ZyXEL Communications VANTAGE CNM 2.0 - User manual

Vantage CNM 2.0
Centralized Network Management
User’s Guide
Version 2.0.00.81.10
2.0.00.61.10
July 2004

Vantage CNM 2.0 User’s Guide
Copyright 2
Copyright
Copyright © 2004 by ZyXEL Communications Corporation.
The contents of this publication may not be reproduced in any part or as a whole, transcribed,
stored in a retrieval system, translated into any language, or transmitted in any form or by any
means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or
otherwise, without the prior written permission of ZyXEL Communications Corporation.
Published by ZyXEL Communications Corporation. All rights reserved.
Disclaimer
ZyXEL does not assume any liability arising out of the application or use of any products, or
software described herein. Neither does it convey any license under its patent rights nor the
patent rights of others. ZyXEL further reserves the right to make changes in any products
described herein without notice. This publication is subject to change without notice.
Trademarks
ZyNOS (ZyXEL Network Operating System) is a registered trademark of ZyXEL
Communications, Inc. Other trademarks mentioned in this publication are used for
identification purposes only and may be properties of their respective owners.
Note: Refer also to the “Open Software Announcements” on
page 316.

Vantage CNM 2.0 User’s Guide
3ZyXEL Limited Warranty
ZyXEL Limited Warranty
ZyXEL warrants that (a) the Vantage CNM 2.0 software (henceforth called the SOFTWARE)
will perform substantially in accordance with the accompanying written materials for a period
of ninety (90) days from the date of receipt, and (b) any Support Services provided by ZyXEL
shall be substantially as described in applicable written materials provided to you by ZyXEL,
and ZyXEL support engineers will make commercially reasonable efforts to solve any
problem issues. To the extent allowed by applicable law, implied warranties on the
SOFTWARE, if any, are limited to ninety (90) days.
CUSTOMER REMEDIES.
ZyXEL's and its suppliers' entire liability and your exclusive remedy shall be, at ZyXEL's
option, either (a) return of the price paid, if any, or (b) repair or replacement of the
SOFTWARE that does not meet ZyXEL's Limited Warranty and which is returned to ZyXEL
with a copy of your receipt. This Limited Warranty is void if failure of the SOFTWARE has
resulted from accident, abuse, or misapplication. Any replacement SOFTWARE will be
warranted for the remainder of the original warranty period or thirty (30) days, whichever is
longer. Outside Taiwan, neither these remedies nor any product support services offered by
ZyXEL are available without proof of purchase from an authorized international source.
NO OTHER WARRANTIES.
To the maximum extent permitted by applicable law, ZyXEL and its suppliers disclaim all
other warranties and conditions, either express or implied, including, but not limited to,
implied warranties of merchantability, fitness for a particular purpose, title, and non-
infringement, with regard to the SOFTWARE, and the provision of or failure to provide
Support Services. This limited warranty gives you specific legal rights. You may have others,
which vary from state/jurisdiction to state/jurisdiction.
Please read the license screen in the installation wizard. You must accept the terms of the
license in order to install Vantage CNM.

Vantage CNM 2.0 User’s Guide
Customer Support 4
Customer Support
Please have the following information ready when you contact customer support.
• Product model and serial number.
• Warranty Information.
• Date that you received your device.
• Brief description of the problem and the steps you took to solve it.
METHOD
LOCATION
SUPPORT
E-MAIL TELEPHONEAWEB SITE REGULAR MAIL
WORLDWIDE
[e-mail] [phone] www.zyxel.com
www.europe.zyxel.com ZyXEL Communications Corp. 6 Innovation Road II
Science Park
Hsinchu 300
Taiwan
[e-mail] [phone] ftp.zyxel.com
ftp.europe.zyxel.com
NORTH
AMERICA
[e-mail] [phone]
+1 - 714 - 632-0882
www.us.zyxel.com ZyXEL Communications Inc.
1130 N. Miller St.
Anaheim
CA 92806-2001
U.S.A.
[e-mail] [phone] ftp.us.zyxel.com
GERMANY [e-mail] [phone] www.zyxel.de ZyXEL Deutschland GmbH.
Adenauerstr. 20/A2 D-52146
Wuerselen
Germany
[e-mail] [phone]
FRANCE
[e-mail] [phone] www.zyxel.fr ZyXEL France
1 rue des Vergers
Bat. 1 / C
69760 Limonest
France
[phone]
SPAIN [e-mail] [phone] www.zyxel.es ZyXEL Communications
Alejandro Villegas 33
1º, 28043 Madrid
Spain
[e-mail] [phone]
DENMARK [e-mail] [phone] www.zyxel.dk ZyXELCommunicationsA/S
Columbusvej 5
2860 Soeborg
Denmark
[e-mail] [phone]
NORWAY [e-mail] [phone] www.zyxel.no ZyXELCommunicationsA/S
N il s H an s e n s ve i 1 3 0 6 6 7 O s l o
Norway
[e-mail] [phone]
SWEDEN [e-mail] [phone] www.zyxel.se ZyXEL Communications A/S
Sjöporten 4, 41764 Göteborg
Sweden
[e-mail] [phone]
FINLAND [e-mail] [phone] www.zyxel.fi ZyXEL Communications Oy
Malminkaari 10
00700 Helsinki
Finland
[e-mail] [phone]
a. “+” is the (prefix) number you enter to make an international telephone call.

