ZyXEL Communications ZyWALL USG Series Supplement

0
ZyWALL USG Series
Unified Security Gateway
Version 4.10
Edition 1, 05/2014
Copyright © 2014 ZyXEL Communications Corporation
Application Notes

ZyXEL –USG Application Notes
1
Table of Contents
Scenario 1 —Connecting your USG to the Internet...................................4
1.1 Application Scenario ........................................................................................4
1.2 Configuration Guide.........................................................................................4
Scenario 2 —WAN Load Balancing and Customized Usage of WAN
Connection for Specific Traffic --Dual WAN setting....................................8
2.1 Application Scenario ........................................................................................8
2.2 Configuration Guide.........................................................................................8
Scenario 3 —How to configure NAT if you have Internet-facing public
servers..........................................................................................................13
3.1 Application Scenario ......................................................................................13
3.2 Configuration Guide.......................................................................................13
Scenario 4 —Secure site-to-site connections by using IPSec VPN –IPv4
with IKEv2 / IPv6 ..........................................................................................17
4.1 Application Scenario ......................................................................................17
4.2 Configuration Guide.......................................................................................17
Scenario 5 —Connect to USG by using IPSec IKEv2 in Windows 7.......25
5.1 Application Scenario ......................................................................................25
5.2 Configuration Guide.......................................................................................25
Scenario 6 —GRE over IPSec VPN tunnel –VPN fail over.......................40
6.1 Application scenario.......................................................................................40
6.2 Configuration Guide.......................................................................................40
Scenario 7 - Deploying SSL VPN for Tele-workers to Access Company
Resources –SSL VPN with Apple Mac OSX...............................................54
7.1 Application Scenario ......................................................................................54
7.2 Configuration Guide.......................................................................................54
Scenario 8 —Reserving Highest Bandwidth Management Priority for
VoIP traffic....................................................................................................58
8.1 Application Scenario ......................................................................................58
8.2 Configuration Guide.......................................................................................58
Scenario 9 - Reserving Highest Bandwidth Management Priority for a
Superior User and Control Session per Host –BWM Per IP or Per User60
9.1 Application Scenario ......................................................................................60
9.2 Configuration Guide.......................................................................................60
Scenario 10 - Using USG to Control Popular Applications –APP patrol.66
10.1 Application Scenario ....................................................................................66
10.2 Configuration Guide.....................................................................................66

ZyXEL –USG Application Notes
2
Scenario 11 –configure unified policy (firewall policy + UTM profile).....70
11.1 Application Scenario ....................................................................................71
11.2 Configuration Guide.....................................................................................71
Scenario 12 –Block HTTPs web site by Content Filter ............................74
12.1 Application Scenario ....................................................................................74
12.2 Configuration Guide.....................................................................................74
Scenario 13: Single sign-on with USG and Windows platform................77
13.1 Application Scenario ....................................................................................77
13.2 Configuration Guide.....................................................................................77
Scenario 14 –WLAN Controller function on USG.....................................90
14.1 Application Scenario ....................................................................................90
14.2 Configuration Guide.....................................................................................90
Scenario 15 –Device HA on the USG.........................................................95
15.1 Application Scenario ....................................................................................95
15.2 Configuration Guide.....................................................................................95

ZyXEL –USG Application Notes
3
Tutorial 1: How to Set Up Your Network.....................................................98
1.1Wizard Overview .........................................................................................98
1.2 How to Configure Interfaces, Port Roles, and Zones ........................98
1.3 How to Configure a Cellular Interface ................................................101
1.4 How to Set Up a Wireless LAN............................................................103
1.6 How to Set Up IPv6 Interfaces For Pure IPv6 Routing....................108
1.7 How to Set Up an IPv6 6to4 Tunnel....................................................113
1.8 How to Set Up an IPv6-in-IPv4 Tunnel...............................................117
Tutorial 2: Protecting Your Network.........................................................121
2.1 Firewall....................................................................................................121
2.2 User-aware Access Control..................................................................122
2.3 Device and Service Registration.........................................................123
2.4 Anti-Virus Policy Configuration............................................................124
2.5 IDP Profile Configuration......................................................................126
2.6 ADP Profile Configuration ....................................................................127
2.7 Content Filter Profile Configuration.....................................................129
2.8 Viewing Content Filter Reports............................................................131
2.9Anti-Spam Policy Configuration ..............................................................134
Tutorial 3: Create Secure Connections Across the Internet...................136
3.1 IPSec VPN..............................................................................................136
3.2 VPN Concentrator Example.................................................................138
3.3 Hub-and-spoke IPSec VPN Without VPN Concentrator.................140
3.4 USG IPSec VPN Client Configuration Provisioning.........................142
3.5SSL VPN.....................................................................................................144
3.6L2TP VPN with Android, iOS, and Windows.........................................145
Tutorial 4: Managing Traffic ......................................................................159
4.1How to Configure Bandwidth Management...........................................159
4.2 How to Configure a Trunk for WAN Load Balancing ........................166
4.3 How to Use Multiple Static Public WAN IPAddresses for
LAN-to-WAN Traffic.........................................................................................168
4.4How to Use Device HA to Backup Your USG........................................169
4.5How to Configure DNS Inbound Load Balancing.................................173
4.6 How to Allow Public Access to a Web Server ...................................189
4.7How to Manage Voice Traffic ...................................................................177
4.8How to Limit Web Surfing and MSN to Specific People......................197

