ZyXEL Communications ZyXEL ZyWALL 5 User manual

ZyWALL 5
Internet Security Appliance
User’s Guide
Version 3.62
June 2004

ZyWALL 5 Internet Security Appliance
ii Copyright
Copyright
Copyright © 2004 by ZyXEL Communications Corporation.
The contents of this publication may not be reproduced in any part or as a whole, transcribed, stored in
a retrieval system, translated into any language, or transmitted in any form or by any means,
electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the
prior written permission of ZyXEL Communications Corporation.
Published by ZyXEL Communications Corporation. All rights reserved.
Disclaimer
ZyXEL does not assume any liability arising out of the application or use of any products, or software
described herein. Neither does it convey any license under its patent rights nor the patent rights of
others. ZyXEL further reserves the right to make changes in any products described herein without
notice.
This publication is subject to change without notice.
Trademarks
Trademarks mentioned in this publication are used for identification purposes only and may be
properties of their respective owners.

ZyWALL 5 Internet Security Appliance
FCC Statement iii
Federal Communications Commission (FCC)
Interference Statement
This device complies with Part 15 of FCC rules. Operation is subject to the following two conditions:
This device may not cause harmful interference.
This device must accept any interference received, including interference that may cause undesired
operations.
This equipment has been tested and found to comply with the limits for a CLASS B digital device
pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection
against harmful interference in a commercial environment. This equipment generates, uses, and can
radiate radio frequency energy, and if not installed and used in accordance with the instructions, may
cause harmful interference to radio communications.
If this equipment does cause harmful interference to radio/television reception, which can be
determined by turning the equipment off and on, the user is encouraged to try to correct the
interference by one or more of the following measures:
Reorient or relocate the receiving antenna.
Increase the separation between the equipment and the receiver.
Connect the equipment into an outlet on a circuit different from that to which the receiver is
connected.
Consult the dealer or an experienced radio/TV technician for help.
Notice 1
Changes or modifications not expressly approved by the party responsible for compliance could void
the user's authority to operate the equipment.
Certifications
1. Go to www.zyxel.com.
2. Select your product from the drop-down list box on the ZyXEL home page to go to that product's
page.
3. Select the certification you wish to view from this page.

ZyWALL 5 Internet Security Appliance
iv Information for Canadian Users
Information for Canadian Users
The Industry Canada label identifies certified equipment. This certification means that the equipment
meets certain telecommunications network protective, operation, and safety requirements. The
Industry Canada does not guarantee that the equipment will operate to a user's satisfaction.
Before installing this equipment, users should ensure that it is permissible to be connected to the
facilities of the local telecommunications company. The equipment must also be installed using an
acceptable method of connection. In some cases, the company's inside wiring associated with a single
line individual service may be extended by means of a certified connector assembly. The customer
should be aware that the compliance with the above conditions may not prevent degradation of service
in some situations.
Repairs to certified equipment should be made by an authorized Canadian maintenance facility
designated by the supplier. Any repairs or alterations made by the user to this equipment, or equipment
malfunctions, may give the telecommunications company cause to request the user to disconnect the
equipment.
For their own protection, users should ensure that the electrical ground connections of the power
utility, telephone lines, and internal metallic water pipe system, if present, are connected together. This
precaution may be particularly important in rural areas.
Caution
Users should not attempt to make such connections themselves, but should contact the appropriate
electrical inspection authority, or electrician, as appropriate.
Note
This digital apparatus does not exceed the class A limits for radio noise emissions from digital
apparatus set out in the radio interference regulations of Industry Canada.

