ZyXEL Communications ZyWALL 5 Series User manual

ZyWALL 5/35/70 Series
Internet Security Appliance
User’s Guide
Version 4.01
7/2006
Edition 1

ZyWALL 5/35/70 Series User’s Guide
Copyright 3
Copyright
Copyright © 2006 by ZyXEL Communications Corporation.
The contents of this publication may not be reproduced in any part or as a whole, transcribed,
stored in a retrieval system, translated into any language, or transmitted in any form or by any
means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or
otherwise, without the prior written permission of ZyXEL Communications Corporation.
Published by ZyXEL Communications Corporation. All rights reserved.
Disclaimer
ZyXEL does not assume any liability arising out of the application or use of any products, or
software described herein. Neither does it convey any license under its patent rights nor the
patent rights of others. ZyXEL further reserves the right to make changes in any products
described herein without notice. This publication is subject to change without notice.
Trademarks
ZyNOS (ZyXEL Network Operating System) is a registered trademark of ZyXEL
Communications, Inc. Other trademarks mentioned in this publication are used for
identification purposes only and may be properties of their respective owners.

ZyWALL 5/35/70 Series User’s Guide
4Certifications
Certifications
Federal Communications Commission (FCC) Interference Statement
The device complies with Part 15 of FCC rules. Operation is subject to the following two
conditions:
• This device may not cause harmful interference.
• This device must accept any interference received, including interference that may cause
undesired operations.
This device has been tested and found to comply with the limits for a Class B digital device
pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable
protection against harmful interference in a commercial environment. This device generates,
uses, and can radiate radio frequency energy, and if not installed and used in accordance with
the instructions, may cause harmful interference to radio communications.
If this device does cause harmful interference to radio/television reception, which can be
determined by turning the device off and on, the user is encouraged to try to correct the
interference by one or more of the following measures:
1Reorient or relocate the receiving antenna.
2Increase the separation between the equipment and the receiver.
3Connect the equipment into an outlet on a circuit different from that to which the receiver
is connected.
4Consult the dealer or an experienced radio/TV technician for help.
Notices
Changes or modifications not expressly approved by the party responsible for compliance
could void the user's authority to operate the equipment.
This Class B digital apparatus complies with Canadian ICES-003.
Cet appareil numérique de la classe B est conforme à la norme NMB-003 du Canada.
Viewing Certifications
1Go to http://www.zyxel.com.
2Select your product from the drop-down list box on the ZyXEL home page to go to that
product's page.
3Select the certification you wish to view from this page.

ZyWALL 5/35/70 Series User’s Guide
Safety Warnings 5
Safety Warnings
For your safety, be sure to read and follow all warning notices and instructions.
• Do NOT use this product near water, for example, in a wet basement or near a swimming
pool.
• Do NOT expose your device to dampness, dust or corrosive liquids.
• Do NOT store things on the device.
• Do NOT install, use, or service this device during a thunderstorm. There is a remote risk
of electric shock from lightning.
• Connect ONLY suitable accessories to the device.
• Do NOT open the device or unit. Opening or removing covers can expose you to
dangerous high voltage points or other risks. ONLY qualified service personnel should
service or disassemble this device. Please contact your vendor for further information.
• Make sure to connect the cables to the correct ports.
• Place connecting cables carefully so that no one will step on them or stumble over them.
• Always disconnect all cables from this device before servicing or disassembling.
• Use ONLY an appropriate power adaptor or cord for your device.
• Connect the power adaptor or cord to the right supply voltage (for example, 110V AC in
North America or 230V AC in Europe).
• Do NOT allow anything to rest on the power adaptor or cord and do NOT place the
product where anyone can walk on the power adaptor or cord.
• Do NOT use the device if the power adaptor or cord is damaged as it might cause
electrocution.
• If the power adaptor or cord is damaged, remove it from the power outlet.
• Do NOT attempt to repair the power adaptor or cord. Contact your local vendor to order a
new one.
• Do not use the device outside, and make sure all the connections are indoors. There is a
remote risk of electric shock from lightning.
• CAUTION: RISK OF EXPLOSION IF BATTERY (on the motherboard) IS REPLACED
BY AN INCORRECT TYPE. DISPOSE OF USED BATTERIES ACCORDING TO
THE INSTRUCTIONS. Dispose them at the applicable collection point for the recycling
of electrical and electronic equipment. For detailed information about recycling of this
product, please contact your local city office, your household waste disposal service or
the store where you purchased the product.
• Do NOT obstruct the device ventilation slots, as insufficient airflow may harm your
device.
• Fuse Warning! Replace a fuse only with a fuse of the same type and rating.

