ZyXEL Communications ZyWALL 70 User manual

Copyright © 2007. All rights reserved.
ZyWALL 70
Internet Security Appliance
Quick Start Guide
Version 4.03
10/2007
Edition 1
DEFAULT LOGIN
IP Address http://192.168.1.1
User Name admin
Password 1234
CONTENTS
ENGLISH 2
DEUTSCH 19
ESPAÑOL 37
FRANÇAIS 54
ITALIANO 71
РУССКИЙ 88
简体中文 106
繁體中文 122

ENGLISH
2
Overview
The ZyWALL 70 is a load-balancing, dual WAN firewall with VPN, bandwidth management, content filtering,
anti-spam, anti-virus, IDP (Intrusion Detection and Protection) and many other features. You can use it as a
transparent firewall and not reconfigure your network nor configure the ZyWALL’s routing features. The
ZyWALL increases network security by providing DMZ ports for use with publicly accessible servers. This
guide covers the initial connections and configuration needed to start using the ZyWALL in your network.
See the User’s Guide for more information on all features.
You may need your Internet access information.
This guide is divided into the following sections.
1 Hardware Connections
You need the following.
1Hardware Connections
2Accessing the Web Configurator
3Bridge Mode
4Internet Access Setup and Product Registration
5DNS
6NAT
7Firewall
8VPN Rule Setup
9Anti-Spam Setup
10Troubleshooting
ZyWALL Computer Ethernet Cables Power Cord
ENGLISH

ENGLISH
3
Do the following to make hardware connections for initial setup.
1Use an Ethernet cable to connect the LAN port to a computer. You can also use Ethernet cables to
connect public servers (web, e-mail, FTP, etc.) to the DMZ ports.
2Use another Ethernet cable(s) to connect the WAN 1 and/or WAN 2 port to an Ethernet jack with Internet
access.
3Insert the ZyWALL Turbo extension card to use the anti-virus and IDP features or insert a wireless LAN
card to use the wireless LAN feature. See the ZyWALL Turbo Card guide for more information about the
extension card. See the user’s guide about installing a wireless LAN card.
4Use the included power cord to connect the power socket (on the rear panel) to a power outlet.
5Push the power switch to the on position and look at the front panel. The PWR LED turns on. The SYS
LED blinks while performing system testing and then stays on if the testing is successful. The ACT, CARD,
LAN, DMZ, and WAN LEDs turn on and stay on if the corresponding connections are properly made.

ENGLISH
4
2 Accessing the Web Configurator
Use this section to configure the WAN 1 interface for Internet access.
5The HOME screen opens.
The ZyWALL is in router mode by default. Continue to the next step if you want to use routing features
such as NAT, DHCP and VPN.
Go to Section 3 if you prefer to use the ZyWALL as a transparent firewall.
1Launch your web browser. Enter 192.168.1.1 (the
ZyWALL’s default IP address) as the address.
If the login screen does not display, see Section
10.1 to set your computer’s IP address.
2Click Login (the default password 1234 is already
entered).
3Change the login password by entering a new
password and clicking Apply.
4Click Apply to replace the ZyWALL’s default
digital certificate.

ENGLISH
5
6Check the
Network
Status
table. If the
WAN 1
status is not
Down and
there is an
IP address,
go to
Section 5.
If the WAN
1status is
Down (or
there is not
an IP
address),
click the
Wizard icon
and use
Section 4 to configure WAN 1.
Use the NETWORK WAN screens if you need to configure WAN 2. You can also configure load balancing
between the WAN ports.
3 Bridge Mode
When you set the ZyWALL to bridge mode, it functions as a transparent firewall. Do the following to set the
ZyWALL to bridge mode.

ENGLISH
6
4 Internet Access Setup and Product Registration
1Click the Wizard icon in the HOME screen and then
Internet Access Setup to open the Internet access
wizard.
Enter the Internet access information exactly as given to
you.
If you were given an IP address to use, select Static in the
IP Address Assignment drop-down list box and enter the
information provided.
Note: The fields vary depending on what you select in
the Encapsulation field. Fill them in with the
information provided by the ISP or network
administrator.
Click Apply when you are done.
1Click MAINTENANCE in
the navigation panel and
then Device Mode.
2Select Bridge and
configure a (static) IP
address subnet mask and
gateway IP address for
the ZyWALL’s LAN, WAN,
DMZ and WLAN
interfaces.
3Click Apply. The ZyWALL
restarts.
Skip to Section 5 if you have
servers that you need to be
accessible from the WAN.

ENGLISH
7
• PPP over Ethernet or PPTP Encapsulation
Select Nailed-Up when you want your connection up all the time (this could be expensive if your ISP bills you
for Internet usage time instead of a flat monthly fee).
To not have the connection up all the time, specify an idle time-out period (in seconds) in Idle Timeout.
•Ethernet Encapsulation
Configure a Roadrunner service in the
NETWORK WAN screens (use the WAN 1
tab).

