ZyXEL Communications ZyWALL USG 100 Series Instruction Manual

1/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
ZyXEL
Firmware Release Note
ZyWALL USG 100
Release 2.10(AQQ.0)
Date: April 2, 2008
Author: Kevin Chiang
Project Leader: Kevin Chiang

2/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
ZyXEL ZyWALL USG 100
Release 2.10(AQQ.0)
Release Note
Date: April 2, 2008
Supported Platforms:
ZyXEL ZyWALL USG 100
Versions:
ZLD Version : V2.10(AQQ.0) | 2008-04-02 13:53:43
BootModule Version : V1.08 | 12/04/2007 15:36:17
Files lists contains in the Release ZIP file
File name : 210AQQ0C0.bin
Purpose: This binary firmware image file is for normal system update.
Note: The firmware update may take five or more minutes depending on the scale of device
configuration. The more complex configuration will take more update time. Do not turn off or
reset the ZyWALL while the firmware update is in progress. The firmware might get damaged, if
device loss power or you reset the device during the firmware upload. You might need to refer to
Appendix 3 of this document to recover the firmware.
File name : 210AQQ0C0.conf
Purpose: This ASCII file contains default system configuration commands.
File name : 210AQQ0C0.db
Purpose: This binary file contains default system signatures.
Note: The file is only needed when doing system recovery from damage.
File name : 210AQQ0C0.doc
Purpose: This release file.

3/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
File name : 210AQQ0C0.ri
Purpose: This binary firmware recovery image file is for emergent system firmware damage
recovery only.
Note: The ZyWALL firmware could be damaged, for example by the power going off or pressing
Reset button during a firmware update.
File name : AppPatrol_Support_List.xls
Purpose: This file contains the Application support list by ZyWALL ZLD AppPatrol module.
File name : firmware.xml
Purpose: This file is needed by ZyXEL Centralized Network Management (CNM) 3.0 or after.
Read Me First
1. The system default configuration is summarized as below:
zThe default device administration username is “admin”, password is “1234”.
zThe default LAN interface is lan1, which are P3, P4 and P5 ports on the front panel.
The default IP address of lan1 is 192.168.1.1/24.
zBy default, WWW/SSH/SNMP service can only be accessed from LAN subnet.
zThe default WAN interface is wan1, and the secondary WAN interface is wan2. These
two interfaces will automatically get IP address using DHCP by default.
2. It is recommended that user backup the “startup-config.conf ” file first before upgrading
firmware. The backup configuration file can be used if user wants to downgrade to an older
firmware version.
3. If user upgrades from previous released firmware to this version, there is no need to restore to
system default configuration.
4. If user upgrades firmware from the version which is before than 2.10(AQQ.0)b7, please refer
to Appendix 1 Note 2 for more information.
5. If there is difficulty to configure via GUI (popup java script error, etc). It is recommended to
logout the configuration window and clear browser cache first, then try to login and configure
again.
6. To reset device to system default, user can press RESET button for 5 seconds and the device
will reset itself to system default configuration then reboot automatically.
zNote 1: After resetting, the original configuration will be removed. It is recommended to
backup the configuration before performing this operation.
zNote 2: After resetting, if user has subscribed to security licenses, user needs to connect
to internet with myZyXEL.com and refresh license information.

4/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
7. If there is problem to reboot successfully after firmware upgrade, please refer to Appendix 3:
Firmware Recovery.

5/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
Known Issues:
Anti-Virus:
1. [SPR: 061218052]
[Symptom] Question mark ‘?’ is a special character for ZyWALL and if it is used in
white/black list, it may not work correctly.
[Workaround] Use “Ctrl+V” + “?” or use GUI to configure this feature.
ALG:
1. [SPR: 070228428]
[Symptom] SIP ALG might malfunction if SIP client is using new version of XLite. It will also
make SIP BWM in App Patrol malfunction.
App. Patrol:
1. [SPR: 070530582]
[Symptom] App. Patrol provides granular control over IM/P2P such as login, file downloading,
voice/video over IP. In current design, if administrators choose to block one of these actions,
the connection for the IM/P2P might be blocked as well.
Build in Service:
1. [SPR: 061014444]
[Symptom] Console might show weird characters when leave board running for a long
time (overnight).
[Workaround] Please wait for around 1 minute and reset terminal; the terminal will be back to
normal operation.
Cellular
1. [SPR: 071122531]
[Symptom] Using Sierra Wireless AC850, and change then apply the band to
“GPRS/EDGE(GSM) only”. Although the dialing is success, but the current band on GUI is
still “UMTS”.
[Workaround] The AC850 is unable to be queried after connected. So user can disconnect first
then connect again to get the correct status.
2. [SPR: 080225768]
[Symptom] “Device Profile” may not work when the authentication is required by ISP.
[Workaround] Use “Custom Profile” instead.
3. [SPR: 080310472]

