ZyXEL Communications VPN Series User manual

1/810
www.zyxel.com
ZyWALL/USG/ATP /VPN Series
ATP200/ ATP500/ ATP800
USG20-VPN / USG20W-VPN / USG40 / USG40W /
USG60 / USG60W / USG110 / UGS210 / USG310/
USG1100 /USG1900 / USG2200-VPN
VPN50 / VPN100 /VPN300 /VPN1000
Security Firewalls
Firmware Version 4.60
Edition 1, 12/2020
Handbook
Default Login Details
LAN Port IP Address
https://192.168.1.1
User Name
admin
Password
1234

2/810
www.zyxel.com
copyright © 2018 ZyXEL Communications Corporation
Table of Content
How to Configure Site-to-site IPSec VPN with Amazon VPC ..................19
Set Up the IPSec VPN Tunnel on the Amazon VPC............................20
Set Up the IPSec VPN Tunnel on the ZyWALL/USG.............................24
Test the IPSec VPN Tunnel ....................................................................30
What Could Go Wrong? ......................................................................31
How to Configure Site-to-site IPSec VPN with Microsoft (MS) Azure......32
Set Up the IPSec VPN Tunnel on the ZyWALL/USG.............................33
Set Up the IPSec VPN Tunnel on the MS Azure...................................38
Test the IPSec VPN Tunnel ....................................................................45
What Could Go Wrong?......................................................................48
How to Configure GRE over IPSec VPN Tunnel.........................................49
Set Up the ZyWALL/USG GRE over IPSec VPN Tunnel of Corporate
Network (HQ) ........................................................................................50
Set Up the ZyWALL/USG GRE over IPSec VPN Tunnel of Corporate
Network (Branch) .................................................................................55
Test the GRE over IPSec VPN Tunnel ....................................................59
What Could Go Wrong? ......................................................................60
How to Configure Site-to-site IPSec VPN Where the Peer has a Static IP
Address........................................................................................................62
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(Branch).................................................................................................67
Test the IPSec VPN Tunnel ....................................................................71
What Could Go Wrong?......................................................................72
How to Configure Site-to-site IPSec VPN Where the Peer has a Dynamic
IP Address....................................................................................................74
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(HQ) .......................................................................................................74
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(Branch has a Dynamic IP Address) ...................................................78
Test the IPSec VPN Tunnel ....................................................................82

3/810
www.zyxel.com
What Could Go Wrong?......................................................................84
How to Configure IPSec Site to Site VPN while one Site is behind a NAT
router............................................................................................................86
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(HQ) .......................................................................................................86
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(Branch).................................................................................................90
Set Up the NAT Router (Using ZyWALL USG device in this example)94
Test the IPSec VPN Tunnel ....................................................................96
What Could Go Wrong? ......................................................................97
How to Configure Hub-and-Spoke IPSec VPN.........................................98
Set Up the IPSec VPN Tunnel on the ZyWALL/USG by Using VPN
Concentrator Hub_HQ-to-Branch_A ..................................................99
Hub_HQ-to-Branch_B .........................................................................103
Hub_HQ Concentrator....................................................................... 107
Spoke_Branch_A ................................................................................108
Spoke_Branch_B .................................................................................113
Test the IPSec VPN Tunnel ..................................................................118
What Could Go Wrong?....................................................................122
Set Up the IPSec VPN Tunnel of ZyWALL/USG without Using VPN
Concentrator Hub_HQ-to-Branch_A ................................................124
Hub_HQ-to-Branch_B .........................................................................127
Spoke_Branch_A ................................................................................130
Spoke_Branch_B .................................................................................133
Test the IPSec VPN Tunnel ..................................................................136
What Could Go Wrong?....................................................................139
How to Use Dual-WAN to Perform Fail-Over on VPN Using the VPN
Concentrator.............................................................................................141
Set Up the IPSec VPN Tunnel on the ZyWALL/USG Hub_HQ-to-
Branch_A.............................................................................................142
Hub_HQ-to-Branch_B .........................................................................145
Hub_HQ Concentrator....................................................................... 148
Spoke_Branch_A ................................................................................149
Spoke_Branch_B .................................................................................152

