1,000 Mbps rewall throughput
• 180 Mbps VPN throughput
• 120 Mbps IDP throughput
• 90 Mbps AV throughput
• 90 Mbps AV and IDP throughput
• 5 x GbE RJ-45, 1 x USB (dual-WAN & mobile broadband)
• Built-in single-radio AP (802.11 b/g/n)
• 400 Mbps rewall throughput
• 100 Mbps VPN throughput
• 55 Mbps IDP throughput
• 50 Mbps AV throughput
• 50 Mbps AV and IDP throughput
USG40W
Unied Securi
ty
Gatew
ay
• 90 Mbps AV and IDP throughpu
t
USG60W
Unied Security Gateway
USG60/60W/40/40W
Unified Security Gateway—Performance Series

3
Built-in Wireless AP
Built with single-radio and dual-radio wireless access
points, the ZyXEL USG40W and USG60W are ideal for
retail and oce environments. The USG60W integrates
802.11 a/b/g/n technology that delivers Wi-Fi over both
the 2.4 GHz and the 5 GHz spectrums.
Unied Security Policy
Unied security policy oers object-based management
and a unied conguration interface for rewall and all
security-related policies. Users can easily apply all policy
criteria to every UTM feature, reduce conguration time,
and get more streamlined policy management.
Anti-Virus
Powered by Kaspersky SafeStream II gateway anti-virus,
ZyXEL USGs provide comprehensive and real-time
protection against malware threats before they enter the
network. ZyXEL USGs can identify and block over 650,000
viruses right at the gate and provide high-speed scanning
with stream-based virus scanning technology.
Anti-Spam
With a cloud-based IP reputation system, ZyXEL anti-
spam can deliver accurate, zero-hour spam outbreak
protection by analyzing up-to-the-minute sender
reputation data from highly diverse trac sources. It
can detect spam outbreaks in the rst few minutes of
emergence regardless of spam language or format.
Robust VPN
ZyXEL USGs support high-throughput IPSec, L2TP over
IPSec and SSL VPN for a wide range of site-to-client
and site-to-site VPN deployments. Reinforced with the
advanced SHA-2 encryption, the ZyXEL USGs provide the
most secure VPN for business communications.
Feature Introduction
Integrated WLAN Controller
The integrated WLAN controller supports CAPWAP,
and enables centralized authentication and access
management of multiple APs in the network. The ZyXEL
USG Performance Series can manage 2 APs by default,
and up to 10 APs with license upgrade.
Application Intelligence
ZyXEL’s USG Performance Series can identify, categorize
and control over 3,000 social, gaming, productivity, and
other Web applications and behaviors. Users can prioritize
productive applications, throttle acceptable ones, and
block unproductive applications to boost productivity
and prevent bandwidth abuse.
Intrusion Detection & Prevention (IDP)
ZyXEL’s IDP system uses Deep Packet Inspection (DPI)
technology that can scan multiple layers and protocols
to inspect vulnerabilities invisible to simple port- and
protocol-based rewalls. ZyXEL’s IDP eliminates false
positives with a database of malware signatures and
provides eective protection against intrusions from
unknown back doors.
Content Filtering
ZyXEL content ltering helps screen access to websites
that are not business related or malicious. With a massive,
cloud-based database of over 140 billion URLs that are
continuously analyzed and tracked, ZyXEL provides highly
accurate, broad and instant protection against malicious
Web content.
Dual-WAN & Mobile Broadband
The ZyXEL USG Performance Series provides high Internet
uptime with dual-WAN and mobile broadband support.
Dual-WAN works with two Ethernet WAN connections for
active-active load balancing or active-passive failover.
Comprehensive mobile broadband USB modems are also
supported for WAN backup.