6/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
[Symptom] CPU usage keeps 99% while uploading more than 300kbps UDP packets through
the E220 3G device.
Connectivity Check
1. [SPR: 080312637]
[Symptom] The traffic may not go out for a while when connectivity-check checks the
connectivity is back to normal.
[Workaround] Stop attempting to connect the remote for a while, the retry again.
2. [SPR: 080312640]
[Symptom] Even there is not outgoing traffic through the PPP/3G connection, the PPP/3G
dial-on-demand connection will not be disconnected when enabled the connectivity check
function.
[Workaround] Avoid setting the connectivity check on dial-on-demand interface.
Device-HA
1. [SPR: 071127734]
[Symptom] PC client may temporarily unable to connect to Device-HA backup device after
backup taking over for master.
[Workaround] The virtual MAC address will be switch to backup device, and some PC clients
does not accept GARP notification, so PC client may needs to wait its ARP entry timeout or
refresh it manually.
2. [SPR: 080311531]
[Symptom] Device-HA Status is not updated in GUI ÆNetwork ÆInterface ÆStatus, and in
GUI ÆStatus ÆInterface Status Summary.
DHCP
1. [SPR: 070912654, 071120331, 71228654]
[Symptom] Reserve a IP-MAC of a DHCP client in DHCP table will cause reserved hostname
turn to “none”, and after unreserved, this client will disappear from DHCP table.
2. [SPR: 080314899]
[Symptom] The client can’t get IP address from the DUT when use configures two DHCP
relay servers.
Dial-in management:
1. [SPR: 070112673]
[Symptom] Dial in service can’t work with ISDN device.
2. [SPR: 070112671]
[Symptom] After remote modem logout CLI terminal, local modem will not drop connection
immediately. It will drop connection after 20 seconds.

7/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
[Workaround] Wait for 20 seconds, connection will be dropped. Remote user can dial in again.
Firewall
1. [SPR: 070905212]
[Symptom] When ZyWALL provides DHCP service, the firewall cannot block DHCP packets
from client to ZyWALL.
IDP/ADP:
1. [SPR: 070928616]
[Symptom] The IDP custom signature might disappear after editing.
2. [SPR: 080228001]
[Symptom] Enable ADP on any to ZyWALL rule with drop all port scan and HTTP inspection,
and access device GUI, ADP may have false alarm on port scan and HTTP inspection.
3. [SPR: 080310478]
[Symptom] Clicking rule sort by name from IDP or ADP profile, then user cannot edit the
profile.
INTERFACE:
1. [SPR: 070105290]
[Symptom] Modem will not disconnect right away if disabling aux interface while modem is
dialing.
[Workaround] Wait for 15 seconds, it will be disconnected.
IPSec VPN:
1. [SPR: 070814164]
[Symptom] ZyWALL does not support DNAT over IPSec with “Many one-to-one” case.
2. [SPR: 070814168]
[Symptom] VPN tunnel could not be established when 1) a non ZyWALL peer gateway reboot
and 2) ZyWALL has a previous established Phase 1 with peer gateway, and the Phase 1 is not
yet expired. Under those conditions, ZyWALL will continue to use the previous phase 1 SA to
negotiate the Phase 2 SA. It would result in phase 2 negotiation to fail.
[Workaround] User could disable and re-enable phase 1 rule in ZyWALL or turn on DPD
function to resolve problem.
3. [SPR: 070814169]
[Symptom] PKI does not interoperate with Windows CA server, when using SCEP.
4. [SPR: 080313799]
[Symptom] The local ID of VPN Phase 1 is not correct when you configure it by IPSec VPN
Wizard and uses the FQDN in the security gateway.

8/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
L2TP:
1. [SPR: 070723365]
[Symptom] When a L2TP client behind NAT device. It could not establish L2TP over IPSec
VPN tunnel with ZyWALL.
[Workaround] Use public IP instead of private IP for the L2TP client.
2. [SPR: 070628839]
[Symptom] Sometimes, L2TP could not be established when there are policies overlapped
IPSec tunnel used by L2TP.
[Workaround] Do not configure policy overlapped IPSec tunnels with L2TP.
3. [SPR: 080311533]
[Symptom] CPU usage keeps in 99% while using L2TP and having IPSec Rules on DUT.
Log System:
1. [SPR: 070814152]
[Symptom] CPU utilization will reach 100% when system generates too many system logs. In
extreme cases, it might impact normal traffic and user may experience slow GUI/CLI response.
[Workaround] Turn off unnecessary logs.
Policy Route:
1. [SPR: 080311510]
[Symptom] Manually dial of PPP or AUX interface is failed if the next-hop contains these
interfaces and the incoming interface is any, also other criteria are all matched.
[Workaround] Avoid setting the incoming interface to any.
SSL VPN
1. [SPR: 061220177]
[Symptom] Sometimes, Network Extender has error message and user cannot get ppp interface.
[Workaround] Close all browsers and login again
2. [SPR: 070102074]
[Symptom] To add a folder will cause Application and File Sharing part was hidden.
[Workaround] Use Windows 2000 SP4 or later then this issue disappears.
3. [SPR: 070415641]
[Symptom] OWA cannot logout normally if the browser is IE7
[Workaround] This bug is happened on OWA2003 SP1 with IE7 only. Use IE6 instead
4. [SPR: 070517901]
[Symptom] In CIFS, filename will error after downloading a file with Chinese name and no
file extension when browser is IE

