ZyXEL Communications ZyWALL USG Series Installation and operating instructions

ZyWALL USG Series
Unified Security Gateway
Version 4.10
Edition 1, 05/2014
Copyright © 2014 ZyXEL Communications Corporation
Application Note

ZyXEL –USG Application Note
2
Table of Contents
Table of Contents
Scenario 1 —Connecting your USG to the Internet 5
1.1 Application Scenario 5
1.2 Configuration Guide 5
Scenario 2 —WAN Load Balancing and Customized Usage of WAN Connection for
Specific Traffic --Dual WAN setting 9
2.1 Application Scenario 9
2.2 Configuration Guide 9
Scenario 3 —How to configure NAT if you have Internet-facing public servers 14
3.1 Application Scenario 14
3.2 Configuration Guide 14
Scenario 4 —Secure site-to-site connections using IPSec VPN –IPV4 using IKEv2/IPv6
4.1 Application Scenario 18
4.2 Configuration Guide 18
Scenario 6 —GRE over IPSec VPN tunnel –VPN fail over 22
6.1 Application scenario 22
6.2 Configuration Guide 22
Scenario 7 - Deploying SSL VPN for Tele-workers to Access Company Resources –SSL
VPN with Windows & Apple Mac OSX 36
7.1 Application Scenario 36
7.2 Configuration Guide 36
Scenario 8 —Reserving Highest Bandwidth Management Priority for VoIP traffic 40
8.1 Application Scenario 40
8.2 Configuration Guide 40
Scenario 9 - Reserving Highest Bandwidth Management Priority for a Superior User
and Control Session per Host –BWM Per IP or Per User 43
9.1 Application Scenario 43
9.2 Configuration Guide 43
Scenario 10 - Using USG to Control Popular Applications –APP patrol 49
10.1 Application Scenario 49
10.2 Configuration Guide 49
Scenario 11 –Using policy control to block packets and UTM session 54
11.2 Application Scenario 55
11.1 Configuration Guide 55
Scenario 12 –Block HTTPs web site by Content Filter 58
12.1 Application Scenario 58

ZyXEL –USG Application Note
3
12.2 Configuration Guide 58
Scenario 13: Single sign-on for USG and Windows platform 61
13.1 Application Scenario 61
13.2 Configuration Guide 61
Scenario 14 –WLAN Controller function on USG 74
14.1 Application Scenario 74
14.2 Configuration Guide 74
Scenario 15 –Device HA on the USG 79
15.1 Application Scenario 79
15.2 Configuration Guide 79

ZyXEL –USG Application Note
4
Tutorial 1: How to Set Up Your Network
1.1 Wizard Overview
1.2 How to Configure Interfaces, Port Roles, and Zones
1.3 How to Configure a Cellular Interface
1.4 How to Set Up a Wireless LAN
1.5 How to Configure Ethernet, PPP, VLAN, Bridge and Policy Routing
1.6 How to Set Up IPv6 Interfaces For Pure IPv6 Routing
1.7 How to Set Up an IPv6 6to4 Tunnel
1.8 How to Set Up an IPv6-in-IPv4 Tunnel
Tutorial 2: Protecting Your Network
2.1 Firewall
2.2 User-aware Access Control
2.3 Endpoint Security (EPS)
2.4 Device and Service Registration
2.5 Anti-Virus Policy Configuration
2.6 IDP Profile Configuration
2.7 ADP Profile Configuration
2.8 Content Filter Profile Configuration
2.9 Viewing Content Filter Reports
2.10 Anti-Spam Policy Configuration
Tutorial 3: Create Secure Connections Across the Internet
3.1 IPSec VPN
3.2 VPN Concentrator Example
3.3 Hub-and-spoke IPSec VPN Without VPN Concentrator
3.4 ZyWALL IPSec VPN Client Configuration Provisioning
3.5 SSL VPN
3.6 L2TP VPN with Android, iOS, and Windows
3.7 One-Time Password Version 2 (OTPv2)
Tutorial 4: Managing Traffic
4.1 How to Configure Bandwidth Management
4.2 How to Configure a Trunk for WAN Load Balancing
4.3 How to Use Multiple Static Public WAN IP Addresses for LAN-to-WAN
traffic
4.4 How to Use Device HA to Backup Your ZyWALL
4.5 How to Configure DNS Inbound Load Balancing
4.6 How to Allow Public Access to a Web Server
4.7 How to Manage Voice Traffic
4.8 How to Limit Web Surfing and MSN to Specific People

