ZyXEL Communications ZyWALL USG Series Supplement

0
ZyWALL USG Series
Unified Security Gateway
Version 4.10
Edition 1, 05/2014
Copyright © 2014 ZyXEL Communications Corporation
Application Notes

ZyXEL –USG Application Notes
1
Table of Contents
Scenario 1 —Connecting your USG to the Internet...................................4
1.1 Application Scenario ........................................................................................4
1.2 Configuration Guide.........................................................................................4
Scenario 2 —WAN Load Balancing and Customized Usage of WAN
Connection for Specific Traffic --Dual WAN setting....................................8
2.1 Application Scenario ........................................................................................8
2.2 Configuration Guide.........................................................................................8
Scenario 3 —How to configure NAT if you have Internet-facing public
servers..........................................................................................................13
3.1 Application Scenario ......................................................................................13
3.2 Configuration Guide.......................................................................................13
Scenario 4 —Secure site-to-site connections by using IPSec VPN –IPv4
with IKEv2 / IPv6 ..........................................................................................17
4.1 Application Scenario ......................................................................................17
4.2 Configuration Guide.......................................................................................17
Scenario 5 —Connect to USG by using IPSec IKEv2 in Windows 7.......25
5.1 Application Scenario ......................................................................................25
5.2 Configuration Guide.......................................................................................25
Scenario 6 —GRE over IPSec VPN tunnel –VPN fail over.......................40
6.1 Application scenario.......................................................................................40
6.2 Configuration Guide.......................................................................................40
Scenario 7 - Deploying SSL VPN for Tele-workers to Access Company
Resources –SSL VPN with Apple Mac OSX...............................................54
7.1 Application Scenario ......................................................................................54
7.2 Configuration Guide.......................................................................................54
Scenario 8 —Reserving Highest Bandwidth Management Priority for
VoIP traffic....................................................................................................58
8.1 Application Scenario ......................................................................................58
8.2 Configuration Guide.......................................................................................58
Scenario 9 - Reserving Highest Bandwidth Management Priority for a
Superior User and Control Session per Host –BWM Per IP or Per User60
9.1 Application Scenario ......................................................................................60
9.2 Configuration Guide.......................................................................................60
Scenario 10 - Using USG to Control Popular Applications –APP patrol.66
10.1 Application Scenario ....................................................................................66
10.2 Configuration Guide.....................................................................................66

ZyXEL –USG Application Notes
2
Scenario 11 –configure unified policy (firewall policy + UTM profile).....70
11.1 Application Scenario ....................................................................................71
11.2 Configuration Guide.....................................................................................71
Scenario 12 –Block HTTPs web site by Content Filter ............................74
12.1 Application Scenario ....................................................................................74
12.2 Configuration Guide.....................................................................................74
Scenario 13: Single sign-on with USG and Windows platform................77
13.1 Application Scenario ....................................................................................77
13.2 Configuration Guide.....................................................................................77
Scenario 14 –WLAN Controller function on USG.....................................90
14.1 Application Scenario ....................................................................................90
14.2 Configuration Guide.....................................................................................90
Scenario 15 –Device HA on the USG.........................................................95
15.1 Application Scenario ....................................................................................95
15.2 Configuration Guide.....................................................................................95

ZyXEL –USG Application Notes
3
Tutorial 1: How to Set Up Your Network.....................................................98
1.1Wizard Overview .........................................................................................98
1.2 How to Configure Interfaces, Port Roles, and Zones ........................98
1.3 How to Configure a Cellular Interface ................................................101
1.4 How to Set Up a Wireless LAN............................................................103
1.6 How to Set Up IPv6 Interfaces For Pure IPv6 Routing....................108
1.7 How to Set Up an IPv6 6to4 Tunnel....................................................113
1.8 How to Set Up an IPv6-in-IPv4 Tunnel...............................................117
Tutorial 2: Protecting Your Network.........................................................121
2.1 Firewall....................................................................................................121
2.2 User-aware Access Control..................................................................122
2.3 Device and Service Registration.........................................................123
2.4 Anti-Virus Policy Configuration............................................................124
2.5 IDP Profile Configuration......................................................................126
2.6 ADP Profile Configuration ....................................................................127
2.7 Content Filter Profile Configuration.....................................................129
2.8 Viewing Content Filter Reports............................................................131
2.9Anti-Spam Policy Configuration ..............................................................134
Tutorial 3: Create Secure Connections Across the Internet...................136
3.1 IPSec VPN..............................................................................................136
3.2 VPN Concentrator Example.................................................................138
3.3 Hub-and-spoke IPSec VPN Without VPN Concentrator.................140
3.4 USG IPSec VPN Client Configuration Provisioning.........................142
3.5SSL VPN.....................................................................................................144
3.6L2TP VPN with Android, iOS, and Windows.........................................145
Tutorial 4: Managing Traffic ......................................................................159
4.1How to Configure Bandwidth Management...........................................159
4.2 How to Configure a Trunk for WAN Load Balancing ........................166
4.3 How to Use Multiple Static Public WAN IPAddresses for
LAN-to-WAN Traffic.........................................................................................168
4.4How to Use Device HA to Backup Your USG........................................169
4.5How to Configure DNS Inbound Load Balancing.................................173
4.6 How to Allow Public Access to a Web Server ...................................189
4.7How to Manage Voice Traffic ...................................................................177
4.8How to Limit Web Surfing and MSN to Specific People......................197