Vantage CNM 2.0 User’s Guide
Table of Contents 6
Table of Contents
Copyright ..................................................................................................................2
ZyXEL Limited Warranty.......................................................................................... 3
Customer Support.................................................................................................... 4
List of Tables ..........................................................................................................24
Preface ....................................................................................................................28
Introducing Vantage Centralized Network Management (CNM) 2.0 .......................28
Chapter 1
Introducing Vantage...............................................................................................30
1.1 Key Features ......................................................................................................30
1.1.1 Object Tree View ......................................................................................30
1.1.2 Flexible Friendly Device Registration .......................................................30
1.1.3 Building Blocks .........................................................................................30
1.1.4 Multiple Domain Administration ................................................................30
1.1.5 Complete Device Configuration ................................................................30
1.1.6 Configuration Synchronization ..................................................................30
1.1.7 Firewall .....................................................................................................31
1.1.8 One-Click VPN ..........................................................................................31
1.1.9 Configuration File Management ................................................................31
1.1.10 Firmware Upgrade ..................................................................................31
1.1.11 Monitoring and Notifications ....................................................................31
1.1.12 Logs ........................................................................................................31
1.1.13 Data Maintenance ...................................................................................31
1.1.14 Vantage System Management ................................................................31
1.1.15 License Management .............................................................................31
1.2 Vantage Requirements and Installation ..............................................................32
Chapter 2
GUI Introduction.....................................................................................................34
2.1 Overview ............................................................................................................34
2.1.1 Object Pane ..............................................................................................34
2.2 Object Tree View Types .....................................................................................35
2.3 Searches ............................................................................................................35

Vantage CNM 2.0 User’s Guide
7Table of Contents
2.4 Folders ...............................................................................................................35
2.5 Devices ..............................................................................................................38
2.6 Content Pane .....................................................................................................38
2.6.1 Object Path ...............................................................................................38
2.6.2 Menu Path ................................................................................................38
2.7 Menu Overview ..................................................................................................38
2.8 Procedure For Configuring A Device .................................................................39
2.9 Context-Sensitive Menus ...................................................................................40
2.10 Icon Key ...........................................................................................................40
Chapter 3
Device Menus ......................................................................................................... 44
3.1 Device Menus Overview ....................................................................................44
3.1.1 Device Main Screen ..................................................................................44
3.2 Device Status .....................................................................................................46
3.3 Device Registration ............................................................................................46
3.3.1 Manual Option ..........................................................................................48
3.3.1.1 Configuring ZyXEL Device using Commands .................................48
3.3.1.2 Configuring ZyXEL Device using Web Configurator .......................48
3.3.2 Import From an XML Registration File ......................................................49
3.3.2.1 Basic XML Syntax ...........................................................................50
3.3.2.2 Minimum Mandatory Device Settings ..............................................51
3.4 Device – Vantage Data Inconsistency: Synchronize ..........................................52
3.4.1 Vantage – Device Override Criteria ..........................................................53
3.4.1.1 Vantage CNM Override Device .......................................................53
3.4.1.2 Device Override Vantage CNM .......................................................53
3.4.1.3 Synchronizing Device with Vantage ................................................53
3.5 Firmware Management ......................................................................................53
3.5.1 Add Firmware Screen ...............................................................................54
3.5.2 Firmware Upgrade Select Product Line and Mode ...................................55
3.5.3 Firmware Upgrade Process ......................................................................56
3.5.4 Advisory Notes on Firmware Upgrade ......................................................56
3.5.5 Configuration File ......................................................................................56
3.5.6 Configuration File Management ................................................................57
3.5.7 Configuration File Backup .........................................................................57
3.5.8 Configuration File Restore ........................................................................58
Chapter 4
Configuration > Select Device BB & General ...................................................... 60
4.1 Select Device BB ...............................................................................................60
4.1.1 Procedure to Select and Apply a Device BB ............................................62
4.2 Configuration General Screens ..........................................................................62
4.2.1 System ......................................................................................................63

