ZyXEL Communications ZyXEL ZyWALL 2WE Installation instructions

ZyWALL 2WE
Internet Security Gateway
Compact Guide
Version 3.62
April 2004

ZyWALL 2WE
2
Table of Contents
1 Introducing the ZyWALL ............................................................................................................. 4
2 Hardware ........................................................................................................................................ 4
2.1 Rear Panel ................................................................................................................................. 5
2.2 The Front Panel LEDs............................................................................................................... 6
3 Setting Up Your Computer’s IP Address..................................................................................... 7
3.1 Windows NT/2000/XP .............................................................................................................. 7
4 Configuring Your ZyWALL ......................................................................................................... 9
4.1 Accessing Your ZyWALL Via Web Configurator.................................................................... 9
4.2 Internet Access Using the Wizard ........................................................................................... 10
4.3 Test Your Internet Connection ................................................................................................ 13
4.4 Check Your WAN Setup......................................................................................................... 14
4.5 Common Screen Command Buttons ....................................................................................... 14
5 Advanced Configuration.............................................................................................................. 15
5.1 Network Address Translation Overview ................................................................................. 15
5.2 Configuring SUA Server ......................................................................................................... 15
5.3 Wireless LAN Overview ......................................................................................................... 17
5.4 Configuring Wireless .............................................................................................................. 17
5.5 Configuring IEEE 802.1X Authentication .............................................................................. 19
5.6 Local User Database and RADIUS Overview......................................................................... 20
5.7 Firewall Overview................................................................................................................... 20
5.8 Configuring Firewall ............................................................................................................... 21
5.9 Procedure for Configuring Firewall Rules .............................................................................. 24
5.10 Configuring Source and Destination Addresses .................................................................... 26
5.11 Content Filtering Overview................................................................................................... 27
5.11.1 Restrict Web Features.................................................................................................... 27
5.11.2 Create a Filter List ......................................................................................................... 27
5.11.3 Customize Web Site Access .......................................................................................... 28
5.11.4 General Content Filter Configuration............................................................................ 28
5.12 Content Filtering with an External Server ............................................................................. 29
5.13 A Procedure to Enable External Database Content Filtering................................................. 29
5.14 Configuring for Registering and Categories.......................................................................... 29

ZyWALL 2WE
3
5.15 Configuring Customization ................................................................................................... 31
5.16 VPN Overview ...................................................................................................................... 32
5.17 Summary Screen.................................................................................................................... 32
5.18 Configuring VPN Policies..................................................................................................... 35
5.18.1 X-Auth (Extended Authentication)................................................................................ 35
5.19 Viewing SA Monitor............................................................................................................. 39
5.20 UPnP Overview..................................................................................................................... 40
5.21 Configuring UPnP ................................................................................................................. 40
6 Troubleshooting............................................................................................................................ 41

ZyWALL 2WE
4
1 Introducing the ZyWALL
The ZyWALL 2WE is the ideal secure gateway for all data passing between the Internet and the
LAN. By integrating NAT, firewall, VPN capability, and wireless LAN, ZyXEL’s ZyWALL 2WE
is a complete security solution that protects your Intranet and efficiently manages data traffic on
your network. The embedded web configurator is easy to operate and totally independent of the
operating system platform you use.
You should have an Internet account already set up and have been given most of the following
information.
Internet Account Information
Your device’s WAN IP Address (if given): __________________
DNS Server IP Address (if given): Primary __________________, Secondary _________________
Encapsulation:
 Ethernet Service Type: _______________________
Login Server IP Address: ______________
User Name: ____________ Password: ____________
 PPTP User Name: ____________ Password: ____________
Your WAN IP Address: ____________ PPTP Server IP Address: ___________
Connection ID (if required): ____________
 PPPoE (PPPoE) Service Name: ____________
User Name: ____________ Password: ____________
2 Hardware
This section provides details on hardware specifications.