ZyWALL 5 Internet Security Appliance
ZyXEL Limited Warranty v
ZyXEL Limited Warranty
ZyXEL warrants to the original end user (purchaser) that this product is free from any defects in
materials or workmanship for a period of up to two years from the date of purchase. During the
warranty period, and upon proof of purchase, should the product have indications of failure due to
faulty workmanship and/or materials, ZyXEL will, at its discretion, repair or replace the defective
products or components without charge for either parts or labor, and to whatever extent it shall deem
necessary to restore the product or components to proper operating condition. Any replacement will
consist of a new or re-manufactured functionally equivalent product of equal value, and will be solely
at the discretion of ZyXEL. This warranty shall not apply if the product is modified, misused,
tampered with, damaged by an act of God, or subjected to abnormal working conditions.
NOTE
Repair or replacement, as provided under this warranty, is the exclusive remedy of the purchaser. This
warranty is in lieu of all other warranties, express or implied, including any implied warranty of
merchantability or fitness for a particular use or purpose. ZyXEL shall in no event be held liable for
indirect or consequential damages of any kind of character to the purchaser.
To obtain the services of this warranty, contact ZyXEL's Service Center for your Return Material
Authorization number (RMA). Products must be returned Postage Prepaid. It is recommended that the
unit be insured when shipped. Any returned products without proof of purchase or those with an out-
dated warranty will be repaired or replaced (at the discretion of ZyXEL) and the customer will be
billed for parts and labor. All repaired or replaced products will be shipped by ZyXEL to the
corresponding return address, Postage Paid. This warranty gives you specific legal rights, and you may
also have other rights that vary from country to country.
Online Registration
Register online registration at www.zyxel.com for free future product updates and information.

ZyWALL 5 Internet Security Appliance
vi Customer Support
Customer Support
When you contact your customer support representative please have the following information ready:
Please have the following information ready when you contact customer support.
• Product model and serial number.
• Warranty Information.
• Date that you received your device.
• Brief description of the problem and the steps you took to solve it.
SUPPORT E-MAIL TELEPHONE1WEB SITEMETHOD
LOCATION
SALES E-MAIL FAX1FTP SITE
REGULAR MAIL
[email protected]m.tw [phone] www.zyxel.com
www.europe.zyxel.com
ftp.zyxel.com
WORLDWIDE
[e-mail] [phone] ftp.europe.zyxel.com
ZyXEL Communications Corp.
6 Innovation Road II
Science Park
Hsinchu 300
Taiwan
[email protected]m [phone]
[phone]
www.us.zyxel.comNORTH
AMERICA
[e-mail] [phone] ftp.us.zyxel.com
ZyXEL Communications Inc.
1130 N. Miller St.
Anaheim
CA 92806-2001
U.S.A.
[email protected] [phone] www.zyxel.deGERMANY
[e-mail] [phone]
ZyXEL Deutschland GmbH.
Adenauerstr. 20/A2 D-52146
Wuerselen
Germany
[phone]FRANCE [email protected]
[phone]
www.zyxel.fr ZyXEL France
1 rue des Vergers
Bat. 1 / C
69760 Limonest
France
[email protected] [phone]SPAIN
[e-mail] [phone]
www.zyxel.es ZyXEL Communications
Alejandro Villegas 33
1º, 28043 Madrid
Spain
[email protected] [phone] www.zyxel.dkDENMARK
[e-mail] [phone]
ZyXEL Communications A/S
Columbusvej 5
2860 Soeborg
Denmark
[email protected] [phone] www.zyxel.noNORWAY
[e-mail] [phone]
ZyXEL Communications A/S
Nils Hansens vei 13
0667 Oslo
Norway
[email protected] [phone] www.zyxel.seSWEDEN
[e-mail] [phone]
ZyXEL Communications A/S
Sjöporten 4, 41764 Göteborg
Sweden
[email protected] [phone] www.zyxel.fiFINLAND
[e-mail] [phone]
ZyXEL Communications Oy
Malminkaari 10
00700 Helsinki
Finland
1“+” is the (prefix) number you enter to make an international telephone call.