Vantage CNM 2.0 User’s Guide
Table of Contents 8
4.2.2 DDNS ........................................................................................................64
4.2.3 Time Setting ..............................................................................................66
4.2.4 Owner Info ................................................................................................67
Chapter 5
Configuration > LAN ..............................................................................................70
5.1 LAN Overview ....................................................................................................70
5.2 DHCP Setup .......................................................................................................70
5.2.1 IP Pool Setup ............................................................................................70
5.2.2 DNS Servers .............................................................................................70
5.2.3 LAN TCP/IP ..............................................................................................70
5.2.4 Factory LAN Defaults ................................................................................70
5.2.5 IP Address and Subnet Mask ...................................................................71
5.2.6 RIP Setup .................................................................................................71
5.2.7 Multicast ....................................................................................................71
5.3 Configuring LAN IP – ZyWALL ...........................................................................72
5.4 Configuring LAN IP - Prestige ............................................................................75
5.5 Configuring LAN Static DHCP – ZyWALL ..........................................................77
5.6 Configuring LAN IP Alias – ZyWALL ..................................................................78
Chapter 6
Configuration > WLAN........................................................................................... 82
6.1 Wireless LAN Overview .....................................................................................82
6.1.1 Additional Installation Requirements for using 802.1x ..............................82
6.2 Wireless LAN Basics ..........................................................................................82
6.2.1 Channel ....................................................................................................82
6.2.2 ESS ID ......................................................................................................82
6.2.3 RTS/CTS .................................................................................................83
6.2.4 Fragmentation Threshold ..........................................................................84
6.2.5 WEP ..........................................................................................................84
6.3 Configuring Wireless LAN ..................................................................................84
6.3.1 WLAN Wireless .........................................................................................85
6.4 Configuring MAC Filter .......................................................................................86
6.5 802.1x Overview ................................................................................................87
6.5.1 Configuring 802.1x – ZyWALL ..................................................................88
6.5.2 Configuring 802.1x – Prestige ..................................................................88
6.6 Local User Database ..........................................................................................90
6.6.1 Configuring Local User Database .............................................................90
6.6.2 RADIUS ....................................................................................................91
6.6.2.1 Types of RADIUS Messages ...........................................................92
6.6.3 EAP Authentication Overview ...................................................................92
6.7 Configuring RADIUS ..........................................................................................93

Vantage CNM 2.0 User’s Guide
9Table of Contents
Chapter 7
Configuration > DMZ..............................................................................................96
7.1 DMZ Overview ...................................................................................................96
7.2 DMZ Addresses .................................................................................................96
7.3 Configuring DMZ ................................................................................................96
Chapter 8
Configuration > WAN ...........................................................................................100
8.1 General WAN – ZyWALL .................................................................................100
8.1.1 TCP/IP Priority (Metric) ...........................................................................100
8.1.2 WAN ISP – ZyWALL ...............................................................................102
8.1.2.1 Ethernet Encapsulation .................................................................102
8.1.2.2 PPPoE Encapsulation ...................................................................103
8.1.2.3 PPTP Encapsulation .....................................................................105
8.2 WAN IP – ZyWALL ...........................................................................................107
8.3 Dial Backup – ZyWALL ....................................................................................108
8.3.1 Traffic Redirect ........................................................................................109
8.3.2 Configuring Dial Backup - ZyWALL ........................................................109
8.3.3 Advanced Modem Setup – ZyWALL .......................................................112
8.3.3.1 AT Command Strings ....................................................................112
8.3.4 Edit Dial Backup – ZyWALL ....................................................................114
8.4 General WAN – Prestige ..................................................................................116
8.4.1 Traffic Shaping ........................................................................................117
8.4.2 Configuring Prestige WAN Setup ...........................................................117
8.4.3 WAN Backup - Prestige ..........................................................................122
8.4.3.1 Traffic Redirect .............................................................................122
8.4.4 Configuring WAN Backup - Prestige .......................................................122
8.4.5 Configuring Advanced WAN Backup – Prestige .....................................125
8.4.6 Advanced Modem Setup – Prestige .......................................................128
Chapter 9
Configuration > NAT ............................................................................................ 130
9.1 NAT Overview ..................................................................................................130
9.1.1 NAT Definitions .......................................................................................130
9.1.2 What NAT Does ......................................................................................131
9.1.3 How NAT Works .....................................................................................131
9.1.4 NAT Mapping Types ...............................................................................131
9.1.5 SUA (Single User Account) Versus NAT ................................................132
9.2 Configuring NAT ...............................................................................................132
9.2.1 Disable NAT ............................................................................................133
9.3 SUA Servers ....................................................................................................133
9.3.1 Port Forwarding: Services and Port Numbers ........................................134
9.3.2 Configuring SUA Servers – ZyWALL ......................................................134

