ZyXEL Communications ZyWALL ATP Series User manual

1/782
www.zyxel.com
ZyWALL/USG/ATP /VPN Series
ATP100/ ATP100W/ ATP200/ ATP500/ ATP700 / ATP800
USG20-VPN / USG20W-VPN / USG40 / USG40W /
USG60 / USG60W / USG110 / UGS210 / USG310/
USG1100 /USG1900 / USG2200-VPN
USG FLEX 100/ USG FLEX 200/ USG FLEX 500
VPN50 / VPN100 /VPN300 /VPN1000
Security Firewalls
Edition 5, June/2020
Handbook
Default Login Details
LAN Port IP Address
https://192.168.1.1
User Name
admin
Password
1234

2/782
www.zyxel.com
copyright © 2020 ZyXEL Communications Corporation
Table of Content
How to Configure Site-to-site IPSec VPN with Amazon VPC.................. 20
Set Up the IPSec VPN Tunnel on the Amazon VPC............................ 21
Set Up the IPSec VPN Tunnel on the ZyWALL/USG............................. 25
Test the IPSec VPN Tunnel ..................................................................... 31
What Could Go Wrong?....................................................................... 32
How to Configure Site-to-site IPSec VPN with Microsoft (MS) Azure ..... 33
Set Up the IPSec VPN Tunnel on the ZyWALL/USG............................. 34
Set Up the IPSec VPN Tunnel on the MS Azure................................... 39
Test the IPSec VPN Tunnel ..................................................................... 46
What Could Go Wrong? ...................................................................... 49
How to Configure GRE over IPSec VPN Tunnel........................................ 50
Set Up the ZyWALL/USG GRE over IPSec VPN Tunnel of Corporate
Network (HQ)......................................................................................... 51
Set Up the ZyWALL/USG GRE over IPSec VPN Tunnel of Corporate
Network (Branch) .................................................................................. 56
Test the GRE over IPSec VPN Tunnel .................................................... 60
What Could Go Wrong?....................................................................... 61
How to Configure Site-to-site IPSec VPN Where the Peer has a Static IP
Address ....................................................................................................... 63
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(Branch).................................................................................................. 68
Test the IPSec VPN Tunnel ..................................................................... 72
What Could Go Wrong? ...................................................................... 73
How to Configure Site-to-site IPSec VPN Where the Peer has a Dynamic
IP Address ................................................................................................... 75
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(HQ) ........................................................................................................ 75
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(Branch has a Dynamic IP Address) ................................................... 79
Test the IPSec VPN Tunnel ..................................................................... 83

3/782
www.zyxel.com
What Could Go Wrong? ...................................................................... 85
How to Configure IPSec Site to Site VPN while one Site is behind a NAT
router ........................................................................................................... 87
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(HQ) ........................................................................................................ 87
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(Branch).................................................................................................. 91
Set Up the NAT Router (Using ZyWALL USG device in this example)95
Test the IPSec VPN Tunnel ..................................................................... 97
What Could Go Wrong?....................................................................... 98
How to Configure Hub-and-Spoke IPSec VPN........................................ 99
Set Up the IPSec VPN Tunnel on the ZyWALL/USG by Using VPN
Concentrator Hub_HQ-to-Branch_A ................................................ 100
Hub_HQ-to-Branch_B.......................................................................... 104
Hub_HQ Concentrator ....................................................................... 108
Spoke_Branch_A ................................................................................. 109
Spoke_Branch_B.................................................................................. 114
Test the IPSec VPN Tunnel ................................................................... 119
What Could Go Wrong? .................................................................... 123
Set Up the IPSec VPN Tunnel of ZyWALL/USG without Using VPN
Concentrator Hub_HQ-to-Branch_A ................................................ 125
Hub_HQ-to-Branch_B.......................................................................... 128
Spoke_Branch_A ................................................................................. 131
Spoke_Branch_B.................................................................................. 134
Test the IPSec VPN Tunnel ................................................................... 137
What Could Go Wrong? .................................................................... 140
How to Use Dual-WAN to Perform Fail-Over on VPN Using the VPN
Concentrator ............................................................................................ 142
Set Up the IPSec VPN Tunnel on the ZyWALL/USG Hub_HQ-to-
Branch_A.............................................................................................. 143
Hub_HQ-to-Branch_B.......................................................................... 146
Hub_HQ Concentrator ....................................................................... 149
Spoke_Branch_A ................................................................................. 150
Spoke_Branch_B.................................................................................. 153

