ZyXEL Communications ZyWALL 70 User manual

ZyWALL 70
Internet Security Appliance
User’s Guide
Version 3.64
3/2005

ZyWALL 70 User’s Guide
Copyright 3
Copyright
Copyright © 2005 by ZyXEL Communications Corporation.
The contents of this publication may not be reproduced in any part or as a whole, transcribed,
stored in a retrieval system, translated into any language, or transmitted in any form or by any
means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or
otherwise, without the prior written permission of ZyXEL Communications Corporation.
Published by ZyXEL Communications Corporation. All rights reserved.
Disclaimer
ZyXEL does not assume any liability arising out of the application or use of any products, or
software described herein. Neither does it convey any license under its patent rights nor the
patent rights of others. ZyXEL further reserves the right to make changes in any products
described herein without notice. This publication is subject to change without notice.
Trademarks
ZyNOS (ZyXEL Network Operating System) is a registered trademark of ZyXEL
Communications, Inc. Other trademarks mentioned in this publication are used for
identification purposes only and may be properties of their respective owners.

ZyWALL 70 User’s Guide
4 Federal Communications Commission (FCC) Interference Statement
Federal Communications
Commission (FCC) Interference
Statement
This device complies with Part 15 of FCC rules. Operation is subject to the following two
conditions:
• This device may not cause harmful interference.
• This device must accept any interference received, including interference that may cause
undesired operations.
This equipment has been tested and found to comply with the limits for a Class B digital
device pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable
protection against harmful interference in a commercial environment. This equipment
generates, uses, and can radiate radio frequency energy, and if not installed and used in
accordance with the instructions, may cause harmful interference to radio communications.
If this equipment does cause harmful interference to radio/television reception, which can be
determined by turning the equipment off and on, the user is encouraged to try to correct the
interference by one or more of the following measures:
• Reorient or relocate the receiving antenna.
• Increase the separation between the equipment and the receiver.
• Connect the equipment into an outlet on a circuit different from that to which the receiver
is connected.
• Consult the dealer or an experienced radio/TV technician for help.
Notice 1
Changes or modifications not expressly approved by the party responsible for compliance
could void the user's authority to operate the equipment.
This Class B digital apparatus complies with Canadian ICES-003.
Cet appareil numérique de la classe B est conforme à la norme NMB-003 du Canada.
Certifications
Go to www.zyxel.com
1Select your product from the drop-down list box on the ZyXEL home page to go to that
product's page.
2Select the certification you wish to view from this page.

ZyWALL 70 User’s Guide
Safety Warnings 5
Safety Warnings
For your safety, be sure to read and follow all warning notices and instructions.
• Do NOT open the device or unit. Opening or removing covers can expose you to
dangerous high voltage points or other risks. ONLY qualified service personnel can
service the device. Please contact your vendor for further information.
• Connect the power cord to the right supply voltage (110V AC in North America or 230V
AC in Europe).
• Place connecting cables carefully so that no one will step on them or stumble over them.
Do NOT allow anything to rest on the power cord and do NOT locate the product where
anyone can walk on the power cord.
• If you wall mount your device, make sure that no electrical, gas or water pipes will be
damaged.
• Do NOT install nor use your device during a thunderstorm. There may be a remote risk of
electric shock from lightning.
• Do NOT expose your device to dampness, dust or corrosive liquids.
• Do NOT use this product near water, for example, in a wet basement or near a swimming
pool.
• Make sure to connect the cables to the correct ports.
• Do NOT obstruct the device ventilation slots, as insufficient airflow may harm your
device.
• Do NOT store things on the device.
• Connect ONLY suitable accessories to the device.

ZyWALL 70 User’s Guide
6ZyXEL Limited Warranty
ZyXEL Limited Warranty
ZyXEL warrants to the original end user (purchaser) that this product is free from any defects
in materials or workmanship for a period of up to two years from the date of purchase. During
the warranty period, and upon proof of purchase, should the product have indications of failure
due to faulty workmanship and/or materials, ZyXEL will, at its discretion, repair or replace the
defective products or components without charge for either parts or labor, and to whatever
extent it shall deem necessary to restore the product or components to proper operating
condition. Any replacement will consist of a new or re-manufactured functionally equivalent
product of equal value, and will be solely at the discretion of ZyXEL. This warranty shall not
apply if the product is modified, misused, tampered with, damaged by an act of God, or
subjected to abnormal working conditions.
Note
Repair or replacement, as provided under this warranty, is the exclusive remedy of the
purchaser. This warranty is in lieu of all other warranties, express or implied, including any
implied warranty of merchantability or fitness for a particular use or purpose. ZyXEL shall in
no event be held liable for indirect or consequential damages of any kind of character to the
purchaser.
To obtain the services of this warranty, contact ZyXEL's Service Center for your Return
Material Authorization number (RMA). Products must be returned Postage Prepaid. It is
recommended that the unit be insured when shipped. Any returned products without proof of
purchase or those with an out-dated warranty will be repaired or replaced (at the discretion of
ZyXEL) and the customer will be billed for parts and labor. All repaired or replaced products
will be shipped by ZyXEL to the corresponding return address, Postage Paid. This warranty
gives you specific legal rights, and you may also have other rights that vary from country to
country.

