ZyXEL Communications ZyWall Installation instructions

ZyWALL Series
Support Note
V1
2013
4/1/2013

Scenario 1 - Restricting Bandwidth Management
Priority for Traffic
1.1 Application Scenario
In an enterprise network, there are various types of traffic. However, most company's
Internet bandwidth is limited. All traffic will contend for it and may result in some
important traffic, for example. Therefore, intelligent bandwidth management for
improved productivity becomes a matter of high concern for network administrators. A
ZyWALL provides Bandwidth Management (BWM) function to effectively manage
bandwidth according to different flexible criteria. Here is the example to limit FTP traffic
by BWM.

1.2 Configuration Guide
Network conditions:
- WAN download bandwidth: 2M
- WAN upload bandwidth: 1M
Goals to achieve:
Restrict FTP download/upload bandwidth to 1000/500 kbps and set priority of FTP
traffic to 4 for all users.
ZyWALL configuration:
Step 1: Configuration > BWM > check “Enable BWM”
Step 2: Configuration > BWM > Select the “Add”
(1) Select the “WAN trunk interface”in incoming and outgoing interface
(2) And service object select the “FTP”.
(3) Limit the inbound 1000Kbps and Outbound 500Kbps and the all of the
priority is 4.

Scenario 2 - Assign IPv6 to your LAN to access
remote IPv6 network
2.1 Application Scenario
Nowadays, more and more Internet service providers provide IPv6 environment. With
IPv6 feature enabled on ZyWALL, it can assign an IPv6 to clients under it and pass IPv6
traffic through IPv4 environment to access remote IPv6 network.
2.2 6to4 IP Translate Introduction
Network conditions:
ZyWALL:
WAN1: 59.124.163.155(Static)
Goal to achieve:
A ZyWALL will assign IPv6 IP address to the clients behind it, and the clients can access
remote IPv6 network by using the ZyWALL 6to4 tunnel.

ZyWALL Configuration:
Step 1: Configuration > System > IPv6 > Click Enable IPv6
Step 2: Setting the static IP on WAN1

Step 3: Setting IPv6 IP address on LAN1
(1) Go to Configuration > Interface > Ethernet > double click LAN1 interface in IPv6
configuration.
(2) Convert WAN1 IP address to hexadecimal
Check Enable Stateless Address Auto-configuration (SLAAC) box and enter
2002:3b7c:a39b::/64 in the prefix table.
(3) Check IPv6 Router Advertisement Setting box and add the prefix in the Advertised
Prefix Table.

Step 4: Enable 6 to 4 tunnel.
(1) Go to Configuration > Interface > Tunnel > Click Add button
(2) Select the 6to4 in that Tunnel Mode
(3) Check the Prefix in the 6tp4 tunnel Parameter
(4) Select the WAN1 interface as the gateway in the Gateway Setting
After these configuration steps, connect your computer to the device and check that
your computer received an IPv6 IP address from tunnel.

Scenario 3 –Dialing up L2TP VPN connection to
ZyWALL by using iOS/Android mobile device
3.1 Application Scenario
Smart phone become increasingly popular with consumers. Though it brings us much
more convenience, but also brings security concerns. A ZyWALL is compatible with
iOS/Android mobile devices to establish L2TP VPN connection, provide secure and
private mobile data transferring no matter if your mobile devices is behind NAT. In the
following diagram, outside employees need to visit an internal website in Intranet, they
can just dial up L2TP VPN to ZyWALL and access needed internal resource.

3.2 Configuration Guide
Network conditions:
ZyWALL:
-WAN1 IP: 59.124.163.150
-Local subnet: 192.168.1.0/24
-L2TP pool:192.168.100.0/24
-Intranet website: http://info.zyxel.com
iOS/Android mobile device:
-IP: 116.59.252.188 (3G mobile network)
-IP: 10.59.3.103 (Behind NAT device)
IPSec VPN conditions:
Phase 1:
-Authentication: 12345678
-Local/Peer IP: WAN1/0.0.0.0
-Negotiation: Main mode
-Encryption algorithm: 3DES/3DES/DES
-Authentication algorithm:
SHA1/MD5/SHA1
-Key group: DH1
Phase 2:
-Encapsulation Mode: Transport mode
-Active protocol: ESP
-Encryption algorithm: 3DES/3DES/DES
-Authentication algorithm:
SHA1/MD5/SHA1
-Perfect Forward Secrecy: none
Goals to achieve:
Build up an L2TP over IPSec VPN tunnel for mobile users to access Intranet website.
ZyWALL configuration
Step 1: Click Configuration > VPN > IPSec VPN > VPN Gateway to visit VPN gateway
configuration screen
Step 2: Click the “Add” button to add a VPN gateway rule.

Step 3: Fill in the needed VPN gateway configuration.

Step 4: Click Configuration > VPN > IPSec VPN > VPN Connection to visit the
configuration screen to set phase 2 rule
Step 5: Click the “Add” button to add a VPN connection rule.
Step 6: Fill in the needed VPN connection configuration.

Step 7: Click Configuration > VPN > L2TP VPN to visit L2TP VPN configuration screen
Step 8: Create a address object for L2TP users
Step 9: Fill in the needed L2TP VPN connection configuration.

iOS mobile client configuration
Step 1: Settings > General > Network >
VPN > Add configuration and insert
needed L2TP VPN settings.
Secret is the pre-shared key 12345678.
Step 2: Choose the VPN and turn on
Step 3. Go to Monitor > VPN Monitor > L2TP over IPSec to check the L2TP session.

Android mobile client configuration
Step 1: Settings > Wireless & networks >
VPN
Step 2: Add VPN network

Step 3: Select L2TP/IPSec PSK as the type
and fill in the server address.
Step 4: Fill in the Pre-shared key 12345678
and click “Save”.

Step 5: Click on “ZyWALL”to connect to
the L2TP VPN. Fill in the L2TP password
and click “Connect”.
Step 6: Device will show connected when
dial up successfully
Step 7. Go to Monitor > VPN Monitor > L2TP over IPSec to check the L2TP session.

Scenario 4 –One click Setup VPN connection to
headquarter
4.1 Application Scenario
As an enterprise, employees often have business trip around the world. They might
need to access the resource which inside headquarter during trip and it brings secure
concerns. One of the solutions is to build a IPSec VPN tunnel to reach the purpose, but it
has difficulty for non-technical employees and will increase work loading on network
administrator to help them setup. A ZyWALL provides an EASY VPN solution to
download a VPN configuration file from it and import the configuration file to build up
the VPN connection.
1. Login ZyWALL via IPSec VPN client software for authentication.
2. Retrieve IPSec VPN configuration profile from ZyWALL.
3. Double click profile to build up IPSec VPN tunnel and access internal resource.

4.2 Configuration Guide
Network conditions:
ZyWALL:
-WAN 1 IP: 59.124.163.147
-Local subnet: 192.168.1.0/24
IPSec VPN conditions:
Phase 1:
-Authentication: 12345678
-Local/Peer IP: WAN1/0.0.0.0
-Negotiation: Main mode
-Encryption algorithm: DES
-Authentication algorithm: MD5
-Key group: DH1
Outside user:
-IP: 114.16.87.56
Phase 2:
-Encapsulation Mode: Tunnel mode
-Active protocol: ESP
-Encryption algorithm: DES
-Authentication algorithm: SHA1
-Perfect Forward Secrecy: none