ZyWALL 5/35/70 Series User’s Guide
6Safety Warnings
This product is recyclable. Dispose of it properly.

ZyWALL 5/35/70 Series User’s Guide
ZyXEL Limited Warranty 7
ZyXEL Limited Warranty
ZyXEL warrants to the original end user (purchaser) that this product is free from any defects
in materials or workmanship for a period of up to two years from the date of purchase. During
the warranty period, and upon proof of purchase, should the product have indications of failure
due to faulty workmanship and/or materials, ZyXEL will, at its discretion, repair or replace the
defective products or components without charge for either parts or labor, and to whatever
extent it shall deem necessary to restore the product or components to proper operating
condition. Any replacement will consist of a new or re-manufactured functionally equivalent
product of equal or higher value, and will be solely at the discretion of ZyXEL. This warranty
shall not apply if the product has been modified, misused, tampered with, damaged by an act
of God, or subjected to abnormal working conditions.
Note
Repair or replacement, as provided under this warranty, is the exclusive remedy of the
purchaser. This warranty is in lieu of all other warranties, express or implied, including any
implied warranty of merchantability or fitness for a particular use or purpose. ZyXEL shall in
no event be held liable for indirect or consequential damages of any kind to the purchaser.
To obtain the services of this warranty, contact ZyXEL's Service Center for your Return
Material Authorization number (RMA). Products must be returned Postage Prepaid. It is
recommended that the unit be insured when shipped. Any returned products without proof of
purchase or those with an out-dated warranty will be repaired or replaced (at the discretion of
ZyXEL) and the customer will be billed for parts and labor. All repaired or replaced products
will be shipped by ZyXEL to the corresponding return address, Postage Paid. This warranty
gives you specific legal rights, and you may also have other rights that vary from country to
country.
Registration
Register your product online to receive e-mail notices of firmware upgrades and information
at www.zyxel.com for global products, or at www.us.zyxel.com for North American products.

ZyWALL 5/35/70 Series User’s Guide
8Customer Support
Customer Support
Please have the following information ready when you contact customer support.
• Product model and serial number.
• Warranty Information.
• Date that you received your device.
• Brief description of the problem and the steps you took to solve it.
METHOD
LOCATION
SUPPORT E-MAIL TELEPHONE WEB SITE REGULAR MAIL
SALES E-MAIL FAX FTP SITE
CORPORATE
HEADQUARTERS
(WORLDWIDE)
[email protected] [phone] www.zyxel.com
www.europe.zyxel.com ZyXEL Communications Corp. 6 Innovation Road II
Science Park
Hsinchu 300
Taiwan
[email protected] [phone] ftp.zyxel.com
ftp.europe.zyxel.com
COSTA RICA [email protected] [phone] www.zyxel.co.cr ZyXEL Costa Rica
Plaza Roble Escazú
Etapa El Patio, Tercer Piso
San José, Costa Rica
[email protected] [phone] ftp.zyxel.co.cr
CZECH REPUBLIC
[email protected] [phone] www.zyxel.cz ZyXEL Communications
Czech s.r.o.
Modranská 621
143 01 Praha 4 - Modrany
Ceská Republika
[email protected] [phone]
DENMARK [email protected] [phone] www.zyxel.dk ZyXEL Communications A/S
Columbusvej
2860 Soeborg
Denmark
[email protected] [phone]
FINLAND [email protected] [phone] www.zyxel.fi ZyXEL Communications Oy
Malminkaari 10
00700 Helsinki
Finland
[email protected] [phone]
FRANCE
[email protected] [phone] www.zyxel.fr ZyXEL France
1 rue des Vergers
Bat. 1 / C
69760 Limonest
France
[phone]
GERMANY [email protected] [phone] www.zyxel.de ZyXEL Deutschland GmbH.
Adenauerstr. 20/A2 D-52146
Wuerselen
Germany
[email protected] [phone]
HUNGARY [email protected] [phone] www.zyxel.hu ZyXEL Hungary
48, Zoldlomb Str.
H-1025, Budapest
Hungary
[email protected] [phone]
KAZAKHSTAN
http://zyxel.kz/support [phone] www.zyxel.kz ZyXEL Kazakhstan
43, Dostyk ave.,Office 414
Dostyk Business Centre
050010, Almaty
Republic of Kazakhstan
[email protected] [phone]
NORTH AMERICA
[email protected] 1-800-255-4101
[phone] www.us.zyxel.com ZyXEL Communications Inc.
1130 N. Miller St.
Anaheim
CA 92806-2001
U.S.A.
[email protected] [phone] ftp.us.zyxel.com