ZyWALL 70 User’s Guide
Customer Support 7
Customer Support
Please have the following information ready when you contact customer support.
• Product model and serial number.
• Warranty Information.
• Date that you received your device.
• Brief description of the problem and the steps you took to solve it.
METHOD
LOCATION
SUPPORT E-MAIL TELEPHONEAWEB SITE
REGULAR MAIL
SALES E-MAIL FAX FTP SITE
CORPORATE
HEADQUARTERS
(WORLDWIDE)
[email protected] [phone] www.zyxel.com
www.europe.zyxel.com
ZyXEL Communications Corp.
6 Innovation Road II
Science Park
Hsinchu 300
Taiw an
[email protected] [phone] ftp.zyxel.com
ftp.europe.zyxel.com
CZECH REPUBLIC
[email protected] [phone] www.zyxel.cz ZyXEL Communications
Czech s.r.o.
Modranská 621
143 01 Praha 4 - Modrany
Ceská Republika
[email protected] [phone]
DENMARK
[email protected] [phone] www.zyxel.dk ZyXELCommunicationsA/S
Columbus vej 5
2860 Soeborg
Denmark
[email protected] [phone]
FINLAND
[email protected] [phone] www.zyxel.fi ZyXEL Communications Oy
Malminka ari 10
00700 Helsinki
Finland
[email protected] [phone]
FRANCE
[email protected] [phone] www.zyxel.fr Z y X E L F r a n c e
1 rue d es Ve rge rs
Bat. 1 / C
69760 Limonest
France
[phone]
GERMANY
[email protected] [phone] www.zyxel.de ZyXEL Deutschland GmbH.
Adenauerstr. 20/A2 D-52146
Wuerselen
Germany
[email protected] [phone]
NORTH AMERICA
[email protected] [phone]
[phone]
www.us.zyxel.com ZyXEL Communications Inc.
1130 N. Miller St.
Anaheim
CA 92806-2001
U.S.A.
[email protected] [phone] ftp.us.zyxel.com
NORWAY
[email protected] [phone] www.zyxel.no ZyXELCommunicationsA/S
Nils Hansens vei 13
0667 Oslo
Norway
[email protected] [phone]
SPAIN
[email protected] [phone] www.zyxel.es ZyXEL Communications
Alejandro Villegas 33
1º,28043Madrid
Spain
[email protected] [phone]
SWEDEN
[email protected] [phone] www.zyxel.se ZyXEL Communications A/S
Sjöporten 4, 41764 Göteborg
Sweden
[email protected] [phone]

ZyWALL 70 User’s Guide
8Customer Support
UNITED KINGDOM
[email protected] [phone] www.zyxel.co.uk ZyXEL Communications UK
Ltd.,11, The Courtyard,
Eastern Road, Bracknell,
Berkshire, RG12 2XB,
United Kingdom (UK)
[email protected] [phone] ftp.zyxel.co.uk
a. “+” is the (prefix) number you enter to make an international telephone call.
METHOD
LOCATION
SUPPORT E-MAIL TELEPHONEAWEB SITE
REGULAR MAIL
SALES E-MAIL FAX FTP SITE