ZyWALL 5 Internet Security Appliance
Table of Contents vii
Table of Contents
Copyright................................................................................................................................................ii
Federal Communications Commission (FCC) Interference Statement ...........................................iii
Information for Canadian Users ......................................................................................................... iv
ZyXEL Limited Warranty.................................................................................................................... v
Customer Support ................................................................................................................................vi
Table of Contents.................................................................................................................................vii
List of Figures .....................................................................................................................................xiv
List of Tables ....................................................................................................................................... xxi
Preface ................................................................................................................................................ xxv
Getting Started....................................................................................................................................... I
Chapter 1 Getting to Know Your ZyWALL ................................................................................1-1
1.1 ZyWALL 5 Internet Security Appliance Overview ............................................................1-1
1.2 ZyWALL Features ..............................................................................................................1-1
1.3 Applications for the ZyWALL ............................................................................................1-6
Chapter 2 Introducing the Web Configurator.............................................................................2-1
2.1 Web Configurator Overview ...............................................................................................2-1
2.2 Accessing the ZyWALL Web Configurator........................................................................2-1
2.3 Resetting the ZyWALL .......................................................................................................2-2
2.4 Navigating the ZyWALL Web Configurator ......................................................................2-3
Chapter 3 Wizard Setup.................................................................................................................3-1
3.1 Wizard Setup Overview ......................................................................................................3-1
3.2 Internet Access ....................................................................................................................3-1
3.3 VPN Overview ....................................................................................................................3-9
3.4 VPN Wizard ........................................................................................................................3-9
3.5 IPSec Algorithms ..............................................................................................................3-13
LAN, Bridge, Wireless LAN and Authentication Server ..................................................................II
Chapter 4 LAN Screens..................................................................................................................4-1
4.1 LAN Overview....................................................................................................................4-1
4.2 DHCP Setup ........................................................................................................................4-1
4.3 LAN TCP/IP........................................................................................................................4-1
4.4 Configuring LAN ................................................................................................................4-3
4.5 Configuring Static DHCP....................................................................................................4-5
4.6 Configuring IP Alias ...........................................................................................................4-6
4.7 Configuring Port Roles........................................................................................................4-8
Chapter 5 Bridge Screens...............................................................................................................5-1
5.1 Bridge Loop.........................................................................................................................5-1
5.2 Spanning Tree Protocol (STP) ............................................................................................5-1
5.3 Configuring Bridge .............................................................................................................5-3
5.4 Configuring Port Roles........................................................................................................5-4
Chapter 6 Wireless LAN and Authentication Server..................................................................6-1
6.1 Wireless LAN Overview .....................................................................................................6-1
6.2 Wireless LAN Basics ..........................................................................................................6-1
6.3 Wireless Security.................................................................................................................6-2
6.4 Inserting a PCMCIA/CardBus Wireless LAN Card............................................................6-3
6.5 Configuring Wireless LAN .................................................................................................6-4
6.6 Configuring MAC Filter......................................................................................................6-5
6.7 802.1x Overview .................................................................................................................6-7
6.8 RADIUS ..............................................................................................................................6-7
6.9 Introduction to Local User Database...................................................................................6-8

