ZyXEL Communications ZYWALL - CLI User manual

www.zyxel.com
ZyWALL (ZLD)
CLI Reference Guide
Version 2.20, 2.21
2/2011
Edition 3
DEFAULT LOGIN
User Name admin
Password 1234

About This CLI Reference Guide
ZyWALL (ZLD) CLI Reference Guide 3
About This CLI Reference Guide
Intended Audience
This manual is intended for people who want to configure ZLD-based ZyWALLs via
Command Line Interface (CLI). You should have at least a basic knowledge of TCP/IP
networking concepts and topology. Generally, it is organized by feature as outlined in the web
configurator.
"This guide is intended as a command reference for a series of products.
Therefore many commands or command options in this guide may not be
available in your product. See your User’s Guide for a list of supported
features and details about feature implementation.
Please refer to www.zyxel.com or your product’s CD for product specific User Guides and
product certifications.
How To Use This Guide
1Read Chapter 1 on page 11 for how to access and use the CLI (Command Line
Interface).
2Read Chapter 2 on page 27 to learn about the CLI user and privilege modes.
3Subsequent chapters are arranged by menu item as defined in the web configurator. Read
each chapter carefully for detailed information on that menu item.
"Some features cannot be configured in both the web configurator and CLI.
CLI Reference Guide Feedback
Help us help you. Send all Reference Guide-related comments, questions or suggestions for
improvement to the following address, or use e-mail instead. . Thank you!
The Technical Writing Team,
ZyXEL Communications Corp.,
6 Innovation Road II,
Science-Based Industrial Park,
Hsinchu, 300, Taiwan.
E-mail: [email protected]

Document Conventions
ZyWALL (ZLD) CLI Reference Guide
4
Document Conventions
Warnings and Notes
These are how warnings and notes are shown in this User’s Guide.
1Warnings tell you about things that could harm you or your device.
"Notes tell you other important information (for example, other things you may
need to configure or helpful tips) or recommendations.
Syntax Conventions
• The ZLD-based ZyWALL may be referred to as the “ZyWALL”, the “device”, the
“system” or the “product” in this User’s Guide.
• Product labels, screen names, field labels and field choices are all in bold font.
• A key stroke is denoted by square brackets and uppercase text, for example, [ENTER]
means the “enter” or “return” key on your keyboard.
• “Enter” means for you to type one or more characters and then press the [ENTER] key.
“Select” or “choose” means for you to use one of the predefined choices.
• A right angle bracket ( > ) within a screen name denotes a mouse click. For example,
Maintenance > Log > Log Setting means you first click Maintenance in the navigation
panel, then the Log sub menu and finally the Log Setting tab to get to that screen.
• Units of measurement may denote the “metric” value or the “scientific” value. For
example, “k” for kilo may denote “1000” or “1024”, “M” for mega may denote “1000000”
or “1048576” and so on.
• “e.g.,” is a shorthand for “for instance”, and “i.e.,” means “that is” or “in other words”.

Document Conventions
ZyWALL (ZLD) CLI Reference Guide 5
Icons Used in Figures
Figures in this User’s Guide may use the following generic icons. The ZyWALL icon is not an
exact representation of your device.
ZyWALL Computer Notebook computer
Server Firewall Telephone
Switch Router

Document Conventions
ZyWALL (ZLD) CLI Reference Guide
6

Contents Overview
ZyWALL (ZLD) CLI Reference Guide 7
Contents Overview
Introduction ..............................................................................................................................9
Command Line Interface ............................................................................................................11
User and Privilege Modes ......................................................................................................... 27
Object Reference ....................................................................................................................... 31
Status ......................................................................................................................................... 33
Registration ............................................................................................................................... 37
Network ...................................................................................................................................45
Interfaces ................................................................................................................................... 47
Trunks ........................................................................................................................................ 85
Route ......................................................................................................................................... 91
Routing Protocol ........................................................................................................................ 99
Zones ....................................................................................................................................... 103
DDNS ...................................................................................................................................... 107
Virtual Servers ..........................................................................................................................111
HTTP Redirect ..........................................................................................................................117
ALG ......................................................................................................................................... 121
Firewall ..................................................................................................................................125
Firewall .................................................................................................................................... 127
VPN ........................................................................................................................................135
IPSec VPN ............................................................................................................................... 137
SSL VPN ................................................................................................................................. 147
L2TP VPN ................................................................................................................................ 153
Application Patrol ................................................................................................................161
Application Patrol ..................................................................................................................... 163
Anti-X ....................................................................................................................................175
Anti-Virus ................................................................................................................................. 177
IDP Commands ....................................................................................................................... 185
Content Filtering ...................................................................................................................... 203
Anti-Spam ................................................................................................................................ 215
Device HA .............................................................................................................................225
Device HA ................................................................................................................................ 227