ZyXEL –USG Application Note
5

ZyXEL –USG Application Note
6
Scenario 1 —Connecting your USG to the Internet
1.1 Application Scenario
Nowadays, more and more Internet service providers provide IPv6 environment.
With IPv6 feature enabled on ZyWALL USG, it can assign an IPv6 address to clients
under it and pass IPv6 traffic through IPv4 environment to access a remote IPv6
network.
1.2 Configuration Guide
Network conditions:
USG:
WAN1: 61.222.9.5(Static PPPoE v4)
Or
WAN1:59.124.163.150(Static)
Goal to achieve:
A ZyWALL USG will assign IPv6 IP addresses to the clients which are behind it, and the
clients can access a remote IPv6 network by using the ZyWALL USG 6to4 tunnel.
USG configuration
Step1: Configuration >System >IPv6 > Click Enable IPv6

ZyXEL –USG Application Note
7
Step2: Setting the static IP on WAN1
Configuration>Interface > Ethernet> Double Click WAN1 interface and
configure with static IP address 59.124.163.150.
Step3: Setting IPv6 IP address on LAN1
(1) Configuration>Interface >Ethernet> double click LAN1 interface in IPv6
configuration.

ZyXEL –USG Application Note
8
(2) Convert WAN1 IP address to hexadecimal. 59.124.163.150(Decimal) =
3b7c:a396(Hex). Fill in 2002:3b7c:a396::1/128 in the prefix table as the
LAN interface IPv6 address.
(3) Check IPv6 Router Advertisement Setting box and add the prefix in the
Advertised Prefix Table.
Step4: Enable 6 to 4 tunnel.
(1) Configuration>Interface>Tunnel> Click Add button

ZyXEL –USG Application Note
9
(2) Select the 6to4 in that Tunnel Mode
(3) Check the Prefix in the 6tp4 tunnel Parameter
(4) Select the WAN1 interface as the gateway in the Gateway Setting

ZyXEL –USG Application Note
10
Scenario 2 —WAN Load Balancing and Customized
Usage of WAN Connection for Specific Traffic
--Dual WAN setting
2.1 Application Scenario
The company has two WAN connections for sharing outbound internet traffic. WAN1
uses static IP, and WAN2 uses a PPPoE connection. Since WAN1 ISP is also the
company’s VoIP provider, the network administrator wants VoIP traffic primarily
sent out over WAN1. In case WAN1 is down, the VoIP traffic can still go out over
WAN2 PPPoE connection. Network administrator also wants HTTP traffic sent over
WAN2 PPPoE connection primarily. In case WAN2 PPPoE is down, LAN users can still
surf internet over WAN1. For all other types of traffic, administrator needs the two
WAN connections to share the outbound traffic load, performing load balancing.
2.2 Configuration Guide
Goals to achieve:
1) VoIP traffic goes out primarily through WAN1. In case WAN1 is down, it will go out
via WAN2 PPPoE connection.
2) HTTP traffic goes out primarily through WAN2 PPPoE connection. In case WAN2
PPPoE is down, it will go out via WAN1.
3) All other traffic goes out via WAN trunk performing Load Balancing with Least

ZyXEL –USG Application Note
11
Load Balancing algorithm.
USG configuration
Step 1. Configure a PPPoE account on WAN2 interface.
(1) Go to CONFIGURATION > Object > ISP Account, add a PPPoE account:
(2) Go to CONFIGURATION > Network > Interface > PPP, add a new PPP
interface which is based on WAN 2 interface:

ZyXEL –USG Application Note
12
Step 2. Go to CONFIGURATION > Network > Interface > Trunk. Add WAN Trunks.
(1) Add WAN trunk for VoIP traffic —Set WAN1 as Active mode, while setting
WAN2_ppp as Passive mode.
(2) Add WAN trunk for HTTP traffic —Set WAN2_ppp as Active mode, while
setting WAN1 as Passive mode.
(3) Use SYSTEM_DEFAULT_WAN_TRUNK to do load balancing for all other
traffic.
Step 3. Go to CONFIGURATION > Network > Routing > Policy Route, add policy routes

ZyXEL –USG Application Note
13
for VoIP traffic and HTTP traffic.
(1) Add a policy route for VoIP traffic:
Source: LAN1_subnet
Destination: Any
Service: SIP
Next Hop: select the newly created WAN trunk WAN_Trunk_VoIP
Please note that to make sure this policy route applies to all VoIP traffic,
including both the SIP signaling and RTP (voice data), we need to enable SIP ALG.
Go to Configuration > Network > ALG, enable SIP ALG.
(2) Add a policy route for HTTP traffic:
Source: LAN1_subnet
Destination: Any
Service: HTTP
Next Hop: Select the newly created WAN trunk WAN_Trunk_HTTP.