ZyWALL 5/35/70 Series User’s Guide
Customer Support 9
+” is the (prefix) number you enter to make an international telephone call.
NORWAY [email protected] [phone] www.zyxel.no ZyXEL Communications A/S
Nils Hansens vei 13
0667 Oslo
Norway
[email protected] [phone]
POLAND [email protected] [phone] www.pl.zyxel.com ZyXEL Communications
ul. Okrzei 1A
03-715 Warszawa
Poland
[phone]
RUSSIA http://zyxel.ru/support [phone] www.zyxel.ru ZyXEL Russia
Ostrovityanova 37a Str.
Moscow, 117279
Russia
[email protected] [phone]
SPAIN [email protected] [phone] www.zyxel.es ZyXEL Communications
Arte, 21 5ª planta
28033 Madrid
Spain
[email protected] [phone]
SWEDEN [email protected] [phone] www.zyxel.se ZyXEL Communications A/S Sjöporten 4, 41764 Göteborg
Sweden
[email protected] [phone]
UKRAINE [email protected] [phone] www.ua.zyxel.com ZyXEL Ukraine
13, Pimonenko Str.
Kiev, 04050
Ukraine
[email protected] [phone]
UNITED KINGDOM
[email protected] [phone]
08707 555779 (UK only) www.zyxel.co.uk ZyXEL Communications UK
Ltd.,11 The Courtyard,
Eastern Road, Bracknell,
Berkshire, RG12 2XB,
United Kingdom (UK)
[email protected] [phone] ftp.zyxel.co.uk
METHOD
LOCATION
SUPPORT E-MAIL TELEPHONE WEB SITE REGULAR MAIL
SALES E-MAIL FAX FTP SITE

ZyWALL 5/35/70 Series User’s Guide
10 Customer Support

ZyWALL 5/35/70 Series User’s Guide
Table of Contents 11
Table of Contents
Copyright ..................................................................................................................3
Certifications ............................................................................................................4
Safety Warnings .......................................................................................................5
ZyXEL Limited Warranty..........................................................................................7
Customer Support....................................................................................................8
Table of Contents ................................................................................................... 11
List of Figures ........................................................................................................31
List of Tables ..........................................................................................................45
Preface ....................................................................................................................53
Chapter 1
Getting to Know Your ZyWALL .............................................................................55
1.1 ZyWALL Internet Security Appliance Overview ..................................................55
1.2 ZyWALL Features ..............................................................................................55
1.2.1 Physical Features .....................................................................................56
1.2.2 Non-Physical Features .............................................................................57
1.3 Applications for the ZyWALL ..............................................................................63
1.3.1 Secure Broadband Internet Access via Cable or DSL Modem .................63
1.3.2 VPN Application ........................................................................................63
1.3.3 Front Panel Lights .....................................................................................64
Chapter 2
Introducing the Web Configurator........................................................................67
2.1 Web Configurator Overview ...............................................................................67
2.2 Accessing the ZyWALL Web Configurator .........................................................67
2.3 Resetting the ZyWALL .......................................................................................68
2.3.1 Procedure To Use The Reset Button ........................................................68
2.3.2 Uploading a Configuration File Via Console Port .....................................69
2.4 Navigating the ZyWALL Web Configurator ........................................................69
2.4.1 Title Bar ....................................................................................................70
2.4.2 Main Window ............................................................................................71
2.4.3 HOME Screen: Router Mode .................................................................71
2.4.4 HOME Screen: Bridge Mode ...................................................................74