USG60/60W/40/40W
Unied Security Gateway—Performance Series

4
USG60/60W/40/40W
Unied Security Gateway—Performance Series
Application Diagram
Anti-malware protection and
application optimization
• Enabling anti-virus, anti-spam and
intrusion prevention, business
networks gain deep, extensive
protection against all types of
malware threats
• Content ltering enables businesses
to deny access to Websites that are
malicious or not business-related
• Application intelligence technology
not only enable businesses to block
or throttle non-productive Web
applications, but also optimize
Web applications that increase
productivity
VPN application
• Branch oces, partners and home
users can deploy ZyXEL USGs for
site-to-site IPSec VPN connections
• Branch oces can additionally
deploy IPSec VPN HA (load
balancing and failover) for always
online VPN connectivity
• Remote users can securely access
company resources with their
computers or smartphones via SSL,
IPSec and L2TP over IPSec VPN
• The headquarter USG can also
establish an IPSec VPN connection
with Microsoft Azure for secured
access to a variety of cloud-based
applications
Internet
Unied Security Gateway
Remote
Desktop Network Extend
BI
System Web Apps
Inventory
Server File Sharing
OA, ERP,
CRM System Email Server
DMZ Resources
Remote
Desktop Network Extend
BI
System Web Apps
Inventory
Server File Sharing
OA, ERP,
CRM System Email Server
DMZ Resources
Workgroup
Productive Web applications
Non-productive
Web applications
Viruses, intrusions,
malicious Websites,
email spam
SPAM
Anti-Virus Intrusion
Prevention
Anti-Spam Content
Filtering
Application Intelligence
& Optimization
Headquarters
Branch
Oce
Partner
Oce
SSL VPN
IPSec VPN
IPSec VPN
IPSec VPN
IPSec VPN
IPSec VPN HA
L2TP over
IPSec VPN
USG40W
Unied Security
Gateway
USG110
Unied Security
Gateway
USG1100
Unied Security
Gateway
USG1900
Unied Security
Gateway
Traveling
Employee
Traveling
Employee
Traveling
Employee
Home
User
Microsoft
Azure
Internet
Unied Security Gateway
Remote
Desktop Network Extend
BI
System Web Apps
Inventory
Server File Sharing
OA, ERP,
CRM System Email Server
DMZ Resources
Remote
Desktop Network Extend
BI
System Web Apps
Inventory
Server File Sharing
OA, ERP,
CRM System Email Server
DMZ Resources
Workgroup
Productive Web applications
Non-productive
Web applications
Viruses, intrusions,
malicious Websites,
email spam
SPAM
Anti-Virus Intrusion
Prevention
Anti-Spam Content
Filtering
Application Intelligence
& Optimization
Headquarters
Branch
Oce
Partner
Oce
SSL VPN
IPSec VPN
IPSec VPN
IPSec VPN
IPSec VPN
IPSec VPN HA
L2TP over
IPSec VPN
USG40W
Unied Security
Gateway
USG110
Unied Security
Gateway
USG1100
Unied Security
Gateway
USG1900
Unied Security
Gateway
Traveling
Employee
Traveling
Employee
Traveling
Employee
Home
User
Microsoft
Azure

5
USG60/60W/40/40W
Unified Security Gateway—Performance Series
Specications
Model USG60W USG60 USG40W USG40
Hardware Specifications
10/100/1000 Mbps RJ-45 ports 4 x LAN/DMZ, 2 x WAN 4 x LAN/DMZ, 2 x WAN 3 x LAN/DMZ,
1 x WAN, 1 x OPT
3 x LAN/DMZ,
1 x WAN, 1 x OPT
USB ports 2 2 1 1
Console port Yes (DB9) Yes (DB9) Yes (RJ-45) Yes (RJ-45)
Rack-mountable Yes (Optional) Yes - -
System Capacity & Performance*1