4/782
www.zyxel.com
Test the IPSec VPN Tunnel................................................................... 157
What Could Go Wrong? .................................................................... 160
How to Configure IPSec VPN with ZyWALL IPSec VPN Client ............... 161
Set Up the ZyWALL/USG IPSec VPN Tunnel ....................................... 162
Set Up the ZyWALL IPSec VPN Client ................................................. 166
Test the IPSec VPN Tunnel ................................................................... 169
What Can Go Wrong?........................................................................ 171
How to Configure Site-to-site IPSec VPN with FortiGate....................... 173
Set Up the IPSec VPN Tunnel on the ZyWALL/USG........................... 174
Set Up the IPSec VPN Tunnel on the FortiGate................................. 177
Test the IPSec VPN Tunnel ................................................................... 182
What Could Go Wrong? .................................................................... 183
How to Configure Site-to-site IPSec VPN with WatchGuard ................ 185
Set Up the IPSec VPN Tunnel on the ZyWALL/USG........................... 186
Set Up the IPSec VPN Tunnel on the WatchGuard.......................... 189
Test the IPSec VPN Tunnel ................................................................... 195
What Could Go Wrong? .................................................................... 196
How to Configure Site-to-site IPSec VPN with Cisco............................. 198
Set Up the IPSec VPN Tunnel on the ZyWALL/USG........................... 199
Set Up the IPSec VPN Tunnel on the Cisco ....................................... 204
Test the IPSec VPN Tunnel ................................................................... 209
What Could Go Wrong? .................................................................... 211
How to Configure Site-to-site IPSec VPN with a SonicWALL router ..... 212
Set Up the IPSec VPN Tunnel on the ZyWALL/USG........................... 213
Set Up the IPSec VPN Tunnel on the SonicWALL .............................. 220
Test the IPSec VPN Tunnel ................................................................... 224
What Could Go Wrong? .................................................................... 226
How to Configure IPSec VPN Failover .................................................... 229
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(HQ) ...................................................................................................... 230
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(Branch)................................................................................................ 233
Set up the WAN Trunk (ZyWALL/USG_HQ) ........................................ 238

5/782
www.zyxel.com
Set up the Failover Command Line (ZyWALL/USG HQ).................. 239
Test the IPSec VPN Tunnel ................................................................... 240
What Could Go Wrong? .................................................................... 242
How to Configure L2TP over IPSec VPN while the ZyWALL/USG is behind
a NAT router.............................................................................................. 244
Set Up the L2TP VPN Tunnel on the ZyWALL/USG_HQ...................... 245
Set Up the NAT Router (Using ZyWALL USG device in this example)
............................................................................................................... 249
Test the L2TP over IPSec VPN Tunnel .................................................. 252
What Could Go Wrong?..................................................................... 255
How to Configure L2TP VPN with Android 5.0 Mobile Devices ............ 257
Set Up the L2TP VPN Tunnel on the ZyWALL/USG ............................. 258
Set Up the L2TP VPN Tunnel on the Android Device........................ 262
Test the L2TP over IPSec VPN Tunnel ................................................. 265
What Could Go Wrong? .................................................................... 267
How to Configure L2TP VPN with iOS 8.4 Mobile Devices..................... 269
Set Up the L2TP VPN Tunnel on the ZyWALL/USG ............................. 269
Set Up the L2TP VPN Tunnel on the iOS Device ................................ 275
Test the L2TP over IPSec VPN Tunnel ................................................. 276
What Could Go Wrong? .................................................................... 279
How to Import ZyWALL/USG Certificate for L2TP over IPsec in Windows 10
................................................................................................................... 281
Set Up the L2TP VPN Tunnel on the ZyWALL/USG ............................. 281
Export a Certificate from ZyWALL/USG and Import it to Windows 10
Operating System ............................................................................... 286
Set Up the L2TP VPN Tunnel on the Windows 10............................... 291
Test the L2TP over IPSec VPN Tunnel ................................................. 296
What Could Go Wrong? .................................................................... 298
How to Import ZyWALL/USG Certificate for L2TP over IPsec in IOS mobile
phone........................................................................................................ 300
Set Up the L2TP VPN Tunnel on the ZyWALL/USG ............................. 300
Export a Certificate from ZyWALL/USG and Import it to iOS Mobile
Phone ................................................................................................... 305