ZyWALL 5/35/70 Series User’s Guide
12 Table of Contents
2.4.5 Navigation Panel .......................................................................................78
2.4.6 Port Statistics ...........................................................................................83
2.4.7 Show Statistics: Line Chart........................................................................84
2.4.8 DHCP Table Screen ................................................................................85
2.4.9 VPN Status ................................................................................................86
2.4.10 Bandwidth Monitor ..................................................................................87
Chapter 3
Wizard Setup ..........................................................................................................89
3.1 Wizard Setup Overview .....................................................................................89
3.2 Internet Access .................................................................................................90
3.2.1 ISP Parameters ........................................................................................90
3.2.1.1 Ethernet ...........................................................................................90
3.2.1.2 PPPoE Encapsulation .....................................................................92
3.2.1.3 PPTP Encapsulation .......................................................................93
3.2.2 Internet Access Wizard: Second Screen...................................................95
3.2.3 Internet Access Wizard: Registration.........................................................96
3.3 VPN Wizard Gateway Setting ............................................................................99
3.4 VPN Wizard Network Setting ...........................................................................101
3.5 VPN Wizard IKE Tunnel Setting (IKE Phase 1) ...............................................103
3.6 VPN Wizard IPSec Setting (IKE Phase 2) .......................................................104
3.7 VPN Wizard Status Summary ..........................................................................106
3.8 VPN Wizard Setup Complete ...........................................................................109
Chapter 4
Tutorial ...................................................................................................................111
4.1 Security Settings for VPN Traffic ......................................................................111
4.1.1 IDP for From VPN Traffic Example .........................................................111
4.1.2 IDP for To VPN Traffic Example ..............................................................113
4.2 Firewall Rule for VPN Example ........................................................................114
4.2.1 Configuring the VPN Rule .......................................................................115
4.2.2 Configuring the Firewall Rules ................................................................118
4.2.2.1 Firewall Rule to Allow Access Example ........................................119
4.2.2.2 Default Firewall Rule to Block Other Access Example ..................121
Chapter 5
Registration ..........................................................................................................123
5.1 myZyXEL.com overview ...................................................................................123
5.1.1 Subscription Services Available on the ZyWALL ....................................123
5.2 Registration ......................................................................................................124
5.3 Service .............................................................................................................126

ZyWALL 5/35/70 Series User’s Guide
Table of Contents 13
Chapter 6
LAN Screens.........................................................................................................129
6.1 LAN, WAN and the ZyWALL ............................................................................129
6.2 IP Address and Subnet Mask ...........................................................................129
6.2.1 Private IP Addresses ..............................................................................130
6.3 DHCP ...............................................................................................................131
6.3.1 IP Pool Setup ..........................................................................................131
6.4 RIP Setup .........................................................................................................131
6.5 Multicast ...........................................................................................................131
6.6 WINS ................................................................................................................132
6.7 LAN ..................................................................................................................132
6.8 LAN Static DHCP .............................................................................................135
6.9 LAN IP Alias ...................................................................................................136
6.10 LAN Port Roles ..............................................................................................139
Chapter 7
Bridge Screens.....................................................................................................141
7.1 Bridge Loop ......................................................................................................141
7.2 Spanning Tree Protocol (STP) .........................................................................142
7.2.1 Rapid STP ..............................................................................................142
7.2.2 STP Terminology ....................................................................................142
7.2.3 How STP Works .....................................................................................142
7.2.4 STP Port States ......................................................................................143
7.3 Bridge ...............................................................................................................143
7.4 Bridge Port Roles ............................................................................................145
Chapter 8
WAN Screens........................................................................................................147
8.1 WAN Overview .................................................................................................147
8.2 Multiple WAN ....................................................................................................147
8.3 Load Balancing Introduction .............................................................................148
8.4 Load Balancing Algorithms ..............................................................................148
8.4.1 Least Load First ......................................................................................148
8.4.1.1 Example 1 .....................................................................................149
8.4.1.2 Example 2 .....................................................................................149
8.4.2 Weighted Round Robin ...........................................................................150
8.4.3 Spillover ..................................................................................................150
8.5 TCP/IP Priority (Metric) ....................................................................................151
8.6 WAN General ...................................................................................................151
8.7 Configuring Load Balancing .............................................................................155
8.7.1 Least Load First ......................................................................................155
8.7.2 Weighted Round Robin ...........................................................................156
8.7.3 Spillover ..................................................................................................157