4/810
www.zyxel.com
Test the IPSec VPN Tunnel ..................................................................156
What Could Go Wrong?....................................................................159
How to Configure IPSec VPN with ZyWALL IPSec VPN Client................160
Set Up the ZyWALL/USG IPSec VPN Tunnel .......................................161
Set Up the ZyWALL IPSec VPN Client.................................................165
Test the IPSec VPN Tunnel ..................................................................168
What Can Go Wrong? .......................................................................170
How to Configure Site-to-site IPSec VPN with FortiGate .......................172
Set Up the IPSec VPN Tunnel on the ZyWALL/USG........................... 173
Set Up the IPSec VPN Tunnel on the FortiGate ................................176
Test the IPSec VPN Tunnel ..................................................................181
What Could Go Wrong?....................................................................182
How to Configure Site-to-site IPSec VPN with WatchGuard .................184
Set Up the IPSec VPN Tunnel on the ZyWALL/USG........................... 185
Set Up the IPSec VPN Tunnel on the WatchGuard..........................188
Test the IPSec VPN Tunnel ..................................................................194
What Could Go Wrong?....................................................................195
How to Configure Site-to-site IPSec VPN with Cisco .............................197
Set Up the IPSec VPN Tunnel on the ZyWALL/USG........................... 198
Set Up the IPSec VPN Tunnel on the Cisco....................................... 203
Test the IPSec VPN Tunnel ..................................................................208
What Could Go Wrong?....................................................................210
How to Configure Site-to-site IPSec VPN with a SonicWALL router ......211
Set Up the IPSec VPN Tunnel on the ZyWALL/USG........................... 212
Set Up the IPSec VPN Tunnel on the SonicWALL..............................219
Test the IPSec VPN Tunnel ..................................................................223
What Could Go Wrong?....................................................................225
How to Configure IPSec VPN Failover.....................................................228
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(HQ) .....................................................................................................229
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(Branch)............................................................................................... 232
Set up the WAN Trunk (ZyWALL/USG_HQ)........................................237

5/810
www.zyxel.com
Set up the Failover Command Line (ZyWALL/USG HQ)..................238
Test the IPSec VPN Tunnel ..................................................................239
What Could Go Wrong?....................................................................241
How to Configure L2TP over IPSec VPN while the ZyWALL/USG is behind
a NAT router...............................................................................................243
Set Up the L2TP VPN Tunnel on the ZyWALL/USG_HQ......................244
Set Up the NAT Router (Using ZyWALL USG device in this example)
..............................................................................................................248
Test the L2TP over IPSec VPN Tunnel ..................................................251
What Could Go Wrong? ....................................................................254
How to Configure L2TP VPN with Android 5.0 Mobile Devices .............256
Set Up the L2TP VPN Tunnel on the ZyWALL/USG .............................257
Set Up the L2TP VPN Tunnel on the Android Device........................ 261
Test the L2TP over IPSec VPN Tunnel.................................................264
What Could Go Wrong?....................................................................266
How to Configure L2TP VPN with iOS 8.4 Mobile Devices .....................268
Set Up the L2TP VPN Tunnel on the ZyWALL/USG .............................268
Set Up the L2TP VPN Tunnel on the iOS Device ................................274
Test the L2TP over IPSec VPN Tunnel.................................................275
What Could Go Wrong?....................................................................278
How to Import ZyWALL/USG Certificate for L2TP over IPsec in Windows 10
....................................................................................................................280
Set Up the L2TP VPN Tunnel on the ZyWALL/USG .............................280
Export a Certificate from ZyWALL/USG and Import it to Windows 10
Operating System...............................................................................285
Set Up the L2TP VPN Tunnel on the Windows 10...............................290
Test the L2TP over IPSec VPN Tunnel.................................................294
What Could Go Wrong?....................................................................296
How to Import ZyWALL/USG Certificate for L2TP over IPsec in IOS mobile
phone.........................................................................................................298
Set Up the L2TP VPN Tunnel on the ZyWALL/USG .............................298
Export a Certificate from ZyWALL/USG and Import it to iOS Mobile
Phone ..................................................................................................303