ZyWALL 70 User’s Guide
Table of Contents 9
Table of Contents
Copyright .................................................................................................................. 3
Federal Communications Commission (FCC) Interference Statement ............... 4
Safety Warnings ....................................................................................................... 5
ZyXEL Limited Warranty.......................................................................................... 6
Customer Support.................................................................................................... 7
Table of Contents ..................................................................................................... 9
List of Figures ........................................................................................................ 27
List of Tables .......................................................................................................... 39
Preface .................................................................................................................... 47
Chapter 1
Getting to Know Your ZyWALL ............................................................................. 49
1.1 ZyWALL 70 Internet Security Appliance Overview .............................................49
1.2 Physical Features ...............................................................................................49
1.2.1 Non-Physical Features .............................................................................51
1.3 Applications for the ZyWALL ..............................................................................56
1.3.1 Secure Broadband Internet Access via Cable or DSL Modem .................56
1.3.2 VPN Application ........................................................................................56
1.3.3 Front Panel LEDs .....................................................................................57
Chapter 2
Introducing the Web Configurator........................................................................ 59
2.1 Web Configurator Overview ...............................................................................59
2.2 Accessing the ZyWALL Web Configurator .........................................................59
2.3 Resetting the ZyWALL .......................................................................................60
2.3.1 Procedure To Use The Reset Button ........................................................61
2.3.2 Uploading a Configuration File Via Console Port .....................................61
2.4 Navigating the ZyWALL Web Configurator ........................................................62
2.4.1 Router Mode .............................................................................................62
2.4.2 Bridge Mode .............................................................................................64
2.4.3 Navigation Panel .......................................................................................66
2.4.4 System Statistics .......................................................................................69
2.4.4.1 Show Statistics: Line Chart .............................................................70

ZyWALL 70 User’s Guide
10 Table of Contents
2.4.5 DHCP Table Screen .................................................................................71
2.4.6 VPN Status ...............................................................................................72
Chapter 3
Wizard Setup .......................................................................................................... 75
3.1 Wizard Setup Overview ......................................................................................75
3.2 Internet Access .................................................................................................75
3.2.1 ISP Parameters ........................................................................................75
3.2.1.1 Ethernet ...........................................................................................75
3.2.1.2 PPPoE Encapsulation .....................................................................77
3.2.1.3 PPTP Encapsulation .......................................................................78
3.2.2 Internet Access Wizard Setup Complete ..................................................80
3.3 VPN Wizard ........................................................................................................81
3.3.1 Network Setting ........................................................................................83
3.3.2 IKE Tunnel Setting (IKE Phase 1) ............................................................85
3.3.3 IPSec Setting (IKE Phase 2) .....................................................................87
3.3.4 VPN Status Summary ...............................................................................88
3.3.5 VPN Wizard Setup Complete ...................................................................91
Chapter 4
LAN Screens........................................................................................................... 93
4.1 LAN Overview ....................................................................................................93
4.2 DHCP Setup .......................................................................................................93
4.2.1 IP Pool Setup ............................................................................................93
4.3 LAN TCP/IP ........................................................................................................93
4.3.1 Factory LAN Defaults ................................................................................93
4.3.2 IP Address and Subnet Mask ...................................................................94
4.3.3 RIP Setup .................................................................................................94
4.3.4 Multicast ....................................................................................................95
4.4 DNS Servers ......................................................................................................95
4.5 Configuring LAN .................................................................................................95
4.6 Configuring Static DHCP ....................................................................................98
4.7 Configuring IP Alias ............................................................................................99
Chapter 5
Bridge Screens..................................................................................................... 103
5.1 Bridge Loop ......................................................................................................103
5.2 Spanning Tree Protocol (STP) .........................................................................103
5.2.1 Rapid STP ..............................................................................................104
5.2.2 STP Terminology ....................................................................................104
5.2.3 How STP Works .....................................................................................104
5.2.4 STP Port States ......................................................................................105
5.3 Configuring Bridge ...........................................................................................105

