ZyXEL Communications ZyWALL 1050 User manual

ZyWALL 1050
Internet Security Gateway
User’s Guide
Version 1.00
9/2006
Edition 3

ZyWALL 1050 User’s Guide
Copyright 3
Copyright
Copyright © 2006 by ZyXEL Communications Corporation.
The contents of this publication may not be reproduced in any part or as a whole, transcribed,
stored in a retrieval system, translated into any language, or transmitted in any form or by any
means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or
otherwise, without the prior written permission of ZyXEL Communications Corporation.
Published by ZyXEL Communications Corporation. All rights reserved.
Disclaimer
ZyXEL does not assume any liability arising out of the application or use of any products, or
software described herein. Neither does it convey any license under its patent rights nor the
patent rights of others. ZyXEL further reserves the right to make changes in any products
described herein without notice. This publication is subject to change without notice.
Trademarks
Trademarks mentioned in this publication are used for identification purposes only and may be
properties of their respective owners.

ZyWALL 1050 User’s Guide
4Certifications
Certifications
FCC Statement
This device complies with Part 15 of the FCC rules. Operation is subject to the following two
conditions:
1This switch may not cause harmful interference.
2This switch must accept any interference received, including interference that may cause
undesired operations.
FCC Warning
This equipment has been tested and found to comply with the limits for a Class A digital
switch, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable
protection against harmful interference in a commercial environment. This equipment
generates, uses, and can radiate radio frequency energy and, if not installed and used in
accordance with the instruction manual, may cause harmful interference to radio
communications. Operation of this equipment in a residential area is likely to cause harmful
interference in which case the user will be required to correct the interference at his own
expense.
CE Mark Warning:
This is a class A product. In a domestic environment this product may cause radio interference
in which case the user may be required to take adequate measures.
Taiwanese BSMI (Bureau of Standards, Metrology and Inspection)
A Warning:
Notices
Changes or modifications not expressly approved by the party responsible for compliance
could void the user's authority to operate the equipment.
This Class A digital apparatus complies with Canadian ICES-003.
Cet appareil numérique de la classe A est conforme à la norme NMB-003 du Canada.

ZyWALL 1050 User’s Guide
Certifications 5
Viewing Certifications
1Go to www.zyxel.com.
2Select your product from the drop-down list box on the ZyXEL home page to go to that
product's page.
3Select the certification you wish to view from this page.

ZyWALL 1050 User’s Guide
6Safety Warnings
Safety Warnings
For your safety, be sure to read and follow all warning notices and instructions.
• Do NOT open the device or unit. Opening or removing covers can expose you to
dangerous high voltage points or other risks. ONLY qualified service personnel can
service the device. Please contact your vendor for further information.
• Connect the power cord to the right supply voltage (110V AC in North America or 230V
AC in Europe).
• Place connecting cables carefully so that no one will step on them or stumble over them.
Do NOT allow anything to rest on the power cord and do NOT locate the product where
anyone can walk on the power cord.
• Do NOT install nor use your device during a thunderstorm. There may be a remote risk of
electric shock from lightning.
• Do NOT expose your device to dampness, dust or corrosive liquids.
• Do NOT use this product near water, for example, in a wet basement or near a swimming
pool.
• Make sure to connect the cables to the correct ports.
• Do NOT obstruct the device ventilation slots, as insufficient airflow may harm your
device.
• Do NOT store things on the device.
• Connect ONLY suitable accessories to the device.
• CAUTION: RISK OF EXPLOSION IF BATTERY (on the motherboard) IS REPLACED
BY AN INCORRECT TYPE. DISPOSE OF USED BATTERIES ACCORDING TO
THE INSTRUCTIONS. Dispose them at the applicable collection point for the recycling
of electrical and electronic equipment. For detailed information about recycling of this
product, please contact your local city office, your household waste disposal service or
the store where you purchased the product.
This product is recyclable. Dispose of it properly.

