ZyXEL Communications ZyWALL USG 100 Series Instruction Manual

1/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
ZyXEL
Firmware Release Note
ZyWALL USG 100
Release 2.10(AQQ.0)
Date: April 2, 2008
Author: Kevin Chiang
Project Leader: Kevin Chiang

2/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
ZyXEL ZyWALL USG 100
Release 2.10(AQQ.0)
Release Note
Date: April 2, 2008
Supported Platforms:
ZyXEL ZyWALL USG 100
Versions:
ZLD Version : V2.10(AQQ.0) | 2008-04-02 13:53:43
BootModule Version : V1.08 | 12/04/2007 15:36:17
Files lists contains in the Release ZIP file
File name : 210AQQ0C0.bin
Purpose: This binary firmware image file is for normal system update.
Note: The firmware update may take five or more minutes depending on the scale of device
configuration. The more complex configuration will take more update time. Do not turn off or
reset the ZyWALL while the firmware update is in progress. The firmware might get damaged, if
device loss power or you reset the device during the firmware upload. You might need to refer to
Appendix 3 of this document to recover the firmware.
File name : 210AQQ0C0.conf
Purpose: This ASCII file contains default system configuration commands.
File name : 210AQQ0C0.db
Purpose: This binary file contains default system signatures.
Note: The file is only needed when doing system recovery from damage.
File name : 210AQQ0C0.doc
Purpose: This release file.

3/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
File name : 210AQQ0C0.ri
Purpose: This binary firmware recovery image file is for emergent system firmware damage
recovery only.
Note: The ZyWALL firmware could be damaged, for example by the power going off or pressing
Reset button during a firmware update.
File name : AppPatrol_Support_List.xls
Purpose: This file contains the Application support list by ZyWALL ZLD AppPatrol module.
File name : firmware.xml
Purpose: This file is needed by ZyXEL Centralized Network Management (CNM) 3.0 or after.
Read Me First
1. The system default configuration is summarized as below:
zThe default device administration username is “admin”, password is “1234”.
zThe default LAN interface is lan1, which are P3, P4 and P5 ports on the front panel.
The default IP address of lan1 is 192.168.1.1/24.
zBy default, WWW/SSH/SNMP service can only be accessed from LAN subnet.
zThe default WAN interface is wan1, and the secondary WAN interface is wan2. These
two interfaces will automatically get IP address using DHCP by default.
2. It is recommended that user backup the “startup-config.conf ” file first before upgrading
firmware. The backup configuration file can be used if user wants to downgrade to an older
firmware version.
3. If user upgrades from previous released firmware to this version, there is no need to restore to
system default configuration.
4. If user upgrades firmware from the version which is before than 2.10(AQQ.0)b7, please refer
to Appendix 1 Note 2 for more information.
5. If there is difficulty to configure via GUI (popup java script error, etc). It is recommended to
logout the configuration window and clear browser cache first, then try to login and configure
again.
6. To reset device to system default, user can press RESET button for 5 seconds and the device
will reset itself to system default configuration then reboot automatically.
zNote 1: After resetting, the original configuration will be removed. It is recommended to
backup the configuration before performing this operation.
zNote 2: After resetting, if user has subscribed to security licenses, user needs to connect
to internet with myZyXEL.com and refresh license information.

4/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
7. If there is problem to reboot successfully after firmware upgrade, please refer to Appendix 3:
Firmware Recovery.

5/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
Known Issues:
Anti-Virus:
1. [SPR: 061218052]
[Symptom] Question mark ‘?’ is a special character for ZyWALL and if it is used in
white/black list, it may not work correctly.
[Workaround] Use “Ctrl+V” + “?” or use GUI to configure this feature.
ALG:
1. [SPR: 070228428]
[Symptom] SIP ALG might malfunction if SIP client is using new version of XLite. It will also
make SIP BWM in App Patrol malfunction.
App. Patrol:
1. [SPR: 070530582]
[Symptom] App. Patrol provides granular control over IM/P2P such as login, file downloading,
voice/video over IP. In current design, if administrators choose to block one of these actions,
the connection for the IM/P2P might be blocked as well.
Build in Service:
1. [SPR: 061014444]
[Symptom] Console might show weird characters when leave board running for a long
time (overnight).
[Workaround] Please wait for around 1 minute and reset terminal; the terminal will be back to
normal operation.
Cellular
1. [SPR: 071122531]
[Symptom] Using Sierra Wireless AC850, and change then apply the band to
“GPRS/EDGE(GSM) only”. Although the dialing is success, but the current band on GUI is
still “UMTS”.
[Workaround] The AC850 is unable to be queried after connected. So user can disconnect first
then connect again to get the correct status.
2. [SPR: 080225768]
[Symptom] “Device Profile” may not work when the authentication is required by ISP.
[Workaround] Use “Custom Profile” instead.
3. [SPR: 080310472]