SPI firewall throughput (Mbps)*2 1,000 1,000 400 400
VPN throughput (Mbps)*3 180 180 100 100
IDP throughput (Mbps)*4 120 120 55 55
AV throughput (Mbps)*4 90 90 50 50
UTM throughput (AV and IDP)*4
90 90 50 50
Unlimited user licenses Yes Yes Yes Yes
Max. TCP concurrent sessions*5 40,000 40,000 20,000 20,000
New TCP session rate 3,000 3,000 3,000 3,000
Max. UTM (AV & IDP)
concurrent sessions*5 40,000 40,000 20,000 20,000
Max. concurrent IPsec VPN tunnels 20 20 10 10
Max. concurrent SSL VPN users 12 12 7 7
Included SSL VPN user no. 2 2 2 2
Customizable zones Yes Yes Yes Yes
IPv6 support Yes Yes Yes Yes
VLAN interface 16 16 8 8
WLAN Management
AP Controller (APC) ver. 1.0 1.0 1.0 1.0
Managed AP number (default/max.) 2/10 2/10 2/10 2/10
Wireless Specifications
Standard compliance 802.11 a/b/g/n - 802.11 b/g/n -
Wireless frequency Concurrent 2.4 & 5 GHz - 2.4 GHz -
Radio 2-1-
SSID number 16 - 8 -
Maximum
transmit power
(Max. total
channel)
US (FCC) 2.4 GHz 24.3 dBm, 2 antennas - 24.3 dBm, 2 antennas -
US (FCC) 5 GHz 25.8 dBm, 2 antennas - - -
EU (ETSI) 2.4 GHz 17 dBm, 2 antennas - 17 dBm, 2 antennas -
EU (ETSI) 5 GHz 25.6 dBm, 2 antennas - - -
No. of antenna
2.4 GHz: 2T2R MIMO
5 GHz: 2T2R MIMO
(Detachable, SMA-R)
-2.4 GHz: 2T2R MIMO
(Detachable, SMA-R) -
Antenna gain 3 dBi - 3 dBi -
Data rate
802.11 b/g: 1, 2, 5.5, 6, 9,
11, 12, 18, 24, 36, 48 and 54
Mbps
802.11a: 6, 9, 12, 18, 24, 36,
48 and 54 Mbps
802.11n: up to 300 Mbps in
MCS15 (40 MHz; GI = 400 ns)
-
802.11 b/g: 1, 2, 5.5, 6, 9,
11, 12, 18, 24, 36, 48 and 54
Mbps
802.11n: up to 300 Mbps in
MCS15 (40 MHz; GI = 400 ns)
-
Receive
sensitivity
2.4 GHz
2.4 GHz:
11 Mbps ≤ -87 dBm
54 Mbps ≤ -77 dBm
HT20 ≤ -71 dBm
HT40 ≤ -68 dBm
-
2.4 GHz:
11 Mbps ≤ -87 dBm
54 Mbps ≤ -77 dBm
HT20, MCS15 ≤ -71 dBm
HT40, MCS15 ≤ -68 dBm
-
5 GHz
5 GHz:
54 Mbps ≤ -75 dBm
HT20, MCS15 ≤ -71 dBm
HT40, MCS15 ≤ -69 dBm
- - -

6
USG60/60W/40/40W
Unified Security Gateway—Performance Series
Model USG60W USG60 USG40W USG40
Key Software Features
Virtual Private Network (VPN) Yes
(IPSec, SSL, L2TP over IPSec)
Yes
(IPSec, SSL, L2TP over IPSec)
Yes
(IPSec, SSL, L2TP over IPSec)
Yes
(IPSec, SSL, L2TP over IPSec)
Firewall Yes Yes Yes Yes
Anti-Virus (AV) Yes Yes Yes Yes
Anti-spam Yes Yes Yes Yes
Content Filtering (CF) Yes Yes Yes Yes
Application intelligence and
optimization Yes Yes Yes Yes
Intrusion Detection and Prevention
(IDP) Yes Yes Yes Yes
Single Sign-On (SSO) Yes Yes Yes Yes
Power Requirements
Power input 12 V DC, 3.0 A max. 12 V DC, 3.0 A max. 12 V DC, 2.0 A max. 12 V DC, 2.0 A max.
Max. power consumption (watt) 28.0 19.0 17.0 14.0
Others
MTBF (hr) 497,644 815,463.9 386,931.7 414,329.4
Physical Specifications
Item dimensions (WxDxH)(mm/in.) 272 x 171 x 36/
10.71 x 6.73 x 1.42
242 x 175 x 36/
9.53 x 6.89 x 1.42
216 x 143 x 33/
8.50 x 5.63 x 1.30
216 x 143 x 33/
8.50 x 5.63 x 1.30
Item weight (kg/lb.) 1.46/3.23 1.25/2.76 0.91/2 0.89/1.96
Included accessories
• Power adapter
• Rack mounting kit
• Antenna
• Power adapter
• Rack mounting kit
• Power adapter
• DB9 - RJ45 cable for console
connection
• Antenna
• Power adapter
• DB9 - RJ45 cable for console
connection
*1: Actual performance may vary depending on network conditions and activated applications.