ZyWALL 70 User’s Guide
Table of Contents 11
Chapter 6
Wireless LAN ........................................................................................................ 109
6.1 Introduction ......................................................................................................109
6.1.1 Additional Installation Requirements for Using 802.1x ...........................109
6.2 Wireless Security .............................................................................................109
6.3 Security Parameters Summary ........................................................................110
6.4 WEP Encryption ............................................................................................... 111
6.5 802.1x Overview .............................................................................................. 111
6.6 Dynamic WEP Key Exchange .......................................................................... 111
6.7 Introduction to WPA .........................................................................................112
6.7.1 User Authentication ................................................................................112
6.7.2 Encryption ...............................................................................................112
6.8 WPA-PSK Application Example ....................................................................... 113
6.9 Introduction to RADIUS ....................................................................................113
6.10 WPA with RADIUS Application Example ........................................................114
6.11 Wireless Client WPA Supplicants ................................................................... 114
6.12 Configuring Wireless LAN ..............................................................................115
6.12.1 Static WEP ............................................................................................117
6.12.2 WPA-PSK .............................................................................................119
6.12.3 WPA ......................................................................................................120
6.12.4 802.1x + Dynamic WEP ........................................................................121
6.12.5 802.1x + Static WEP .............................................................................123
6.12.6 802.1x + No WEP .................................................................................124
6.12.7 No Access 802.1x + Static WEP ...........................................................126
6.12.8 No Access 802.1x + No WEP ...............................................................127
6.13 Configuring MAC Filter ...................................................................................127
6.13.1 EAP Authentication Overview ...............................................................129
Chapter 7
WAN Screens........................................................................................................ 131
7.1 WAN Overview .................................................................................................131
7.2 Multiple WAN ....................................................................................................131
7.3 Load Balancing Introduction .............................................................................132
7.4 Load Balancing Algorithms ..............................................................................132
7.4.1 Least Load First ......................................................................................132
7.4.1.1 Example 1 .....................................................................................132
7.4.1.2 Example 2 .....................................................................................133
7.4.2 Weighted Round Robin ...........................................................................134
7.4.3 Spillover ..................................................................................................134
7.5 TCP/IP Priority (Metric) ....................................................................................135
7.6 Configuring General .........................................................................................135
7.7 Configuring Load Balancing .............................................................................138
7.7.1 Least Load First ......................................................................................138

ZyWALL 70 User’s Guide
12 Table of Contents
7.7.2 Weighted Round Robin ...........................................................................139
7.7.3 Spillover ..................................................................................................140
7.7.3.1 WAN IP Address Assignment ........................................................141
7.7.3.2 DNS Server Address Assignment .................................................142
7.7.3.3 WAN MAC Address .......................................................................142
7.8 Configuring WAN Setup ...................................................................................143
7.8.1 Ethernet Encapsulation ...........................................................................143
7.8.2 PPPoE Encapsulation .............................................................................146
7.8.3 PPTP Encapsulation ...............................................................................150
7.9 Traffic Redirect .................................................................................................153
7.10 Configuring Traffic Redirect ............................................................................153
7.11 Configuring Dial Backup .................................................................................154
7.12 Advanced Modem Setup ................................................................................158
7.12.1 AT Command Strings ............................................................................158
7.12.2 DTR Signal ...........................................................................................158
7.12.3 Response Strings ..................................................................................158
7.13 Configuring Advanced Modem Setup ............................................................158
Chapter 8
DMZ Screens ........................................................................................................ 161
8.1 DMZ Overview .................................................................................................161
8.2 Configuring DMZ ..............................................................................................161
8.3 Configuring IP Alias ..........................................................................................163
8.4 DMZ Public IP Address Example .....................................................................165
8.5 DMZ Private and Public IP Address Example ..................................................165
Chapter 9
Firewalls................................................................................................................ 167
9.1 Firewall Overview .............................................................................................167
9.2 Types of Firewalls ............................................................................................167
9.2.1 Packet Filtering Firewalls ........................................................................167
9.2.2 Application-level Firewalls ......................................................................167
9.2.3 Stateful Inspection Firewalls ...................................................................168
9.3 Introduction to ZyXEL’s Firewall .......................................................................168
9.4 Denial of Service ..............................................................................................169
9.4.1 Basics .....................................................................................................169
9.4.2 Types of DoS Attacks .............................................................................170
9.4.2.1 ICMP Vulnerability ........................................................................172
9.4.2.2 Illegal Commands (NetBIOS and SMTP) ......................................172
9.4.2.3 Traceroute .....................................................................................173
9.5 Stateful Inspection ............................................................................................173
9.5.1 Stateful Inspection Process ....................................................................174
9.5.2 Stateful Inspection and the ZyWALL .......................................................175