ENGLISH
8
2Click Next to display the screen where you
can register your ZyWALL with myZyXEL.com
(ZyXEL’s online services center) and activate
the free content filtering, anti-spam, anti-virus
and IDP trial applications. Otherwise, click
Skip and then Close to complete Internet
access setup.
Note: Make sure you have installed the ZyWALL Turbo Card before you activate the IDP and anti-virus
subscription services.
Turn the ZyWALL off before you install or remove the ZyWALL Turbo Card.
3If you already have an account at
myZyXEL.com, select Existing
myZyXEL.com account and enter account
information. Otherwise, select New
myZyXEL.com account and fill in the
fields below to create a new account and
register your ZyWALL. Click Next.
4Wait for the registration progress to finish.

ENGLISH
9
5The following screen displays if the registration
was not successful. Click Return to go back to
the Device Registration screen and check your
settings.
6Click Close to leave the wizard screen when
the registration and activation are done.
Note: If you want to activate a standard
service with your iCard’s PIN number
(license key), use the
REGISTRATION Service screen.
See the user’s guide for details.
5 DMZ
The DeMilitarized Zone (DMZ) allows public servers (web, e-mail, FTP, etc.) to be visible to the outside world
and still have firewall protection from DoS (Denial of Service) attacks.
Unlike the LAN, the ZyWALL does not assign TCP/IP configuration via DHCP to computers connected to the
DMZ ports. Configure the computers with static IP addresses (in the same subnet as the DMZ port's IP
address) and DNS server addresses. Use the ZyWALL's DMZ IP address as the default gateway.
Do the following to configure the DMZ if the ZyWALL is in routing mode.
Note: You do not need to configure DMZ with bridge mode, skip to Section 7.
1Click NETWORK, DMZ in the navigation panel.

ENGLISH
10
6 NAT
NAT (Network Address Translation - NAT, RFC 1631) means the translation of an IP address in one network
to a different IP address in another. You can use the NAT Address Mapping screens to have the ZyWALL
translate multiple public IP addresses to multiple private IP addresses on your LAN (or DMZ).
The following example allows access from the WAN to an HTTP (web) server on the DMZ. The server has a
private IP address of 10.0.0.20.
2Specify an IP address and subnet mask for the
DMZ interface.
If you use private IP addresses on the DMZ,
use NAT to make the servers publicly
accessible (see Section 6).
A public IP address must be on a separate
subnet from the WAN port’s public IP address.
If you do not configure NAT for the public IP
addresses on the DMZ, the ZyWALL routes
traffic to the public IP addresses on the DMZ
without performing NAT. This may be useful for
hosting servers for NAT unfriendly
applications.
3Click Apply.

ENGLISH
11
7 Firewall
You can use the ZyWALL without configuring the firewall.
The ZyWALL’s firewall is pre-configured to protect your LAN from attacks from the Internet. By default, no
traffic can enter your LAN unless a request was generated on the LAN first. The ZyWALL allows access to the
DMZ from the WAN or LAN, but blocks traffic from the DMZ to the LAN.
8 VPN Rule Setup
A VPN (Virtual Private
Network) tunnel gives you a
secure connection to another
computer or network.
A gateway policy identifies the
IPSec routers at either end of a
VPN tunnel.
A network policy specifies
which devices (behind the
IPSec routers) can use the
VPN tunnel.
1Click ADVANCED, NAT in the
navigation panel and then Port
Forwarding.
2Select the Active check box.
3Type a name for the rule.
4Type the port number that the
service uses.
5Type the HTTP server’s IP address.
6Click Apply.

ENGLISH
12
This figure helps explain the main fields in the wizard screens.
1Click the Wizard icon ( ) in the HOME screen and then the VPN Setup link to open the VPN wizard.
Note: Your settings are not saved when you click Back.
2Use this screen to configure the gateway policy.
Name: Enter a name to identify the gateway policy.
Remote Gateway Address: Enter the IP address or
domain name of the remote IPSec router.
3Use this screen to configure the network policy.
Leave the Active check box selected.
Name: Enter a name to identify the network policy.
Select Single and enter an IP address for a single IP
address.
Select Range IP and enter starting and ending IP
addresses for a specific range of IP addresses.
Select Subnet and enter an IP address and subnet
mask to specify IP addresses on a network by their
subnet mask.