6/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
[Symptom] CPU usage keeps 99% while uploading more than 300kbps UDP packets through
the E220 3G device.
Connectivity Check
1. [SPR: 080312637]
[Symptom] The traffic may not go out for a while when connectivity-check checks the
connectivity is back to normal.
[Workaround] Stop attempting to connect the remote for a while, the retry again.
2. [SPR: 080312640]
[Symptom] Even there is not outgoing traffic through the PPP/3G connection, the PPP/3G
dial-on-demand connection will not be disconnected when enabled the connectivity check
function.
[Workaround] Avoid setting the connectivity check on dial-on-demand interface.
Device-HA
1. [SPR: 071127734]
[Symptom] PC client may temporarily unable to connect to Device-HA backup device after
backup taking over for master.
[Workaround] The virtual MAC address will be switch to backup device, and some PC clients
does not accept GARP notification, so PC client may needs to wait its ARP entry timeout or
refresh it manually.
2. [SPR: 080311531]
[Symptom] Device-HA Status is not updated in GUI ÆNetwork ÆInterface ÆStatus, and in
GUI ÆStatus ÆInterface Status Summary.
DHCP
1. [SPR: 070912654, 071120331, 71228654]
[Symptom] Reserve a IP-MAC of a DHCP client in DHCP table will cause reserved hostname
turn to “none”, and after unreserved, this client will disappear from DHCP table.
2. [SPR: 080314899]
[Symptom] The client can’t get IP address from the DUT when use configures two DHCP
relay servers.
Dial-in management:
1. [SPR: 070112673]
[Symptom] Dial in service can’t work with ISDN device.
2. [SPR: 070112671]
[Symptom] After remote modem logout CLI terminal, local modem will not drop connection
immediately. It will drop connection after 20 seconds.

7/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
[Workaround] Wait for 20 seconds, connection will be dropped. Remote user can dial in again.
Firewall
1. [SPR: 070905212]
[Symptom] When ZyWALL provides DHCP service, the firewall cannot block DHCP packets
from client to ZyWALL.
IDP/ADP:
1. [SPR: 070928616]
[Symptom] The IDP custom signature might disappear after editing.
2. [SPR: 080228001]
[Symptom] Enable ADP on any to ZyWALL rule with drop all port scan and HTTP inspection,
and access device GUI, ADP may have false alarm on port scan and HTTP inspection.
3. [SPR: 080310478]
[Symptom] Clicking rule sort by name from IDP or ADP profile, then user cannot edit the
profile.
INTERFACE:
1. [SPR: 070105290]
[Symptom] Modem will not disconnect right away if disabling aux interface while modem is
dialing.
[Workaround] Wait for 15 seconds, it will be disconnected.
IPSec VPN:
1. [SPR: 070814164]
[Symptom] ZyWALL does not support DNAT over IPSec with “Many one-to-one” case.
2. [SPR: 070814168]
[Symptom] VPN tunnel could not be established when 1) a non ZyWALL peer gateway reboot
and 2) ZyWALL has a previous established Phase 1 with peer gateway, and the Phase 1 is not
yet expired. Under those conditions, ZyWALL will continue to use the previous phase 1 SA to
negotiate the Phase 2 SA. It would result in phase 2 negotiation to fail.
[Workaround] User could disable and re-enable phase 1 rule in ZyWALL or turn on DPD
function to resolve problem.
3. [SPR: 070814169]
[Symptom] PKI does not interoperate with Windows CA server, when using SCEP.
4. [SPR: 080313799]
[Symptom] The local ID of VPN Phase 1 is not correct when you configure it by IPSec VPN
Wizard and uses the FQDN in the security gateway.