ZyWALL 1050 User’s Guide
ZyXEL Limited Warranty 7
ZyXEL Limited Warranty
ZyXEL warrants to the original end user (purchaser) that this product is free from any defects
in materials or workmanship for a period of up to two years from the date of purchase. During
the warranty period, and upon proof of purchase, should the product have indications of failure
due to faulty workmanship and/or materials, ZyXEL will, at its discretion, repair or replace the
defective products or components without charge for either parts or labor, and to whatever
extent it shall deem necessary to restore the product or components to proper operating
condition. Any replacement will consist of a new or re-manufactured functionally equivalent
product of equal or higher value, and will be solely at the discretion of ZyXEL. This warranty
shall not apply if the product has been modified, misused, tampered with, damaged by an act
of God, or subjected to abnormal working conditions.
Note
Repair or replacement, as provided under this warranty, is the exclusive remedy of the
purchaser. This warranty is in lieu of all other warranties, express or implied, including any
implied warranty of merchantability or fitness for a particular use or purpose. ZyXEL shall in
no event be held liable for indirect or consequential damages of any kind to the purchaser.
To obtain the services of this warranty, contact ZyXEL's Service Center for your Return
Material Authorization number (RMA). Products must be returned Postage Prepaid. It is
recommended that the unit be insured when shipped. Any returned products without proof of
purchase or those with an out-dated warranty will be repaired or replaced (at the discretion of
ZyXEL) and the customer will be billed for parts and labor. All repaired or replaced products
will be shipped by ZyXEL to the corresponding return address, Postage Paid. This warranty
gives you specific legal rights, and you may also have other rights that vary from country to
country.
Registration
Register your product online to receive e-mail notices of firmware upgrades and information
at www.zyxel.com for global products, or at www.us.zyxel.com for North American products.

ZyWALL 1050 User’s Guide
8Customer Support
Customer Support
Please have the following information ready when you contact customer support.
• Product model and serial number.
• Warranty Information.
• Date that you received your device.
• Brief description of the problem and the steps you took to solve it.
METHOD
LOCATION
SUPPORT E-MAIL TELEPHONE WEB SITE
REGULAR MAIL
SALES E-MAIL FAX FTP SITE
CORPORATE
HEADQUARTERS
(WORLDWIDE)
[email protected] [phone] www.zyxel.com
www.europe.zyxel.com
ZyXEL Communications Corp.
6 Innovation Road II
Science Park
Hsinchu 300
Taiwan
[email protected] [phone] ftp.zyxel.com
ftp.europe.zyxel.com
COSTA RICA
[email protected] [phone] www.zyxel.co.cr ZyXEL Costa Rica
Plaza Roble Escazú
Etapa El Patio, Tercer Piso
San José, Costa Rica
[email protected] [phone] ftp.zyxel.co.cr
CZECH REPUBLIC
[email protected] [phone] www.zyxel.cz ZyXEL Communications
Czech s.r.o.
Modranská 621
143 01 Praha 4 - Modrany
Ceská Republika
[email protected] [phone]
DENMARK
[email protected] [phone] www.zyxel.dk ZyXEL Communications A/S
Columbusvej
2860 Soeborg
Denmark
[email protected] [phone]
FINLAND
[email protected] [phone] www.zyxel.fi ZyXEL Communications Oy
Malminkaari 10
00700 Helsinki
Finland
[email protected] [phone]
FRANCE
[email protected] [phone] www.zyxel.fr ZyXEL France
1 rue des Vergers
Bat. 1 / C
69760 Limonest
France
[phone]
GERMANY
[email protected] [phone] www.zyxel.de ZyXEL Deutschland GmbH.
Adenauerstr. 20/A2 D-52146
Wuerselen
Germany
[email protected] [phone]
HUNGARY
[email protected] [phone] www.zyxel.hu ZyXEL Hungary
48, Zoldlomb Str.
H-1025, Budapest
Hungary
[email protected] [phone]
KAZAKHSTAN
http://zyxel.kz/support [phone] www.zyxel.kz ZyXEL Kazakhstan
43, Dostyk ave.,Office 414
Dostyk Business Centre
050010, Almaty
Republic of Kazakhstan
[email protected] [phone]
NORTH AMERICA
[email protected] 1-800-255-4101
[phone]
www.us.zyxel.com ZyXEL Communications Inc.
1130 N. Miller St.
Anaheim
CA 92806-2001
U.S.A.
[email protected] [phone] ftp.us.zyxel.com