6/810
www.zyxel.com
Set Up the L2TP VPN Tunnel on the iOS Mobile Device ...................303
Test the L2TP over IPSec VPN Tunnel.................................................306
What Could Go Wrong?....................................................................308
How to Configure 2 factor for VPN connection? ...................................309
Set up the ZyWALL/USG IPSec VPN Tunnel....................................... 310
Set up the ZyWALL IPSec VPN Client ................................................ 315
Set up notification for 2 factor authentication................................ 319
Set up authentication for 2 factor VPN connection.......................320
Test the Result .....................................................................................321
What could went wrong.................................................................... 324
How to Import ZyWALL/USG Certificate for L2TP over IPsec in Android
mobile phone............................................................................................324
Set Up the L2TP VPN Tunnel on the ZyWALL/USG .............................325
Export a Certificate from ZyWALL/USG and Import it to Android
Mobile Phone......................................................................................329
Set Up the L2TP VPN Tunnel on the Android Mobile Device ...........330
Test the L2TP over IPSec VPN Tunnel.................................................334
What Could Go Wrong?....................................................................336
How to Configure the L2TP VPN with Apple MAC OS X 10.11 Operating
System........................................................................................................338
Set Up the L2TP VPN Tunnel on the ZyWALL/USG .............................338
Set Up the L2TP VPN Tunnel on the Apple MAC OS X 10.11 El
Capitan Operating System ...............................................................343
Test the L2TP over IPSec VPN Tunnel.................................................346
What Could Go Wrong?....................................................................348
How to configure if I want user can only see SSL VPN Login button in
web portal login page .............................................................................350
Set Up the DNS Service ....................................................................... 351
Set Up the ZyWALL/USG SSL VPN Setting............................................351
Set Up the ZyWALL/USG System Setting .............................................352
Test the SSL VPN ..................................................................................353
How to Deploy SSL VPN with Apple Mac OS X 10.10 Operating System
....................................................................................................................357

7/810
www.zyxel.com
Set Up the SSL VPN Tunnel on the ZyWALL/USG ............................... 358
Set Up the SSL VPN Tunnel on the Apple MAC OS X 10.10 Operating
System.................................................................................................. 361
Test the SSL VPN Tunnel ......................................................................365
What Could Go Wrong?....................................................................368
How To Configure SSL VPN for Remote Access Mobile Devices..........370
Set Up the SSL VPN Tunnel on the ZyWALL/USG ............................... 371
Test the SSL VPN Tunnel ......................................................................374
What Could Go Wrong?....................................................................376
How to Configure an SSL VPN Tunnel (with SecuExtender version 4.0.0.1)
on the Windows 10 Operating System....................................................377
Set up the SSL VPN Tunnel with Windows 10 ....................................377
What Can Go Wrong?....................................................................... 381
How to redirect multiple LAN interface traffic to the VPN tunnel .........383
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(HQ) .....................................................................................................384
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(Branch)............................................................................................... 387
Set up the Policy Route (ZyWALL/USG_HQ).....................................391
Set up the Policy Route (ZyWALL/USG_Branch) ..............................392
Test the IPSec VPN Tunnel ..................................................................394
What Could Go Wrong?....................................................................395
How to Create VTI and Configure VPN Failover with VTI ......................397
VTI Deployment Flow.......................................................................... 397
Set Up the ZyWALL/USG VTI of Corporate Network (HQ) ............... 398
Set Up the ZyWALL/USG VTI of Corporate Network (Branch) ........403
Test the IPSec VPN Tunnel..................................................................409
What Can Go Wrong?....................................................................... 411
How to configure the USG when using a Cloud Based SIP system ......413
Set Up the SIP ALG ..............................................................................414
Test result ............................................................................................. 414
What could go wrong?......................................................................415

8/810
www.zyxel.com
How to block HTTPS websites by Domain Filter without applying SSL
Inspection..................................................................................................415
Set Up the Content Filter on the ZyWALL/USG................................. 416
Set Up the Security Policy on the ZyWALL/USG ...............................419
Set Up the System Policy on the ZyWALL/USG................................. 419
Test the Result .....................................................................................419
How to Configure Content Filter 2.0 with Geo IP Blocking....................422
Set Up the Address Objet with Geo IP on the ZyWALL/USG........... 423
Set Up the Security Policy on the ZyWALL/USG ...............................423
Test the Result .....................................................................................424
What Could Go Wrong?....................................................................425
How to Configure Content Filter 2.0 with HTTPs Domain Filter...............426
Application Scenario .........................................................................426
Set Up the Content Filter on the ZyWALL/USG..................................427
Set Up the Security Policy on the ZyWALL/USG ...............................429
Set Up the System Policy on the ZyWALL/USG................................. 430
Test the Result .....................................................................................431
What Could Wrong? ..........................................................................431
How to block the client accessing to certain country using Geo IP and
Content Filter .............................................................................................432
Check Geo IP License Status on the ZyWALL/USG...........................433
Set Up the Address Objet with Geo IP on the ZyWALL/USG........... 434
Set Up the Security Policy on the ZyWALL/USG ...............................435
Test the Result .....................................................................................436
How to Restrict Web Portal access from the Internet ............................439
Set Up the ZyWALL/USG System Setting .............................................439
Test the Web Access .......................................................................... 440
How to Setup and Configure Daily Report .............................................443
Set Up the ZyWALL/USG Email Daily Report Setting...........................444
Test the Daily Log Report ................................................................... 445
What Could Go Wrong?....................................................................447
How to Setup and Configure Email Logs ................................................448