Contents Overview
ZyWALL (ZLD) CLI Reference Guide
8
Objects ..................................................................................................................................235
User/Group .............................................................................................................................. 237
Addresses ................................................................................................................................ 245
Services ................................................................................................................................... 249
Schedules ................................................................................................................................ 253
AAA Server .............................................................................................................................. 255
Authentication Objects ............................................................................................................. 263
Certificates ............................................................................................................................... 267
ISP Accounts ........................................................................................................................... 273
SSL Application ....................................................................................................................... 277
Endpoint Security ....................................................................................................................281
System ..................................................................................................................................289
System ..................................................................................................................................... 291
System Remote Management ................................................................................................. 299
Maintenance .........................................................................................................................313
File Manager ............................................................................................................................ 315
Logs ......................................................................................................................................... 333
Reports and Reboot ................................................................................................................339
Session Timeout ...................................................................................................................... 345
Diagnostics ............................................................................................................................. 347
Packet Flow Explore ................................................................................................................ 349
Maintenance Tools ................................................................................................................... 353
Watchdog Timer ....................................................................................................................... 359
Command List ......................................................................................................................363
List of Commands (Alphabetical) ............................................................................................. 365

9
PART I
Introduction
Command Line Interface (11)
User and Privilege Modes (27)
Object Reference (31)
Status (33)
Registration (37)

10

ZyWALL (ZLD) CLI Reference Guide 11
CHAPTER 1
Command Line Interface
This chapter describes how to access and use the CLI (Command Line Interface).
1.1 Overview
If you have problems with your ZyWALL, customer support may request that you issue some
of these commands to assist them in troubleshooting.
1Use of undocumented commands or misconfiguration can damage the
ZyWALL and possibly render it unusable.
1.1.1 The Configuration File
When you configure the ZyWALL using either the CLI (Command Line Interface) or the web
configurator, the settings are saved as a series of commands in a configuration file on the
ZyWALL. You can store more than one configuration file on the ZyWALL. However, only one
configuration file is used at a time.
You can perform the following with a configuration file:
• Back up ZyWALL configuration once the ZyWALL is set up to work in your network.
• Restore ZyWALL configuration.
• Save and edit a configuration file and upload it to multiple ZyWALLs (of the same model)
in your network to have the same settings.
"You may also edit a configuration file using a text editor.
1.2 Accessing the CLI
You can access the CLI using a terminal emulation program on a computer connected to the
console port, from the web configurator or access the ZyWALL using Telnet or SSH (Secure
SHell).

Chapter 1 Command Line Interface
ZyWALL (ZLD) CLI Reference Guide
12
"The ZyWALL might force you to log out of your session if reauthentication
time, lease time, or idle timeout is reached. See Chapter 25 on page 237 for
more information about these settings.
1.2.1 Console Port
The default settings for the console port are as follows.
When you turn on your ZyWALL, it performs several internal tests as well as line
initialization. You can view the initialization information using the console port.
• Garbled text displays if your terminal emulation program’s speed is set lower than the
ZyWALL’s.
• No text displays if the speed is set higher than the ZyWALL’s.
• If changing your terminal emulation program’s speed does not get anything to display,
restart the ZyWALL.
• If restarting the ZyWALL does not get anything to display, contact your local customer
support.
Figure 1 Console Port Power-on Display
After the initialization, the login screen displays.
Figure 2 Login Screen
Table 1 Managing the ZyWALL: Console Port
SETTING VALUE
Speed 115200 bps
Data Bits 8
Parity None
Stop Bit 1
Flow Control Off
FLASH: AMD 16M
BootModule Version: V1.08 | 12/04/2007 15:36:17
DRAM: Size = 256 Mbytes
DRAM POST: Testing: 262144K
Welcome to ZyWALL 1050
Username:

Chapter 1 Command Line Interface
ZyWALL (ZLD) CLI Reference Guide 13
Enter the user name and password at the prompts.
"The default login username is admin and password is 1234. The username
and password are case-sensitive.
1.2.2 Web Configurator Console
"Before you can access the CLI through the web configurator, make sure your
computer supports the Java Runtime Environment. You will be prompted to
download and install the Java plug-in if it is not already installed.
When you access the CLI using the web console, your computer establishes a SSH (Secure
SHell) connection to the ZyWALL. Follow the steps below to access the web console.
1Log into the web configurator.
2Click the Console icon in the top-right corner of the web configurator screen.
3If the Java plug-in is already installed, skip to step 4.
Otherwise, you will be prompted to install the Java plug-in. If the prompt does not
display and the screen remains gray, you have to download the setup program.
4The web console starts. This might take a few seconds. One or more security screens
may display. Click Yes or Always.
Figure 3 Web Console: Security Warnings
Finally, the User Name screen appears.