ZyWALL 5 Internet Security Appliance
viii Table of Content
6.10 Configuring 802.1X ....................................................................................................... 6-8
6.11 Authentication Server..................................................................................................... 6-9
6.12 Configuring Local User Database .................................................................................. 6-9
6.13 Configuring RADIUS .................................................................................................. 6-11
WAN and DMZ ................................................................................................................................... III
Chapter 7 WAN Screens................................................................................................................ 7-1
7.1 WAN Overview.................................................................................................................. 7-1
7.2 TCP/IP Priority (Metric)..................................................................................................... 7-1
7.3 Configuring Route .............................................................................................................. 7-1
7.4 Configuring WAN Setup .................................................................................................... 7-2
7.5 Traffic Redirect ................................................................................................................7-10
7.6 Configuring Traffic Redirect ............................................................................................ 7-11
7.7 Configuring Dial Backup.................................................................................................. 7-12
7.8 Advanced Modem Setup .................................................................................................. 7-16
7.9 Configuring Advanced Modem Setup .............................................................................. 7-16
7.10 Dynamic DNS .............................................................................................................. 7-18
7.11 Configuring Dynamic DNS.......................................................................................... 7-18
Chapter 8 DMZ Screens................................................................................................................ 8-1
8.1 DMZ Overview .................................................................................................................. 8-1
8.2 Configuring DMZ............................................................................................................... 8-1
8.3 Configuring IP Alias........................................................................................................... 8-3
8.4 Configuring Port Roles....................................................................................................... 8-5
8.5 DMZ Public IP Address Example ...................................................................................... 8-6
8.6 DMZ Private and Public IP Address Example ................................................................... 8-6
Firewall and Content Filtering .......................................................................................................... IV
Chapter 9 Firewalls........................................................................................................................ 9-1
9.1 Firewall Overview .............................................................................................................. 9-1
9.2 Types of Firewalls ..............................................................................................................9-1
9.3 Introduction to ZyXEL’s Firewall...................................................................................... 9-2
9.4 Denial of Service ................................................................................................................ 9-3
9.5 Stateful Inspection .............................................................................................................. 9-6
9.6 Guidelines for Enhancing Security with Your Firewall ..................................................... 9-9
9.7 Packet Filtering Versus Firewall ........................................................................................ 9-9
Chapter 10 Firewall Screens ....................................................................................................... 10-1
10.1 Access Methods ........................................................................................................... 10-1
10.2 Firewall Policies Overview .......................................................................................... 10-1
10.3 Rule Logic Overview ................................................................................................... 10-2
10.4 Connection Direction Examples................................................................................... 10-3
10.5 Alerts............................................................................................................................ 10-4
10.6 Configuring Firewall .................................................................................................... 10-4
10.7 Example Firewall Rule............................................................................................... 10-11
10.8 Predefined Services .................................................................................................... 10-15
10.9 Anti-Probing............................................................................................................... 10-17
10.10 Configuring Attack Alert ........................................................................................... 10-18
Chapter 11 Content Filtering Screens........................................................................................ 11-1
11.1 Content Filtering Overview.......................................................................................... 11-1
11.2 General Content Filter Configuration .......................................................................... 11-1
11.3 Content Filtering with an External Server.................................................................... 11-4
11.4 Checking Content Filtering Activation ........................................................................ 11-4
11.5 Configuring for Registering and Categories ................................................................ 11-5
11.6 Configuring Customization ........................................................................................ 11-11

ZyWALL 5 Internet Security Appliance
Table of Contents ix
11.7 Customizing Keyword Blocking URL Checking .......................................................11-13
VPN/IPSec ............................................................................................................................................. V
Chapter 12 Introduction to IPSec ...............................................................................................12-1
12.1 VPN Overview..............................................................................................................12-1
12.2 IPSec Architecture ........................................................................................................12-2
12.3 Encapsulation................................................................................................................12-3
12.4 IPSec and NAT .............................................................................................................12-4
Chapter 13 VPN Screens..............................................................................................................13-1
13.1 VPN/IPSec Overview ...................................................................................................13-1
13.2 IPSec Algorithms ..........................................................................................................13-1
13.3 My IP Address ..............................................................................................................13-2
13.4 Secure Gateway Address ..............................................................................................13-2
13.5 Summary Screen ...........................................................................................................13-3
13.6 Keep Alive ....................................................................................................................13-4
13.7 NAT Traversal ..............................................................................................................13-5
13.8 ID Type and Content.....................................................................................................13-6
13.9 Pre-Shared Key .............................................................................................................13-8
13.10 Editing VPN Policies ....................................................................................................13-8
13.11 IKE Phases ..................................................................................................................13-15
13.12 Configuring Advanced VPN Rule ..............................................................................13-16
13.13 Manual Key Setup.......................................................................................................13-19
13.14 Configuring Manual Key ............................................................................................13-19
13.15 Viewing SA Monitor...................................................................................................13-23
13.16 Configuring Global Setting.........................................................................................13-24
13.17 Telecommuter VPN/IPSec Examples .........................................................................13-24
13.18 VPN and Remote Management...................................................................................13-27
Certificates............................................................................................................................................VI
Chapter 14 Certificates ................................................................................................................14-1
14.1 Certificates Overview ...................................................................................................14-1
14.2 Self-signed Certificates.................................................................................................14-2
14.3 Configuration Summary................................................................................................14-2
14.4 My Certificates..............................................................................................................14-2
14.5 Certificate File Formats ................................................................................................14-5
14.6 Importing a Certificate..................................................................................................14-5
14.7 Creating a Certificate ....................................................................................................14-6
14.8 My Certificate Details...................................................................................................14-9
14.9 Trusted CAs ................................................................................................................14-12
14.10 Importing a Trusted CA’s Certificate .........................................................................14-14
14.11 Trusted CA Certificate Details....................................................................................14-15
14.12 Trusted Remote Hosts.................................................................................................14-18
14.13 Verifying a Trusted Remote Host’s Certificate ..........................................................14-20
14.14 Importing a Trusted Remote Host’s Certificate ..........................................................14-21
14.15 Trusted Remote Host Certificate Details ....................................................................14-21
14.16 Directory Servers ........................................................................................................14-24
14.17 Add or Edit a Directory Server ...................................................................................14-25
NAT and Static Route ....................................................................................................................... VII
Chapter 15 Network Address Translation (NAT) .....................................................................15-1
15.1 NAT Overview..............................................................................................................15-1
15.2 Using NAT....................................................................................................................15-4
15.3 SUA Server ...................................................................................................................15-4
15.4 Configuring SUA Server...............................................................................................15-6

