ZyXEL Communications ZyWALL USG Series Installation and operating instructions

ZyWALL USG Series
Unified Security Gateway
Version 4.10
Edition 1, 05/2014
Copyright © 2014 ZyXEL Communications Corporation
Application Note

ZyXEL –USG Application Note
2
Table of Contents
Table of Contents
Scenario 1 —Connecting your USG to the Internet 5
1.1 Application Scenario 5
1.2 Configuration Guide 5
Scenario 2 —WAN Load Balancing and Customized Usage of WAN Connection for
Specific Traffic --Dual WAN setting 9
2.1 Application Scenario 9
2.2 Configuration Guide 9
Scenario 3 —How to configure NAT if you have Internet-facing public servers 14
3.1 Application Scenario 14
3.2 Configuration Guide 14
Scenario 4 —Secure site-to-site connections using IPSec VPN –IPV4 using IKEv2/IPv6
4.1 Application Scenario 18
4.2 Configuration Guide 18
Scenario 6 —GRE over IPSec VPN tunnel –VPN fail over 22
6.1 Application scenario 22
6.2 Configuration Guide 22
Scenario 7 - Deploying SSL VPN for Tele-workers to Access Company Resources –SSL
VPN with Windows & Apple Mac OSX 36
7.1 Application Scenario 36
7.2 Configuration Guide 36
Scenario 8 —Reserving Highest Bandwidth Management Priority for VoIP traffic 40
8.1 Application Scenario 40
8.2 Configuration Guide 40
Scenario 9 - Reserving Highest Bandwidth Management Priority for a Superior User
and Control Session per Host –BWM Per IP or Per User 43
9.1 Application Scenario 43
9.2 Configuration Guide 43
Scenario 10 - Using USG to Control Popular Applications –APP patrol 49
10.1 Application Scenario 49
10.2 Configuration Guide 49
Scenario 11 –Using policy control to block packets and UTM session 54
11.2 Application Scenario 55
11.1 Configuration Guide 55
Scenario 12 –Block HTTPs web site by Content Filter 58
12.1 Application Scenario 58

ZyXEL –USG Application Note
3
12.2 Configuration Guide 58
Scenario 13: Single sign-on for USG and Windows platform 61
13.1 Application Scenario 61
13.2 Configuration Guide 61
Scenario 14 –WLAN Controller function on USG 74
14.1 Application Scenario 74
14.2 Configuration Guide 74
Scenario 15 –Device HA on the USG 79
15.1 Application Scenario 79
15.2 Configuration Guide 79

ZyXEL –USG Application Note
4
Tutorial 1: How to Set Up Your Network
1.1 Wizard Overview
1.2 How to Configure Interfaces, Port Roles, and Zones
1.3 How to Configure a Cellular Interface
1.4 How to Set Up a Wireless LAN
1.5 How to Configure Ethernet, PPP, VLAN, Bridge and Policy Routing
1.6 How to Set Up IPv6 Interfaces For Pure IPv6 Routing
1.7 How to Set Up an IPv6 6to4 Tunnel
1.8 How to Set Up an IPv6-in-IPv4 Tunnel
Tutorial 2: Protecting Your Network
2.1 Firewall
2.2 User-aware Access Control
2.3 Endpoint Security (EPS)
2.4 Device and Service Registration
2.5 Anti-Virus Policy Configuration
2.6 IDP Profile Configuration
2.7 ADP Profile Configuration
2.8 Content Filter Profile Configuration
2.9 Viewing Content Filter Reports
2.10 Anti-Spam Policy Configuration
Tutorial 3: Create Secure Connections Across the Internet
3.1 IPSec VPN
3.2 VPN Concentrator Example
3.3 Hub-and-spoke IPSec VPN Without VPN Concentrator
3.4 ZyWALL IPSec VPN Client Configuration Provisioning
3.5 SSL VPN
3.6 L2TP VPN with Android, iOS, and Windows
3.7 One-Time Password Version 2 (OTPv2)
Tutorial 4: Managing Traffic
4.1 How to Configure Bandwidth Management
4.2 How to Configure a Trunk for WAN Load Balancing
4.3 How to Use Multiple Static Public WAN IP Addresses for LAN-to-WAN
traffic
4.4 How to Use Device HA to Backup Your ZyWALL
4.5 How to Configure DNS Inbound Load Balancing
4.6 How to Allow Public Access to a Web Server
4.7 How to Manage Voice Traffic
4.8 How to Limit Web Surfing and MSN to Specific People

ZyXEL –USG Application Note
5

ZyXEL –USG Application Note
6
Scenario 1 —Connecting your USG to the Internet
1.1 Application Scenario
Nowadays, more and more Internet service providers provide IPv6 environment.
With IPv6 feature enabled on ZyWALL USG, it can assign an IPv6 address to clients
under it and pass IPv6 traffic through IPv4 environment to access a remote IPv6
network.
1.2 Configuration Guide
Network conditions:
USG:
WAN1: 61.222.9.5(Static PPPoE v4)
Or
WAN1:59.124.163.150(Static)
Goal to achieve:
A ZyWALL USG will assign IPv6 IP addresses to the clients which are behind it, and the
clients can access a remote IPv6 network by using the ZyWALL USG 6to4 tunnel.
USG configuration
Step1: Configuration >System >IPv6 > Click Enable IPv6

ZyXEL –USG Application Note
7
Step2: Setting the static IP on WAN1
Configuration>Interface > Ethernet> Double Click WAN1 interface and
configure with static IP address 59.124.163.150.
Step3: Setting IPv6 IP address on LAN1
(1) Configuration>Interface >Ethernet> double click LAN1 interface in IPv6
configuration.

ZyXEL –USG Application Note
8
(2) Convert WAN1 IP address to hexadecimal. 59.124.163.150(Decimal) =
3b7c:a396(Hex). Fill in 2002:3b7c:a396::1/128 in the prefix table as the
LAN interface IPv6 address.
(3) Check IPv6 Router Advertisement Setting box and add the prefix in the
Advertised Prefix Table.
Step4: Enable 6 to 4 tunnel.
(1) Configuration>Interface>Tunnel> Click Add button

ZyXEL –USG Application Note
9
(2) Select the 6to4 in that Tunnel Mode
(3) Check the Prefix in the 6tp4 tunnel Parameter
(4) Select the WAN1 interface as the gateway in the Gateway Setting

ZyXEL –USG Application Note
10
Scenario 2 —WAN Load Balancing and Customized
Usage of WAN Connection for Specific Traffic
--Dual WAN setting
2.1 Application Scenario
The company has two WAN connections for sharing outbound internet traffic. WAN1
uses static IP, and WAN2 uses a PPPoE connection. Since WAN1 ISP is also the
company’s VoIP provider, the network administrator wants VoIP traffic primarily
sent out over WAN1. In case WAN1 is down, the VoIP traffic can still go out over
WAN2 PPPoE connection. Network administrator also wants HTTP traffic sent over
WAN2 PPPoE connection primarily. In case WAN2 PPPoE is down, LAN users can still
surf internet over WAN1. For all other types of traffic, administrator needs the two
WAN connections to share the outbound traffic load, performing load balancing.
2.2 Configuration Guide
Goals to achieve:
1) VoIP traffic goes out primarily through WAN1. In case WAN1 is down, it will go out
via WAN2 PPPoE connection.
2) HTTP traffic goes out primarily through WAN2 PPPoE connection. In case WAN2
PPPoE is down, it will go out via WAN1.
3) All other traffic goes out via WAN trunk performing Load Balancing with Least