ZyWALL 1050 User’s Guide
Customer Support 9
NORWAY
[email protected] [phone] www.zyxel.no ZyXEL Communications A/S
Nils Hansens vei 13
0667 Oslo
Norway
[email protected] [phone]
POLAND
[email protected] [phone] www.pl.zyxel.com ZyXEL Communications
ul. Okrzei 1A
03-715 Warszawa
Poland
[phone]
RUSSIA
http://zyxel.ru/support [phone] www.zyxel.ru ZyXEL Russia
Ostrovityanova 37a Str.
Moscow, 117279
Russia
[email protected] [phone]
SPAIN
[email protected] [phone] www.zyxel.es ZyXEL Communications
Arte, 21 5ª planta
28033 Madrid
Spain
[email protected] [phone]
SWEDEN
[email protected] [phone] www.zyxel.se ZyXEL Communications A/S
Sjöporten 4, 41764 Göteborg
Sweden
[email protected] [phone]
UKRAINE
[email protected] [phone] www.ua.zyxel.com ZyXEL Ukraine
13, Pimonenko Str.
Kiev, 04050
Ukraine
[email protected] [phone]
METHOD
LOCATION
SUPPORT E-MAIL TELEPHONE WEB SITE
REGULAR MAIL
SALES E-MAIL FAX FTP SITE

ZyWALL 1050 User’s Guide
10 Customer Support

ZyWALL 1050 User’s Guide
Table of Contents 11
Table of Contents
Copyright .................................................................................................................. 3
Certifications ............................................................................................................ 4
Safety Warnings ....................................................................................................... 6
ZyXEL Limited Warranty.......................................................................................... 7
Customer Support.................................................................................................... 8
Table of Contents ................................................................................................... 11
List of Figures ........................................................................................................ 27
List of Tables .......................................................................................................... 37
About This User's Guide ....................................................................................... 43
Chapter 1
Introducing the ZyWALL........................................................................................ 47
1.1 Overview and Key Default Settings ....................................................................47
1.2 Front Panel LEDs ...............................................................................................48
1.3 Management Overview ......................................................................................48
1.4 Starting and Stopping the ZyWALL ....................................................................50
1.5 Resetting the ZyWALL .......................................................................................50
Chapter 2
Features and Applications .................................................................................... 53
2.1 Features .............................................................................................................53
2.2 Packet Flow ........................................................................................................54
2.2.1 Interface to Interface (Through ZyWALL) .................................................55
2.2.2 Interface to Interface (To/From ZyWALL) .................................................55
2.2.3 Interface to Interface (From VPN Tunnel) .................................................55
2.2.4 Interface to Interface (To VPN Tunnel) .....................................................55
2.3 Applications ........................................................................................................55
2.3.1 VPN Connectivity ......................................................................................56
2.3.2 User-Aware Access Control ......................................................................56
2.3.3 Multiple WAN Interfaces ...........................................................................57
2.3.4 Device HA .................................................................................................57