Chapter 1 Command Line Interface
ZyWALL (ZLD) CLI Reference Guide
14
Figure 4 Web Console: User Name
5Enter the user name you want to use to log in to the console. The console begins to
connect to the ZyWALL.
"The default login username is admin. It is case-sensitive.
Figure 5 Web Console: Connecting
Then, the Password screen appears.
Figure 6 Web Console: Password
6Enter the password for the user name you specified earlier, and click OK. If you enter
the password incorrectly, you get an error message, and you may have to close the
console window and open it again. If you enter the password correctly, the console
screen appears.

Chapter 1 Command Line Interface
ZyWALL (ZLD) CLI Reference Guide 15
Figure 7 Web Console
7To use most commands in this User’s Guide, enter configure terminal. The prompt
should change to Router(config)#.
1.2.3 Telnet
Use the following steps to Telnet into your ZyWALL.
1If your computer is connected to the ZyWALL over the Internet, skip to the next step.
Make sure your computer IP address and the ZyWALL IP address are on the same
subnet.
2In Windows, click Start (usually in the bottom left corner) and Run. Then type telnet
and the ZyWALL’s IP address. For example, enter telnet 192.168.1.1 (the default
management IP address).
3Click OK. A login screen displays. Enter the user name and password at the prompts.
"The default login username is admin and password is 1234. The username
and password are case-sensitive.
1.2.4 SSH (Secure SHell)
You can use an SSH client program to access the CLI. The following figure shows an example
using a text-based SSH client program. Refer to the documentation that comes with your SSH
program for information on using it.
"The default login username is admin and password is 1234. The username
and password are case-sensitive.

Chapter 1 Command Line Interface
ZyWALL (ZLD) CLI Reference Guide
16
Figure 8 SSH Login Example
1.3 How to Find Commands in this Guide
You can simply look for the feature chapter to find commands. In addition, you can use the
List of Commands (Alphabetical) at the end of the guide. This section lists the commands in
alphabetical order that they appear in this guide.
If you are looking at the CLI Reference Guide electronically, you might have additional
options (for example, bookmarks or Find...) as well.
1.4 How Commands Are Explained
Each chapter explains the commands for one keyword. The chapters are divided into the
following sections.
1.4.1 Background Information (Optional)
"See the User’s Guide for background information about most features.
This section provides background information about features that you cannot configure in the
web configurator. In addition, this section identifies related commands in other chapters.
1.4.2 Command Input Values (Optional)
This section lists common input values for the commands for the feature in one or more tables
C:\>ssh2 [email protected]
Host key not found from database.
Key fingerprint:
xolor-takel-fipef-zevit-visom-gydog-vetan-bisol-lysob-cuvun-muxex
You can get a public key's fingerprint by running
% ssh-keygen -F publickey.pub
on the keyfile.
Are you sure you want to continue connecting (yes/no)? yes
Host key saved to C:/Documents and Settings/user/Application Data/SSH/
hostkeys/
ey_22_192.168.1.1.pub
host key for 192.168.1.1, accepted by user Tue Aug 09 2005 07:38:28
admin's password:
Authentication successful.

Chapter 1 Command Line Interface
ZyWALL (ZLD) CLI Reference Guide 17
1.4.3 Command Summary
This section lists the commands for the feature in one or more tables.
1.4.4 Command Examples (Optional)
This section contains any examples for the commands in this feature.
1.4.5 Command Syntax
The following conventions are used in this User’s Guide.
• A command or keyword in courier new must be entered literally as shown. Do not
abbreviate.
• Values that you need to provide are in italics.
• Required fields that have multiple choices are enclosed in curly brackets {}.
• A range of numbers is enclosed in angle brackets <>.
• Optional fields are enclosed in square brackets [].
•The
|symbol means OR.
For example, look at the following command to create a TCP/UDP service object.
service-object object-name {tcp | udp} {eq <1..65535> | range <1..65535>
<1..65535>}
1Enter service-object exactly as it appears.
2Enter the name of the object where you see object-name.
3Enter tcp or udp, depending on the service object you want to create.
4Finally, do one of the following.
•Enter
eq exactly as it appears, followed by a number between 1 and 65535.
•Enter
range exactly as it appears, followed by two numbers between 1 and 65535.
1.4.6 Changing the Password
It is highly recommended that you change the password for accessing the ZyWALL. See
Section 25.2 on page 238 for the appropriate commands.
1.5 CLI Modes
You run CLI commands in one of several modes.
Table 2 CLI Modes
USER PRIVILEGE CONFIGURATION SUB-COMMAND
What Guest users
can do Unable to access Unable to access Unable to access Unable to access
What User users
can do • Look at (but not
run) available
commands
Unable to access Unable to access Unable to access

