ZyXEL Communications ZyWALL 70 User manual

ZyWALL 70
Internet Security Gateway
Quick Start Guide
Version 3.64
3/2005
Table of Contents
ENGLISH 1
DEUTSCH 23
ESPAÑOL 47
FRANÇAIS 71
ITALIANO 95
中文 119

ENGLISH
1
Overview
The ZyWALL 70 is a load-balancing, dual WAN firewall with VPN, bandwidth management, content filtering
and many other features. You can use it as a transparent firewall and not reconfigure your network nor
configure the ZyWALL’s routing features. The ZyWALL increases network security by providing DMZ ports for
use with publicly accessible servers. This guide covers the initial connections and configuration needed to
start using the ZyWALL in your network.
See the User’s Guide for more information on all features.
You may need your Internet access information.
This guide is divided into the following sections.
1 Hardware Connections
You need the following.
1Hardware Connections
2Accessing the Web Configurator
3Bridge Mode
4Internet Access Setup
5DNS
6NAT
7Firewall
8VPN Rule Setup
9myZyXEL.com Product Registration
10External Database Content Filtering
11Troubleshooting
ZyWALL Computer Ethernet Cables Power Cord
ENGLISH

ENGLISH
2
Do the following to make hardware connections for initial setup.
1Use an Ethernet cable to connect the LAN port to a computer. You can also use Ethernet cables to
connect public servers (web, e-mail, FTP, etc.) to the DMZ ports.
2Use another Ethernet cable(s) to connect the WAN 1 and/or WAN 2 port to an Ethernet jack with Internet
access.
3Use the included power cord to connect the power socket (on the rear panel) to a power outlet
4Push the power switch to the on position and look at the front panel. The PWR LED turns on. The SYS
LED blinks while performing system testing and then stays on if the testing is successful. The ACT, CARD,
LAN, DMZ, and WAN LEDs turn on and stay on if the corresponding connections are properly made.

ENGLISH
3
2 Accessing the Web Configurator
Use this section to configure the WAN 1 interface for Internet access.
5The HOME screen opens.
The ZyWALL is in router mode by default. Continue to the next step if you want to use routing features
such as NAT, DHCP and VPN.
Go to Section 3 if you prefer to use the ZyWALL as a transparent firewall.
1Launch your web browser. Enter 192.168.1.1 (the
ZyWALL’s default IP address) as the address.
If the login screen does not display, see Section
11.1 to set your computer’s IP address.
2Click Login (the default password 1234 is already
entered).
3Change the login password by entering a new
password and clicking Apply.
4Click Apply to replace the ZyWALL’s default
digital certificate.

ENGLISH
4
3 Bridge Mode
When you set the ZyWALL to bridge mode, it functions as a transparent firewall. Do the following to set the
ZyWALL to bridge mode.
6Check the Network
Status table. If the
WAN 1 status is not
Down and there is an
IP address, go to
Section 5.
If the WAN 1 status is
Down (or there is not
an IP address), click
Internet Access and
use Section 4 to
configure WAN 1.
Use the NETWORK
WAN screens if you
need to configure
WAN 2. You can also
configure load
balancing between the
WAN ports.

ENGLISH
5
4 Internet Access Setup
Enter the Internet access information exactly as given to you.
If you were given an IP address to use, select Static in the IP Address Assignment drop-down list box and
enter the information provided.
Note: The fields vary depending on what you select in the Encapsulation field. Fill them in with the
information provided by the ISP or network administrator.
Click Finish when you are done.
1Click MAINTENANCE in
the navigation panel and
then Device Mode.
2Select Bridge and
configure a (static) IP
address subnet mask and
gateway IP address for
the ZyWALL’s LAN, WAN,
DMZ and WLAN
interfaces.
3Click Apply. The ZyWALL
restarts.
Skip to Section 5 if you have
servers that you need to be
accesible from the WAN.

ENGLISH
6
•PPP over Ethernet or PPTP Encapsulation
Select Nailed-Up when you want your connection up all the time (this could be expensive if your ISP bills you
for Internet usage time instead of a flat monthly fee).
To not have the connection up all the time, specify an idle time-out period (in seconds) in Idle Timeout.
•Ethernet Encapsulation
Configure a Roadrunner service in the
NETWORK WAN screens (use the WAN 1 tab).