ZyWALL 1050 User’s Guide
12 Table of Contents
Chapter 3
Web Configurator ................................................................................................... 59
3.1 Web Configurator Requirements ........................................................................59
3.2 Web Configurator Access ..................................................................................59
3.3 Web Configurator Main Screen ..........................................................................61
3.3.1 Title Bar ....................................................................................................61
3.3.2 Navigation Panel .......................................................................................62
3.3.3 Main Window ............................................................................................64
3.3.4 Status Bar .................................................................................................65
Chapter 4
Wizard Setup .......................................................................................................... 67
4.1 Wizard Setup Overview ......................................................................................67
4.2 Installation Setup, One ISP ................................................................................68
4.3 Step 1 Internet Access .....................................................................................69
4.3.1 Ethernet: Auto IP Address Assignment ....................................................70
4.3.2 Ethernet: Static IP Address Assignment ....................................................70
4.3.3 Step 2 Internet Access Ethernet ...............................................................72
4.3.4 PPPoE: Auto IP Address Assignment ......................................................73
4.3.5 PPPoE: Static IP Address Assignment .....................................................74
4.3.6 Step 2 Internet Access PPPoE .................................................................76
4.3.6.1 ISP Parameters ...............................................................................76
4.3.6.2 WAN IP Address Assignments ........................................................76
4.3.7 PPTP: Auto IP Address Assignment .........................................................77
4.3.8 PPTP: Static IP Address Assignment .......................................................80
4.3.9 Step 2 Internet Access PPTP ...................................................................81
4.3.9.1 ISP Parameters ...............................................................................81
4.3.9.2 PPTP Configuration .........................................................................82
4.3.9.3 WAN IP Address Assignments ........................................................82
4.3.10 Step 4 Internet Access - Finish ...............................................................83
4.4 Device Registration ..........................................................................................83
4.5 Installation Setup, Two Internet Service Providers .............................................86
4.5.1 Internet Access Wizard Setup Complete ..................................................88
4.6 VPN Setup .........................................................................................................88
4.7 VPN Wizards ......................................................................................................89
4.7.1 VPN Express Wizard ................................................................................90
4.8 VPN Express Wizard - Remote Gateway ...........................................................91
4.8.1 VPN Express Wizard - Policy Setting .......................................................92
4.8.2 VPN Express Wizard - Summary ..............................................................93
4.8.3 VPN Express Wizard - Finish ...................................................................94
4.8.4 VPN Advanced Wizard .............................................................................95
4.8.5 VPN Advanced Wizard - Remote Gateway ..............................................96
4.8.5.1 Phase 1 Setting ...............................................................................96

ZyWALL 1050 User’s Guide
Table of Contents 13
4.8.6 VPN Advanced Wizard - Phase 1 .............................................................98
4.8.6.1 Phase 2 Setting ...............................................................................99
4.8.7 VPN Advanced Wizard - Phase 2 ...........................................................100
4.8.8 VPN Advanced Wizard - Summary .........................................................102
4.8.9 VPN Advanced Wizard - Finish ..............................................................102
Chapter 5
Configuration Basics .......................................................................................... 105
5.1 Granular Configuration .....................................................................................105
5.2 Terminology in the ZyWALL .............................................................................106
5.3 Physical Ports, Interfaces, and Zones ..............................................................107
5.3.1 Network Topology Example ....................................................................108
5.4 Feature Configuration Overview ......................................................................108
5.5 Objects .............................................................................................................116
5.6 System Management .......................................................................................117
Chapter 6
Tutorials ................................................................................................................ 119
6.1 Interfaces and Zones .......................................................................................119
6.1.1 Set up Port Grouping ..............................................................................120
6.1.2 Set up Ethernet Interfaces ......................................................................121
6.1.3 WAN Trunk .............................................................................................124
6.1.4 Zones ......................................................................................................128
6.2 VPN ..................................................................................................................131
6.2.1 Set up the Ethernet Interfaces ................................................................131
6.2.2 Set up the Zones for the Ethernet Interfaces ..........................................133
6.2.3 Set up the VPN Gateway ........................................................................133
6.2.4 Set up the VPN Connection ....................................................................133
6.2.5 Set up the Policy Route for the VPN Tunnel ...........................................134
6.2.6 Set up the Zone for the VPN Tunnel .......................................................135
6.3 Device HA ........................................................................................................136
6.3.1 Set up the Ethernet Interfaces on the Master .........................................137
6.3.2 Set up DNS for the Virtual Router ...........................................................138
6.3.3 Set up the VRRP Groups on the Master .................................................138
6.3.4 Set up the Password for Synchronization ...............................................139
6.3.5 Finish Configuring the Master .................................................................139
6.3.6 Set up the Ethernet Interfaces on the Backup ........................................140
6.3.7 Set up the VRRP Groups on the Backup ................................................140
6.3.8 Synchronize the Backup .........................................................................140
6.4 User-Aware Access Control .............................................................................141
6.4.1 Set up User Accounts .............................................................................142
6.4.2 Set up User Groups ................................................................................142
6.4.3 Set up User Authentication Using the RADIUS Server ...........................143

