ZyXEL Communications ZYWALL USG 20W User manual

ZyWALL USG
20/20W/50/
100/200
Unified Security Gateway
ZyWALL USG
20/20W/50/
100/200
Unified Security Gateway
■ Robust security without
sacrificing performance
■ Comprehensive support to IPv6
■ Robust hybrid VPN
(IPSec/SSL/2TP)
- Zero-configuration remote
access with EASY VPN
- Support L2TP VPN on mobile
device (iPhone and Android
phone)
■ ICSA Firewall, IPSec certification
■ Content filter stops malware
and Web threats
■ Powerful Email security
■ Non-stop Internet access with
multiple WAN and 3G backups
As broadband quickly becomes a necessity in the business world facing network security
threats,the breaches evolve into highly sophisticated attacks to paralyze networks and to
steal sensitive information.In response to such attacks,small businesses have to meet the
great challenge protecting their networks.
The ZyWALL USG 20/20W/50/100/200 Series is designed for small business to provide
real-time inspection and multi-layer network protection to prevent the network from threats.
The USG Series embodies Stateful Packet Inspection (SPI) Firewall, Anti-Virus (AV), Intrusion
Detection and Prevention (IDP),Content Filtering, Anti-Spam and VPN (IPSec/SSL/L2TP)
features in one box. In addition, the USG Series not only offers complete security license to
fulfill your demand but also guarantees the continuous firmware upgrades to save your cost.
Incorporating comprehensive security features in the connected devices, the USG Series
safeguards your organization’s customer and company records, intellectual properties as well
as critical resources from both external and internal threats.
Benefits
Robust security without sacrificing performance
The ZyWALL USG 20/20W/50/100/200 Series is built with a powerful Integrated High-Performance
Security architecture that provides real-time inspection to prevent networks from threats without
sacrificing performance. Corporate networks are not only flawlessly secured but also get significant
performance enhancements on productivity and efficiency since file loading,emailing and
information searching applications are processed at higher speeds.
Comprehensive IPv6 support smoothly connects future-ready
networks
The ZyWALL USG Series is IPv6-ready today and is certified with “IPv6 Ready” gold
logo.With IPv6 feature enabled, the USG Series ensures businesses with a smooth
migration path from the IPv4-based networks to the full IPv6 infrastructure. It assigns
IPv6 addresses to clients and passes the IPv6 traffics through the IPv4 environment.The USG Series
supports dual-stack and IPv4 tunneling (6rd and 6to4 transition tunnel) implementations for
Internet connectivity to access IPv6 applications.
Security on a New Level
-The Future Is Ahead. Stay Ahead with ZyXEL USGs.

2
ZyWALL USG
20/20W/50/
100/200
Unified Security Gateway
ZyWALL USG
20/20W/50/
100/200
Unified Security Gateway
EASY VPN reduces operation cost and time
Establishing a VPN tunnel is a good way to build secure connections among remote offices,branch offices and partners; however it is difficult for
non-technical employees, such as sales people, to use because of complicated configuration.The ZyWALL USG Series is equipped with the “EASY VPN”
solution to push configuration files to the VPN clients automatically; this eliminates the configuration efforts while securing the access at the same time.In
addition, the USG Series supports L2TP VPN technology on iPhones,Android phones and many other mobile devices as L2TP VPN enables employees in
remote places to connect to the headquarters with easy and free access.
Content filter for safer Web surfing
The World Wide Web has become the main target for network threats,since the Internet itself is a very effective malware delivery mechanism.With threats
hidden directly in contents such as cookies, add-ons and rootkits, it makes malware exceptionally difficult to detect.
The ZyWALL USG Series content filter solution provided by Blue Coat and Commtouch,the leading providers, reduces costs and extends protection by
combining a comprehensive, integrated database featuring millions of URLs, IP addresses and domains.With the solution, the USG Series not only enables
real-time protection that deters emerging Web threats including malware and phishing, but also blocks or monitors certain sites to maintain employee
productivity.
Powerful Email security
The ZyWALL USG Series delivers industry-leading protection, powered by Commtouch, against spam, phishing and virus-laden emails.The extremely high
performance of Commtouch technology comes from the unique recurrent pattern detection (RPD) mechanism that possesses its superior capability
through analyzing millions of new patterns each day (24x7x365) to block all the associated messages real-time. In addition, the ZyWALL USG applies
sender-based IP reputation to remove over 80% of unwanted mails and to take advantage of the zero-hour virus outbreak protection feature, which is
capable of blocking or delaying suspicious messages hours before commercial anti-virus signatures are available.
