ZyXEL Communications ZyWALL 70 User manual

ZyWALL 70
Internet Security Appliance
Quick Start Guide
Version 3.62
December 2003

ZyWALL 70 Internet Security Appliance
1
Introducing the ZyWALL
The ZyWALL 70 is the ideal secure gateway for all data passing between the Internet and the LAN. By
integrating NAT, firewall, VPN capability and wireless LAN, ZyXEL’s ZyWALL 70 is a complete security
solution that protects your Intranet and efficiently manages data traffic on your network. The embedded web
configurator is easy to operate and totally independent of the operating system platform you use.
You should have an Internet account already set up and have been given most of the following information.
Internet Account Information
Your device’s WAN IP Address (if given): __________________
Your device’s WAN Default Gateway (if given): __________________
Your device’s WAN Net Mask (if given): __________________
DNS Server IP Address (if given): Primary _______________, Secondary _______________, Third _______________
Encapsulation: (choose one below)
 Ethernet Service Type: _______________________
Login Server IP Address: ______________
User Name: ____________ Password: ____________
 PPTP User Name: ____________ Password: ____________
Your WAN IP Address: ____________ PPTP Server IP Address: ___________
Connection ID (if required): ____________
 PPPoE (PPPoE) Service Name: ____________
User Name: ____________ Password: ____________
Procedure to View a Product’s Certification(s)
1. Go to www.zyxel.com.
2. Select your product from the drop-down list box on the ZyXEL home page to go to that product's page.
3. Select the certification you wish to view from this page.

ZyWALL 70 Internet Security Appliance
2
1 Hardware Connections
1.1 Front Panel and Connections
LABEL DESCRIPTION
RESET You only need to use this button if you’ve forgotten the ZyWALL’s password. It returns
the ZyWALL to the factory defaults (password is 1234, LAN IP address 192.168.1.1,
terminal emulation settings as described below etc.; see your User’s Guide for details).
LAN Connect a computer to this port with an Ethernet cable. This port is auto-negotiating (can
connect at 10 or 100Mbps) and auto-crossover (automatically adjust to the type of
Ethernet cable you use (straight-through or crossover)).
WAN-1/2 Connect your cable/DSL modem to this port with the cable that came with your modem.
DMZ 10/100M Connect publicly accessible servers (Web, FTP, etc.) to these ports to make them visible
to the outside world. Use Ethernet cables to connect these ports to computers or
switches.
DIAL BACKUP
Only connect this port if you want to set up a backup WAN connection; see your User’s
Guide for details.
Connect the 9-pin female end of your modem or TA cable to this port and the other end
to your modem or TA.
CONSOLE Only connect this port if you want to configure the ZyWALL using the SMT via console
port; see your User’s Guide for details.
Connect the 9-pin male end of the console cable to the console port of the ZyWALL and
the other end to a serial port (COM1, COM2 or other COM port) on your computer. Your
computer should have a terminal emulation communications program (such as
HyperTerminal) set to VT100 terminal emulation, no parity, 8 data bits, 1 stop bit, no flow
control and 9600 bps port speed.

ZyWALL 70 Internet Security Appliance
3
1.2 Rear Panel and Connections
LABEL DESCRIPTION
Extension Card
Slot Do not insert or remove a card with the ZyWALL turned on.
Turn off the ZyWALL before inserting or removing an 11 Mbps 802.11b-compliant
wireless LAN PCMCIA card (to avoid damage).
Slide the 64-pin connector end of the PCMCIA wireless LAN card into the slot as
shown next.
Do not force, bend or twist the wireless LAN card.
POWER 100-
240VAC
Connect the included power cord (use only this cord) to this power socket.
After you’ve made the connections, connect the power cord to a power supply and push the power switch to
the on position. Look at the front panel LEDs.

ZyWALL 70 Internet Security Appliance
4
1.3 The Front Panel LEDs
The PWR LED turns on when you connect the power. The SYS LED blinks while performing system testing
and then stays on if the testing is successful. The ACT, CARD, LAN, WAN and DMZ LEDs turn on if the
corresponding connections are properly made. Refer to the following table for more detailed LED
descriptions.
LED COLOR STATUS DESCRIPTION
Off The ZyWALL is turned off.
Green On The ZyWALL is turned on.
PWR
Red On The power to the ZyWALL is too low.
Off The ZyWALL is not ready or has failed.
On The ZyWALL is ready and running.
SYS Green
Flashing The ZyWALL is rebooting.
Off The backup port is not connected.ACT Green
Flashing The backup port is sending or receiving packets.
Off The wireless LAN is not ready, or has failed.
On The wireless LAN is ready.
CARD Green
Flashing The wireless LAN is sending or receiving packets.
Off The LAN is not connected.
On The ZyWALL has a successful 10Mbps Ethernet connection.Green
Flashing The 10M LAN is sending or receiving packets.
On The ZyWALL has a successful 100Mbps Ethernet connection.
LAN
10/100
Orange
Flashing The 100M LAN is sending or receiving packets.
Off The WAN connection is not ready, or has failed.
On The ZyWALL has a successful 10Mbps WAN connection.
WAN-1/2
10/100 Green
Flashing The 10M WAN is sending or receiving packets.