ZyWALL 1050 User’s Guide
14 Table of Contents
6.4.4 Set up Web Surfing Policies ...................................................................144
6.4.5 Set up Bandwidth Restrictions ................................................................145
6.4.6 Set up MSN Policies ...............................................................................146
6.4.7 Set up LAN-to-DMZ Policies ...................................................................147
6.5 Trunks ..............................................................................................................148
6.5.1 Set up Available Bandwidth on Ethernet Interfaces ................................149
6.5.2 Change WAN Trunk Algorithm ................................................................149
6.6 NAT 1:1 Example .............................................................................................150
6.6.1 Address Objects .....................................................................................150
6.6.2 Interface ..................................................................................................151
6.6.3 Policy Route ............................................................................................152
6.6.4 Firewall Rule ...........................................................................................152
Chapter 7
Status ................................................................................................................... 155
7.1 Status Screen ...................................................................................................155
7.2 VPN Status .......................................................................................................160
7.3 DHCP Table .....................................................................................................161
7.4 Statistics ...........................................................................................................161
Chapter 8
Registration ......................................................................................................... 163
8.1 myZyXEL.com overview ...................................................................................163
8.1.1 Subscription Services Available on the ZyWALL ....................................163
8.2 Registration ......................................................................................................164
8.3 Service .............................................................................................................165
Chapter 9
File Manager ......................................................................................................... 167
9.1 Configuration Files and Shell Scripts Overview ...............................................167
9.1.1 Comments in Configuration Files or Shell Scripts ..................................168
9.1.2 Errors in Configuration Files or Shell Scripts ..........................................169
9.1.3 ZyWALL Configuration File Details .........................................................169
9.1.4 Configuration File Flow at Restart ..........................................................169
9.2 Configuration File Screen .................................................................................170
9.3 Firmware Package Screen ...............................................................................172
9.4 Shell Script Screen ...........................................................................................174
Chapter 10
Interface .......................................................................................................... 177
10.1 Interface Overview .........................................................................................177
10.1.1 Types of Interfaces ...............................................................................177
10.1.2 IP Address Assignment ........................................................................178

ZyWALL 1050 User’s Guide
Table of Contents 15
10.1.3 Interface Parameters ............................................................................180
10.1.4 DHCP Settings ......................................................................................180
10.1.5 Ping Check Settings .............................................................................182
10.1.6 Relationships Between Interfaces ........................................................182
10.2 Ethernet Interfaces .........................................................................................183
10.2.1 Ethernet Interfaces Overview ...............................................................183
10.2.2 Ethernet Summary Screen ...................................................................184
10.2.3 Ethernet Edit .........................................................................................185
10.3 Port Grouping .................................................................................................190
10.3.1 Port Grouping Overview .......................................................................190
10.3.2 Port Grouping Screen ...........................................................................192
10.4 VLAN Interfaces .............................................................................................192
10.4.1 VLAN Overview ....................................................................................193
10.4.2 VLAN Interfaces Overview ....................................................................194
10.4.3 VLAN Summary Screen ........................................................................194
10.4.4 VLAN Add/Edit ......................................................................................195
10.5 Bridge Interfaces ............................................................................................199
10.5.1 Bridge Overview ...................................................................................200
10.5.2 Bridge Interface Overview ....................................................................201
10.5.3 Bridge Summary ...................................................................................201
10.5.4 Bridge Add/Edit .....................................................................................202
10.6 PPPoE/PPTP Interfaces ................................................................................206
10.6.1 PPPoE/PPTP Overview ........................................................................207
10.6.2 PPPoE/PPTP Interfaces Overview .......................................................207
10.6.3 PPPoE/PPTP Interface Summary ........................................................208
10.6.4 PPPoE/PPTP Interface Add/Edit ..........................................................209
10.7 Auxiliary Interface ...........................................................................................211
10.7.1 Auxiliary Interface Overview .................................................................211
10.7.2 Auxiliary ................................................................................................211
10.8 Virtual Interfaces ............................................................................................213
10.8.1 Virtual Interfaces Add/Edit ....................................................................213
Chapter 11
Trunks ........................................................................................................... 215
11.1 Trunks Overview .............................................................................................215
11.2 Trunk Scenario Examples ..............................................................................215
11.3 Load Balancing Introduction ...........................................................................215
11.4 Load Balancing Algorithms .............................................................................216
11.4.1 Least Load First ....................................................................................216
11.4.1.1 Least Load First Example 1 .........................................................216
11.4.2 Weighted Round Robin .........................................................................217
11.4.3 Spillover ................................................................................................218
11.5 Trunk Summary ..............................................................................................218