ZyWALL 70 User’s Guide
Table of Contents 13
9.5.3 TCP Security ...........................................................................................175
9.5.4 UDP/ICMP Security ................................................................................176
9.5.5 Upper Layer Protocols ............................................................................176
9.6 Guidelines For Enhancing Security With Your Firewall ....................................177
9.7 Packet Filtering Vs Firewall ..............................................................................177
9.7.1 Packet Filtering: ......................................................................................177
9.7.1.1 When To Use Filtering ...................................................................177
9.7.2 Firewall ...................................................................................................178
9.7.2.1 When To Use The Firewall ............................................................178
Chapter 10
Firewall Screens................................................................................................... 179
10.1 Access Methods .............................................................................................179
10.2 Firewall Policies Overview .............................................................................179
10.3 Rule Logic Overview ......................................................................................180
10.3.1 Rule Checklist .......................................................................................180
10.3.2 Security Ramifications ..........................................................................181
10.3.3 Key Fields For Configuring Rules .........................................................181
10.3.3.1 Action ..........................................................................................181
10.3.3.2 Service ........................................................................................181
10.3.3.3 Source Address ...........................................................................181
10.3.3.4 Destination Address ....................................................................181
10.4 Connection Direction Examples .....................................................................181
10.4.1 LAN To WAN Rules ..............................................................................182
10.4.2 WAN To LAN Rules ..............................................................................182
10.5 Alerts ..............................................................................................................183
10.6 Configuring Firewall .......................................................................................183
10.6.1 Rule Summary ......................................................................................186
10.6.2 Configuring Firewall Rules ....................................................................187
10.6.3 Configuring Custom Services ...............................................................190
10.7 Example Firewall Rule ...................................................................................190
10.8 Predefined Services .......................................................................................194
10.9 Anti-Probing ...................................................................................................196
10.10 DoS Thresholds ...........................................................................................197
10.10.1 Threshold Values ................................................................................198
10.10.2 Half-Open Sessions ............................................................................198
10.10.2.1 TCP Maximum Incomplete and Blocking Time .........................198
Chapter 11
Content Filtering Screens ................................................................................... 201
11.1 Content Filtering Overview .............................................................................201
11.1.1 Restrict Web Features ..........................................................................201
11.1.2 Create a Filter List .................................................................................201

ZyWALL 70 User’s Guide
14 Table of Contents
11.1.3 Customize Web Site Access ................................................................201
11.2 General Content Filter Configuration ..............................................................201
11.3 Content Filtering with an External Database ..................................................204
11.4 Categories and Registering ............................................................................204
11.5 Customization ................................................................................................. 211
11.6 Customizing Keyword Blocking URL Checking ..............................................214
11.6.1 Domain Name or IP Address URL Checking ........................................214
11.6.2 Full Path URL Checking ........................................................................214
11.6.3 File Name URL Checking .....................................................................214
11.7 Content Filtering Cache ..................................................................................215
Chapter 12
Content Filtering Registration and Reports....................................................... 217
12.1 Introduction to myZyXEL.com ........................................................................217
12.1.1 A Note on myZyXEL.com Numbers ......................................................218
12.2 myZyXEL.com Account Registration ..............................................................218
12.3 Registering Your ZyXEL Device .....................................................................220
12.4 Content Filtering Registration .........................................................................223
12.5 Checking Content Filtering Activation ............................................................225
12.6 Updating Product Registration Information ....................................................226
12.7 Viewing Content Filtering Reports ..................................................................226
12.8 Configuration File ...........................................................................................228
Chapter 13
Introduction to IPSec ........................................................................................... 229
13.1 VPN Overview ................................................................................................229
13.1.1 IPSec ....................................................................................................229
13.1.2 Security Association .............................................................................229
13.1.3 Other Terminology ................................................................................229
13.1.3.1 Encryption ...................................................................................229
13.1.3.2 Data Confidentiality .....................................................................230
13.1.3.3 Data Integrity ...............................................................................230
13.1.3.4 Data Origin Authentication ..........................................................230
13.1.4 VPN Applications ..................................................................................230
13.1.4.1 Linking Two or More Private Networks Together .........................230
13.1.4.2 Accessing Network Resources When NAT Is Enabled ...............230
13.1.4.3 Unsupported IP Applications .......................................................230
13.2 IPSec Architecture .........................................................................................231
13.2.1 IPSec Algorithms ..................................................................................231
13.2.2 Key Management ..................................................................................231
13.3 Encapsulation .................................................................................................231
13.3.1 Transport Mode ....................................................................................232
13.3.2 Tunnel Mode .........................................................................................232