ENGLISH
7
5 DMZ
The DeMilitarized Zone (DMZ) allows public servers (web, e-mail, FTP, etc.) to be visible to the outside world
and still have firewall protection from DoS (Denial of Service) attacks.
Unlike the LAN, the ZyWALL does not assign TCP/IP configuration via DHCP to computers connected to the
DMZ ports. Configure the computers with static IP addresses (in the same subnet as the DMZ port's IP
address) and DNS server addresses. Use the ZyWALL's DMZ IP address as the default gateway.
Do the following to configure the DMZ if the ZyWALL is in routing mode.
Note: You do not need to configure DMZ with bridge mode, skip to Section 7.
1Click DMZ in the navigation panel.

ENGLISH
8
6 NAT
NAT (Network Address Translation - NAT, RFC 1631) means the translation of an IP address in one network
to a different IP address in another. You can use the NAT Address Mapping screens to have the ZyWALL
translate multiple public IP addresses to multiple private IP addresses on your LAN (or DMZ).
The following example allows access from the WAN to an HTTP (web) server on the DMZ. The server has a
private IP address of 10.0.0.20.
2Specify an IP address and subnet mask for the DMZ
interface.
If you use private IP addresses on the DMZ, use NAT to
make the servers publicly accessible (see Section 6).
A public IP address must be on a separate subnet from
the WAN port’s public IP address. If you do not configure
NAT for the public IP addresses on the DMZ, the ZyWALL
routes traffic to the public IP addresses on the DMZ
without performing NAT. This may be useful for hosting
servers for NAT unfriendly applications.
3Click Apply.

ENGLISH
9
7 Firewall
You can use the ZyWALL without configuring the firewall.
The ZyWALL’s firewall is pre-configured to protect your LAN from attacks from the Internet. By default, no
traffic can enter your LAN unless a request was generated on the LAN first. The ZyWALL allows access to the
DMZ from the WAN or LAN, but blocks traffic from the DMZ to the LAN.
If you are using the ZyWALL in router mode, continue with the next section. For bridge mode, skip to Section
9.
1Click NAT in the navigation panel
and then Port Forwarding.
2Select the Active check box.
3Type a name for the rule.
4Type the port number that the
service uses.
5Type the HTTP server’s IP address.
6Click Apply.

ENGLISH
10
8 VPN Rule Setup
A VPN (Virtual Private
Network) tunnel gives you a
secure connection to another
computer or network.
A gateway policy identifies the
IPSec routers at either end of a
VPN tunnel.
A network policy specifies
which devices (behind the
IPSec routers) can use the
VPN tunnel.
This figure helps explain the main fields in the wizard screens.
1Click VPN in the HOME screen (you may need to scroll up to see the link) to open the VPN wizard.

ENGLISH
11
Note: Your settings are not saved when you click Back.
2Use this screen to configure the gateway policy.
Name: Enter a name to identify the gateway policy.
Remote Gateway Address: Enter the IP address or
domain name of the remote IPSec router.
3Use this screen to configure the network policy.
Leave the Active check box selected.
Name: Enter a name to identify the network policy.
Select Single and enter an IP address for a single IP
address.
Select Range IP and enter starting and ending IP
addresses for a specific range of IP addresses.
Select Subnet and enter an IP address and subnet
mask to specify IP addresses on a network by their
subnet mask.