ZyWALL 1050 User’s Guide
16 Table of Contents
11.6 Configuring a Trunk ........................................................................................219
Chapter 12
IPSec VPN ............................................................................................................ 223
12.1 IPSec VPN Overview .....................................................................................223
12.1.1 IPSec SA Overview ..............................................................................224
12.1.1.1 Local Network and Remote Network ...........................................224
12.1.1.2 Active Protocol ............................................................................224
12.1.1.3 Encapsulation ..............................................................................225
12.1.1.4 IPSec SA Proposal and Perfect Forward Secrecy ......................225
12.1.2 Additional Topics for IPSec SA .............................................................226
12.1.2.1 IPSec SA using Manual Keys .....................................................226
12.1.2.2 NAT for Inbound and Outbound Traffic ........................................226
12.2 Related Configuration ....................................................................................228
12.3 VPN Connection Screens ..............................................................................229
12.3.1 VPN Connection Summary ...................................................................229
12.3.2 VPN Connection Add/Edit IKE ..............................................................230
12.3.3 VPN Connection Add/Edit Manual Key ...............................................234
12.4 VPN Gateway Screens ..................................................................................238
12.4.1 IKE SA Overview ..................................................................................238
12.4.1.1 IP Addresses of the ZyWALL and Remote IPSec router .............239
12.4.1.2 IKE SA Proposal .........................................................................239
12.4.1.3 Diffie-Hellman (DH) Key Exchange .............................................240
12.4.1.4 Authentication .............................................................................241
12.4.2 Additional Topics for IKE SA .................................................................242
12.4.2.1 Negotiation Mode ........................................................................242
12.4.2.2 VPN, NAT, and NAT Traversal .....................................................243
12.4.2.3 Extended Authentication .............................................................243
12.4.2.4 Certificates ..................................................................................244
12.4.3 VPN Gateway Summary .......................................................................244
12.4.4 VPN Gateway Add/Edit .........................................................................245
12.5 VPN Concentrator ..........................................................................................250
12.5.1 VPN Concentrator Summary ................................................................251
12.5.2 VPN Concentrator Add/Edit ..................................................................252
12.6 SA Monitor Screen .........................................................................................254
Chapter 13
Routing Protocol ................................................................................................. 255
13.1 Routing Protocol Overview .............................................................................255
13.1.1 RIP Overview ........................................................................................255
13.1.2 Authentication Types ............................................................................256
13.2 RIP Screen .....................................................................................................256
13.3 OSPF Overview .............................................................................................258

