ZyXEL Communications ZyWALL VPN2S User manual

1/63
www.zyxel.com
VPN2S
VPN2S
VPN
Firmware V1.12(ABLN.0)b9
Edition 1, 5/2018
Handbook
Default Login Details
LAN Port IP Address
https://192.168.1.1
User Name
admin
Password
1234
Copyright © 2018 ZyXEL Communications Corporation

2/63
www.zyxel.com
Table of Content
How to Setup VPN2S connect with Android Mobile via L2TP tunnel ........4
Set Up the PPPoE Connection On VPN2S Series................................... 5
Set Up the L2TP VPN Tunnel on VPN2S.................................................... 6
Configure the L2TP VPN Tunnel on Android Mobile (Version 5.0.2) ... 8
Test the L2TP over IPSec VPN Tunnel ...................................................... 9
What Could Go Wrong? ........................................................................ 10
How to configure site to site VPN ..............................................................11
Configuration the LAN IP on HQ Site.................................................... 12
Setup the VPN configuration on HQ Site............................................. 14
Configuration the LAN IP on Branch Site............................................. 16
Setup the VPN configuration on Branch Site...................................... 18
Test IPSec VPN on VPN2S Series ............................................................ 20
How to configure VPN with PC -Server Role.............................................21
Set Up the IPSec VPN Tunnel on the VPN2S......................................... 21
Setup the Zywall IPsec VPN client......................................................... 24
Test VPN2S as Server Role ...................................................................... 27
How to setup scheduled rule via firewall on VPN2S................................29
Setup the schedule rule on the VPN2S ................................................ 30
Test scheduled rule via firewall on VPN2S ........................................... 32
How to Configure Interface Group Bridge / Bundle WAN Interface (Triple
play).............................................................................................................32
Set Up the Interface Group Bridge / Bundle WAN Interface Group
on the VPN2S. ........................................................................................... 33
How to configure Multi-WAN .....................................................................36
Set Up the Multi-WAN on the VPN2S. .................................................... 37
Check the Multi-WAN status ................................................................... 37
How to Configure NAT Port Forwarding ....................................................38
Set Up the Port Forwarding on the VPN2S........................................... 39
Test the Port Forwarding ......................................................................... 40
How to Configure NAT Port Triggering.......................................................42
Set Up the Port Triggering on the VPN2S.............................................. 43

3/63
www.zyxel.com
How to Enable NAT ALG .............................................................................44
Enable the ALG on the VPN2S .............................................................. 44
How to Configure NAT Default Server .......................................................45
Set Up the Default Server on the VPN2S .............................................. 46
Test the Default Server ............................................................................ 47
How to Configure NAT Address Mapping ................................................48
Set Up the VPN2S Address Mapping (One-to-One) .......................... 49
Set Up the VPN2S Address Mapping (Many-to-Many) ..................... 50
Set Up the VPN2S Address Mapping (Many-to-one)......................... 51
How to setup policy route to force VPN2S clients following rules..........52
Set Up the policy route to force VPN2S clients following rules......... 53
How to Configure Content Filter by Category .........................................55
Set up the Content Filter by Category ................................................ 55
Test the Content Filter ............................................................................. 57
How to Configure bypass website by Content Filter white list................58
Set up the Content Filter by Category ................................................ 58
Set up the Content Filter white list ........................................................ 60
Test bypass website by Content Filter white list ................................... 60
How to Configure bypass website by Content Filter black list...............60
Set up the Content Filter by black list .................................................. 61
Set up the Content Filter black list........................................................ 62
Test block website by Content Filter black list ..................................... 62

4/63
www.zyxel.com
How to Setup VPN2S connect with Android Mobile via L2TP
tunnel
This is an example of using the L2TP VPN and VPN client software
included in Android mobile phone operating systems. When the VPN
tunnel is configured, users can securely access the network and allow
traffic from L2TP clients to go to the Internet from an Android mobile
phone.
Figure VPN2S connect with Mobile through L2TP VPN Tunnel
Note:
All network IP addresses and subnet masks are used as examples in this article.
Please replace them with your actual network IP addresses and subnet masks.