ZyWALL 70 User’s Guide
Table of Contents 15
13.4 IPSec and NAT ...............................................................................................232
Chapter 14
VPN Screens......................................................................................................... 235
14.1 VPN/IPSec Overview .....................................................................................235
14.2 IPSec Algorithms ............................................................................................235
14.2.1 AH (Authentication Header) Protocol ....................................................235
14.2.2 ESP (Encapsulating Security Payload) Protocol ..................................235
14.3 My ZyWALL ....................................................................................................236
14.4 Remote Gateway Address .............................................................................236
14.4.1 Dynamic Remote Gateway Address .....................................................237
14.5 Nailed Up .......................................................................................................237
14.6 NAT Traversal ................................................................................................237
14.6.1 NAT Traversal Configuration .................................................................238
14.7 ID Type and Content ......................................................................................238
14.7.1 ID Type and Content Examples ............................................................239
14.8 IKE Phases ....................................................................................................240
14.8.1 Negotiation Mode ..................................................................................241
14.8.2 Pre-Shared Key ....................................................................................241
14.8.3 Diffie-Hellman (DH) Key Groups ...........................................................242
14.8.4 Perfect Forward Secrecy (PFS) ...........................................................242
14.9 X-Auth (Extended Authentication) ..................................................................242
14.9.1 Authentication Server ...........................................................................242
14.10 Icons Key .....................................................................................................243
14.11 IPSec Fields Summary .................................................................................243
14.12 IKE VPN Rule Summary Screen ..................................................................244
14.12.1 Configuring an IKE Gateway Policy ....................................................245
14.12.2 Configuring an IKE Network Policy .....................................................251
14.12.2.1 Associating a Network Policy to a Gateway Policy ...................255
14.13 Manual VPN Rule Summary Screen ............................................................256
14.13.1 Editing Manual VPN Rules .................................................................258
14.13.2 Security Parameter Index (SPI) ..........................................................258
14.14 Viewing SA Monitor ......................................................................................262
14.15 Configuring Global Setting ...........................................................................263
14.16 Telecommuter VPN/IPSec Examples ...........................................................264
14.16.1 Telecommuters Sharing One VPN Rule Example ..............................264
14.16.2 Telecommuters Using Unique VPN Rules Example ...........................264
14.17 VPN and Remote Management ...................................................................266
Chapter 15
Certificates............................................................................................................ 267
15.1 Certificates Overview .....................................................................................267
15.1.1 Advantages of Certificates ....................................................................268

ZyWALL 70 User’s Guide
16 Table of Contents
15.2 Self-signed Certificates ..................................................................................268
15.3 Configuration Summary .................................................................................268
15.4 My Certificates ...............................................................................................269
15.5 Certificate File Formats ..................................................................................270
15.6 Importing a Certificate ....................................................................................271
15.7 Creating a Certificate .....................................................................................272
15.8 My Certificate Details .....................................................................................274
15.9 Trusted CAs ...................................................................................................277
15.10 Importing a Trusted CA’s Certificate .............................................................279
15.11 Trusted CA Certificate Details ......................................................................280
15.12 Trusted Remote Hosts .................................................................................283
15.13 Verifying a Trusted Remote Host’s Certificate ..............................................285
15.13.1 Trusted Remote Host Certificate Fingerprints .....................................285
15.14 Importing a Trusted Remote Host’s Certificate ............................................286
15.15 Trusted Remote Host Certificate Details ......................................................287
15.16 Directory Servers .........................................................................................290
15.17 Add or Edit a Directory Server .....................................................................291
Chapter 16
Authentication Server.......................................................................................... 293
16.1 Authentication Server Overview .....................................................................293
16.1.1 Local User Database ............................................................................293
16.1.2 RADIUS ................................................................................................293
16.2 Configuring Local User Database ..................................................................293
16.3 Configuring RADIUS ......................................................................................295
Chapter 17
Network Address Translation (NAT) ................................................................... 297
17.1 NAT Overview ................................................................................................297
17.1.1 NAT Definitions .....................................................................................297
17.1.2 What NAT Does ....................................................................................298
17.1.3 How NAT Works ...................................................................................298
17.1.4 NAT Application ....................................................................................299
17.1.5 Port Restricted Cone NAT ....................................................................300
17.1.6 NAT Mapping Types .............................................................................300
17.2 Using NAT ......................................................................................................301
17.2.1 SUA (Single User Account) Versus NAT ..............................................301
17.3 Configuring NAT Overview .............................................................................302
17.4 Configuring Address Mapping ........................................................................303
17.4.1 Address Mapping Edit ...........................................................................305
17.5 Port Forwarding ..............................................................................................306
17.5.1 Default Server IP Address ....................................................................307
17.5.2 Port Forwarding: Services and Port Numbers ......................................307