ZyWALL 5/35/70 Series User’s Guide
14 Table of Contents
8.8 WAN Route ......................................................................................................157
8.9 WAN IP Address Assignment ...........................................................................159
8.10 DNS Server Address Assignment ................................................................159
8.11 WAN MAC Address ........................................................................................160
8.12 WAN .............................................................................................................160
8.12.1 WAN Ethernet Encapsulation ...............................................................160
8.12.2 PPPoE Encapsulation ...........................................................................163
8.12.3 PPTP Encapsulation .............................................................................166
8.13 Traffic Redirect ..........................................................................................170
8.14 Configuring Traffic Redirect ............................................................................170
8.15 Configuring Dial Backup .................................................................................171
8.16 Advanced Modem Setup ..............................................................................175
8.16.1 AT Command Strings ............................................................................175
8.16.2 DTR Signal ...........................................................................................175
8.16.3 Response Strings ..................................................................................175
8.17 Configuring Advanced Modem Setup ............................................................175
Chapter 9
DMZ Screens ........................................................................................................179
9.1 DMZ ...............................................................................................................179
9.2 Configuring DMZ ..............................................................................................179
9.3 DMZ Static DHCP ..........................................................................................182
9.4 DMZ IP Alias ..................................................................................................183
9.5 DMZ Public IP Address Example .....................................................................185
9.6 DMZ Private and Public IP Address Example ..................................................186
9.7 DMZ Port Roles ..............................................................................................187
Chapter 10
Wireless LAN........................................................................................................189
10.1 Wireless LAN Introduction ..............................................................................189
10.1.1 Additional Installation Requirements for Using 802.1x .........................189
10.2 Configuring WLAN .......................................................................................189
10.3 WLAN Static DHCP ......................................................................................192
10.4 WLAN IP Alias ..............................................................................................193
10.5 WLAN Port Roles ..........................................................................................195
10.6 Wireless Security ...........................................................................................197
10.6.1 Encryption .............................................................................................198
10.6.2 Authentication .......................................................................................198
10.6.3 Restricted Access .................................................................................199
10.6.4 Hide ZyWALL Identity ...........................................................................199
10.7 Security Parameters Summary ......................................................................199
10.8 WEP Encryption .............................................................................................199
10.9 802.1x Overview ............................................................................................200

ZyWALL 5/35/70 Series User’s Guide
Table of Contents 15
10.9.1 Introduction to RADIUS ........................................................................200
10.9.1.1 Types of RADIUS Messages .......................................................200
10.9.2 EAP Authentication Overview ...............................................................201
10.10 Dynamic WEP Key Exchange ......................................................................202
10.11 Introduction to WPA ......................................................................................202
10.11.1 User Authentication .............................................................................202
10.11.2 Encryption ...........................................................................................202
10.12 WPA-PSK Application Example ...................................................................203
10.13 Introduction to RADIUS ................................................................................204
10.14 WPA with RADIUS Application Example ......................................................204
10.15 Wireless Client WPA Supplicants .................................................................205
10.16 Wireless Card .............................................................................................205
10.16.1 Static WEP ..........................................................................................207
10.16.2 WPA-PSK ...........................................................................................208
10.16.3 WPA ....................................................................................................210
10.16.4 IEEE 802.1x + Dynamic WEP ............................................................211
10.16.5 IEEE 802.1x + Static WEP ..................................................................212
10.16.6 IEEE 802.1x + No WEP ......................................................................214
10.16.7 No Access 802.1x + Static WEP .........................................................215
10.16.8 No Access 802.1x + No WEP .............................................................216
10.17 MAC Filter ...................................................................................................217
Chapter 11
Firewall..................................................................................................................219
11.1 Firewall Overview ..........................................................................................219
11.2 Packet Direction Matrix ..................................................................................220
11.3 Packet Direction Examples ............................................................................221
11.3.1 To VPN Packet Direction .......................................................................222
11.3.2 From VPN Packet Direction ..................................................................224
11.3.3 From VPN To VPN Packet Direction .....................................................225
11.4 Security Considerations .................................................................................226
11.5 Firewall Rules Example ..................................................................................227
11.6 Asymmetrical Routes .....................................................................................229
11.6.1 Asymmetrical Routes and IP Alias ........................................................229
11.7 Firewall Default Rule (Router Mode) ..............................................................230
11.8 Firewall Default Rule (Bridge Mode) ............................................................232
11.9 Firewall Rule Summary .................................................................................234
11.9.1 Firewall Edit Rule ..............................................................................236
11.10 Anti-Probing ..............................................................................................239
11.11 Firewall Thresholds ....................................................................................240
11.11.1 Threshold Values .................................................................................241
11.12 Threshold Screen .........................................................................................241
11.13 Service ........................................................................................................243

