ZyXEL Communications ZyWALL SSL 10 User manual

ZyWALL SSL 10
Integrated SSL-VPN Appliance
Quick Start Guide
Version 1.00
12/2006
Edition 1
Copyright © 2006. All rights reserved.
Table of Contents
ENGLISH 2
DEUTSCH 12
ESPAÑOL 22
FRANÇAIS 32
ITALIANO 42
日本語 52
简体中文 62
SVENSKA 70
РУССКИЙ 80
繁體中文 90

ENGLISH
2
Introduction
The ZyWALL SSL 10 is an SSL VPN gateway that allows you to set up secure remote
network and application access without pre-installing client software. This guide shows you
how to connect and configure the ZyWALL (SSL10) to allow a remote user (A) to access a
web server (WWW) on your local network via an SSL-VPN connection. You may need your
Internet access account information.
Configuration Steps
1System Requirements
2Initial Hardware Connection
3Access the Web Configurator
4Configure Setup Wizard
5Create Web Links for Easy Remote Access
6Test Remote User Connection From the Internet
7Deploy the ZyWALL in Your Network
1 System Requirements
The following lists the browser and computer system requiremens for remote user login.
• Internet Explorer 5.5 with Microsoft XML (MSXML) service pack installed or 6.0 and above
• Netscape 7.2 and above
• Firefox 1.0 and above
• Mozilla 1.7.3 and above
• Windows 2000 Professional, Windows XP Home/Professional (with service pack 2 and
above) or Linux.
• Sun Java Virtual Machine (JVM) installed with a minimum version of 1.4.2_07 for
Netscape/Mozilla/Firefox and 1.4.2_02 for Internet Explorer and Linux computers.
• Java enabled in Internet Explorer on Windows computers.
SSL10
AWWW
https://
Internet
ENGLISH

ENGLISH
3
2 Initial Hardware Connection
1Use an Ethernet cable to connect the WAN port to a broadband modem or gateway.
2Use an Ethernet cable to connect a management computer to a LAN port.
3Use the included power adaptor to connect the POWER 12V port on the rear panel to a
power source.
After you have connected the power and turned on the power source, check the LEDs. The
PWR LED turns on. The SYS LED blinks while performing system testing and stays on
when the testing is successful. The WAN and LAN LEDs turn on when the corresponding
ports are connected.
VIf none of the LEDs turn on when the power is connected, check the port
connections and make sure the power source is turned on.
3 Access the Web Configurator
Follow the steps below to log into the web configurator through a LAN port and configure
the ZyWALL. You must use Internet Explorer 6.0/Netscape 7.0 or later versions.
1Make sure your computer is set to receive an IP address from the ZyWALL.
2Launch your web browser. Enter 192.168.1.1 (the
ZyWALL’s default LAN IP address) as the
address.
123

ENGLISH
4
3If you see a security or warning screen, click OK
or Yes to continue.
4The login screen displays. Enter admin as the
user name and 1234 as the password. For initial
setup, leave the One-Time Password field blank
and click Login.
5If another certificate screen displays, click Yes to
continue.
6This is the first time that you log into the ZyWALL.
The initial main screen displays as shown.
Click Setup Wizard.
4 Setup Wizard
For initial configuration, use the setup wizard screens to do the following.
• Configure the LAN/WAN settings
• Create a remote user account
• Create an SSL-VPN access policy
•RegistertheZyWALL
Follow the steps to configure the wizard screens. Click Next > in each wizard screen to
continue.

ENGLISH
5
1To display the setup wizard, click Setup
Wizard in the initial main screen.
•SelectInstall on Gateway’s DMZ port if you
want to connect the ZyWALL to a gateway in
your network.
•SelectInstall as a New Gateway if you want
to configure the ZyWALL both as a NAT router
and an SSL VPN gateway in your network.
2If you install the ZyWALL behind another
gateway, configure the ZyWALL’s IP settings
in the first first wizard screen.
If you install the ZyWALL as a new gateway,
configure Internet settings in the first wizard
screen.
3Create a new remote user account to allow
a remote user to log into your local network.
Enter a unique user name (up to 31
characters using “0-9”, “a-z” and “A-Z”) and
password (up to 64 characters using “0-9”,
“a-z” and “A-Z”).
"You cannot use the admin account
to access network resources.
4Specify the IP address and subnet mask of a
local network behind the ZyWALL you want to
allow SSL-VPN access.
Specify the range of private IP addresses to
assign to the remote users and the ZyWALL.
This is used for establishing an SSL-VPN
connection and allow the remote users to
access resources as if they are on the local
network.