*2: Maximum throughput based on RFC 2544 (1,518-byte UDP packets).
*3: VPN throughput measured based on RFC 2544 (1,424-byte UDP packets).
*4: AV and IDP throughput measured using the industry standard HTTP performance test (1,460-byte HTTP packets). Testing done with multiple flows.
*5: Maximum sessions measured using the industry standard IXIA IxLoad testing tool.
Features Set
Software Features
Firewall
• ICSA-certied rewall (certication in
progress)
• Routing and transparent (bridge) modes
• Stateful packet inspection
• User-aware policy enforcement
• SIP/H.323 NAT traversal
• ALG support for customized ports
• Protocol anomaly detection and protection
• Trac anomaly detection and protection
• Flooding detection and protection
• DoS/DDoS protection
IPv6 Support
• IPv6 Ready gold logo (certication in
progress)
• Dual stack
• IPv4 tunneling (6rd and 6to4 transition
tunnel)
• IPv6 addressing
• DNS
• DHCPv6
• Bridge
• VLAN
• PPPoE
• Static routing
• Policy routing
• Session control
• Firewall and ADP
• IPSec VPN
• Intrusion Detection and Prevention (IDP)
• Application intelligence and optimization
• Content ltering
• Anti-virus, anti-malware
• Anti-spam
IPSec VPN
• ICSA-certied IPSec VPN (certication in
progress)
• Encryption: AES (256-bit), 3DES and DES
• Authentication: SHA-2 (512-bit), SHA-1 and
MD5
• Key management: manual key, IKEv1 and
IKEv2 with EAP
• Perfect forward secrecy (DH groups) support
1, 2, 5
• IPSec NAT traversal
• Dead peer detection and relay detection
• PKI (X.509) certicate support
• VPN concentrator
• Simple wizard support
• VPN auto-reconnection
• VPN High Availability (HA): load-balancing
and failover
• L2TP over IPSec
• GRE and GRE over IPSec
• NAT over IPSec
• ZyXEL VPN client provisioning
SSL VPN
• Supports Windows and Mac OS X
• Supports full tunnel mode
• Supports 2-step authentication
• Customizable user portal

7
Intrusion Detection and Prevention (IDP)
• Routing and transparent (bridge) mode
• Signature-based and behavior-based
scanning
• Automatic signature updates
• Customizable protection prole
• Customized signatures supported
Application Intelligence and Optimization
• Granular control over the most important
applications
• Identies and controls over 3,000 applications
and behaviors
• Supports over 15 application categories
• Application bandwidth management
• Supports user authentication
• Real-time statistics and reports
Anti-Virus
• Supports Kaspersky anti-virus signatures
• Identies and blocks over 650,000 viruses
• Stream-based anti-virus engine
• HTTP, FTP, SMTP, POP3 and IMAP4 protocol
support
• Automatic signature updates
• No le size limitation
Anti-Spam
• Transparent mail interception via SMTP and
POP3 protocols
• Congurable POP3 and SMTP ports
• Sender-based IP reputation lter
• Recurrent Pattern Detection (RPD) technology
• Zero-hour virus outbreak protection
• X-Header support
• Blacklist and whitelist support
• Supports DNSBL checking
• Spam tag support
• Statistics report
Content Filtering
• Social media ltering
• Malicious Website ltering
• URL blocking and keyword blocking
• Blacklist and whitelist support
• Blocks java applets, cookies and ActiveX
• Dynamic, cloud-based URL ltering database
• Unlimited user license support
• Customizable warning messages and
redirection URL
Unied Security Policy
• Unied policy management interface
• Supported UTM features: anti-virus, anti-
spam, IDP, content ltering, application
intelligence, rewall (ACL)
• 3-tier conguration: object-based, prole-
based, policy-based
• Policy criteria: zone, source and destination IP
address, user, time
WLAN Management