9/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
5. [SPR:070523177]
[Symptom] SSLVPN Reverse Proxy has the problem of page partial load in MAC’s safari
browser.
[Workaround] Safari has bug on rendering webpage. Reload the page may solve. Suggest
using FireFox/Camino to access.
6. [SPR: 080221664]
[Symptom] Cannot use reverse proxy and network extension with Firefox 2.X and JRE
1.6.0_04
[Workaround] Use JRE before version 1.6.0_04
7. [SPR: 080311597]
[Symptom] Device will crash when user login into SSLVPN and match Force User
Authentication Policy.
[Workaround] Avoid setting the Force User Authentication Policy which has the same
direction with user login into SSLVPN. For example, user login into SSLVPN from wan1 and
try to access the resources in the dmz, then do not configure the Force User Authentication
Policy which is from wan1 to dmz.
8. [SPR: 080321291]
[Symptom] Cannot download file under SSL VPN file sharing if authority of shared folder and
file belong to different user.
User Aware:
1. [SPR: 070814170]
[Symptom] In some occasions, Outlook Express might be terminated if both ZyWALL force
authentication and https force redirect features are enabled and access user does not login to
ZyWALL first.
2. [SPR: 070202237]
[Symptom] An access user could gain access right after signing in ZyWALL (if properly
configured) and log out when he don’t need to access the network resources anymore. But
sometimes user stays in signing in state after he closes the access window directly and the
resources could still be accessible.
[Workaround] For access users, user logout button to logout instead of closing window directly.
For administrations, enable user lease/idle detection for access users.
3. [SPR: 070813119]
[Symptom] Device supports authenticating user remotely by creating AAA method which
includes AAA servers (LDAP/AD/Radius). If a user uses an account which exists in 2 AAA
server and supplies correct password for the latter AAA server in AAA method, the
authentication result depends on what the former AAA server is. If the former server is Radius,
the authentication would be granted, otherwise, it would be rejected.

10/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
[Workaround] Avoid having the same account in AAA servers within a method.
4. [SPR: 071025415]
[Symptom] Authentication is failed while doing Avalanche SSL VPN stress testing.
Wireless LAN:
1. [SPR: 080313797]
[Symptom] In GUI ÆNetwork ÆInterface ÆWLAN ÆGeneral ÆEdit, if DHCP network
setting is conflicted. It can’t save successful after changed the un-conflict DHCP IP address.
2. [SPR: 080314883]
[Symptom] The channel is never changed when user select the auto-channel and apply more
than once.
[Workaround] Change any settings in WLAN general page, and re-apply again.
3. [SPR: 080314880]
[Symptom] If there is a wireless client associates DUT with 802.11b, then DUT will crash
after changed DUT 802.11 mode from 802.11b/g to 802.11b.

11/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
Features:
Modifications in 2.10(AQQ.0) - 2008/04/02
First release.

12/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
Appendix 1. Firmware upgrade / downgrade procedure
The following is the firmware upgrade procedure:
1. If user did not backup the configuration file before firmware upgrade, please follow the
procedures below:
zUse Browser to login into ZyWALL as administrator.
zClick Maintenance > File Manager > Configuration File to open the Configuration File
screen. Use the Configuration File screen to backup current configuration file.
zFind firmware at www.zyxel.com in a file that (usually) uses the system model name with
the .bin extension, for example, “210AQQ0C0.bin”.
zClick Maintenance > File Manager > Firmware Package to open the Firmware Package
screen. Browser to the location of firmware package and then click Upload. The
ZyWALL automatically reboots after a successful upload.
zAfter several minutes, the system is successfully upgraded to newest version.
The following is the firmware downgrade procedure:
1. If user has already backup the configuration file before firmware upgrade, please follow the
procedures below:
zUse Console/Telnet /SSH to login into ZyWALL.
zRouter>enable
zRouter#configure terminal
zRouter(config)#setenv-startup stop-on-error off
zRouter(config)#write
zLoad the older firmware to ZyWALL using standard firmware upload procedure.
zAfter system uploads and boot-up successfully, login into ZyWALL via GUI.
zGo to GUI Æ“File Manager” menu, select the backup configuration filename, for example,
statup-config-backup.conf and press “Apply” button.
zAfter several minutes, the system is successfully downgraded to older version.
2. If user did not backup the configuration file before firmware upgrade, please follow the
procedures below:
1. Use Console/Telnet /SSH to login into ZyWALL.
2. Router>enable
3. Router#configure terminal
4. Router(config)#setenv-startup stop-on-error off
5. Router(config)#write
6. Load the older firmware to ZyWALL using standard firmware upload procedure.
7. After system upload and boot-up successfully, login into ZyWALL via
Console/Telnet/SSH.
8. Router>enable
9. Router#write
Now the system is successfully downgraded to older version.
Note 1: ZyWALL might lose some configuration settings during this downgrade procedure. It is
caused by configuration conflict between older and newer firmware version. If this situation
happens, user needs to configure these settings again.