6/782
www.zyxel.com
Set Up the L2TP VPN Tunnel on the iOS Mobile Device ................... 305
Test the L2TP over IPSec VPN Tunnel ................................................. 308
What Could Go Wrong? .................................................................... 310
How to Import ZyWALL/USG Certificate for L2TP over IPsec in Android
mobile phone........................................................................................... 311
Set Up the L2TP VPN Tunnel on the ZyWALL/USG ............................. 312
Export a Certificate from ZyWALL/USG and Import it to Android
Mobile Phone ...................................................................................... 316
Set Up the L2TP VPN Tunnel on the Android Mobile Device........... 317
Test the L2TP over IPSec VPN Tunnel ................................................. 320
What Could Go Wrong? .................................................................... 322
How to Configure the L2TP VPN with Apple MAC OS X 10.11 Operating
System....................................................................................................... 324
Set Up the L2TP VPN Tunnel on the ZyWALL/USG ............................. 324
Set Up the L2TP VPN Tunnel on the Apple MAC OS X 10.11 El
Capitan Operating System ................................................................ 329
Test the L2TP over IPSec VPN Tunnel ................................................. 332
What Could Go Wrong? .................................................................... 334
How to configure if I want user can only see SSL VPN Login button in
web portal login page............................................................................. 336
Set Up the DNS Service........................................................................ 337
Set Up the ZyWALL/USG SSL VPN Setting............................................ 337
Set Up the ZyWALL/USG System Setting ............................................. 338
Test the SSL VPN ................................................................................... 339
How to Deploy SSL VPN with Apple Mac OS X 10.10 Operating System
................................................................................................................... 343
Set Up the SSL VPN Tunnel on the ZyWALL/USG ............................... 344
Set Up the SSL VPN Tunnel on the Apple MAC OS X 10.10 Operating
System................................................................................................... 347
Test the SSL VPN Tunnel....................................................................... 351
What Could Go Wrong? .................................................................... 354
How To Configure SSL VPN for Remote Access Mobile Devices ......... 356
Set Up the SSL VPN Tunnel on the ZyWALL/USG ............................... 357

7/782
www.zyxel.com
Test the SSL VPN Tunnel....................................................................... 360
What Could Go Wrong? .................................................................... 362
How to Configure an SSL VPN Tunnel (with SecuExtender version 4.0.0.1)
on the Windows 10 Operating System ................................................... 363
Set up the SSL VPN Tunnel with Windows 10 .................................... 363
What Can Go Wrong? ....................................................................... 367
How to redirect multiple LAN interface traffic to the VPN tunnel ........ 369
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(HQ) ...................................................................................................... 370
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network
(Branch)................................................................................................ 373
Set up the Policy Route (ZyWALL/USG_HQ) ..................................... 377
Set up the Policy Route (ZyWALL/USG_Branch) .............................. 378
Test the IPSec VPN Tunnel ................................................................... 380
What Could Go Wrong? .................................................................... 381
How to Create VTI and Configure VPN Failover with VTI...................... 383
VTI Deployment Flow .......................................................................... 383
Set Up the ZyWALL/USG VTI of Corporate Network (HQ) ............... 384
Set Up the ZyWALL/USG VTI of Corporate Network (Branch) ........ 389
Test the IPSec VPN Tunnel .................................................................. 395
What Can Go Wrong? ....................................................................... 397
How to configure the USG when using a Cloud Based SIP system ..... 399
Set Up the SIP ALG............................................................................... 400
Test result .............................................................................................. 400
What could go wrong? ...................................................................... 401
How to block HTTPS websites by Domain Filter without applying SSL
Inspection ................................................................................................. 401
Set Up the Content Filter on the ZyWALL/USG................................. 402
Set Up the Security Policy on the ZyWALL/USG ............................... 405
Set Up the System Policy on the ZyWALL/USG................................. 405
Test the Result ...................................................................................... 405
How to Configure Content Filter 2.0 with Geo IP Blocking................... 408
Set Up the Address Objet with Geo IP on the ZyWALL/USG........... 409

8/782
www.zyxel.com
Set Up the Security Policy on the ZyWALL/USG ............................... 409
Test the Result ...................................................................................... 410
What Could Go Wrong? .................................................................... 411
How to Configure Content Filter 2.0 with HTTPs Domain Filter .............. 412
Application Scenario.......................................................................... 412
Set Up the Content Filter on the ZyWALL/USG .................................. 413
Set Up the Security Policy on the ZyWALL/USG ............................... 415
Set Up the System Policy on the ZyWALL/USG................................. 416
Test the Result ...................................................................................... 417
What Could Wrong?........................................................................... 417
How to block the client accessing to certain country using Geo IP and
Content Filter ............................................................................................ 418
Check Geo IP License Status on the ZyWALL/USG........................... 419
Set Up the Address Objet with Geo IP on the ZyWALL/USG........... 420
Set Up the Security Policy on the ZyWALL/USG ............................... 421
Test the Result ...................................................................................... 422
How to Restrict Web Portal access from the Internet ........................... 425
Set Up the ZyWALL/USG System Setting ............................................. 425
Test the Web Access ........................................................................... 426
How to Setup and Configure Daily Report............................................. 429
Set Up the ZyWALL/USG Email Daily Report Setting........................... 430
Test the Daily Log Report .................................................................... 431
What Could Go Wrong? .................................................................... 433
How to Setup and Configure Email Logs ............................................... 434
Set Up the ZyWALL/USG Email Logs Setting........................................ 435
Test the Email Log ................................................................................ 436
What Could Go Wrong? .................................................................... 437
How to Setup and send logs to a Syslog Server.................................... 438
Set Up the Syslog Server (Use Papertrail syslog in this example) ....... 438
Set Up the ZyWALL/USG Remote Server Setting ................................ 441
Test the Remote Server ....................................................................... 442
What Could Go Wrong? .................................................................... 443
How to Setup and send logs to a Vantage Reports Server.................. 444