ZyWALL 70 User’s Guide
Table of Contents 17
17.5.3 Configuring Servers Behind Port Forwarding (Example) ......................307
17.5.4 NAT and Multiple WAN .........................................................................308
17.5.5 Port Translation ....................................................................................308
17.6 Configuring Port Forwarding ..........................................................................309
17.7 Configuring Trigger Port .................................................................................311
Chapter 18
Static Route .......................................................................................................... 315
18.1 Static Route Overview ....................................................................................315
18.2 Configuring IP Static Route ............................................................................315
18.2.1 Configuring a Static Route Entry ...........................................................317
Chapter 19
Policy Route ......................................................................................................... 319
19.1 Introduction to IP Policy Routing ....................................................................319
19.2 Benefits ..........................................................................................................319
19.3 Routing Policy ................................................................................................319
19.4 IP Routing Policy Setup .................................................................................320
19.5 Configuring the IP Policy Route Entry ............................................................321
Chapter 20
Bandwidth Management ...................................................................................... 325
20.1 Bandwidth Management Overview ................................................................325
20.2 Bandwidth Classes and Filters .......................................................................325
20.3 Proportional Bandwidth Allocation .................................................................326
20.4 Application-based Bandwidth Management ...................................................326
20.5 Subnet-based Bandwidth Management .........................................................326
20.6 Application and Subnet-based Bandwidth Management ...............................326
20.7 Scheduler .......................................................................................................327
20.7.1 Priority-based Scheduler ......................................................................327
20.7.2 Fairness-based Scheduler ....................................................................327
20.8 Maximize Bandwidth Usage ...........................................................................327
20.8.1 Reserving Bandwidth for Non-Bandwidth Class Traffic ........................328
20.8.2 Maximize Bandwidth Usage Example ..................................................328
20.8.2.1 Priority-based Allotment of Unused and Unbudgeted Bandwidth 328
20.8.2.2 Fairness-based Allotment of Unused and Unbudgeted Bandwidth ...
329
20.9 Bandwidth Borrowing .....................................................................................329
20.9.1 Bandwidth Borrowing Example .............................................................330
20.9.2 Maximize Bandwidth Usage With Bandwidth Borrowing ......................330
20.10 Configuring Summary ..................................................................................331
20.11 Configuring Class Setup ...............................................................................332
20.11.1 Bandwidth Manager Class Configuration ............................................334

ZyWALL 70 User’s Guide
18 Table of Contents
20.11.2 Bandwidth Management Statistics ......................................................337
20.12 Configuring Monitor .....................................................................................338
Chapter 21
DNS........................................................................................................................ 341
21.1 DNS Overview ................................................................................................341
21.2 DNS Server Address Assignment ..................................................................341
21.3 DNS Servers ..................................................................................................341
21.4 Address Record .............................................................................................342
21.4.1 DNS Wildcard .......................................................................................342
21.5 Name Server Record .....................................................................................342
21.5.1 Private DNS Server ..............................................................................342
21.6 System Screen ...............................................................................................343
21.6.1 Adding an Address Record ...................................................................344
21.6.2 Inserting a Name Server record ............................................................345
21.7 DNS Cache ....................................................................................................347
21.8 Configure DNS Cache ....................................................................................347
21.9 Configuring DNS LAN ....................................................................................348
21.10 Dynamic DNS ...............................................................................................350
21.10.1 DYNDNS Wildcard ..............................................................................350
21.10.2 High Availability ..................................................................................350
21.11 Configuring Dynamic DNS ...........................................................................350
Chapter 22
Remote Management ........................................................................................... 353
22.1 Remote Management Overview .....................................................................353
22.1.1 Remote Management Limitations .........................................................353
22.1.2 Remote Management and NAT ............................................................354
22.1.3 System Timeout ...................................................................................354
22.2 Introduction to HTTPS ....................................................................................354
22.3 Configuring WWW ..........................................................................................355
22.4 HTTPS Example ............................................................................................357
22.4.1 Internet Explorer Warning Messages ...................................................357
22.4.2 Netscape Navigator Warning Messages ...............................................358
22.4.3 Avoiding the Browser Warning Messages ............................................359
22.4.4 Login Screen .........................................................................................359
22.5 SSH Overview ...............................................................................................362
22.6 How SSH works .............................................................................................362
22.7 SSH Implementation on the ZyWALL .............................................................363
22.7.1 Requirements for Using SSH ................................................................364
22.8 Configuring SSH ............................................................................................364
22.9 Secure Telnet Using SSH Examples ..............................................................365
22.9.1 Example 1: Microsoft Windows .............................................................365