ZyWALL 1050 User’s Guide
Table of Contents 17
13.3.1 OSPF Areas ..........................................................................................258
13.3.2 OSPF Routers ......................................................................................259
13.3.3 Virtual Links ..........................................................................................260
13.3.4 OSPF Configuration ..............................................................................261
13.4 OSPF Screens ...............................................................................................261
13.4.1 OSPF Summary ....................................................................................261
13.4.2 OSPF Area Add/Edit .............................................................................263
Chapter 14
Zones.................................................................................................................... 267
14.1 Zones Overview .............................................................................................267
14.1.1 Effect of Zones on Different Types of Traffic .........................................267
14.2 Zone Summary ...............................................................................................268
14.3 Zone Add/Edit ................................................................................................269
Chapter 15
ISP Accounts ........................................................................................................ 271
15.1 ISP Accounts Overview ..................................................................................271
15.2 ISP Account Summary ...................................................................................271
15.3 ISP Account Edit ............................................................................................272
Chapter 16
Device HA ............................................................................................................ 275
16.1 Virtual Router Redundancy Protocol (VRRP) Overview .................................275
16.1.1 Additional VRRP Notes .........................................................................276
16.2 VRRP Group Overview ..................................................................................277
16.3 Device HA Screens ........................................................................................277
16.4 VRRP Group Summary ..................................................................................278
16.5 VRRP Group Add/Edit ....................................................................................279
16.6 Synchronization Overview ..............................................................................281
16.6.1 Synchronize Screen ..............................................................................282
Chapter 17
DDNS .................................................................................................................. 285
17.1 DDNS Overview .............................................................................................285
17.1.1 DYNDNS Wildcard ................................................................................285
17.1.2 High Availability (HA) ............................................................................285
17.1.3 Mail Exchanger .....................................................................................286
17.2 DDNS Screens ...............................................................................................286
17.3 DDNS Summary .............................................................................................287
17.4 Dynamic DNS Add/Edit ..................................................................................288

ZyWALL 1050 User’s Guide
18 Table of Contents
Chapter 18
Route .................................................................................................................... 291
18.1 Policy Route ...................................................................................................291
18.1.1 Benefits .................................................................................................291
18.2 Routing Policy ................................................................................................291
18.2.1 NAT and SNAT .....................................................................................292
18.2.2 Port Triggering ......................................................................................292
18.3 IP Routing Policy Setup .................................................................................293
18.4 Policy Route Edit ............................................................................................294
18.4.1 Adding a New Service ..........................................................................297
18.5 IP Static Routes ..............................................................................................298
18.6 Static Route Summary ...................................................................................299
18.7 Edit a Static Route ..........................................................................................299
Chapter 19
Firewall........................................................................................................... 301
19.1 Firewall Overview ...........................................................................................301
19.2 Firewall Rules .................................................................................................302
19.2.1 Through-ZyWALL Rules .......................................................................302
19.2.1.1 Global Through-ZyWALL Rules ..................................................303
19.2.2 To-ZyWALL Rules .................................................................................303
19.2.3 Firewall and VPN Traffic .......................................................................304
19.3 Firewall Rule Example Applications ...............................................................304
19.4 Alerts ..............................................................................................................306
19.5 Asymmetrical Routes .....................................................................................306
19.5.1 Virtual Interfaces and Asymmetrical Routes .........................................307
19.6 Configuring the Firewall .................................................................................307
19.6.1 Through-ZyWALL Rules with Zone Pairs .............................................307
19.6.2 Through Firewall Rules with All Rules ..................................................310
19.6.3 To-ZyWALL Rules .................................................................................312
19.6.4 Edit a Firewall Rule................................................................................315
19.7 Firewall Rule Configuration Example .............................................................317
Chapter 20
Application Patrol ............................................................................................... 321
20.1 Application Patrol Overview ...........................................................................321
20.1.1 Classification of Applications ................................................................321
20.1.2 Default Action for Each Application ......................................................321
20.1.3 Exceptions to the Default Action ...........................................................322
20.1.4 Bandwidth Management for Applications .............................................322
20.1.5 Other Applications ................................................................................322
20.2 Application Patrol Screens .............................................................................322
20.3 Configuration Summary .................................................................................323