5/63
www.zyxel.com
Set Up the PPPoE Connection On VPN2S Series
Go to Configuration> Wan/Internet> WAN Setup> WAN1> Edit, change the
Encapsulation from default IPoE to PPPoE and fill the username/password on PPP
information.

6/63
www.zyxel.com
Set Up the L2TP VPN Tunnel on VPN2S
Go to Configuration> VPN> IPsec VPN > Default_L2TP_VPN_GW and
Default_L2TP_VPN_Connection > Edit, enable both of rule and fill the pre-share key on
Default_L2TP_VPN_GW.
Figure Configuration> VPN> IPsec VPN > Default_L2TP_VPN_GW

7/63
www.zyxel.com
Figure Configuration> VPN> IPsec VPN > Default_L2TP_VPN_Connection

8/63
www.zyxel.com
Move to L2TP VPN, Enable this feature, and select Server type.
Fill the IP Address which will be assigned to l2tp client on IP Address Pool.
Figure Configuration> VPN> L2TP VPN
Configure the L2TP VPN Tunnel on Android Mobile (Version
5.0.2)
Go to Setting> Wireless & Networks > VPN> Add VPN Profile, and fill the name of profile.
Select L2TP/IPSec PSK on Type field, enter Server address and pre-shared key.

9/63
www.zyxel.com
Test the L2TP over IPSec VPN Tunnel
Type the username and password, and click CONNECT
The L2TP VPN session connected

10/63
www.zyxel.com
What Could Go Wrong?
Make sure your Pre-shared key on VPN2S and Mobile are the same

11/63
www.zyxel.com
How to configure site to site VPN
The multinational corporations have many sites at each country, so if
they want to communicate from HQ to branch under security, the client
to Site VPN is the option they needed.
This scenario uses two units of VPN2S to create an IPSec VPN
connection.
Moreover, both USGs get their public IPs via PPPoE .
HQ WAN IP: 61.231.53.228, LAN IP: 192.168.2.1
Branch WAN IP: 36.226.203.74 LAN IP: 192.168.3.1
Note:
All network IP addresses and subnet masks are used as examples in this article.
Please replace them with your actual network IP addresses and subnet masks.
This example was tested using VPN2S.

12/63
www.zyxel.com
Configuration the LAN IP on HQ Site
Go to Configuration > LAN/ Home network > VLAN/ Interface Group >
Add
Create the Lan Subnet: 192.168.2.X/24, first go to VLAN to separate the
LAN2, and then change the subnet to 192.168.2.X/24

13/63
www.zyxel.com
Go to Configuration > LAN Setup >Edit

14/63
www.zyxel.com
Setup the VPN configuration on HQ Site
Go to Configuration > VPN > IPSec VPN > Add the profile on Gateway
configuration and Connection configuration
For the VPN gateway, please enter the VPN gateway name, select the
Interface (for public IP), enter the peer’s domain in the Primary field,
and enter the Pre-Shared Key.

15/63
www.zyxel.com
For the VPN connection (Phase 2):
1. Enter the Connection Name, select Site-to-site as the Application
Scenario, and select the name of the phase 1 profile (Branch) in the
VPN Gateway field.
2. For Local policy, choose the subnet that your PC is connected to.

16/63
www.zyxel.com
Configuration the LAN IP on Branch Site
Go to Configuration > LAN/ Home network > VLAN/ Interface Group >
Add
Create the Lan Subnet: 192.168.3.X/24, first go to VLAN to separate the
LAN2, and then change the subnet to 192.168.3.X/24

17/63
www.zyxel.com
Go to Configuration > LAN Setup >Edit

18/63
www.zyxel.com
Setup the VPN configuration on Branch Site
Go to Configuration > VPN > IPSec VPN > Add the profile on Gateway
configuration and Connection configuration
For the VPN gateway, please enter the VPN gateway name, select the
Interface (for public IP), enter the peer’s domain in the Primary field,
and enter the Pre-Shared Key.

19/63
www.zyxel.com
For the VPN connection (Phase 2):
3. Enter the Connection Name, select Site-to-site as the Application
Scenario, and select the name of the phase 1 profile (Branch) in the
VPN Gateway field.
4. For Local policy, choose the subnet that your PC is connected to.

20/63
www.zyxel.com
Test IPSec VPN on VPN2S Series
Click the connect button, and the Icon will change from Gray to light