ZyWALL 2WE
5
2.1 Rear Panel
LABEL DESCRIPTION
1. LAN 10/100M 1-
4
Connect a computer to one of these ports with an Ethernet cable. These ports are auto-
negotiating (can connect at 10 or 100Mbps) and auto-sensing (automatically adjust to
the type of Ethernet cable you use (straight-through or crossover).
2. WAN 10/100M Connect your cable/DSL modem to this port with the cable that came with your modem.
3. POWER 12
VDC
Connect the included power adaptor (use only this adapter) to this power socket.
After you’ve made the connections, connect the power cable to a power supply and look at the front panel LEDs.
CON/AUX switch
CON/AUX port
Only connect this port if you want to configure the ZyWALL using the SMT via console
port or set up a backup WAN connection; see your User’s Guide for details.
Set this switch to the “CON” side to use the CON/AUX port as a console port for local
device configuration and management. Connect the 9-pin male end of the console
cable to the console port of the ZyWALL and the other end to a serial port (COM1,
COM2 or other COM port) on your computer. Your computer should have a terminal
emulation communications program (such as HyperTerminal) set to VT100 terminal
emulation, no parity, 8 data bits, 1 stop bit, no flow control and 9600 bps port speed.
Set this switch to the “AUX” side to use the CON/AUX port as an auxiliary dial-up WAN
connection. Use the included CON/AUX converter, with the console cable to connect
the CON/AUX port to your modem or TA.

ZyWALL 2WE
6
LABEL DESCRIPTION
RESET You only need to use this button if you’ve forgotten the ZyWALL’s password. It returns
the ZyWALL to the factory defaults (password is 1234, LAN IP address 192.168.1.1,
terminal emulation settings as described above etc.; see your User’s Guide for details).
2.2 The Front Panel LEDs
The PWR LED turns on when you connect the power. The SYS LED blinks while performing
system testing and then stays on if the testing is successful. The CON/AUX, LAN, and WAN LEDs
turn on if the ports are properly connected.
LED COLOR STATUS MEANING
On The ZyWALL is turned on.PWR Green
Off The ZyWALL is turned off.
SYS Green Off The ZyWALL is not ready or failed.
On The ZyWALL is ready and running.
Flashing The ZyWALL is rebooting.
Red On The power to the ZyWALL is too low.

ZyWALL 2WE
7
LED COLOR STATUS MEANING
LAN
10/100M
1-4
Green
Orange
On
On
Flashing
Off
The ZyWALL has a LAN connection of 10Mbps.
The ZyWALL has a LAN connection of 100Mbps.
The ZyWALL is sending/receiving packets.
The ZyWALL does not have an Ethernet connection.
10/100M
WAN
Green
Orange
On
On
Flashing
Off
The WAN link is connected at 10Mbps.
The WAN link is connected at 100Mbps.
The WAN link is sending/receiving packets.
The WAN link is not ready, or has failed.
CON/AUX Off The CON/AUX link is not ready, or has failed.
Green
On The CON/AUX switch is set to CON and the CON/AUX port is
connected to a management computer.
Orange Off The CON/AUX link is not ready, or has failed.
On The CON/AUX switch is set to AUX and the CON/AUX port has an
Internet connection through a dial-up modem.
Flashing The CON/AUX switch is set to AUX and the CON/AUX port is
sending or receiving data through a dial-up modem.
WLAN Green On
Off
Flashing
The Wireless LAN feature is enabled.
The Wireless LAN link is not ready, or has failed.
The Wireless LAN link is sending/receiving packets.
3 Setting Up Your Computer’s IP Address
Skip this section if your computer is already set up to accept a dynamic IP
address. This is the default for most new computers.
The ZyWALL is already set up to assign your computer an IP address. Use this section to set up
your computer to receive an IP address or assign it a static IP address in the 192.168.1.2 to
192.168.1.254 range with a subnet mask of 255.255.255.0. This is necessary to ensure that your
computer can communicate with your ZyWALL.
Your computer must have an Ethernet card and TCP/IP installed. TCP/IP should already be installed
on computers using Windows NT/2000/XP, Macintosh OS 7 and later
3.1 Windows NT/2000/XP
1. In Windows XP, click start, Control Panel. In Windows 2000/NT, click Start, Settings, Control Panel.
2. In Windows XP, click Network Connections.
In Windows 2000/NT, click Network and Dial-up Connections.
3. Right-click Local Area Connection and then click Properties.