More 3G card support
The ZyWALL USG Series not only supports multiple WAN ports but also 3G networks through USB or PC cards.With 3G connections, the USG Series enables
load sharing or failover to deliver highly reliable network connectivity; it also supports more 3G cards with generic driver to ensure excellent
interoperability. Since the customers don’t have to purchase specific 3G cards to save cost.
High performance
The ZyXEL USG Series is built with a powerful
Integrated High Performance Security
architecture. It provides real-time inspection to
prevent networks from threats without sacrificing
performance.Take the USG 50 as an example: its
excellent performance delivers sufficient speed
boost to meet all small business needs.
Key Applications
250
200
150
100
50
0
ZyWALL 5 FG-30B TZ100 ZyWALL
USG 50
10000
7500
5000
2500
0
ZyWALL 5 TZ100FG-30B ZyWALL
USG 50
Competitive Comparison:
Firewall Throughput in Mbps
* Source: Performance figures from ZyXEL, SonicWALL and Fortinet Websites.
Competitive Comparison: Sessions

3
EASY VPN — zero configuration
remote access
When establishing VPN tunnels, it could
be quite difficult for non-technical
employees to use due to the
complicated configuration.
The ZyWALL USG Series is equipped with
the“EASY VPN”solution to push
configuration files to the VPN clients
automatically; this eliminates the
configuration efforts while securing the
access at the same time.
Content Filter stops malware
and Web threats
The ZyWALL USG Content Filter enables
businesses to protect their users and
networks from malware and abuse such
as spyware, phishing attacks and
inappropriate P2P or IM usage.It keeps
office computers from getting infected
by dangerous malware and
comprehensively protects business
network environments.
Non-stop Internet access with
multiple WAN and 3G backups
The ZyWALL USG supports not only WAN
traffic load balancing to increase the overall
network throughput but also flexible 3G
backup as a WAN alternative to enhance
network reliability. Network
Provider
(IP VPN)
LAN
ZyWALL USG 300
Unified Security
Gateway
Vantage CNM
Centralized Network
Management
Remote Office
Corporate
Headquarters
BRAS
Host by SI or Customer
Operating in
Active/Passive Mode
3G
Network
WAN2 (3G)
WAN1
Primary
Backup
ADSL Fiber
Last-Mile
IPSec or GRE Tunnel for
Secure Connection
ZyWALL USG fail
over and fail back
between WAN1
(ADSL/Fiber) &
WAN2 (3G WAN)
ZyWALLUSG300
PWR
SYS
AUX
RESET
CARD1
CARD2
10/100/1000
1234567USB
1
2
CONSOLE
AUX
P2P
IM
Virus
Spyware
Phishing
Sit
e
to
Sit
e
IP
S
e
c
VPN
Client to Site
IPSec VPN
Internet
Branch
ZyWALLUSG300
PWR
SYS
AUX
RESET
CARD1
CARD2
10/100/1000
1234567USB
1
2
CONSOLE
AUX
Mobile User
Branch
ZyWALLUSG300
PWR
SYS
AUX
RESET
CARD1
CARD2
10/100/1000
1234567USB
1
2
CONSOLE
AUX
User
Server Farm
ZyWALL USG
Unified Security
Gateway
Network
Extend
Application Server
(Inventory, Store...)
Web-based
Application
Remote
Desktop
File
Share
OA, ERP System
CRM System
BI
System
Email
Server
Headquarters
IPSec
VPN Client
IPSec
VPN Client
I
V
Conguration
File
Easy provisioning for ZyWALL IPSec VPN client
- USG automatically provides configuration file to the client.

4
Specifications
Product Photo
Note:
*1:Testing Methodologies:Maximum performance based on RFC 2544 (UDP packets,1,518 bytes).
*2: VPN (AES) throughput measured using UDP traffic with 1,424 bytes packet size,based on RFC 2544.
*3: UTM (AV+IDP) throughput measured using industry standard IXIA IxLoad test tool against HTTP protocol with 1,460 bytes packet size.Testing done with multiple flows.
*4: 11n (20 MHz),security type: WPA2-PSK
*5: Max sessions measured using industry standard IXIA IxLoad test tool.