8/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
L2TP:
1. [SPR: 070723365]
[Symptom] When a L2TP client behind NAT device. It could not establish L2TP over IPSec
VPN tunnel with ZyWALL.
[Workaround] Use public IP instead of private IP for the L2TP client.
2. [SPR: 070628839]
[Symptom] Sometimes, L2TP could not be established when there are policies overlapped
IPSec tunnel used by L2TP.
[Workaround] Do not configure policy overlapped IPSec tunnels with L2TP.
3. [SPR: 080311533]
[Symptom] CPU usage keeps in 99% while using L2TP and having IPSec Rules on DUT.
Log System:
1. [SPR: 070814152]
[Symptom] CPU utilization will reach 100% when system generates too many system logs. In
extreme cases, it might impact normal traffic and user may experience slow GUI/CLI response.
[Workaround] Turn off unnecessary logs.
Policy Route:
1. [SPR: 080311510]
[Symptom] Manually dial of PPP or AUX interface is failed if the next-hop contains these
interfaces and the incoming interface is any, also other criteria are all matched.
[Workaround] Avoid setting the incoming interface to any.
SSL VPN
1. [SPR: 061220177]
[Symptom] Sometimes, Network Extender has error message and user cannot get ppp interface.
[Workaround] Close all browsers and login again
2. [SPR: 070102074]
[Symptom] To add a folder will cause Application and File Sharing part was hidden.
[Workaround] Use Windows 2000 SP4 or later then this issue disappears.
3. [SPR: 070415641]
[Symptom] OWA cannot logout normally if the browser is IE7
[Workaround] This bug is happened on OWA2003 SP1 with IE7 only. Use IE6 instead
4. [SPR: 070517901]
[Symptom] In CIFS, filename will error after downloading a file with Chinese name and no
file extension when browser is IE

9/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
5. [SPR:070523177]
[Symptom] SSLVPN Reverse Proxy has the problem of page partial load in MAC’s safari
browser.
[Workaround] Safari has bug on rendering webpage. Reload the page may solve. Suggest
using FireFox/Camino to access.
6. [SPR: 080221664]
[Symptom] Cannot use reverse proxy and network extension with Firefox 2.X and JRE
1.6.0_04
[Workaround] Use JRE before version 1.6.0_04
7. [SPR: 080311597]
[Symptom] Device will crash when user login into SSLVPN and match Force User
Authentication Policy.
[Workaround] Avoid setting the Force User Authentication Policy which has the same
direction with user login into SSLVPN. For example, user login into SSLVPN from wan1 and
try to access the resources in the dmz, then do not configure the Force User Authentication
Policy which is from wan1 to dmz.
8. [SPR: 080321291]
[Symptom] Cannot download file under SSL VPN file sharing if authority of shared folder and
file belong to different user.
User Aware:
1. [SPR: 070814170]
[Symptom] In some occasions, Outlook Express might be terminated if both ZyWALL force
authentication and https force redirect features are enabled and access user does not login to
ZyWALL first.
2. [SPR: 070202237]
[Symptom] An access user could gain access right after signing in ZyWALL (if properly
configured) and log out when he don’t need to access the network resources anymore. But
sometimes user stays in signing in state after he closes the access window directly and the
resources could still be accessible.
[Workaround] For access users, user logout button to logout instead of closing window directly.
For administrations, enable user lease/idle detection for access users.
3. [SPR: 070813119]
[Symptom] Device supports authenticating user remotely by creating AAA method which
includes AAA servers (LDAP/AD/Radius). If a user uses an account which exists in 2 AAA
server and supplies correct password for the latter AAA server in AAA method, the
authentication result depends on what the former AAA server is. If the former server is Radius,
the authentication would be granted, otherwise, it would be rejected.

10/18
www.zyxel.com
© Copyright 1995-2008, ZyXEL Communications Corp. All rights reserved.
[Workaround] Avoid having the same account in AAA servers within a method.
4. [SPR: 071025415]
[Symptom] Authentication is failed while doing Avalanche SSL VPN stress testing.
Wireless LAN:
1. [SPR: 080313797]
[Symptom] In GUI ÆNetwork ÆInterface ÆWLAN ÆGeneral ÆEdit, if DHCP network
setting is conflicted. It can’t save successful after changed the un-conflict DHCP IP address.
2. [SPR: 080314883]
[Symptom] The channel is never changed when user select the auto-channel and apply more
than once.
[Workaround] Change any settings in WLAN general page, and re-apply again.
3. [SPR: 080314880]
[Symptom] If there is a wireless client associates DUT with 802.11b, then DUT will crash
after changed DUT 802.11 mode from 802.11b/g to 802.11b.