9/810
www.zyxel.com
Set Up the ZyWALL/USG Email Logs Setting .......................................449
Test the Email Log ............................................................................... 450
What Could Go Wrong?....................................................................451
How to Setup and send logs to a Syslog Server ....................................452
Set Up the Syslog Server (Use Papertrail syslog in this example) ....... 452
Set Up the ZyWALL/USG Remote Server Setting ................................ 455
Test the Remote Server.......................................................................456
What Could Go Wrong?....................................................................457
How to Setup and send logs to a Vantage Reports Server...................458
Set Up the VRPT Server........................................................................ 459
Set Up the ZyWALL/USG Remote Server Setting ................................ 462
Test the Remote Server.......................................................................463
What Could Go Wrong?....................................................................463
How to Setup and send logs to the USB storage....................................464
Set Up the USB System Settings...........................................................465
Set Up the USB Log Storage................................................................466
Check the USG Log Files....................................................................467
How to Activate a Free Access Hotspot.................................................467
Set up the Free Access Hotspot........................................................ 469
Test the User Agreement and Advertisement Webpage............... 470
What could Go Wrong?.....................................................................472
Set up Enable the Free Time Feature ...............................................472
Test Free Time Feature........................................................................ 478
What Can Go Wrong?....................................................................... 481
How to Setup IPv6 Interfaces for Pure IPv6 Routing ...............................483
Setting Up the IPv6 Interface.............................................................484
Set up the Prefix Delegation and Router Advertisement ...............486
Test .......................................................................................................490
What Can Go Wrong?....................................................................... 491
Test .......................................................................................................493
How to Perform and Use the Packet Capture Feature on the
ZyWALL/USG ..............................................................................................493
Set Up the Packet Capture Feature ..................................................494

10/810
www.zyxel.com
Check the Capture Files ....................................................................497
How to Automatically Reboot the ZyWALL/USG by Schedule .............498
Set Up the Shell Script.......................................................................... 499
Set Up the Schedule Run .................................................................... 500
Check the Reboot Status ..................................................................502
How To Schedule YouTube Access.........................................................504
Set Up the Schedule on the ZyWALL/USG ........................................504
Create the Application Objects on the ZyWALL/USG ..................... 505
Set Up SSL Inspection on the ZyWALL/USG........................................505
Set Up the Security Policy on the ZyWALL/USG.................................506
Export Certificate from ZyWALL/USG and Import it to Windows 7
Operation System...............................................................................507
Test the Result...................................................................................... 512
What Could Go Wrong?....................................................................512
How to continuously run a ZySH script....................................................514
Set Up the Shell Script.......................................................................... 514
Set Up the Schedule Run .................................................................... 516
Check the Result ................................................................................ 516
How To Register Your Device and Services at myZyXEL.com ..............517
Account Creation ..............................................................................518
Device Registration ............................................................................ 520
Service Registration (In the Case of Standard License) .................521
Device Management (In the Case of Registering Bundled Licenses)
..............................................................................................................522
Refresh Service....................................................................................523
What Could Go Wrong?....................................................................523
How To Exempt Specific Users From Security Control ...........................525
Set Up the Security Policy on the ZyWALL/USG for Employees .......526
Set Up the Security Policy on the ZyWALL/USG for Executives........528
Test the Result...................................................................................... 530
What Could Go Wrong?....................................................................531
How To Detect and Prevent TCP Port Scanning with ADP .....................532
Set Up the ADP Profile on the ZyWALL/USG ......................................533