Hardware Specifications
10/100/1000 Interfaces (Copper) 4 x LAN/DMZ, 4 x LAN/DMZ, 4 x LAN/DMZ, 5 x LAN/DMZ, 5 x LAN/DMZ,
1 x WAN 1 x WAN 2 x WAN 2 x WAN 2 x WAN, 1 x OPT
USB Ports 1 1 2 2 2
Card Slot - - - 1 1
System Capacity & Performance
SPI Firewall Throughput*1 (Mbps) 175 175 225 225 250
VPN Throughput (AES)*2 (Mbps) 75 75 90 90 90
UTM Throughput (AV+IDP)*3 (Mbps) - - 30 30 40
Unlimited User Licenses Yes Yes Yes Yes Yes
Max. Sessions*4 10,000 10,000 10,000 20,000 40,000
New Session Rate 1,000 1,000 1,200 1,200 1,200
Max. Concurrent IPSec VPN Tunnels 5 5 10 50 100
Max. Concurrent SSL VPN Users 1 1 5 25 25
Included SSL VPN Users 1 1 2 2 2
Customizable Zone Yes Yes Yes Yes Yes
IPv6 Support Yes Yes Yes Yes Yes
Built-in Wireless LAN
Standards - 802.11 b/g/n - - -
Antennas - 2 detachable - - -
WiFi Throughput
*4
(Mbps) - 80 - - -
Maximum Output Power - - - -
Radio Sensitivity - - - -
Power Requirement
Input Voltage 100 - 240 V AC, 100 - 240 V AC, 100 - 240 V AC, 100 - 240 V AC, 100 - 240 V AC,
50/60 Hz, 1.2 A 50/60 Hz, 1.2 A 50/60 Hz, 1.2 A 50/60 Hz, 1.2 A 50/60 Hz, 1.2 A
Power Rating 15 W Max 16 W Max 17 W Max 20 W Max 20 W Max
Physical Specifications
Item dimensions (WxDxH)(mm/in.) 216 x 140 x 33/ 216 x 140 x 33/ 242 x 167 x 35.5/ 242 x 175 x 35.5/ 242 x 175 x 35.5/
8.50 x 5.51 x 1.30 8.50 x 5.51 x 1.30 9.53 x 6.57 x 1.40 9.53 x 6.89 x 1.40 9.53 x 6.89 x 1.40
Item weight (kg/lb.) 0.38/0.84 0.42/0.93 1.2/2.65 1.2/2.65 1.2/2.65
Packing dimensions (WxDxH)(mm/in.) 305 x 205 x 106/ 305 x 205 x 106 / 375 x 238 x 108/ 296 x 158 x 241/ 296 x 158 x 241/
12.01 x 8.07 x 4.17 12.01 x 8.07 x 4.17 14.76 x 9.37 x 4.25 11.65 x 6.22 x 9.49 11.65 x 6.22 x 9.49
Packing weight (kg/lb.) 1/2.20 1.1/2.43 2.4/5.29 2.7/5.95 3/6.61
Environmental Specifications
Operating temperature 0°C to 40°C/32°F to 104°F
Storage temperature -30°C to 60°C/-22°F to 140°F
Operating humidity 5% to 90% (Non-condensing)
802.11b:
18.5 dBm@11 Mbps
802.11g:
15.5 dBm@54 Mbps
802.11n:
15.5 dBm@20 Mbps,
12.5 dBm@40 MHz
802.11b:
≤-83 dBm@11 Mbps
802.11g:
≤-70 dBm@54 Mbps
802.11n:
≤-64 dBm@20 Mbps,
≤-61 dBm@40 MHz
Model ZyWALL USG 20 ZyWALL USG 20W ZyWALL USG 50 ZyWALL USG 100 ZyWALL USG 200

5
Firewall
• ICSA-certified firewall
• Routing and transparent (bridge) mode
• Zone-based access control list
• Stateful packet inspection
• User-aware policy enforcement
• SIP/H.323 NAT traversal
• ALG supports custom ports
IPv6 Support
• IPv6 Ready gold logo certified
• Dual stack
• IPv4 tunneling (6rd and 6to4 transition tunnel)
• Host/Router/Firewall
Virtual Private Network (VPN)
• ICSA-certified IPSec VPN
• Algorithm: AES/3DES/DES
• Authentication: SHA-1/MD5
• Key management: Manual key/IKE
• Perfect forward secrecy (DH groups)
support 1, 2, 5
• IPSec NAT traversal
• Dead peer detection/relay detection
• PKI (X.509) certificate support
• Centralize VPN support
• Simple wizard support
• Auto reconnect VPN
• VPN HA (redundant remote VPN gateways)
SSL VPN
• Clientless secure remote access
• Support reverse proxy mode and full tunnel
mode
• Unified policy enforcement
• Supports two-factor authentication
• Customizable user portal
Intrusion Detection and Prevention
(IDP)
*1
(ZyWALL 50/100/200)
• Routing and transparent (bridge) mode
• Zone-based IDP inspection
• Customizable protection profile
• Protect over 2000 attack
• Automatic signature updates
• Custom signatures
• Protocol anomaly detection and protection
• Traffic anomaly detection and protection
• Flooding detection and protection
• DoS/DDoS protection
Anti-Virus
*2
(ZyWALL 50/100/200)
• Support Kaspersky and ZyXEL Anti-Virus
• Stream-based Anti-Virus engine
• Zone base AV protection
• HTTP/FTP/SMTP/POP3/IMAP4 protocol support
• Automatic signature updates
• No file size limitation
• Blacklist/whitelist support
Application Patrol