ZyXEL –USG Application Notes
4
Scenario 1 —Connecting your USG to the Internet
1.1 Application Scenario
Nowadays, many Internet service providers offer an IPv6 environment. With an IPv6
feature enabled on the USG, it can assign an IPv6 address to clients and pass IPv6
traffic through IPv4 environment to access a remote IPv6 network.
1.2 Configuration Guide
Network conditions:
USG:
WAN1: 61.222.9.5(Static PPPoE v4)
Or
WAN1: 59.124.163.150(Static)
Goal to achieve:
A USG will assign an IPv6 IP addresses to the clients, which are behind it, and the
clients can access a remote IPv6 network by using the USG 6to4 tunnel.
USG configuration
Step 1: Configuration >System >IPv6 > Click Enable IPv6

ZyXEL –USG Application Notes
5
Step 2: Setting the static IP on WAN1
Configuration > Interface > Ethernet > double-click on WAN1 interface and
configure with static IP address 59.124.163.150.
Step 3: Setting IPv6 IP address on LAN1
(1) Configuration >Interface > Ethernet > double-click LAN1 interface in IPv6
configuration.

ZyXEL –USG Application Notes
6
(2) Convert WAN1 IP address to hexadecimal. 59.124.163.150(Decimal) =
3b7c:a396(Hex). Fill-in 2002:3b7c:a396::1/128 in the prefix table as the
LAN interface IPv6 address.
(3) Check the IPv6 Router Advertisement Setting box and add the prefix in
the Advertised Prefix Table.
Step 4: Enable 6 to 4 tunnel.
(1) Configuration > Interface>Tunnel > Click on the Add button.

ZyXEL –USG Application Notes
7
(2) Select the 6to4 in that Tunnel Mode.
(3) Check the Prefix in the 6tp4 tunnel Parameter.
(4) Select the WAN1 interface as the gateway in the Gateway Setting.

ZyXEL –USG Application Notes
8
Scenario 2 —WAN Load Balancing and Customized
Usage of WAN Connection for Specific Traffic --
Dual WAN setting
2.1 Application Scenario
The company has two WAN connections for sharing outbound internet traffic. WAN1
uses a static IP address, and WAN2 uses a PPPoE connection. Since WAN1 ISP is also
the company’s VoIP provider, the network administrator wants VoIP traffic primarily
sent out over WAN1. In case WAN1 is down, the VoIP traffic can still go out over
WAN2 PPPoE connection. The network administrator also wants HTTP traffic sent
over WAN2 PPPoE connection primarily. In case WAN2 PPPoE is down, LAN users can
still surf Internet over WAN1. For all other types of traffic, administrator needs the
two WAN connections to share the outbound traffic load, performing load balancing.
2.2 Configuration Guide
Goals to achieve:
1) VoIP traffic goes out primarily through WAN1. In case WAN1 is down, it will go out
via WAN2 PPPoE connection.
2) HTTP traffic goes out primarily through WAN2 PPPoE connection. In case WAN2
PPPoE is down, it will go out via WAN1.
3) All other traffic goes out via WAN trunk performing Load Balancing with Least

ZyXEL –USG Application Notes
9
Load Balancing algorithm.
USG configuration
Step 1. Configure a PPPoE account on WAN2 interface.
(1) Go to CONFIGURATION > Object > ISP Account, add a PPPoE account:
(2) Go to CONFIGURATION > Network > Interface > PPP, add a new PPP
interface, which is based on WAN 2 interface:

ZyXEL –USG Application Notes
10
Step 2. Go to CONFIGURATION > Network > Interface > Trunk. Add WAN Trunks.
(1) Add WAN trunk for VoIP traffic —Set WAN1 as Active mode, while setting
WAN2_ppp as Passive mode.
(2) Add WAN trunk for HTTP traffic —Set WAN2_ppp as Active mode, while
setting WAN1 as Passive mode.
(3) Use SYSTEM_DEFAULT_WAN_TRUNK to perform load balancing for all other
traffic.
Step 3. Go to CONFIGURATION > Network > Routing > Policy Route, add policy

ZyXEL –USG Application Notes
11
routes for VoIP traffic and HTTP traffic.
(1) Add a policy route for VoIP traffic:
Source: LAN1_subnet
Destination: Any
Service: SIP
Next Hop: select the newly created WAN trunk WAN_Trunk_VoIP
Please note that to make sure this policy route applies to all VoIP traffic,
including both the SIP signaling and RTP (voice data), we need to enable SIP ALG.
Go to Configuration > Network > ALG, enable SIP ALG.
(2) Add a policy route for HTTP traffic:
Source: LAN1_subnet
Destination: Any
Service: HTTP
Next Hop: Select the newly created WAN trunk WAN_Trunk_HTTP.