ZyWALL 2WE
8
4. Select Internet Protocol (TCP/IP) (under the General tab in Win XP) and click Properties.
5. The Internet Protocol TCP/IP Properties screen opens (the
General tab in Windows XP).
- To have your computer assigned a dynamic IP address,
click Obtain an IP address automatically.
-To configure a static IP address, click Use the following IP
Address and fill in the IP address (choose one
from192.168.1.2 to 192.168.1.254), Subnet mask
(255.255.255.0), and Default gateway (192.168.1.1) fields.
6. Click Advanced. Remove any previously installed gateways
in the IP Settings tab and click OK to go back to the Internet
Protocol TCP/IP Properties screen.
7. Click Obtain DNS server address automatically if you do
not know your DNS server IP address(es).
If you know your DNS server IP address(es), click Use the
following DNS server addresses, and type them in the
Preferred DNS server and Alternate DNS server fields.
If you have more than two DNS servers, click Advanced, the
DNS tab and then configure them using Add.
8. Click OK to close the Internet Protocol (TCP/IP) Properties
window.
9. Click OK to close the Local Area Connection Properties
window.
Checking Your Computer’s IP Address
1. In the computer, click Start, (All) Programs, Accessories and then Command Prompt.
2. In the Command Prompt window, type "ipconfig" and then press ENTER. Your computer’s IP address
must be in the correct range (192.168.1.2 to 192.168.1.254) with subnet mask 255.255.255.0 in order to
communicate with the ZyWALL.

ZyWALL 2WE
9
Refer to your User’s Guide for detailed IP address configuration for other Windows and Macintosh
computer operating systems.
4 Configuring Your ZyWALL
This Compact Guide shows you how to use the web configurator wizard
only. See your User’s Guide for background information on all ZyWALL
features and System Management Terminal (SMT) configuration.
 Web Configurator
4.1 Accessing Your ZyWALL Via Web Configurator
Step 1. Launch your web browser. Enter “192.168.1.1” as the web site address.
Step 2. The default password (“1234”) is already in the password field (in non-readable format).
Click Login to proceed to a screen asking you to change your password. Click Reset to
revert to the default password in the password field.
Step 3. It is highly recommended you change the default password! Enter a new password,
retype it to confirm and click Apply; alternatively click Ignore to proceed to the main
menu if you do not want to change the password now.
Web site address.
Default password.
Change default password.

ZyWALL 2WE
10
Step 4. You should now see the web configurator MAIN MENU screen.
 Click WIZARD to begin a series of screens to help you configure your ZyWALL for the
first time.
 Click MAINTENANCE in the navigation panel to see ZyWALL performance statistics,
upload firmware and back up, restore or upload a configuration file.
 Click LOGOUT when you have finished a ZyWALL management session. The ZyWALL
automatically logs you out if it is left idle for five minutes; press ENTER to display the
Login screen again and then log back in.
4.2 Internet Access Using the Wizard
Step 1. Click Wizard Setup in the main menu to display the first wizard screen.
Click WIZARD SETUP for initial
configuration including general
setup, ISP parameters for Internet
A
ccess and WAN IP/DNS
Server/MAC address assignment.
Use submenus to configure ZyWALL features.
Click MAINTENANCE to view information about your ZyWALL or upgrade
configuration/firmware files. Maintenance includes SYSTEM STATUS (Statistics), DHCP
TABLE, F/W (firmware) UPGRADE and CONFIGURATION (Backup, Restore Default).
Click LOGOUT at
any time to exit the
web configurator.