ZyXEL –USG Application Note
14
(3) For all other traffic, use SYSTEM_DEFAULT_WAN_TRUNK to do load
balancing. Go to Configuration > Network > Interface > Trunk. Click Show
Advanced Settings.
Make sure Default SNAT is enabled. Select
SYSTEM_DEFAULT_WAN_TRUNK in Default Trunk Selection.

ZyXEL –USG Application Note
15
Scenario 3 —How to configure NAT if you have
Internet-facing public servers
3.1 Application Scenario
It is a common practice to place company servers behind the USG’s protection; while at
the same time letting WAN side clients/servers access the intranet servers. To give an
example, the company may have an internal FTP server, which needs to be accessible
from the Internet as well. To fulfill this requirement, user can configure a NAT mapping
rule to forward the traffic from Internet side to intranet side. This feature can not only
ensure service availability but also helps avoid exposing the server’s real IP address to be
attacked.
3.2 Configuration Guide
Goal to achieve:
User Tom can access the internal FTP server by accessing the Internet-facing WAN IP
address.
Network Conditions: USG-50:
- WAN IP: 59.124.163.152
- FTP server IP: 192.168.50.33
FTP Server
192.168.50.33
WAN Interface
59.124.163.152
configuration
Step 1. Click CONFIGURATION > Network > NAT to open the configuration screen.

ZyXEL –USG Application Note
16
Step 2. Click the Add button to create a mapping rule.
Step 3. In this page user needs to configure:
- Rule’s name
- Select Virtual Server type to let USG-50 do packet forwarding
- Fill in the Original IP (WAN IP) address
- Fill in the Mapped IP (Internal FTP server IP) address
- Select the service to be mapped (FTP); the ports will be selected automatically
Step 4. Click CONFIGURATION > Security Policy > Policy Control to open the firewall
configuration screen.
Here assume the user already assigned the WAN interface to WAN zone and LAN
interface to LAN1 zone.
Step 5. Click the Add button to create a firewall rule to enable the FTP service to pass
from WAN to LAN1.

ZyXEL –USG Application Note
17
Step 6. User can create an address object for the internal FTP server for further
configuration usage. Click Create new Object for this function.
Step 7. Configure the rule to:
- Allow access from WAN to LAN1
- Source IP address is not specific
- Destination IP address is the FTP server’s address
- Select FTP service (with port 20/21) to be enabled
- Select the allow action for matched packets

ZyXEL –USG Application Note
18
Then Click “OK”you will see the rule in policy control.

ZyXEL –USG Application Note
19
Scenario 4 —Secure site-to-site connections by
using IPSec VPN –IPv4 with IKEv2 / IPv6
4.1 Application Scenario
IPv4 with IKEv2
We want to use IKEv2 to establish a VPN tunnel between the HQ and Branch.
IPv6 (with IKEv2 only)
ISP has changed the environment to IPv6. We applied for IPv6 address pool for
internal use. So we have to change use the IPv6 address to establish VPN tunnel
between USG.
4.2 Configuration Guide
IPv6
Step1. Add a IPV6 VPN phase I on USG1. Go to CONFIGURATION -> VPN -> IPSec
VPN -> VPN Gateway.
My Address: 2002:3b7c:a397:2:ee43:f6ff:fefc:c4b3

ZyXEL –USG Application Note
20
Peer Gateway Address: 2002:3b7c:a397:2:b2b2:dcff:fe70:c1d6
Pre-Shared Key: 12345678
Step 2. Add a IPv6 VPN phase II on USG1. Go to CONFIGURATION -> VPN -> IPSec
VPN -> VPN Connection.
VPN Gateway: USG1_GW
Local policy: 2002:3b7c:a397:2222::/64
Remote policy: 2002:3b7c:a397:1111::/64
Step3. Add an IPV6 VPN phase I on USG2. Go to CONFIGURATION -> VPN -> IPSec