Chapter 1 Command Line Interface
ZyWALL (ZLD) CLI Reference Guide
18
See Chapter 25 on page 237 for more information about the user types. User users can only
log in, look at (but not run) the available commands in User mode, and log out. Limited-
Admin users can look at the configuration in the web configurator and CLI, and they can run
basic diagnostics in the CLI. Admin users can configure the ZyWALL in the web configurator
or CLI.
At the time of writing, there is not much difference between User and Privilege mode for
admin users. This is reserved for future use.
1.6 Shortcuts and Help
1.6.1 List of Available Commands
A list of valid commands can be found by typing ?or [TAB] at the command prompt. To view a
list of available commands within a command group, enter <command> ? or <command>
[TAB].
What Limited-
Admin users can
do
• Look at system
information (like
Status screen)
• Run basic
diagnostics
• Look at system
information (like
Status screen)
• Run basic
diagnostics
Unable to access Unable to access
What Admin
users can do • Look at system
information (like
Status screen)
• Run basic
diagnostics
• Look at system
information (like
Status screen)
• Run basic
diagnostics
• Configure simple
features (such as
an address
object)
• Create or remove
complex parts
(such as an
interface)
• Configure
complex parts
(such as an
interface) in the
ZyWALL
How you enter it Log in to the ZyWALL Type enable in User
mode Type configure terminal in User or
Privilege mode
Type the command
used to create the
specific part in
Configuration mode
What the prompt
looks like Router> Router# Router(config)# (varies by part)
Router(zone)#
Router(config-
if-ge)#
...
How you exit it Type exit Type disable Type exit Type exit
Table 2 CLI Modes (continued)
USER PRIVILEGE CONFIGURATION SUB-COMMAND

Chapter 1 Command Line Interface
ZyWALL (ZLD) CLI Reference Guide 19
Figure 9 Help: Available Commands Example 1
Figure 10 Help: Available Command Example 2
1.6.2 List of Sub-commands or Required User Input
To view detailed help information for a command, enter <command> <sub command> ?.
Figure 11 Help: Sub-command Information Example
Figure 12 Help: Required User Input Example
Router> ?
<cr>
apply
atse
clear
configure
------------------[Snip]--------------------
shutdown
telnet
test
traceroute
write
Router>
Router> show ?
<wlan ap interface>
aaa
access-page
account
ad-server
address-object
------------------[Snip]--------------------
wlan
workspace
zone
Router> show
Router(config)# ip telnet server ?
;
<cr>
port
rule
|
Router(config)# ip telnet server
Router(config)# ip telnet server port ?
<1..65535>
Router(config)# ip telnet server port

Chapter 1 Command Line Interface
ZyWALL (ZLD) CLI Reference Guide
20
1.6.3 Entering Partial Commands
The CLI does not accept partial or incomplete commands. You may enter a unique part of a
command and press [TAB] to have the ZyWALL automatically display the full command.
For example, if you enter config and press [TAB] , the full command of configure
automatically displays.
If you enter a partial command that is not unique and press [TAB], the ZyWALL displays a list
of commands that start with the partial command.
Figure 13 Non-Unique Partial Command Example
1.6.4 Entering a ? in a Command
Typing a ?(question mark) usually displays help information. However, some commands
allow you to input a ?, for example as part of a string. Press [CTRL+V] on your keyboard to
enter a ?without the ZyWALL treating it as a help query.
1.6.5 Command History
The ZyWALL keeps a list of commands you have entered for the current CLI session. You can
use any commands in the history again by pressing the up (y) or down (z) arrow key to scroll
through the previously used commands and press [ENTER].
1.6.6 Navigation
Press [CTRL]+A to move the cursor to the beginning of the line. Press [CTRL]+E to move the
cursor to the end of the line.
1.6.7 Erase Current Command
Press [CTRL]+U to erase whatever you have currently typed at the prompt (before pressing
[ENTER]).
1.6.8 The no Commands
When entering the no commands discribed in this document, you may not need to type the
whole command. For example, with the “[no] mss <536..1452>” command, you use
“mss 536” to specify the MSS value. But to disable the MSS setting, you only need to type
“no mss” instead of “no mss 536”.
Router# c [TAB]
clear configure copy
Router# co [TAB]
configure copy