ENGLISH
13
Note: Make sure that the remote IPSec router uses the same security settings that you configure in
the next two screens.
Negotiation Mode: Select Main Mode for identity protection. Select Aggressive Mode to allow more
incoming connections from dynamic IP addresses to use separate passwords.
Note: Multiple SAs (security associations) connecting through a secure gateway must have the same
negotiation mode.
Encryption Algorithm: Select 3DES or AES for stronger (and slower) encryption.
Authentication Algorithm: Select MD5 for minimal security or SHA-1 for higher security.
Key Group: Select DH2 for higher security.
SA Life Time: Set how often the ZyWALL renegotiates the IKE SA (minimum 180 seconds). A short SA life
time increases security, but renegotiation temporarily disconnects the VPN tunnel.
Pre-Shared Key: Use 8 to 31 case-sensitive ASCII characters or 16 to 62 hexadecimal ("0-9", "A-F")
characters. Precede a hexadecimal key with a "0x” (zero x), which is not counted as part of the 16 to 62
character range for the key.
Encapsulation Mode: Tunnel is compatible with NAT, Transport is not.
IPSec Protocol: ESP is compatible with NAT, AH is not.
Perfect Forward Secrecy (PFS): None allows faster IPSec setup, but DH1 and DH2 are more secure.
4Use this screen to configure IKE (Internet Key
Exchange) tunnel settings.
5Use this screen to configure IPSec settings.

ENGLISH
14
8.1 Using the VPN Connection
Use VPN tunnels to securely send and retrieve files, and allow remote access to corporate networks, web
servers and e-mail. Services work as if you were at the office instead of connected through the Internet.
For example, the “test” VPN rule allows secure
access to an web server on a remote corporate
LAN. Enter the server’s IP address (10.0.0.23 in
this example) as your browser’s URL. The
ZyWALL automatically builds the VPN tunnel
when you attempt to use it.
Click SECURITY, VPN in the navigation panel and
then the SA Monitor tab to display a list of
connected VPN tunnels (the “test” VPN tunnel is
up here).
6Check your VPN settings. Click Finish to save the
settings.
7Click Close in the final screen to complete the
VPN wizard setup. Continue with the next section
to activate the VPN rule and establish a VPN
connection.

ENGLISH
15
9 Anti-Spam Setup
Use anti-spam to have the ZyWALL check for unsolicited commercial or junk e-mail (spam).
Note: You must have already subscribed to the anti-spam service to use the feature (see page 6).
1Click the Wizard icon in the HOME screen and then Anti-Spam Setup to open the anti-spam wizard.
2Select the locations where you
have e-mail servers. An icon of an
e-mail server appears at each spot
you select. In this example the e-
mail servers are on the LAN.
3The ZyWALL recommends which
traffic flows to scan for spam based
on the locations of your e-mail
servers.

ENGLISH
16
You can also use the anti-spam whitelist and blacklist to identify legitimate e-mail and spam. See the anti-
spam chapter in the User’s Guide for details.
10 Troubleshooting
4Use this screen to enable anti-
spam and select which traffic flows
the ZyWALL scans for spam. The
recommended traffic flows are
already selected. You generally
only need to select traffic directions
that have incoming e-mail from
outside e-mail servers.
5Click Apply.
6Click Close in the final screen to
complete the anti-spam wizard
setup.
7Congratulations, you have
configured the ZyWALL to scan for
spam e-mail.
Problem Corrective Action
None of the LEDs
turn on.
Make sure that you have the power cord connected to the ZyWALL and plugged in to an
appropriate power source. Make sure you have the ZyWALL turned on. Check all cable
connections.
If the LEDs still do not turn on, you may have a hardware problem. In this case, you should
contact your local vendor.

ENGLISH
17
10.1 Set Up Your Computer’s IP Address
This section shows you how to set up your computer to receive an IP address in Windows 2000, Windows NT
and Windows XP. This is ensures that your computer can communicate with your ZyWALL.
1In Windows XP, click Start, Control Panel.
In Windows 2000/NT, click Start, Settings, Control Panel.
2In Windows XP, click Network Connections.
In Windows 2000/NT, click Network and Dial-up Connections.
Cannot access
the ZyWALL from
the LAN.
Check the cable connection between the ZyWALL and your computer or hub. Refer to
Section 1 for details.
Ping the ZyWALL from a LAN computer. Make sure your computer’s Ethernet card is
installed and functioning properly.
In the computer, click Start, (All) Programs, Accessories and then Command Prompt. In
the Command Prompt window, type "ping" followed by the ZyWALL’s LAN IP address
(192.168.1.1 is the default) and then press [ENTER]. The ZyWALL should reply. Otherwise,
refer to Section 10.1.
If you’ve forgotten the ZyWALL’s password, use the RESET button. Press the button in for
about 10 seconds (or until the PWR LED starts to blink), then release it. It returns the
ZyWALL to the factory defaults (password is 1234, LAN IP address 192.168.1.1 etc.; see
your User’s Guide for details).
If you’ve forgotten the ZyWALL’s LAN or WAN IP address, you can check the IP address in
the SMT via the console port. Connect your computer to the CONSOLE port using a console
cable. Your computer should have a terminal emulation communications program (such as
HyperTerminal) set to VT100 terminal emulation, no parity, 8 data bits, 1 stop bit, no flow
control and 9600 bps port speed.
Cannot access
the Internet.
Check the ZyWALL’s connection to the Ethernet jack with Internet access. Make sure the
Internet gateway device (such as a DSL modem) is working properly.
Click WAN in the navigation panel to verify your settings.
Cannot establish
a VPN connection
Make sure the ZyWALL and the remote IPSec router use the same VPN settings. Click VPN
in the navigation panel to configure advanced settings.
Access a web site to check that you have a successful Internet connection.
Problem Corrective Action