• ZyXEL AP Controller (APC) 1.0 compliant
• Client RSSI threshold to prevent sticky clients
• IEEE 802.1x authentication
• Wireless Layer 2 isolation
• Captive portal Web authentication
• Customizable captive portal page
• Dynamic guest accounts
• RADIUS authentication
• Wi-Fi Multimedia (WMM) wireless QoS
• CAPWAP discovery protocol
• ZyXEL Wireless Optimizer (ZWO) AP planning
Mobile Broadband
• WAN connection failover via 3G and 4G* USB
modems
• Auto fallback when primary WAN recovers
* 4G USB modem support available in future rmware upgrades
Networking
• Routing mode, bridge mode and hybrid
mode
• Ethernet and PPPoE
• NAT and PAT
• VLAN tagging (802.1Q)
• Virtual interface (alias interface)
• Policy-based routing (user-aware)
• Policy-based NAT (SNAT)
• Dynamic routing (RIPv1/v2 and OSPF)
• DHCP client/server/relay
• Dynamic DNS support
• WAN trunk for more than 2 ports
• Per host session limit
• Guaranteed bandwidth
• Maximum bandwidth
• Priority-bandwidth utilization
Authentication
• Local user database
• Microsoft Windows Active Directory
integration
• External LDAP/RADIUS user database
• XAUTH, IKEv2 with EAP VPN authentication
• Web-based authentication
• Forced user authentication (transparent
authentication)
• IP-MAC address binding
• SSO (Single Sign-On) support
System Management
• Role-based administration
• Multiple administrator logins
• Multi-lingual Web GUI (HTTPS and HTTP)
• Command line interface (console, Web
console, SSH and TELNET)
• SNMP v2c (MIB-II)
• System conguration rollback
• Firmware upgrade via FTP, FTP-TLS and Web
GUI
• Dual rmware images
Logging and Monitoring
• Comprehensive local logging
• Syslog (to up to 4 servers)
• Email alerts (to up to 2 servers)
• Real-time trac monitoring
• Built-in daily report
• Advanced reporting with Vantage Report
USG60/60W/40/40W
Unied Security Gateway—Performance Series

F o r m o r e p r o d u c t i n f o r m a t i o n , v i s i t u s o n t h e w e b a t w w w. Z y X E L . c o m
Copyright © 2014 ZyXEL Communications Corp. All rights reserved. ZyXEL, ZyXEL logoare registered trademarks
of ZyXEL Communications Corp. All other brands, product names, or trademarks mentioned are the property of
their respective owners. All specications are subject to change without notice.
5-100-00814003 08/14
Licenses
Security
Model Kaspersky Anti-Virus Application Intelligence
& IDP Content Filtering Anti-Spam
USG60/60W 1 year
2 years
1 year
2 years
1 year
2 years
1 year
2 years
USG40/40W 1 year
2 years
1 year
2 years
1 year
2 years
1 year
2 years
Notes:
1. ZyXEL USGs can be purchased with 13-month bundled licenses (anti-virus, anti-spam and content filtering), which include a 1-month trial.
2. Licenses can be easily activated, renewed and managed at myZyXEL.com (www.myzyxel.com)
3. License bundles may vary according to region. Please contact your local sales representative for more information.
VPN, Management and Reporting
Model SSL VPN Managed APs IPSec VPN Client Vantage Report
USG60/60W Add 5 tunnels Add 8 APs For 1 client
For 5 clients
For 10 clients
For 50 clients
For 1 device
For 5 devices
For 25 devices
For 100 devices
USG40/40W Add 5 tunnels Add 8 APs
Access Point Compatibility List
Series
NWA3000-N Series NWA5000 Series NWA5120 Series
Unified Pro Access Point Managed Access Point Unified Access Point
Model
NWA3160-N
NWA3560-N
NWA3550-N
NWA5160N
NWA5560-N
NWA5550-N
NWA5121-NI
NWA5121-N
NWA5123-NI
Functions
Central management Yes Yes Yes
Auto provisioning Yes Yes Yes
Data forwarding Local bridge Local bridge Local bridge
USG60/60W/40/40W
Unified Security Gateway—Performance Series