ENGLISH
12
Note: Make sure that the remote IPSec router uses the same security settings that you configure in
the next two screens.
Negotiation Mode: Select Main Mode for identity protection. Select Aggressive Mode to allow more
incoming connections from dynamic IP addresses to use separate passwords.
Note: Multiple SAs (security associations) connecting through a secure gateway must have the same
negotiation mode.
Encryption Algorithm: Select 3DES or AES for stronger (and slower) encryption.
Authentication Algorithm: Select MD5 for minimal security or SHA-1 for higher security.
Key Group: Select DH2 for higher security.
SA Life Time: Set how often the ZyWALL renegotiates the IKE SA (minimum 180 seconds). A short SA life
time increases security, but renegotiation temporarily disconnects the VPN tunnel.
Pre-Shared Key: Use 8 to 31 case-sensitive ASCII characters or 16 to 62 hexadecimal ("0-9", "A-F")
characters. Precede a hexadecimal key with a "0x” (zero x), which is not counted as part of the 16 to 62
character range for the key.
Encapsulation Mode: Tunnel is compatible with NAT, Transport is not.
IPSec Protocol: ESP is compatible with NAT, AH is not.
Perfect Forward Secrecy (PFS): None allows faster IPSec setup, but DH1 and DH2 are more secure.
4Use this screen to configure IKE (Internet Key
Exchange) tunnel settings.
5Use this screen to configure IPSec settings.

ENGLISH
13
8.1 Using the VPN Connection
Use VPN tunnels to securely send and retrieve files, and allow remote access to corporate networks, web
servers and e-mail. Services work as if you were at the office instead of connected through the Internet.
For example, the “test” VPN rule allows
secure access to an web server on a remote
corporate LAN. Enter the server’s IP address
(10.0.0.23 in this example) as your browser’s
URL. The ZyWALL automatically builds the
VPN tunnel when you attempt to use it.
Click VPN in the navigation panel and then
the SA Monitor tab to display a list of
connected VPN tunnels (the “test” VPN
tunnel is up here).
6Check your VPN settings. Click Finish to save the
settings.
7Click Close in the final screen to complete the
VPN wizard setup. Continue with the next section
to activate the VPN rule and establish a VPN
connection.

ENGLISH
14
9 myZyXEL.com Product Registration
myZyXEL.com is ZyXEL’s online services center where you can register your ZyXEL device.
1Go to myZyXEL.com using your web
browser.
2Create a new account (if you don’t have
one already).
Note: You are automatically logged out of
your myZyXEL.com account after five
minutes of inactivity. Simply log back
into your myZyXEL.com account if
this happens to you.
3After you create an account, you will receive a confirmation e-mail. Click the URL in the e-mail to activate
your account.

ENGLISH
15
4Click Continue to go to the myZyXEL.com
login screen.
5Log in.
6Click the link and register your ZyXEL
device.
7Click Add.

ENGLISH
16
8Enter the product serial
number in the Serial Number
field.
9Your device category and
model number automatically
display in the Category and
Model fields respectively.
Otherwise, select the correct
ones from the drop-down list
boxes.
10Enter the device’s MAC
address in the Authentication
Code field (it may already be
displayed).
11Enter a descriptive name in
the Friendly Name field for
identification purposes.
12Click Register.
13Specify the purchase
information and click
Continue.
14Click Continue again to
complete the process.

ENGLISH
17
10 External Database Content Filtering
When you register for and enable external database content filtering, your ZyWALL accesses an external
database that has millions of web sites categorized based on content. You can have the ZyWALL block and/or
log access to web sites based on these categories. Register your ZyWALL at myZyXEL.com (see Section 9)
and then do the following to register for external database content filtering.
15After you have
registered your ZyXEL
device, you can view its
registration details in
the Service
Management screen.
The ZyXEL device is
now registered, but
content filtering is not
activated. To activate
content filtering, you
need to access
myZyXEL.com via your
device. Continue with
the next section.

ENGLISH
18
2The myZyXEL.com login screen opens.
3Enter the user name and password from your myZyXEL.com account.
1In your ZyXEL device’s web
configurator, click CONTENT
FILTER, Categories and then the
Register button.
Note: You must also use the
ZyWALL’s web configurator
CONTENT FILTER screens to
configure and enable content
filtering.
4Click My Product in the navigation
panel.
5Click the product name link for your
device to view its registration details
in the Service Management
screen.

ENGLISH
19
6Click Activate for the content filter service to display the next screen.
7If you want to use the trial, click Submit under
Content Filtering Trial. The trial period begins the
date you apply.
You cannot apply for a trial if you’ve already used a
trial or registered an iCard’s PIN number.
If you purchased an iCard, enter the PIN code exactly
as shown on your iCard in the License Key (PIN code)
field. Select the date when you want your content
filtering to start and click Submit under Registration
Information.