ENGLISH
18
3Right-click Local Area Connection and then click Properties.
Procedure to View a Product’s Certification(s)
1Go to www.zyxel.com.
2Select your product from the drop-down list box on the ZyXEL home page to go to that product's page.
3Select the certification you wish to view from this page.
4Select Internet Protocol (TCP/IP) (under the General
tab in Windows XP) and click Properties.
5The Internet Protocol TCP/IP Properties screen
opens (the General tab in Windows XP). Select the
Obtain an IP address automatically and Obtain DNS
server address automatically options.
6Click OK to close the Internet Protocol (TCP/IP)
Properties window.
7Click Close (OK in Windows 2000/NT) to close the
Local Area Connection Properties window.
8Close the Network Connections screen.

DEUTSCH
19
Übersicht
Die ZyWALL 70 ist eine Load-balancing-, Dual-WAN-Firewall mit VPN, Bandbreitenmanagement, Content
Filtering, Anti-Spam, Anti-Virus, IDP (Intrusion Detection and Protection) und vielen anderen Funktionen. Sie
können sie als transparente Firewall verwenden, ohne das Netzwerk neu zu konfigurieren und die
Routingfunktionen des Geräts zu konfigurieren. Die ZyWALL erhöht die Netzwerksicherheit, indem sie DMZ-
Ports für die Verwendung öffentlich zugänglicher Server bietet. In dieser Anleitung finden Sie eine
Beschreibung der Anschlüsse und der Konfiguration, die notwendig ist, damit Sie die ZyWALL in Ihrem
Netzwerk verwenden können.
Eine ausführliche Beschreibung aller Funktionen finden Sie im Benutzerhandbuch.
Bitte halten Sie die Daten für Ihren Internetzugang bereit.
Diese Anleitung ist in die folgenden Abschnitte aufgeteilt.
1 Anschließen der Hardware
Sie benötigen folgendes:
1Anschließen der Hardware
2Zugriff auf den Web-Konfigurator
3Bridge Mode
4Einrichten des Internetzugriffs und
Produktregistrierung
5DNS
6NAT
7Firewall
8Einstellen der VPN-Regeln
9Anti-Spam einrichten
10Problembeseitigung
ZyWALL Computer Ethernetkabel Netzkabel
DEUTSCH

DEUTSCH
20
Wenn Sie das Gerät installieren, müssen Sie die Hardwaregeräte folgendermaßen anschließen.
1Verbinden Sie den LAN-Port mit einem Ethernet-Kabel mit dem Computer. Mit Ethernet-Kabeln können
Sie auch öffentliche Server (Internet, E-Mail, FTP, usw.) an die DMZ-Ports anschließen.
2Schließen Sie mit einem anderen Ethernet-Kabel den WAN 1- und/oder WAN 2-Port an die Ethernet-
Buchse mit Internetzugriff an.
3Wenn Sie die Antiviren- und IDP-Funktion verwenden möchten, müssen Sie die Erweiterungskarte
ZyWALL TURBO einsetzen. Fur die LAN-Funktion benötigen Sie die Wireless LAN-Karte. Weitere
Informationen zu den Erweiterungskarten erhalten Sie in der Bedienungsanleitung der ZyWALL Turbo
Karte. Eine Installationsanleitung fur eine Wireless LAN-Karte finden Sie im Benutzerhandbuch.
4Schliessen Sie den Netzanschluss des Geräts (an der Rückseite) mit dem mitgelieferten Netzkabel an
eine Netzsteckdose an.
5Schalten Sie den Ein/Aus-Schalter in die Position On und sehen Sie sich das vordere Bedienfeld an. Die
PWR-LED beginnt zu leuchten. Während des Systemtests blinkt die SYS-LED. Wurde er Test erfolgreich
abgeschlossen, bleibt diese Anzeige an. Die LEDs ACT, CARD, LAN, DMZ und WAN beginnen zu
leuchten und bleiben an, wenn die entsprechenden Verbindungen richtig hergestellt wurden.