13/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
Note 2: If user upgrades firmware from the version which is before than 2.10(AQQ.0)b7, please
backup current configuration file first, then use text editor to replace all “LAN2” zone with
“WLAN”, and “lan2” interface with “ext-wlan” in this file (case sensitive). After upgrade finished,
user can upload and apply this file to restore previous settings.

14/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
Appendix 2. SNMPv2 private MIBS support
SNMPv2 private MIBs provides user to monitor ZyWALL platform status. If user wants to
use this feature, you must prepare the following step:
1. Have ZyWALL mib files (zywall.mib and zyxel-zywall-ZLD-Common.mib ) and install to your
MIBs application (like MIB-browser). You can see zywallZLDCommon (OLD is
1.3.6.1.4.1.890.1.6.22).
2. ZyWALL SNMP is enabled.
3. Using your MIBs application connects to ZyWALL.
4. SNMPv2 private MIBs support three kinds of status in ZyWALL:
(A) CPU usage: Device CPU loading (%)
(B) Memery usage: Device RAM usage (%)
(C) VPNIpsecTotalThroughput: The VPN total throughput (Bytes/s), Total means all
packets(Tx + Rx) through VPN.

15/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
Appendix 3. Firmware Recovery
In some rare situation, ZyWALL might not boot up successfully after firmware upgrade. The
following procedures are the steps to recover firmware to normal condition. Please connect
console cable to ZyWALL.
1. Restore the Recovery Image
zIf one of the following cases occur, you need to restore the “recovery image”
Booting failed, device show error code while uncompressing “Recovery Image”.
Device reboot infinitely.
Nothing displays after “Press any key to enter debug mode within 3 seconds.” for
more than1 minute.
Startup message displays “Invalid Recovery Image”.

16/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
The message here could be “Invalid Firmware”. However, it is equivalent to
“Invalid Recovery Image”.
zPress any key to enter debug mode
zEnter atuk. The console prompts warning messages and waiting for the confirmation.
Answer ‘Y’ and start to upload “recovery image” via Xmodem.
zUse the Xmodem feature of terminal emulation software to upload the file.
zWait for about 3.5 minutes until finishing Xmodem.

17/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
zEnter atkz –f –l 192.168.1.1 performing the “Restore Firmware” process.
2. Restore Firmware
zIf “Connect a computer to port 1 and FTP to 192.168.1.1 to upload the new file” displays
on the screen, you need to recover the firmware by the following procedure.
zYou will use FTP to upload the firmware package. Keep the console session open in order
to see when the firmware recovery finishes.
zSet your computer to use a static IP address from 192.168.1.2 ~ 192.168.1.254. No matter
how you have configured the ZyWALL’s IP addresses, your computer must use a static IP
address in this range to recover the firmware.
zConnect your computer to the ZyWALL’s port 1 (the only port that you can use for
recovering the firmware).
zUse an FTP client on your computer to connect to the ZyWALL. This example uses the ftp
command in the Windows command prompt. The ZyWALL’s FTP server IP address for
firmware recovery is 192.168.1.1
zLog in without user name (just press enter).
zSet the transfer mode to binary. Use “bin” (or just “bi” in the Windows command prompt).
zTransfer the firmware file from your computer to the ZyWALL (the command is “put
1.01(XL.0)C0.bin” in the Windows command prompt).
zWait for the file transfer to complete.

18/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
zThe console session displays “Firmware received” after the FTP file transfer is complete.
Then you need to wait while the ZyWALL recovers the firmware (this may take up to 4
minutes).
zThe message here might be “ZLD-current received”. Actually, it is equivalent to
“Firmware received”.
zThe console session displays “done” when the firmware recovery is complete. Then the
ZyWALL automatically restarts.
zThe username prompt displays after the ZyWALL starts up successfully. The firmware
recovery process is now complete and the ZyWALL is ready to use.