ZyWALL 2WE
11
System Name is for identification
purposes. Enter your computer's
"Computer Name".
The Domain Name entry is what is
propagated to the DHCP clients on
the LAN. If you leave this blank, the
domain name obtained by DHCP
from the ISP is used.
Click Next to continue.
Step 2. The second wizard screen has three variations depending on what encapsulation type you
use. Use the information in Internet Account Information to fill in fields.
Choose Ethernet when the WAN
port is used as a regular Ethernet.
Choose from Standard or a
RoadRunner version. You’ll need
User Name, Password and Login
Server IP Address for some
Roadrunner versions.
Click Next to continue.

ZyWALL 2WE
12
Point-to-Point Protocol over
Ethernet (PPPoE) functions as a
dial-up connection. Therefore you’ll
also need a username and
password and possibly the PPPoE
service name. Your ISP will give
you all needed information.
Select Nailed Up Connection if you
do not want the connection to the
PPPoE server to time out.
Otherwise, enter the number of
seconds to elapse before the
ZyWALL disconnects from the
server in the Idle Timeout field. The
default value is 100 seconds. Enter
“0” to prevent the connection from
timing out.
Click Next to continue.
Choose PPTP if your service
provider uses a DSL terminator with
PPTP login. The ZyWALL must
have a static IP address (My IP
Address) in this case, and possibly
a subnet mask (My IP Subnet
Mask) if provided by your ISP.
You’ll also need a username,
associated password, and the DSL
terminator IP address (Server IP
Address). If your ISP has provided
a connection ID name, enter it in the
Connection ID/Name field.
See the PPPoE encapsulation
above for information on the Nailed
Up Connection and Idle Timeout
fields.
Click Next to continue.
Step 3. Fill in the fields and click Finish to save and complete the wizard setup.

ZyWALL 2WE
13
WAN IP Address Assignment
Select Get automatically from
ISP if your ISP did not assign you
a fixed IP address. Select Use
fixed IP address if the ISP
assigned a fixed IP address and
then enter your IP address and
subnet mask in the next two
fields. Enter the gateway IP
address in this field (if provided)
when you select Use Fixed IP
Address.
Select From ISP if your ISP
dynamically assigns DNS server
information.
Select User-Defined if you have
the IP address of a DNS server.
Select None if you do not want to
configure DNS servers
WAN MAC Address
Select Factory Default to use the factory assigned default MAC address. Alternatively, select Spoof this
Computer's MAC address - IP Address and enter the IP address of the computer on the LAN whose MAC address
you are cloning.
4.3 Test Your Internet Connection
Launch your web browser and navigate to www.zyxel.com. You don’t need a dial-up program such
as Dial Up Networking. Internet access is just the beginning. Refer to the User’s Guide for more
detailed information on the complete range of ZyWALL features. If you cannot access the Internet,
open the web configurator again to confirm that the WAN settings you configured in the Wizard
Setup are correct.
Refer to the Troubleshooting section if you have trouble logging in.

ZyWALL 2WE
14
4.4 Check Your WAN Setup
Click WAN and then the WAN
ISP and WAN IP tabs.
The screens look very similar to
screens 2 and 3 in the Wizard
Setup. If the information is
incorrect, make changes and click
Apply. Click Reset to begin
configuring this screen afresh.
4.5 Common Screen Command Buttons
The following table shows common command buttons found on many web configurator screens.
Apply Click Apply to save your changes back to the ZyWALL.
Reset Click Reset to begin configuring this screen afresh.
Cancel Click Cancel to go to the previous screen.