ZyWALL 5/35/70 Series User’s Guide
16 Table of Contents
11.13.1 Firewall Edit Custom Service ..............................................................245
11.14 My Service Firewall Rule Example ...............................................................246
Chapter 12
Intrusion Detection and Prevention (IDP)..........................................................251
12.1 Introduction to IDP ....................................................................................251
12.1.1 Firewalls and Intrusions ........................................................................251
12.1.2 IDS and IDP .........................................................................................252
12.1.3 Host IDP ..............................................................................................252
12.1.4 Network IDP .........................................................................................252
12.1.5 Example Intrusions ...............................................................................253
12.1.5.1 SQL Slammer Worm ...................................................................253
12.1.5.2 Blaster W32.Worm ......................................................................253
12.1.5.3 Nimda ..........................................................................................253
12.1.5.4 MyDoom ......................................................................................254
12.1.6 ZyWALL IDP .........................................................................................254
Chapter 13
Configuring IDP....................................................................................................255
13.1 Overview ........................................................................................................255
13.1.1 Interfaces ..............................................................................................255
13.2 General Setup ................................................................................................256
13.3 IDP Signatures ...............................................................................................257
13.3.1 Attack Types .........................................................................................257
13.3.2 Intrusion Severity ..................................................................................259
13.3.3 Signature Actions ..................................................................................259
13.3.4 Configuring IDP Signatures ..................................................................260
13.3.5 Query View ...........................................................................................262
13.3.5.1 Query Example 1 ........................................................................265
13.3.5.2 Query Example 2 ........................................................................266
13.4 Update ...........................................................................................................267
13.4.1 mySecurityZone ....................................................................................267
13.4.2 Configuring IDP Update ........................................................................268
13.5 Backup and Restore .......................................................................................269
Chapter 14
Anti-Virus..............................................................................................................271
14.1 Anti-Virus Overview .......................................................................................271
14.1.1 Types of Computer Viruses .................................................................271
14.1.2 Computer Virus Infection and Prevention .............................................271
14.1.3 Types of Anti-Virus Scanner ................................................................272
14.2 Introduction to the ZyWALL Anti-Virus Scanner .............................................272
14.2.1 How the ZyWALL Anti-Virus Scanner Works .......................................273