ZyWALL 1050 User’s Guide
Table of Contents 19
20.3.1 Configuration Edit .................................................................................325
20.4 Other Protocol Screen ....................................................................................328
20.4.1 Other Configuration Add/Edit ................................................................330
Chapter 21
IDP ...................................................................................................................... 333
21.1 Introduction to IDP .........................................................................................333
21.1.1 Host Intrusions ......................................................................................333
21.1.2 Network Intrusions ................................................................................333
21.1.3 IDP on the ZyWALL ..............................................................................334
21.2 Protected Zones and Profiles .........................................................................334
21.3 Configuring IDP General ................................................................................334
21.4 Introducing IDP Profiles .................................................................................336
21.4.1 Base Profiles .........................................................................................336
21.5 Profile Summary Screen ................................................................................337
21.6 Creating New Profiles ....................................................................................338
21.6.1 Procedure To Create a New Profile ......................................................338
21.7 Profiles: Packet Inspection .............................................................................339
21.7.1 Policy Types ..........................................................................................339
21.7.2 IDP Service Groups ..............................................................................340
21.7.3 Profile > Packet Inspection > Group View Screen ................................341
21.7.4 Profile > Packet Inspection > Query View Screen ................................344
21.7.5 Query Example .....................................................................................346
21.8 Profiles: Traffic Anomaly ................................................................................348
21.8.1 Port Scanning .......................................................................................348
21.8.1.1 Decoy Port Scans .......................................................................348
21.8.1.2 Distributed Port Scans ................................................................348
21.8.1.3 Port Sweeps ................................................................................349
21.8.1.4 Filtered Port Scans ......................................................................349
21.8.2 Flood Detection .....................................................................................349
21.8.2.1 ICMP Flood Attack ......................................................................349
21.8.2.2 Smurf ...........................................................................................350
21.8.2.3 TCP SYN Flood Attack ................................................................350
21.8.2.4 LAND Attack ................................................................................351
21.8.2.5 UDP Flood Attack ........................................................................351
21.8.3 Profile > Traffic Anomaly Screen ..........................................................352
21.9 Profiles: Protocol Anomaly .............................................................................353
21.9.1 HTTP Inspection and TCP/UDP/ICMP Decoders .................................354
21.9.2 Protocol Anomaly Configuration ...........................................................356
21.10 Introducing IDP Custom Signatures .............................................................358
21.10.1 IP Packet Header ................................................................................358
21.11 Configuring Custom Signatures ...................................................................360
21.11.1 Creating or Editing a Custom Signature .............................................362

ZyWALL 1050 User’s Guide
20 Table of Contents
21.11.2 Custom Signature Example ................................................................366
21.11.2.1 Understand the Vulnerability ......................................................367
21.11.2.2 Analyze Packets ........................................................................367
21.11.3 Applying Custom Signatures ...............................................................370
21.11.4 Verifying Custom Signatures ...............................................................370
21.11.5 Snort Signatures .................................................................................371
21.12 Updating IDP Signatures ..............................................................................372
Chapter 22
Content Filtering Screens .................................................................................. 375
22.1 Content Filtering Overview .............................................................................375
22.1.1 Content Filtering Policies ......................................................................375
22.1.2 Content Filtering Profiles ......................................................................375
22.1.2.1 Category-based Blocking ............................................................375
22.1.2.2 Restrict Web Features .................................................................375
22.1.2.3 Customize Web Site Access .......................................................376
22.1.3 Content Filtering Configuration Guidelines ...........................................376
22.2 Content Filter General Screen .......................................................................376
22.3 Content Filter Policy Screen ...........................................................................379
22.4 Content Filtering Profile Screen .....................................................................380
22.5 External Web Filtering Service .......................................................................381
22.6 Content Filter Categories Screen ...................................................................382
22.7 Content Filter Customization Screen .............................................................388
22.8 Keyword Blocking URL Checking ..................................................................391
22.9 Content Filter Cache Screen ..........................................................................391
Chapter 23
Content Filtering Reports .................................................................................... 395
23.1 Viewing Content Filtering Reports ..................................................................395
23.2 Web Site Submission .....................................................................................400
Chapter 24
Virtual Servers................................................................................................... 403
24.1 Virtual Server Overview .................................................................................403
24.2 Virtual Server Example ..................................................................................404
24.3 Virtual Server Screens ...................................................................................404
24.4 Virtual Server Summary Screen .....................................................................404
24.4.1 Virtual Server Add/Edit .........................................................................405
Chapter 25
HTTP Redirect ..................................................................................................... 409
25.1 HTTP Redirect Overview ...............................................................................409
25.1.1 Web Proxy Server .................................................................................409