ZyWALL 5 Internet Security Appliance
x Table of Content
15.5 Configuring Address Mapping..................................................................................... 15-8
15.6 Configuring Trigger Port............................................................................................ 15-10
Chapter 16 Static Route .............................................................................................................. 16-1
16.1 Static Route Overview ................................................................................................. 16-1
16.2 Configuring IP Static Route ......................................................................................... 16-1
Bandwidth Management, Remote Management and UPnP ........................................................ VIII
Chapter 17 Bandwidth Management ......................................................................................... 17-1
17.1 Bandwidth Management Overview.............................................................................. 17-1
17.2 Bandwidth Classes and Filters ..................................................................................... 17-1
17.3 Proportional Bandwidth Allocation ............................................................................. 17-1
17.4 Bandwidth Management Usage Examples................................................................... 17-2
17.5 Scheduler...................................................................................................................... 17-3
17.6 Maximize Bandwidth Usage ........................................................................................ 17-3
17.7 Bandwidth Borrowing .................................................................................................. 17-5
17.8 Configuring Summary.................................................................................................. 17-6
17.9 Configuring Class Setup .............................................................................................. 17-7
17.10 Configuring Monitor .................................................................................................. 17-11
Chapter 18 Remote Management............................................................................................... 18-1
18.1 Remote Management Overview................................................................................... 18-1
18.2 Introduction to HTTPS................................................................................................. 18-2
18.3 Configuring WWW ...................................................................................................... 18-3
18.4 HTTPS Example .......................................................................................................... 18-4
18.5 SSH Overview............................................................................................................ 18-10
18.6 How SSH works......................................................................................................... 18-10
18.7 SSH Implementation on the ZyWALL ...................................................................... 18-10
18.8 Configuring SSH........................................................................................................ 18-11
18.9 Secure Telnet Using SSH Examples .......................................................................... 18-11
18.10 Secure FTP Using SSH Example............................................................................... 18-13
18.11 Telnet.......................................................................................................................... 18-13
18.12 Configuring TELNET ................................................................................................ 18-14
18.13 Configuring FTP ........................................................................................................ 18-15
18.14 Configuring SNMP .................................................................................................... 18-15
18.15 Configuring DNS ....................................................................................................... 18-18
Chapter 19 UPnP ......................................................................................................................... 19-1
19.1 Universal Plug and Play Overview .............................................................................. 19-1
19.2 UPnP and ZyXEL ........................................................................................................ 19-1
19.3 Configuring UPnP........................................................................................................ 19-2
19.4 Displaying UPnP Port Mapping................................................................................... 19-2
19.5 Installing UPnP in Windows Example......................................................................... 19-4
19.6 Using UPnP in Windows XP Example ........................................................................ 19-5
Logs ...................................................................................................................................................... IX
Chapter 20 Logs Screens ............................................................................................................. 20-1
20.1 Configuring View Log ................................................................................................. 20-1
20.2 Log Description Example............................................................................................. 20-2
20.3 Configuring Log Settings............................................................................................. 20-2
20.4 Configuring Reports..................................................................................................... 20-4
Maintenance ..........................................................................................................................................X
Chapter 21 Maintenance ............................................................................................................. 21-1
21.1 Maintenance Overview ................................................................................................ 21-1
21.2 General Setup ............................................................................................................... 21-1
21.3 Configuring Password .................................................................................................. 21-4