*1
(ZyWALL
50/100/200)
• Application, IM/P2P, stream base media, VoIP
granular access control
• Detail access control of IM (chat, file transfer,
video)
• Application and IM/P2P bandwidth control
• User authentication support
• IM/P2P signature auto update
• Support more than 15 catalogs IM and P2P
• Real-Time statistical reports
• Maximum/guaranteed bandwidth
Anti-Spam
• Zone to zone protection
• Transparently intercept mail via SMTP/POP3
protocols
• POP3/SMTP port configurable
• Sender-based IP Reputation Filter
• Commtouch RPD Query
• Zero-hour Virus Outbreak Protection
• X-Header Support
• Blacklist/whitelist support
• Support DNSBL checking
• Spam tag support
• Statistics report
High Availability (ZyWALL 100/200)
• Active-Passive mode
• Device failure detection and notification
• Support ICMP and TCP ping check
• Link monitoring
• Auto-Sync configurations
Content Filtering (BlueCoat and
Commtouch)
*3
• Social networking control
• Web security—Security threat category
(powered by BlueCoat)
• URL blocking, keyword blocking
• Profile base setting
• Exempt list (blacklist and whitelist)
• Blocks java applet,cookies and active X
• Dynamic URL filtering database (powered by
BlueCoat and Commtouch)
• Unlimited user licenses support
• Customize warning messages and redirect URL
Networking
• Routing mode/bridge mode/mixed mode
• Layer 2 port grouping
• Ethernet/PPPoE
• NAT/PAT
• Tagged VLAN (802.1Q)
• Virtual interface (alias interface)
• Policy-based routing (user-aware)
• Policy-based NAT (SNAT)
• Dynamic routing (RIP v1/v2, OSPF)
• DHCP client/server/relay
• Dynamic DNS support
• WAN Trunk more than 2 port
(ZyWALL 50/100/200)
• Per host session limit
• Guaranteed bandwidth
• Maximum bandwidth
• Priority-bandwidth utilization
ZyWALL USG
20/20W/50/
100/200
Unified Security Gateway
ZyWALL USG
20/20W/50/
100/200
Unified Security Gateway
Features

5-100-00811007 01/12
For more product information, visit us on the web at www.ZyXEL.com
Copyright © 2012 ZyXEL Communications Corp. All rights reserved. ZyXEL, ZyXEL logo are registered trademarks of
ZyXEL Communications Corp. All other brands, product names, or trademarks mentioned are the property of their
respective owners. All specifications are subject to change without notice.
ZyWALL USG
20/20W/50/
100/200
Unified Security Gateway
ZyWALL USG
20/20W/50/
100/200
Unified Security Gateway
Authentication
• Local user database
• Microsoft Windows active directory integrate
• External LDAP/RADIUS user database
• Xauth over RADIUS for IPSec VPN
• Forced user authentication (transparent
authentication)
• IP/MAC address binding
System Management
• Role-Based administration
• Multiple administrator login
• Multi-Lingual web GUI (HTTPS/HTTP)
• Object-based configuration
• Command line interface (console/web
console/SSH/TELNET)
• SNMP v2c (MIB-II)
• System configuration rollback
• Firmware upgrade via FTP/FTP-TLS/web GUI
Logging/Monitoring
• Comprehensive local logging
• Syslog (send to up to 4 servers)
• E-mail alert (send to up to 2 servers)
• Real-Time traffic monitoring
• Built-in daily report
• Advanced reporting (Vantage Report)
• Centralized Network Management (Vantage
CNM) manageable
Certification
• Emission (EMC)
■
FCC Part15 (Class B)
■
CE EMC (Class B)
Note:
*1: Available for USG 50/100/200 models with a ZyWALL Intrusion
Detection/Prevention (IDP) subscription.
*2: Available for USG 50/100/200 models with a ZyWALL Anti-Virus
subscription.
*3: Available for all USG models with a ZyWALL Content Filtering
subscription.
Please visit http://www.zyxel.com/products_services/smb_security_appliances_and_services.shtml and find the following path:
ZyWALL Unified Security Gateways USG product pages to see the 3G Card Compatibility List for supported USB devices.
3G Card Support