ZyXEL –USG Application Notes
4
Scenario 1 —Connecting your USG to the Internet
1.1 Application Scenario
Nowadays, many Internet service providers offer an IPv6 environment. With an IPv6
feature enabled on the USG, it can assign an IPv6 address to clients and pass IPv6
traffic through IPv4 environment to access a remote IPv6 network.
1.2 Configuration Guide
Network conditions:
USG:
WAN1: 61.222.9.5(Static PPPoE v4)
Or
WAN1: 59.124.163.150(Static)
Goal to achieve:
A USG will assign an IPv6 IP addresses to the clients, which are behind it, and the
clients can access a remote IPv6 network by using the USG 6to4 tunnel.
USG configuration
Step 1: Configuration >System >IPv6 > Click Enable IPv6

ZyXEL –USG Application Notes
5
Step 2: Setting the static IP on WAN1
Configuration > Interface > Ethernet > double-click on WAN1 interface and
configure with static IP address 59.124.163.150.
Step 3: Setting IPv6 IP address on LAN1
(1) Configuration >Interface > Ethernet > double-click LAN1 interface in IPv6
configuration.

ZyXEL –USG Application Notes
6
(2) Convert WAN1 IP address to hexadecimal. 59.124.163.150(Decimal) =
3b7c:a396(Hex). Fill-in 2002:3b7c:a396::1/128 in the prefix table as the
LAN interface IPv6 address.
(3) Check the IPv6 Router Advertisement Setting box and add the prefix in
the Advertised Prefix Table.
Step 4: Enable 6 to 4 tunnel.
(1) Configuration > Interface>Tunnel > Click on the Add button.

ZyXEL –USG Application Notes
7
(2) Select the 6to4 in that Tunnel Mode.
(3) Check the Prefix in the 6tp4 tunnel Parameter.
(4) Select the WAN1 interface as the gateway in the Gateway Setting.

ZyXEL –USG Application Notes
8
Scenario 2 —WAN Load Balancing and Customized
Usage of WAN Connection for Specific Traffic --
Dual WAN setting
2.1 Application Scenario
The company has two WAN connections for sharing outbound internet traffic. WAN1
uses a static IP address, and WAN2 uses a PPPoE connection. Since WAN1 ISP is also
the company’s VoIP provider, the network administrator wants VoIP traffic primarily
sent out over WAN1. In case WAN1 is down, the VoIP traffic can still go out over
WAN2 PPPoE connection. The network administrator also wants HTTP traffic sent
over WAN2 PPPoE connection primarily. In case WAN2 PPPoE is down, LAN users can
still surf Internet over WAN1. For all other types of traffic, administrator needs the
two WAN connections to share the outbound traffic load, performing load balancing.
2.2 Configuration Guide
Goals to achieve:
1) VoIP traffic goes out primarily through WAN1. In case WAN1 is down, it will go out
via WAN2 PPPoE connection.
2) HTTP traffic goes out primarily through WAN2 PPPoE connection. In case WAN2
PPPoE is down, it will go out via WAN1.
3) All other traffic goes out via WAN trunk performing Load Balancing with Least

ZyXEL –USG Application Notes
9
Load Balancing algorithm.
USG configuration
Step 1. Configure a PPPoE account on WAN2 interface.
(1) Go to CONFIGURATION > Object > ISP Account, add a PPPoE account:
(2) Go to CONFIGURATION > Network > Interface > PPP, add a new PPP
interface, which is based on WAN 2 interface: