ZyXEL Communications ZYWALL 2 WG User manual

ZyWALL 2WG
Internet Security Appliance
Quick Start Guide
Version 4.02
Edition 1
1/2007
Copyright © 2007. All rights reserved.
Table of Contents
ENGLISH 1
DEUTSCH 17
ESPAÑOL 33
FRANÇAIS 49
ITALIANO 65
РУССКИЙ 81
SVENSKA 99
简体中文 115
繁體中文 131

ENGLISH
1
Overview
The ZyWALL 2WG is a firewall with VPN, bandwidth management, content filtering and many other features.
You can use it as a transparent firewall and not reconfigure your network nor configure the ZyWALL’s routing
features. When the ZyWALL is in router mode, you can also insert a 3G wireless card to add a second WAN.
The ZyWALL increases network security by adding the option to change port roles from LAN to DMZ for use
with publicly accessible servers. This guide covers the initial connections and configuration needed to start
using the ZyWALL in your network.
See the User’s Guide for more information on all features.
You may need your Internet access information.
This guide is divided into the following sections.
1 Hardware Connections
You need the following.
1Hardware Connections
2Accessing the Web Configurator
3Bridge Mode
4Internet Access Setup and Product Registration
5DMZ
6NAT
7Firewall
8VPN Rule Setup
9Troubleshooting
ZyWALL Computer Ethernet Cables Power Adaptor
ENGLISH

ENGLISH
2
Do the following to make hardware connections for initial setup.
1Use an Ethernet cable to connect the LAN/DMZ port to a computer. If you configure these ports as DMZ
ports in the LAN or DMZ screen through the web configurator, you can also use Ethernet cables to connect
public servers (web, e-mail, FTP, etc.) to the LAN/DMZ ports.
2Use another Ethernet cable to connect the WAN port to an Ethernet jack with Internet access.
"Use the blue console cable if you want to connect the CONSOLE port to your computer. Use
the black dial backup cable if you want to connect the AUX port to an analog modem.
3Insert a 3G wireless card into the card slot on the side panel to access the Internet wirelessly via a 3G
network. At the time of writing, you can only use the Sierra AC850/860 3G wireless card in the ZyWALL.
4Use the included power adaptor to connect the power socket (on the rear panel) to a power outlet.
5Look at the front panel. The PWR LED turns on. The CARD, LAN/DMZ and WAN LEDs turn on and stay
on if the corresponding connections are properly made.

ENGLISH
3
VIf none of the LEDs are on, check your connections, and inspect your cables for damage.
Make sure that you have the power adaptor connected to the ZyWALL and plugged in to an
appropriate power source. Make sure the power source is turned on. If the LEDs are still off,
contact your local vendor.
2 Accessing the Web Configurator
Use this section to configure the WAN 1 interface for Internet access.
VIf the login screen does not display, check your browser’s security settings and make sure
your computer’s Ethernet card is installed and functioning properly.
Your computer should be also set to get an IP address automatically from a DHCP server.
See Set Up Your Computer’s IP Address for more information.
1Launch your web browser. Enter 192.168.1.1 (the
ZyWALL’s default IP address) as the address.
2Click Login (the default password 1234 is already
entered).

ENGLISH
4
VIf you changed the password and have forgotten it, you need to return the ZyWALL to the
defaults (password is 1234, LAN IP address is 192.168.1.1, etc.). Press the RESET button
(on the rear panel) until the PWR LED starts to blink, then release it.
5The HOME screen opens.
The ZyWALL is in router mode by default. Continue to the next step if you want to use routing features
such as NAT, DHCP and VPN.
Go to section 3if you prefer to use the ZyWALL as a transparent firewall.
6Check the network status table. If the WAN 1 status is not Down and there is an IP address, go to section
5.
If the WAN 1 status is Down (or there is not an IP address), click the Wizard icon and use section 4to
configure WAN 1.
3Change the login password by entering a new
password and clicking Apply.
4Click Apply to replace the ZyWALL’s default
digital certificate.

ENGLISH
5
Use the NETWORK WAN screens if you need to configure WAN 2. You can also configure load balancing
between the WAN connections.
3 Bridge Mode
When you set the ZyWALL to bridge mode, it functions as a transparent firewall. Do the following to set the
ZyWALL to bridge mode.
4 Internet Access Setup and Product Registration
1Click the Wizard icon ( ) in the HOME screen and then the Internet Access Setup link to open the
Internet access wizard.
1Click MAINTENANCE in the navigation
panel and then Device Mode.
2Select Bridge and configure a (static)
IP address subnet mask and gateway
IP address for the ZyWALL’s LAN,
WAN, DMZ and WLAN interfaces.
3Click Apply. The ZyWALL restarts.
Skip to section 5if you have servers that
you need to be accessible from the WAN.

ENGLISH
6
Enter the Internet access information exactly as given to you.
If you were given an IP address to use, select Static in the IP Address Assignment drop-down list box and
enter the information provided.
"The fields vary depending on what you select in the Encapsulation field. Fill them in with the
information provided by the ISP or network administrator.
Click Apply when you are done.
•PPP over Ethernet or PPTP Encapsulation
Select Nailed-Up when you want your connection up all the time (this could be expensive if your ISP bills you
for Internet usage time instead of a flat monthly fee).
•Ethernet Encapsulation
Configure a Roadrunner service in the
NETWORK WAN screens (use the WAN
tab).

ENGLISH
7
To not have the connection up all the time, specify an idle time-out period (in seconds) in Idle Timeout.
2Click Next to display the screen where you can
register your ZyWALL with myZyXEL.com
(ZyXEL’s online services center) and activate the
free content filtering trial application. Otherwise,
click Skip and then Close to complete Internet
access setup.
3If you already have an account at
myZyXEL.com, select Existing myZyXEL.com
account and enter account information.
Otherwise, select New myZyXEL.com account
and fill in the fields below to create a new
account and register your ZyWALL. Click Next.

ENGLISH
8
4Wait for the registration progress to finish.
5The following screen displays if the registration
was not successful. Click Return to go back to
the Device Registration screen and check your
settings.
6Click Close to leave the wizard screen when
the registration and activation are done.
"If you want to activate a standard service with your iCard’s PIN number (license key), use the
REGISTRATION Service screen. See the User’s Guide for details.
VIf you cannot access the Internet via WAN 1, check the ZyWALL’s connection to the Ethernet
jack with Internet access. Make sure the Internet gateway device (such as a DSL modem) is
working properly. Click WAN in the navigation panel to verify your settings.

ENGLISH
9
5 DMZ
The DeMilitarized Zone (DMZ) allows public servers (web, e-mail, FTP, etc.) to be visible to the outside world
and still have firewall protection from DoS (Denial of Service) attacks.
You can assign TCP/IP configuration via DHCP to computers connected to the DMZ ports. Otherwise,
configure the computers with static IP addresses (in the same subnet as the DMZ port's IP address) and DNS
server addresses. Use the ZyWALL's DMZ IP address as the default gateway.
Do the following to configure the DMZ if the ZyWALL is in routing mode.
Note: You do not need to configure DMZ with bridge mode, skip to section 7.
1Click NETWORK > DMZ in the navigation panel.
2Specify an IP address and subnet mask for the
DMZ interface.
If you use private IP addresses on the DMZ, use
NAT to make the servers publicly accessible (see
section 6).
A public IP address must be on a separate subnet
from the WAN port’s public IP address. If you do
not configure NAT for the public IP addresses on
the DMZ, the ZyWALL routes traffic to the public
IP addresses on the DMZ without performing NAT.
This may be useful for hosting servers for NAT
unfriendly applications.
3Click Apply.
4By default, LAN/DMZ ports 1 to 4 are all LAN
ports. To configure a port as a DMZ port, click the
Port Roles tab, select its radio button next to DMZ
and click Apply.
6 NAT
NAT (Network Address Translation - NAT, RFC 1631) means the translation of an IP address in one network
to a different IP address in another. You can use the NAT Address Mapping screens to have the ZyWALL
translate multiple public IP addresses to multiple private IP addresses on your LAN (or DMZ).
The following example allows access from the WAN1 to an HTTP (web) server on the DMZ. The server has a
private IP address of 10.0.0.20.

ENGLISH
10
1Click ADVANCED, NAT in the
navigation panel and then Port
Forwarding.
2Select the WAN connection (WAN1) for
which you want to configure port
forwarding rules.
3Select the Active check box.
4Type a name for the rule.
5Type the port number that the service
uses.
6Type the HTTP server’s IP address.
7Click Apply.
7 Firewall
You can use the ZyWALL without configuring the firewall.
The ZyWALL’s firewall is pre-configured to protect your LAN from attacks from the Internet. By default, no
traffic can enter your LAN unless a request was generated on the LAN first. The ZyWALL allows access to the
DMZ from the WAN or LAN, but blocks traffic from the DMZ to the LAN.
If you are using the ZyWALL in router mode, continue with the next section. For bridge mode, you are done
with initial configuration.
8 VPN Rule Setup
A VPN (Virtual Private Network)
tunnel gives you a secure
connection to another computer or
network.
A gateway policy identifies the
IPSec routers at either end of a VPN
tunnel.
A network policy specifies which
devices (behind the IPSec routers)
can use the VPN tunnel.

ENGLISH
11
This figure helps explain the main fields in the wizard screens.
1Click the Wizard icon ( ) in the HOME screen and then the VPN Setup link to open the VPN wizard.
"Your settings are not saved when you click Back.
2Use this screen to configure the gateway policy.
Name: Enter a name to identify the gateway policy.
Remote Gateway Address: Enter the IP address or
domain name of the remote IPSec router.

ENGLISH
12
3Use this screen to configure the network policy.
Leave the Active check box selected.
Name: Enter a name to identify the network policy.
Select Single and enter an IP address for a single IP
address.
Select Range IP and enter starting and ending IP
addresses for a specific range of IP addresses.
Select Subnet and enter an IP address and subnet
mask to specify IP addresses on a network by their
subnet mask.
"Make sure that the remote IPSec router uses the same security settings that you configure in
the next two screens.
Negotiation Mode: Select Main Mode for identity protection. Select Aggressive Mode to allow more incoming
connections from dynamic IP addresses to use separate passwords.
"Multiple SAs (security associations) connecting through a secure gateway must have the
same negotiation mode.
Encryption Algorithm: Select 3DES or AES for stronger (and slower) encryption.
Authentication Algorithm: Select MD5 for minimal security or SHA-1 for higher security.
Key Group: Select DH2 for higher security.
SA Life Time: Set how often the ZyWALL renegotiates the IKE SA (minimum 180 seconds). A short SA life
time increases security, but renegotiation temporarily disconnects the VPN tunnel.
Pre-Shared Key: Use 8 to 31 case-sensitive ASCII characters or 16 to 62 hexadecimal ("0-9", "A-F")
characters. Precede a hexadecimal key with a "0x” (zero x), which is not counted as part of the 16 to 62
character range for the key.
Encapsulation Mode: Tunnel is compatible with NAT, Transport is not.
IPSec Protocol: ESP is compatible with NAT, AH is not.
Perfect Forward Secrecy (PFS): None allows faster IPSec setup, but DH1 and DH2 are more secure.

ENGLISH
13
8.1 Using the VPN Connection
Use VPN tunnels to securely send and retrieve files, and allow remote access to corporate networks, web
servers and e-mail. Services work as if you were at the office instead of connected through the Internet.
4Use this screen to configure IKE (Internet Key
Exchange) tunnel settings.
5Use this screen to configure IPSec settings.
6Check your VPN settings. Click Finish to save the
settings.
7Click Close in the final screen to complete the
VPN wizard setup. Continue with the next section
to activate the VPN rule and establish a VPN
connection.

ENGLISH
14
For example, the “test” VPN rule allows
secure access to an web server on a
remote corporate LAN. Enter the server’s
IP address (10.0.0.23 in this example) as
your browser’s URL. The ZyWALL
automatically builds the VPN tunnel when
you attempt to use it.
Click SECURITY > VPN in the navigation
panel and then the SA Monitor tab to
display a list of connected VPN tunnels
(the “test” VPN tunnel is up here).
VIf you cannot establish a VPN connection, make sure the ZyWALL and the remote IPSec
router use the same VPN settings. Click VPN in the navigation panel to configure advanced
settings. Access a web site to check that you have a successful Internet connection.
Set Up Your Computer’s IP Address
This section shows you how to set up your computer to receive an IP address in Windows 2000, Windows NT
and Windows XP. This is ensures that your computer can communicate with your ZyWALL.
1In Windows XP, click Start, Control Panel.
In Windows 2000/NT, click Start, Settings, Control Panel.
2In Windows XP, click Network Connections.
In Windows 2000/NT, click Network and Dial-up Connections.
3Right-click Local Area Connection and then click Properties.
4Select Internet Protocol (TCP/IP) (under the General tab in Windows XP) and click Properties.

ENGLISH
15
5The Internet Protocol TCP/IP Properties screen opens
(the General tab in Windows XP). Select the Obtain an
IP address automatically and Obtain DNS server
address automatically options.
6Click OK to close the Internet Protocol (TCP/IP)
Properties window.
7Click Close (OK in Windows 2000/NT) to close the
Local Area Connection Properties window.
8Close the Network Connections screen.
Procedure to View a Product’s Certification(s)
1Go to www.zyxel.com.
2Select your product from the drop-down list box on the ZyXEL home page to go to that product's page.
3Select the certification you wish to view from this page.

ENGLISH
16

DEUTSCH
17
Übersicht
Die ZyWALL 2WG ist eine Firewall mit VPN, Bandbreitenmanagement, Content Filtering und vielen anderen
Funktionen. Sie können sie als transparente Firewall verwenden, ohne das Netzwerk neu zu konfigurieren
und die Routingfunktionen des Geräts zu konfigurieren. Wenn sich der ZyWALL im Router-Modus befindet,
können Sie auch eine 3G-Wireless-Card einsetzen, um ein zweites WAN hinzuzufügen. Die ZyWALL bietet die
Möglichkeit, bei der Benutzung öffentlich zugänglicher Server die Portfunktionen zu wechseln (LAN zu DMZ)
und erhöht damit die Netzwerksicherheit. In dieser Anleitung finden Sie eine Beschreibung der Anschlüsse
und der Konfiguration, die notwendig ist, damit Sie die ZyWALL in Ihrem Netzwerk verwenden können.
Eine ausführliche Beschreibung aller Funktionen finden Sie im Benutzerhandbuch.
Bitte halten Sie die Daten für Ihren Internetzugang bereit.
Diese Anleitung ist in die folgenden Abschnitte aufgeteilt.
1 Anschließen der Hardware
Sie benötigen folgendes:
1Anschließen der Hardware
2Zugriff auf den Web-Konfigurator
3Bridge Mode
4Einrichten des Internetzugriffs und
Produktregistrierung
5DMZ
6NAT
7Firewall
8Einstellen der VPN-Regeln
9Problembeseitigung
ZyWALL Computer Ethernetkabel Netzteil
DEUTSCH

DEUTSCH
18
Wenn Sie das Gerät installieren, müssen Sie die Hardwaregeräte folgendermaßen anschließen.
1Verbinden Sie den LAN-/DMZ-Port mit einem Ethernet-Kabel mit dem Computer. Wenn Sie diese Ports im
LAN- oder DMZ-Fenster mit dem Web-Konfigurator als DMZ-Ports konfigurieren, können Sie auch mit
Ethernetkabeln eine Verbindung von LAN-/DMZ-Ports zu öffentlichen Servern (Internet, E-Mail, FTP usw.)
herstellen.
2Schließen Sie mit einem anderen Ethernet-Kabel den WAN-Port an die Ethernet-Buchse mit Internetzugriff
an.
"Schließen Sie den Konsolenanschluss CONSOLE mit dem blauen Konsolenkabel an den
Computer an. Schließen Sie den Anwahlsicherungsanschluss AUX mit dem schwarzen
Anwahlsicherungskabel an das Analogmodem an.
3Wenn Sie das Internet über UMTS erreichen wollen, setzen Sie Ihre 3G Karte in den seitlichen Kartenslot
ein. Zum Zeitpunkt der Drucklegung können Sie im ZyWALL nur die 3G-Wireless-Card Sierra AC850/860
verwenden.
4Schließen Sie das mitgelieferte Netzteil an der Rückseite der ZyWALL an.

DEUTSCH
19
5Kontrollieren Sie den Systemstart mittels der LEDs an der Frontseite. Die PWR-LED beginnt zu leuchten. Die
LEDs CARD, LAN/DMZ und WAN beginnen zu leuchten und bleiben an, wenn die entsprechenden
Verbindungen richtig hergestellt wurden.
VWenn keine der LEDs leuchtet, prüfen Sie noch einmal, ob alle Kabelverbindungen richtig
gesteckt wurden und ob die Kabel unbeschädigt sind. Stellen Sie sicher, dass der
Netzadapter richtig an das ZyWALL-Gerät und an eine Netzsteckdose angeschlossen wurde.
Stellen Sie sicher, dass das Gerät eingeschaltet ist. Wenn die LEDs immer noch nicht
leuchten, wenden Sie sich an Ihren Fachhändler
2 Zugriff auf den Web-Konfigurator
In diesem Abschnitt wird beschrieben, wie die WAN 1-Schnittstelle für den Internetzugriff konfiguriert wird.
1Starten Sie Ihren Internetbrowser. Geben Sie als
Adresse 192.168.1.1 (die Standard IP-Adresse der
ZyWALL) ein.
2Klicken Sie auf Login (Einloggen) (das
Standardpasswort 1234 ist bereits vorgegeben).