9/782
www.zyxel.com
Set Up the VRPT Server ........................................................................ 445
Set Up the ZyWALL/USG Remote Server Setting ................................ 448
Test the Remote Server ....................................................................... 449
What Could Go Wrong? .................................................................... 449
How to Setup and send logs to the USB storage................................... 450
Set Up the USB System Settings ........................................................... 451
Set Up the USB Log Storage ................................................................ 452
Check the USG Log Files .................................................................... 453
How to Setup IPv6 Interfaces for Pure IPv6 Routing .............................. 454
Setting Up the IPv6 Interface ............................................................. 455
Set up the Prefix Delegation and Router Advertisement ............... 457
Test ........................................................................................................ 461
What Can Go Wrong? ....................................................................... 462
Test ........................................................................................................ 464
How to Perform and Use the Packet Capture Feature on the
ZyWALL/USG ............................................................................................. 464
Set Up the Packet Capture Feature................................................... 465
Check the Capture Files..................................................................... 468
How to Automatically Reboot the ZyWALL/USG by Schedule............. 469
Set Up the Shell Script .......................................................................... 470
Set Up the Schedule Run..................................................................... 471
Check the Reboot Status................................................................... 473
How To Schedule YouTube Access........................................................ 475
Set Up the Schedule on the ZyWALL/USG......................................... 475
Create the Application Objects on the ZyWALL/USG ..................... 476
Set Up SSL Inspection on the ZyWALL/USG........................................ 476
Set Up the Security Policy on the ZyWALL/USG................................. 477
Export Certificate from ZyWALL/USG and Import it to Windows 7
Operation System ............................................................................... 478
Test the Result ...................................................................................... 484
What Could Go Wrong? .................................................................... 484
How to continuously run a ZySH script ................................................... 486
Set Up the Shell Script .......................................................................... 486

10/782
www.zyxel.com
Set Up the Schedule Run..................................................................... 488
Check the Result ................................................................................. 488
How To Register Your Device and Services at myZyXEL.com ............. 489
Account Creation............................................................................... 490
Device Registration............................................................................. 492
Service Registration (In the Case of Standard License) ................. 493
Device Management (In the Case of Registering Bundled Licenses)
............................................................................................................... 494
Refresh Service .................................................................................... 495
What Could Go Wrong? .................................................................... 495
How To Exempt Specific Users From Security Control .......................... 497
Set Up the Security Policy on the ZyWALL/USG for Employees ....... 498
Set Up the Security Policy on the ZyWALL/USG for Executives........ 500
Test the Result ...................................................................................... 502
What Could Go Wrong? .................................................................... 503
How To Detect and Prevent TCP Port Scanning with ADP .................... 504
Set Up the ADP Profile on the ZyWALL/USG ...................................... 505
Test the Result ...................................................................................... 508
What Could Go Wrong? .................................................................... 509
How To Block Facebook ......................................................................... 510
Set Up the Content Filter on the ZyWALL/USG .................................. 511
Set Up the SSL Inspection on the ZyWALL/USG ................................. 511
Set Up the Security Policy on the ZyWALL/USG................................. 513
Export Certificate from ZyWALL/USG and Import it to Windows 7
Operation System ............................................................................... 514
Test the Result ...................................................................................... 519
What Could Go Wrong? .................................................................... 520
How To Exempt Specific Users From a Blocked Website ..................... 521
Set Up the Security Policy on the ZyWALL/USG for Employees ....... 522
Set Up the Security Policy on the ZyWALL/USG for Executives........ 524
Test the Result ...................................................................................... 527
What Could Go Wrong? .................................................................... 528
How To Control Access To Google Drive............................................... 529