ZyWALL 70 Internet Security Appliance
5
LED COLOR STATUS DESCRIPTION
On The ZyWALL has a successful 100Mbps WAN connection.Orange
Flashing The 100M WAN is sending or receiving packets.
Off The DMZ connection is not ready, or has failed.
On The ZyWALL is connected to a 100Mbps DMZ.Green
Flashing The 10M DMZ is sending or receiving packets.
On The ZyWALL is connected to a 100Mbps DMZ.
DMZ
10/100
Orange
Flashing The 100M DMZ is sending or receiving packets.
2 Setting Up Your Computer’s IP Address
Skip this section if your computer is already set up to accept a dynamic IP
address. This is the default for most new computers.
The ZyWALL is already set up to assign your computer an IP address. Use this section to set up your
computer to receive an IP address or assign it a static IP address in the 192.168.1.2 to 192.168.1.254 range
with a subnet mask of 255.255.255.0. This is necessary to ensure that your computer can communicate with
your ZyWALL.
Your computer must have an Ethernet card and TCP/IP installed. TCP/IP should already be installed on
computers using Windows NT/2000/XP, Macintosh OS 7 and later operating systems.
Windows 2000/NT/XP
1. In Windows XP, click Start, Control Panel. In Windows 2000/NT, click Start, Settings, Control Panel.
2. In Windows XP, click Network Connections.
In Windows 2000/NT, click Network and Dial-up Connections.
3. Right-click Local Area Connection and then click Properties.
4. Select Internet Protocol (TCP/IP) (under the General tab in Windows XP) and click Properties.

ZyWALL 70 Internet Security Appliance
6
5. The Internet Protocol TCP/IP Properties screen opens (the
General tab in Windows XP).
- To have your computer assigned a dynamic IP address, click
Obtain an IP address automatically.
-To configure a static IP address, click Use the following IP
Address and fill in the IP address (choose one
from192.168.1.2 to 192.168.1.254), Subnet mask
(255.255.255.0), and Default gateway (192.168.1.1) fields.
6. Click Advanced. Remove any previously installed gateways in
the IP Settings tab and click OK to go back to the Internet
Protocol TCP/IP Properties screen.
7. Click Obtain DNS server address automatically if you do
not know your DNS server IP address(es).
If you know your DNS server IP address(es), click Use the
following DNS server addresses, and type them in the
Preferred DNS server and Alternate DNS server fields.
If you have more than two DNS servers, click Advanced, the
DNS tab and then configure them using Add.
8. Click OK to close the Internet Protocol (TCP/IP) Properties
window.
9. Click OK to close the Local Area Connection Properties
window.
Checking Your Computer’s IP Address
1. In the computer, click Start, (All) Programs, Accessories and then Command Prompt.
2. In the Command Prompt window, type "ipconfig" and then press ENTER. Your computer’s IP address must be in
the correct range (192.168.1.2 to 192.168.1.254) with subnet mask 255.255.255.0 in order to communicate with
the ZyWALL.

ZyWALL 70 Internet Security Appliance
7
Refer to your User’s Guide for detailed IP address configuration for other Windows and Macintosh computer
operating systems.
3 Configuring Your ZyWALL
Choose one of these methods to access and configure the ZyWALL. This Quick
Start Guide shows you how to use the web configurator wizards only. See your
User’s Guide for background information on all ZyWALL features and SMT
configuration. Click the web configurator online help for screen-specific web help.
 Web Configurator
 SMT (System Management Terminal). Access the SMT via:
o Console port using terminal emulation software
o LAN, WLAN, DMZ or WAN using Telnet
3.1 Accessing Your ZyWALL Via Web Configurator
Step 1. Launch your web browser. Enter “192.168.1.1” as the web site address.
Step 2. The default password (“1234”) is already in the password field (in non-readable format). Click
Login to proceed to a screen asking you to change your password. Click Reset to revert to the
default password in the password field.
Web site address.
Default password.