ZyWALL 5/35/70 Series User’s Guide
Table of Contents 17
14.2.2 Notes About the ZyWALL Anti-Virus .....................................................273
14.3 General Anti-Virus Setup ...............................................................................274
14.4 Signature Searching .......................................................................................276
14.4.1 Signature Search Example ...................................................................278
14.5 Signature Update .........................................................................................281
14.5.1 mySecurityZone ....................................................................................281
14.5.2 Configuring Anti-virus Update ..............................................................281
14.6 Backup and Restore ......................................................................................283
Chapter 15
Anti-Spam .............................................................................................................285
15.1 Anti-Spam Overview ....................................................................................285
15.1.1 Anti-Spam External Database ...............................................................285
15.1.1.1 SpamBulk Engine ........................................................................286
15.1.1.2 SpamRepute Engine ...................................................................286
15.1.1.3 SpamContent Engine ..................................................................286
15.1.1.4 SpamTricks Engine .....................................................................287
15.1.2 Spam Threshold ....................................................................................287
15.1.3 Phishing ................................................................................................287
15.1.4 Whitelist ................................................................................................288
15.1.5 Blacklist .................................................................................................288
15.1.6 SMTP and POP3 ..................................................................................288
15.1.7 MIME Headers ......................................................................................289
15.2 Anti-Spam General Screen ............................................................................289
15.3 Anti-Spam External DB Screen .................................................................292
15.4 Anti-Spam Lists Screen .................................................................................294
15.5 Anti-Spam Lists Edit Screen .........................................................................296
Chapter 16
Content Filtering Screens ...................................................................................299
16.1 Content Filtering Overview .............................................................................299
16.1.1 Restrict Web Features ..........................................................................299
16.1.2 Create a Filter List ................................................................................299
16.1.3 Customize Web Site Access ................................................................299
16.2 Content Filter General Screen .....................................................................299
16.3 Content Filtering with an External Database ..................................................302
16.4 Content Filter Categories ............................................................................303
16.5 Content Filter Customization .......................................................................310
16.6 Customizing Keyword Blocking URL Checking ..............................................312
16.6.1 Domain Name or IP Address URL Checking ........................................312
16.6.2 Full Path URL Checking .......................................................................312
16.6.3 File Name URL Checking .....................................................................312
16.7 Content Filtering Cache ...............................................................................313

ZyWALL 5/35/70 Series User’s Guide
18 Table of Contents
Chapter 17
Content Filtering Reports....................................................................................315
17.1 Checking Content Filtering Activation ............................................................315
17.2 Viewing Content Filtering Reports ..................................................................315
17.3 Web Site Submission .....................................................................................320
Chapter 18
IPSec VPN.............................................................................................................323
18.1 IPSec VPN Overview ...................................................................................323
18.1.1 IKE SA Overview ..................................................................................324
18.1.1.1 IP Addresses of the ZyWALL and Remote IPSec Router ...........324
18.2 VPN Rules (IKE) ............................................................................................325
18.3 IKE SA Setup ................................................................................................327
18.3.1 IKE SA Proposal ...................................................................................327
18.3.1.1 Diffie-Hellman (DH) Key Exchange .............................................328
18.3.1.2 Authentication .............................................................................328
18.3.1.3 Extended Authentication .............................................................330
18.3.1.4 Negotiation Mode ........................................................................330
18.3.1.5 VPN, NAT, and NAT Traversal .....................................................331
18.4 Additional IPSec VPN Topics .........................................................................332
18.4.1 SA Life Time .........................................................................................332
18.4.2 IPSec High Availability ..........................................................................332
18.4.3 Encryption and Authentication Algorithms ............................................333
18.5 VPN Rules (IKE) Gateway Policy Edit ...........................................................334
18.6 IPSec SA Overview ....................................................................................340
18.6.0.1 Local Network and Remote Network ...........................................340
18.6.0.2 Active Protocol ............................................................................340
18.6.0.3 Encapsulation ..............................................................................341
18.6.0.4 IPSec SA Proposal and Perfect Forward Secrecy ......................341
18.7 VPN Rules (IKE): Network Policy Edit ..........................................................342
18.8 VPN Rules (IKE): Network Policy Move .......................................................346
18.9 IPSec SA Using Manual Keys ....................................................................348
18.9.1 IPSec SA Proposal Using Manual Keys ...............................................348
18.9.2 Authentication and the Security Parameter Index (SPI) .......................348
18.10 VPN Rules (Manual) ....................................................................................348
18.11 VPN Rules (Manual): Edit .........................................................................350
18.12 VPN SA Monitor .........................................................................................353
18.13 VPN Global Setting .....................................................................................354
18.14 Telecommuter VPN/IPSec Examples ...........................................................356
18.14.1 Telecommuters Sharing One VPN Rule Example ..............................356
18.14.2 Telecommuters Using Unique VPN Rules Example ...........................357
18.15 VPN and Remote Management ...................................................................358
18.16 Hub-and-spoke VPN ....................................................................................359