ZyWALL 70 User’s Guide
Table of Contents 19
22.9.2 Example 2: Linux ..................................................................................365
22.10 Secure FTP Using SSH Example ................................................................366
22.11 Telnet ............................................................................................................367
22.12 Configuring TELNET ....................................................................................367
22.13 Configuring FTP ...........................................................................................368
22.14 Configuring SNMP .......................................................................................369
22.14.1 Supported MIBs .................................................................................371
22.14.2 SNMP Traps .......................................................................................371
22.14.3 REMOTE MANAGEMENT: SNMP ......................................................371
22.15 Configuring DNS ..........................................................................................373
22.16 Introducing Vantage CNM ............................................................................373
22.17 Configuring CNM ..........................................................................................374
Chapter 23
UPnP...................................................................................................................... 377
23.1 Universal Plug and Play Overview .................................................................377
23.1.1 How Do I Know If I'm Using UPnP? ......................................................377
23.1.2 NAT Traversal .......................................................................................377
23.1.3 Cautions with UPnP ..............................................................................377
23.2 UPnP and ZyXEL ...........................................................................................378
23.3 Configuring UPnP ..........................................................................................378
23.4 Displaying UPnP Port Mapping ......................................................................379
23.5 Installing UPnP in Windows Example ............................................................380
23.5.1 Installing UPnP in Windows Me ............................................................381
23.5.2 Installing UPnP in Windows XP ............................................................382
23.6 Using UPnP in Windows XP Example ...........................................................382
23.6.1 Auto-discover Your UPnP-enabled Network Device .............................383
23.6.2 Web Configurator Easy Access ............................................................384
Chapter 24
Logs Screens........................................................................................................ 387
24.1 Configuring View Log .....................................................................................387
24.2 Log Description Example ...............................................................................388
24.3 Configuring Log Settings ................................................................................389
24.4 Configuring Reports .......................................................................................392
24.4.1 Viewing Web Site Hits ...........................................................................394
24.4.2 Viewing Protocol/Port ...........................................................................394
24.4.3 Viewing LAN IP Address .......................................................................395
24.4.4 Reports Specifications ..........................................................................396
Chapter 25
Maintenance ......................................................................................................... 397
25.1 Maintenance Overview ...................................................................................397

ZyWALL 70 User’s Guide
20 Table of Contents
25.2 General Setup ................................................................................................397
25.2.1 General Setup and System Name ........................................................397
25.2.2 Domain Name .......................................................................................397
25.3 Configuring Password ....................................................................................398
25.4 Pre-defined NTP Time Servers List ................................................................399
25.5 Configuring Time and Date ............................................................................400
25.5.1 Resetting the Time ................................................................................402
25.5.2 Time Server Synchronization ................................................................402
25.6 .............................................................Introduction To Transparent Bridging 403
25.7 Transparent Firewalls .....................................................................................404
25.8 Configuring Device Mode ...............................................................................405
25.9 F/W Upload Screen ........................................................................................407
25.10 Configuration Screen ...................................................................................409
25.10.1 Backup Configuration .........................................................................410
25.10.2 Restore Configuration ........................................................................410
25.10.3 Back to Factory Defaults .....................................................................412
25.11 Restart Screen ..............................................................................................412
Chapter 26
Introducing the SMT ............................................................................................ 415
26.1 Introduction to the SMT ..................................................................................415
26.2 Accessing the SMT via the Console Port .......................................................415
26.2.1 Initial Screen .........................................................................................415
26.2.2 Entering the Password ..........................................................................416
26.3 Navigating the SMT Interface .........................................................................416
26.3.1 Main Menu ............................................................................................417
26.3.2 SMT Menus Overview ..........................................................................419
26.4 Changing the System Password ....................................................................421
26.5 Resetting the ZyWALL ...................................................................................422
Chapter 27
SMT Menu 1 - General Setup............................................................................... 423
27.1 Introduction to General Setup ........................................................................423
27.2 Configuring General Setup .............................................................................423
27.2.1 Configuring Dynamic DNS ....................................................................425
27.2.1.1 Editing DDNS Host ......................................................................425
Chapter 28
WAN and Dial Backup Setup............................................................................... 429
28.1 Introduction to WAN and Dial Backup Setup ..................................................429
28.2 WAN Setup .....................................................................................................429
28.3 Dial Backup ....................................................................................................430
28.4 Configuring Dial Backup in Menu 2 ................................................................430