ZyWALL 70 Internet Security Appliance
8
Step 3. It is highly recommended you change the default password! Enter a new password, retype it to
confirm and click Apply; alternatively click Ignore if you do not want to change the password
now.
Step 1. Click Apply in the Replace Certificate screen to create a certificate using your ZyWALL’s
MAC address that will be specific to this device.
Step 4. You should now see the web configurator HOME screen.
 Click Internet Access and VPN Wizard to begin setup wizards screens to help you configure your
ZyWALL for the first time.
 Click a link in the navigation panel to configure that ZyWALL feature.
 Click MAINTENANCE in the navigation panel to upload firmware and back up, restore or upload
a configuration file.
 Click Renew to renew the WAN IP address.
 Click Show Statistics to see ZyWALL performance statistics.
 Click Show DHCP Table to show current DHCP client information.
Change default password.

ZyWALL 70 Internet Security Appliance
9
 Click VPN Status to display the active VPN connections.
 Click LOGOUT when you have finished a ZyWALL management session. The ZyWALL
automatically logs you out if it is left idle for five minutes; press Refresh to display the Login
screen again and then log back in. This idle timeout timer is one of the many ZyWALL features that
you may edit using the web configurator.
LOGOUT
Navigation panel
Wizards

ZyWALL 70 Internet Security Appliance
10
3.2 Using the Wizard to Configure for Internet Access
Step 1. Click Internet Access in the HOME screen to help you configure your WAN1 on the ZyWALL
to access the Internet. The first wizard screen has three variations depending on what
encapsulation type you use. Use the information in Internet Account Information to fill in fields.
Choose Ethernet when the WAN port is used
as a regular Ethernet. Choose from Standard
or a RoadRunner version. You’ll need User
Name, Password and Login Server IP
Address for some Roadrunner versions.
Point-to-Point Protocol over Ethernet (PPPoE)
also functions as a dial-up connection.
Therefore you’ll also need a username and
password and possibly the PPPoE service
name.
Your ISP will give you all needed information.
Choose PPTP if your service provider uses a
DSL terminator with PPTP login. The ZyWALL
must have a static IP address in this case.
You’ll also need a login name, associated
password, the DSL terminator IP address and
possibly a connection ID.
Click Next to continue.
Step 2. Fill in the fields and click Finish to save and complete the wizard setup.
WAN IP Address Assignment
Select Get automatically from ISP if your ISP
did not assign you a fixed IP address. Select
Use fixed IP address if the ISP assigned a
fixed IP address and then enter your IP
address and subnet mask in the next two
fields. Enter the gateway IP address in this field
(if provided) when you select Use Fixed IP
Address.
System DNS Servers
Select From ISP if your ISP dynamically
assigns DNS server information (and the
ZyWALL's WAN IP address).
Select User-Defined if you have the IP
address of a DNS server. Enter the DNS
server's IP address in the field to the right.
Select None if you do not want to configure
DNS servers. If you do not configure a DNS
server, you must know the IP address of a
machine in order to access it.

ZyWALL 70 Internet Security Appliance
11
WAN MAC Address
Select Factory Default to use the factory assigned default MAC address. Alternatively, select Spoof this Computer's MAC
address - IP Address and enter the IP address of the computer on the LAN whose MAC address you are cloning.
3.3 Test Your Internet Connection
Launch your web browser and navigate to www.zyxel.com. You don’t need a dial-up program such as Dial
Up Networking. Refer to the User’s Guide for more detailed information on the complete range of ZyWALL
features.
3.4 Using the Wizard to Configure a VPN Policy
Step 1. Click VPN Wizard in the HOME screen to help you edit a VPN rule that use a pre-shared key
and configure IKE settings to establish a VPN tunnel.
Enter the WAN IP address of your ZyWALL.
The ZyWALL uses its current WAN IP
address (static or dynamic) in setting up the
VPN tunnel if you leave this field as 0.0.0.0.
Select IP Address and then enter IP address
to identify the remote IPSec router by its IP
address.
Otherwise, select Domain Name and enter
the domain name.
Click Next to continue.
Step 2. Fill in the fields and click Next to continue.
Select Single for a single IP address. Select
Range IP for a specific range of IP
addresses. Select Subnet to specify IP
addresses on a network by their subnet
mask.
Local Network
If the Local Network field is configured to
Single, enter a (static) IP address on the
LAN behind your ZyWALL. If the Local
Network field is configured to Range IP,
enter the beginning and end (static) IP
address, in a range of computers on the LAN
behind your ZyWALL. If the Local Network
field is configured to Subnet, enter a (static)
IP address and subnet mask on the LAN
behind your ZyWALL.