ZyWALL 5/35/70 Series User’s Guide
Table of Contents 19
18.16.1 Hub-and-spoke VPN Example ............................................................360
18.16.2 Hub-and-spoke Example VPN Rule Addresses .................................360
18.16.3 Hub-and-spoke VPN Requirements and Suggestions ........................361
Chapter 19
Certificates............................................................................................................363
19.1 Certificates Overview .....................................................................................363
19.1.1 Advantages of Certificates ....................................................................364
19.2 Self-signed Certificates ..................................................................................364
19.3 Verifying a Certificate .....................................................................................364
19.3.1 Checking the Fingerprint of a Certificate on Your Computer ................364
19.4 Configuration Summary .................................................................................365
19.5 My Certificates ..............................................................................................366
19.6 My Certificate Details ...................................................................................368
19.7 My Certificate Export .....................................................................................370
19.7.1 Certificate File Export Formats .............................................................370
19.8 My Certificate Import ....................................................................................371
19.8.1 Certificate File Formats .........................................................................372
19.9 My Certificate Create ...................................................................................374
19.10 Trusted CAs ...............................................................................................376
19.11 Trusted CA Details ......................................................................................378
19.12 Trusted CA Import ......................................................................................381
19.13 Trusted Remote Hosts ...............................................................................382
19.14 Trusted Remote Hosts Import ....................................................................384
19.15 Trusted Remote Host Certificate Details ....................................................385
19.16 Directory Servers ........................................................................................388
19.17 Directory Server Add or Edit ......................................................................389
Chapter 20
Authentication Server..........................................................................................391
20.1 Authentication Server Overview .....................................................................391
20.1.1 Local User Database ............................................................................391
20.1.2 RADIUS ................................................................................................391
20.2 Local User Database ....................................................................................391
20.3 RADIUS ........................................................................................................393
Chapter 21
Network Address Translation (NAT)...................................................................395
21.1 NAT Overview ..............................................................................................395
21.1.1 NAT Definitions .....................................................................................395
21.1.2 What NAT Does ....................................................................................396
21.1.3 How NAT Works ...................................................................................396
21.1.4 NAT Application ....................................................................................397

ZyWALL 5/35/70 Series User’s Guide
20 Table of Contents
21.1.5 Port Restricted Cone NAT ....................................................................398
21.1.6 NAT Mapping Types .............................................................................398
21.2 Using NAT ......................................................................................................399
21.2.1 SUA (Single User Account) Versus NAT ..............................................399
21.3 NAT Overview Screen ....................................................................................400
21.4 NAT Address Mapping .................................................................................401
21.4.1 NAT Address Mapping Edit ..................................................................403
21.5 Port Forwarding .............................................................................................404
21.5.1 Default Server IP Address ....................................................................405
21.5.2 Port Forwarding: Services and Port Numbers ......................................405
21.5.3 Configuring Servers Behind Port Forwarding (Example) ......................405
21.5.4 NAT and Multiple WAN .........................................................................406
21.5.5 Port Translation ....................................................................................406
21.6 Port Forwarding Screen .................................................................................407
21.7 Port Triggering ..............................................................................................409
Chapter 22
Static Route ..........................................................................................................413
22.1 IP Static Route ............................................................................................413
22.2 IP Static Route ...............................................................................................413
22.2.1 IP Static Route Edit ..............................................................................415
Chapter 23
Policy Route .........................................................................................................417
23.1 Policy Route ..................................................................................................417
23.2 Benefits ..........................................................................................................417
23.3 Routing Policy ................................................................................................417
23.4 IP Routing Policy Setup .................................................................................418
23.5 Policy Route Edit ...........................................................................................419
Chapter 24
Bandwidth Management......................................................................................423
24.1 Bandwidth Management Overview ...............................................................423
24.2 Bandwidth Classes and Filters .......................................................................423
24.3 Proportional Bandwidth Allocation .................................................................424
24.4 Application-based Bandwidth Management ...................................................424
24.5 Subnet-based Bandwidth Management .........................................................424
24.6 Application and Subnet-based Bandwidth Management ...............................425
24.7 Scheduler .......................................................................................................425
24.7.1 Priority-based Scheduler ......................................................................425
24.7.2 Fairness-based Scheduler ....................................................................425
24.7.3 Maximize Bandwidth Usage .................................................................425
24.7.4 Reserving Bandwidth for Non-Bandwidth Class Traffic ........................426