ZyWALL 2WE
15
5 Advanced Configuration
This section shows you how to configure some of the advanced features of the ZyWALL.
5.1 Network Address Translation Overview
NAT (Network Address Translation - NAT, RFC 1631) is the translation of the IP address of a host
in a packet. For example, the source address of an outgoing packet, used within one network is
changed to a different IP address known within another network.
If you have a single public IP address then choose SUA Only in the Network Address
Translation field of the WAN ISP screen (see section 4.4). If you have multiple public IP
addresses then you may use full feature mapping types (see the User’s Guide for more details).
NAT supports five types of IP/port mapping. They are:
1. One-to-One: One-to-one mode maps one local IP address to one global IP address. Note
that port numbers do not change for One-to-One NAT mapping type.
2. Many-to-One: Many-to-One mode maps multiple local IP addresses to one global IP
address. This is equivalent to SUA (that is, PAT, port address translation), ZyXEL's Single
User Account feature.
3. Many-to-Many Overload: Many-to-Many Overload mode maps multiple local IP
addresses to shared global IP addresses.
4. Many One-to-One: Many One-to-One mode maps each local IP address to unique global
IP addresses.
5. Server: This type allows you to specify inside servers of different services behind the NAT
to be accessible to the outside world.
5.2 Configuring SUA Server
A SUA server set is a list of inside (behind NAT on the LAN) servers, for example, web or FTP,
that you can make visible to the outside world even though SUA makes your whole inside network
appear as a single computer to the outside world.
Click SUA/NAT to open the SUA Server screen.

ZyWALL 2WE
16
The following table describes the fields in this screen.
LABEL DESCRIPTION
Default Server In addition to the servers for specified services, NAT supports a default server. A default
server receives packets from ports that are not specified in this screen. If you do not
assign a default server IP address, then all packets received for ports not specified in this
screen will be discarded.
# This is the number of an individual SUA server entry.
Active Select this check box to enable the SUA server entry. Clear this checkbox to disallow
forwarding of these ports to an inside server without having to delete the entry.
Name Enter a name to identify this port-forwarding rule.
Start Port Type a port number in this field. To forward only one port, type the port number again in
the End Port field. To forward a series of ports, type the start port number here and the
end port number in the End Port field.
End Port Type a port number in this field. To forward only one port, type the port number in the
Start Port field above and then type it again in this field. To forward a series of ports, type
the last port number in a series that begins with the port number in the Start Port field
above.

ZyWALL 2WE
17
LABEL DESCRIPTION
Server IP
Address
Enter the inside IP address of the server here.
5.3 Wireless LAN Overview
This section introduces the wireless LAN and some basic configurations. Wireless LANs can be as
simple as two computers with wireless network interface cards (NICs) communicating in a peer-to-
peer network or as complex as a number of computers with wireless NICs communicating through
access points which bridge network traffic to the wired LAN.
5.4 Configuring Wireless
The following figure provides an example of a WAN application.
Click WIRELESS LAN to open the Wireless screen.
ZyWALLZyWALL

ZyWALL 2WE
18
The following table describes the fields in this screen.
LABEL DESCRIPTION EXAMPLE
Enable
Wireless
LAN
Before you enable the wireless LAN you should configure some security by setting
MAC filters and/or 802.1x security; otherwise your wireless LAN will be vulnerable
upon enabling it. Select the check box to enable the wireless LAN.
No
(default)
ESSID (Extended Service Set ID) The ESSID identifies the Service Set the station is to
connect to. Wireless clients associating to the Access Point must have the same
ESSID. Enter a descriptive name (up to 32 characters) for the wireless LAN.
Wireless
Hide
ESSID
Select this box to hide the ESSID in the outgoing beacon frame so a station
cannot obtain the ESSID through passive scanning.
No
(default)
Channel
ID
Adjacent Access Points (APs) should use a channel different from what you
selected to reduce interference. The wireless LAN users connected to this device
must use the same channel you selected.
CH01
2412 MHz
RTS/CTS
Threshold
(Request To Send) The threshold (number of bytes) for enabling RTS/CTS
handshake. Data with its frame size larger than this value will perform the
RTS/CTS handshake. Setting this attribute to be larger than the maximum MSDU
(MAC service data unit) size turns off the RTS/CTS handshake. Setting this
attribute to zero turns on the RTS/CTS handshake. Enter a value between 0and
2432.
2432
(default)