ZyWALL 70 Internet Security Appliance
12
Remote Network
If the Remote Network field is configured to Single, enter a (static) IP address on the network behind the remote IPSec
router. If the Remote Network field is configured to Range IP, enter the beginning and end (static) IP address, in a range of
computers on the network behind the remote IPSec router. If the Remote Network field is configured to Subnet, enter a
(static) IP address and subnet mask on the network behind the remote IPSec router.
Step 3. Use the third wizard screen to configure IKE tunnel settings.
Negotiation Mode
Select Main Mode or Aggressive Mode.
Multiple SAs connecting through a secure
gateway must have the same negotiation
mode.
Encryption Algorithm
Select the method of data encryption using a
private (secret) key.
The DES encryption algorithm uses a 56-bit
key. Triple DES (3DES) is a variation on
DES that uses a 168-bit key. As a result,
3DES is more secure than DES. It also
requires more processing power, resulting in
increased latency and decreased throughput.
This implementation of AES uses a 128-bit
key. AES is faster than 3DES.
Authentication Algorithm
MD5 (Message Digest 5) and SHA1 (Secure Hash Algorithm) are hash algorithms used to authenticate packet data. Select
MD5 for minimal security and SHA-1 for maximum security.
Key Group
Choose a key group for phase 1 IKE setup. DH1 (default) refers to Diffie-Hellman Group 1 a 768 bit random number. DH2
refers to Diffie-Hellman Group 2 a 1024 bit (1Kb) random number.
SA Life Time (Minutes)
Define the length of time before an IKE SA automatically renegotiates in this field. The minimum value is 180 seconds.
Pre-Shared Key
Type from 8 to 31 case-sensitive ASCII characters or from 16 to 62 hexadecimal ("0-9", "A-F") characters. You must
precede a hexadecimal key with a "0x” (zero x), which is not counted as part of the 16 to 62 character range for the key.
Click Next to continue.

ZyWALL 70 Internet Security Appliance
13
Step 4. Use the forth wizard screen to configure IPSec settings.
Choose Tunnel mode or Transport mode.
Choose which protocol to use (ESP or AH)
for the IKE key exchange.
Choose an encryption algorithm or select
NULL to set up a tunnel without encryption.
Choose an authentication algorithm.
Set the IPSec SA lifetime. This field allows
you to determine how long the IPSec SA
should stay up before it times out.
Choose whether to enable Perfect Forward
Secrecy (PFS) using Diffie-Hellman public-
key cryptography. Select None (the default)
to disable PFS. DH1 refers to Diffie-Hellman
Group 1 a 768 bit random number. DH2
refers to Diffie-Hellman Group 2 a 1024 bit
(1Kb) random number (more secure, yet
slower).
Step 5. This read-only screen shows the status of the current VPN setting. Use the summary table to
check whether what you have configured is correct.
Click Finish to save and complete the wizard
setup. Otherwise, click Back to return to the
previous screen.

ZyWALL 70 Internet Security Appliance
14
4 Troubleshooting
PROBLEM CORRECTIVE ACTION
None of the
LEDs turn on
when you turn
on the ZyWALL.
Make sure that you have the power cord connected to the ZyWALL and an appropriate power
source. Make sure the fuse is not burnt out (see the User’s Guide appendices for details). Check all
cable connections.
If the LEDs still do not turn on, you may have a hardware problem. In this case, you should contact
your local vendor.
Cannot access
the ZyWALL
from the LAN.
Check the cable connection between the ZyWALL and your computer or hub. Refer to the section on
front panel for details.
Ping the ZyWALL from a LAN computer. Make sure your computer’s Ethernet card is installed and
functioning properly.
Cannot ping any
computer on the
LAN.
If the 10/100M LAN LEDs are off, check the cable connections between the ZyWALL and your LAN
computers.
Verify that the IP address and subnet mask of the ZyWALL and the LAN computers are in the same
IP address range.
The WAN IP is provided after the ISP verifies the MAC address, host name or user ID.
Find out the verification method used by your ISP and configure the corresponding fields.
If the ISP checks the WAN MAC address, you should clone the MAC address from a LAN computer.
Click WAN and then the WAN1 or WAN2 tab, select Spoof WAN MAC Address and enter the IP
address of the computer on the LAN whose MAC address you are cloning.
If the ISP checks the host name, enter your computer’s name in the System Name field in the
MAINTENANCE General screen (refer to the Maintenance part in the User’s Guide).
Cannot get a
WAN IP address
from the ISP.
If the ISP checks the user ID, click WAN and then the WAN1 or WAN2 tab. Check your service type,
user name, and password.
Check the ZyWALL’s connection to the cable/DSL device.Cannot access
the Internet. Click WAN to verify your settings.