ENGLISH
6
5Click Next to continue.
6Check the network settings in the next
wizard screen and click Activate SSL-VPN
License.
"You must register your ZyWALL at
myZyXEL.com to allow up to 10
remote users to access at the
same time.
7Follow the on-screen instruction to enter the
myZyXEL.com account information and click
Finished to complete the setup wizard and
start the registration process.
8After the process is complete, click Close.
VIf device registration failed, check that you have entered the account
information correctly and that the ZyWALL can access the Internet.
Now you can log in as a remote user with the user account you have just created. You can
access any resource on the local network (using IP address or domain name). Optionally,
you can create links for the remote user screen to allow one-click access to web-based
applications.
5 Create Web Links for Easy Remote Access
This section shows you how to specify a web-based application and create web links on
the remote user screen.
1Log into the web configurator as an
administrator and click Object > SSL
Application. Click the Add icon.

ENGLISH
7
2Create a Web Application and enter a
descriptive name in the Service Name field.
3In the Address field, enter the address of the
server. For example, http://192.168.1.200.
4Select Web Server in the Server Type field.
5If you use a non-standard port number (for
example, 8080 instead of 80), enter it in the
Virtual Web Port field.
6Click Ok to save the settings.
7Click SSL in the navigation panel and
click the Edit icon to configure the
“default” SSL policy you created using
the setup wizard.
8In the configuration screen that displays, select
the name of the SSL application you have just
created and click Ok to save the settings.
This applies the application setting to the SSL
policy and allows the remote user to access the
server over an SSL-VPN connection.
9Make sure the server is configured properly and
connected to the local network.
6 Test Remote User Connection From the Internet
Follow the steps below to access the local network as a remote user from the Internet. You
must know the WAN IP address of the ZyWALL (get this information in the Status screen).
1Connect your computer to a network outside your company firewall.
2Open your web browser and enter the WAN IP address of the ZyWALL as the URL.
3Click OK or Yes if a security screen displays.

ENGLISH
8
4A login screen displays. Enter the user name and
password of the remote user account you created
using the setup wizard. Click Login.
5After the login is successful, your computer starts
establishing a VPN connection to the ZyWALL.
This may take up to two minutes.
6Download the installation software if you
are prompted to upgrade the JVM, Click
the link to access the Sun Java software
web site. It is recommended you select
the Offline Installation option.
7If a warning screen displays, click
Continue.
8A new network icon displays in the system
tray. This indicates that a VPN connection
has been established between your
computer and the ZyWALL.

ENGLISH
9
9The remote user screen displays. You
can click on a link to access the web
site. Or, if you know the site address,
simply open a new web browser
window and enter the site address to
access.
If you can access the web page, you have
successfully set up your ZyWALL. Refer
to the user’s guide for information on
advanced configuration.
VMake sure that you are using a web browser with settings specified in
System Requirements.
If you are prompted to install or upgrade Java Virtual Machine (JVM), click
the link to access the Sun Java software web site and download the
software using the Offline Installation option.
If you cannot access the remote user screen, check that you have
successfully registered your ZyWALL.
7 Deploy the ZyWALL in Your Network
You can deploy the ZyWALL in one of two ways: behind a gateway or as a new gateway.
7.1 Behind a Gateway
You can connect the ZyWALL to an existing gateway on your network. If the gateway
comes with a DMZ port, connect the ZyWALL to that port for added security. The following
figure shows a network example where the ZyWALL (SSL10) and the web server (WWW)
are connected to the gateway (GW). To access the web server, traffic from the remote user
(A) must go through the VPN tunnel and pass the security checks on the gateway.

ENGLISH
10
"If the ZyWALL is behind a firewall or NAT router, you must configure the
device to allow connection to the ZyWALL on TCP port 443. You can do
this using port forwarding or a firewall rule.
7.2 As a Gateway
If you do not already have a gateway on your network, you can set up the ZyWALL as a
gateway with SSL-VPN access. The following figure shows a network example where the
ZyWALL(SSL10) is connected to a DSL/cable modem for Internet access and the web
server (WWW) is connected to the ZyWALL. To access the web server, traffic from the
remote user (A) is sent through the VPN tunnel. For security, you can configure access
control and end-point control policies on the ZyWALL.
https://
AGW SSL10
WWW
Internet
https://
SSL10
AWWW
Internet
Procedure to View a Product’s Certification(s)
1Go to www.zyxel.com.
2Select your product from the drop-down list box on
the ZyXEL home page to go to that product's page.
3Select the certification you wish to view from this
page.