ZyWALL 2WE
19
LABEL DESCRIPTION EXAMPLE
Frag.
Threshold
The threshold (number of bytes) for the fragmentation boundary for directed
messages. It is the maximum data fragment size that can be sent. Enter a value
between 256 and 2432.
2432
(default)
WEP WEP (Wired Equivalent Privacy) provides data encryption to prevent unauthorized
wireless stations from accessing data transmitted over the wireless network.
Select Disable to allow wireless clients to communicate with the access points
without any data encryption.
Select 64-bit WEP or 128-bit WEP to enable data encryption.
Although WEP is functional at 5.5 and 11 Mbps, there is significant performance
degradation when using WEP at these rates.
Disable
Key 1 to
Key 4 If you chose 64-bit WEP in the WEP Encryption field, then enter any 5 characters (ASCII string) or 10 hexadecimal characters ("0-9", "A-F") preceded by
0x for each key.
If you chose 128-bit WEP in the WEP Encryption field, then enter 13 characters
(ASCII string) or 26 hexadecimal characters ("0-9", "A-F") preceded by 0x for
each key.
There are four data encryption keys to secure your data from eavesdropping by
unauthorized wireless users. The values for the keys must be set up exactly the
same on the access points as they are on the wireless client computers.
5.5 Configuring IEEE 802.1X Authentication
You can set the ZyWALL and your network to authenticate a wireless client before the wireless
client can communicate with the ZyWALL and the wired network to which the ZyWALL is
connected. Your ZyWALL supports the Institute of Electrical and Electronics Engineers (IEEE)
802.1x standard that works with IEEE 802.11 to enhance user authentication.
To change your ZyWALL’s Authentication settings, click WIRELESS LAN, then the 802.1X tab.
The screen appears as shown.

ZyWALL 2WE
20
The following table describes the fields in this screen.
LABEL DESCRIPTION
Authentication
Type
Select Authentication Required to authenticate all wireless clients before they can
access the wired network.
Select No Authentication Required to allow all wireless clients to access your wired
network without authentication.
Select No Access to deny all wireless clients access to your wired network.
Reauthentication
Period
Specify the time interval between the RADIUS server’s authentication checks of
wireless users connected to the network.
This field is activated only when you select Authentication Required in the
Authentication Type field.
5.6 Local User Database and RADIUS Overview
EAP is an authentication protocol designed originally to run over PPP (Point-to-Point Protocol)
frame in order to support multiple types of user authentication. RADIUS is based on a client-sever
model that supports authentication, authorization and accounting. The access point (ZyWALL) is
the client and the server is the RADIUS server. RADIUS is a simple package exchange in which
your ZyWALL acts as a message relay between the wireless client and the network RADIUS server.
In order to ensure network security, the access point and the RADIUS server use a shared secret
key, which is a password, they both know. The key is not sent over the network. In addition to the
shared key, password information exchanged is also encrypted to protect the network from
unauthorized access. By using EAP to interact with an EAP-compatible RADIUS server, the access
point helps a wireless client and a RADIUS server to perform mutual authentication.
To authenticate wireless users without interacting with a network RADIUS server, you can store
user profiles locally. The ZyWALL first checks the local user database, then use the user database
on the RADIUS server to authenticate wireless clients. To change your ZyWALL’s Local User list,
click WIRELESS LAN, then the Local User Database tab.
If you do enable the EAP authentication, you need to specify the local user database or the external
sever for remote user authentication. To set up your ZyWALL’s Local User Database, click
WIRELESS LAN, then the Local User Database tab. To set up your ZyWALL’s RADIUS Server
settings, click WIRELESS LAN, then the RADIUS tab.
5.7 Firewall Overview
The ZyWALL firewall is a stateful inspection firewall and is designed to protect against Denial of
Service attacks when activated. The ZyWALL’s purpose is to allow a private Local Area Network
(LAN) to be securely connected to the Internet. The ZyWALL can be used to prevent theft,
destruction and modification of data, as well as log events, which may be important to the security
of your network. The ZyWALL also has packet-filtering capabilities.