ZyXEL –USG Application Notes
12
(3) For all other traffic, use SYSTEM_DEFAULT_WAN_TRUNK to perform load
balancing. Go to Configuration > Network > Interface > Trunk. Click on
Show Advanced Settings.
Make sure Default SNAT is enabled. Select
SYSTEM_DEFAULT_WAN_TRUNK in Default Trunk Selection.

ZyXEL –USG Application Notes
13
Scenario 3 —How to Configure NAT if you have
Internet-facing Public Servers
3.1 Application Scenario
It is a common practice to place company servers behind the USG’s protection; while at
the same time letting WAN side clients/servers access the intranet servers. To give an
example, the company may have an internal FTP server, which needs to be accessible
from the Internet as well. To fulfill this requirement, the user can configure a NAT
mapping rule to forward the traffic from the Internet side to intranet side. This feature
does not only ensure service availability, but also helps avoid exposing the server’s real
IP address from being attacked.
3.2 Configuration Guide
Goal to achieve:
User Tom can access the Internet FTP server by accessing the Internet-facing the WAN IP
address.
Network Conditions: USG-50:
- WAN IP: 59.124.163.152
- FTP server IP: 192.168.50.33
Configuration
Step 1. Go to CONFIGURATION > Network > NAT to open the configuration screen.

ZyXEL –USG Application Notes
14
Step 2. Click on the Add button to create a mapping rule.
Step 3. In this page, the user needs to configure:
- Rule’s name
- Select Virtual Server type to let USG-50 do packet forwarding
- Fill-in the Original IP (WAN IP) address
- Fill-in the Mapped IP (Internal FTP server IP) address
- Select the service to be mapped (FTP); the ports will be selected automatically
Step 4. Go to CONFIGURATION > Security Policy > Policy Control to open the firewall
configuration screen.
Here assume the user already assigned the WAN interface to WAN zone and LAN
interface to LAN1 zone.
Step 5. Click on the Add button to create a firewall rule to enable the FTP service to pass
from WAN to LAN1.

ZyXEL –USG Application Notes
15
Step 6. The user can create an address object for the internal FTP server for further
configuration usage. Click on Create new Object for this function.
Step 7. Configure the rule to:
- Allow access from WAN to LAN1
- Source IP address is not specific
- Destination IP address is the FTP server’s address
- Select FTP service (with port 20/21) to be enabled
- Select the allow action for matched packets

ZyXEL –USG Application Notes
16
Step 8: Click on the OK button, you will see the rule in policy control.

ZyXEL –USG Application Notes
17
Scenario 4 —Secure Site-to-site Connections using
IPSec VPN –IPv4 with IKEv2 / IPv6
4.1 Application Scenario
IPv4 with IKEv2
We want to use IKEv2 to establish a VPN tunnel between the HQ and Branch Office.
IPv6 (with IKEv2 only)
ISP has changed the environment to IPv6. We applied for IPv6 address pool for
internal use. So we have to change use the IPv6 address to establish an VPN tunnel
between the USG.
4.2 Configuration Guide
IPv4
Network Conditions:
USG-40W with static WAN:
- WAN IP: 59.124.163.155
- Local subnet: 192.168.100.0/24

ZyXEL –USG Application Notes
18
USG-40W with PPPOE WAN:
- PPPOE IP: 220.137.67.76
- Local subnet: 192.168.200.0/24
IPSec VPN Conditions:
Phase 1:
Phase 2:
IKE version: IKEv2
Active Protocol: ESP
Authentication: 1234567890
Encapsulation Mode: Tunnel
Local/Peer ID type: IPv4 0.0.0.0 / Any
Encryption Algorithm: DES
Encryption Algorithm: 3DES
Authentication Algorithm: SHA1
Authentication Algorithm: MD5
Perfect Forward Secrecy: None
Key Group: DH1
Goal to achieve:
Establish an IPSec VPN tunnel between two USGs with the above configuration.
Step 1. Go to CONFIGURATION > VPN > IPSec VPN > VPN Gateway to open the
configuration screen.
Step 2. Click on the Add button to add a VPN gateway rule.
Step 3. To configure the VPN gateway rule, the user needs to fill-in:
- VPN gateway name
- Enable IKEv2 protocol
- Gateway address; both local (My Address) and peer (Peer GW Address)
- Authentication setting
Pre-Shared Key
ID Type setting (Local and Peer side)
- Phase-1 setting
Negotiation mode
Encryption algorithm
Authentication algorithm
Key Group

ZyXEL –USG Application Notes
19