Vantage CNM 2.0 User’s Guide
Table of Contents 10
9.3.3 Configuring SUA Servers – Prestige ......................................................136
9.3.4 Full Feature Address Mapping ................................................................137
9.3.5 Edit Full Feature Address Mapping ........................................................138
9.4 Trigger Port Forwarding – ZyWALL ..................................................................139
9.4.1 Configuring Trigger Port .........................................................................140
9.4.2 Edit Trigger Port ......................................................................................142
Chapter 10
Configuration > Static Route...............................................................................144
10.1 Static Route Overview ....................................................................................144
10.1.1 Static Route Summary ..........................................................................144
10.1.2 Edit Static Route ...................................................................................145
Chapter 11
Configuration > VPN ............................................................................................ 148
11.1 VPN Overview ................................................................................................148
11.1.1 IPSec ....................................................................................................148
11.1.2 Security Association ..............................................................................148
11.1.3 Encryption .............................................................................................148
11.1.4 Data Confidentiality ...............................................................................148
11.1.5 Data Integrity .........................................................................................148
11.1.6 Data Origin Authentication ....................................................................149
11.1.7 IPSec Algorithms ..................................................................................149
11.1.7.1 AH (Authentication Header) Protocol ..........................................149
11.1.7.2 ESP (Encapsulating Security Payload) Protocol .........................149
11.1.8 Key Management ..................................................................................150
11.1.9 Encapsulation .......................................................................................150
11.1.9.1 Transport Mode ...........................................................................150
11.1.9.2 Tunnel Mode ................................................................................150
11.1.10 IPSec and NAT ...................................................................................151
11.1.11 Keep Alive ...........................................................................................151
11.1.12 NAT Traversal .....................................................................................152
11.1.12.1 NAT Traversal Configuration .....................................................152
11.1.13 ID Type and Content ...........................................................................152
11.1.14 IKE Phases .........................................................................................153
11.1.15 Negotiation Mode ................................................................................154
11.1.16 Diffie-Hellman (DH) Key Groups .........................................................154
11.1.17 Perfect Forward Secrecy (PFS) ..........................................................155
11.1.18 Pre-Shared Key ..................................................................................155
11.2 VPN Tunnel Summary ....................................................................................155
11.2.1 Add a VPN Tunnel ................................................................................156
11.2.2 Manual VPN Tunnel ..............................................................................161
11.3 VPN and NetBIOS ..........................................................................................164

Vantage CNM 2.0 User’s Guide
11 Table of Contents
Chapter 12
Configuration > Firewall......................................................................................166
12.1 Firewall Overview ...........................................................................................166
12.2 Types of Firewalls ..........................................................................................166
12.2.1 Packet Filtering Firewalls ......................................................................166
12.2.2 Application-level Firewalls ....................................................................166
12.2.3 Stateful Inspection Firewalls .................................................................167
12.3 Introduction to ZyXEL’s Firewall .....................................................................167
12.3.1 Denial of Service ...................................................................................168
12.3.2 Basics ...................................................................................................168
12.3.3 Types of DoS Attacks ...........................................................................168
12.4 Stateful Inspection ..........................................................................................170
12.4.1 Stateful Inspection Process ..................................................................171
12.4.2 Stateful Inspection and the ZyXEL device ............................................172
12.4.3 TCP Security .........................................................................................172
12.4.4 UDP/ICMP Security ..............................................................................173
12.4.5 Upper Layer Protocols ..........................................................................173
12.4.6 Firewall Policies Overview ....................................................................173
12.4.7 Rule Checklist .......................................................................................175
12.4.8 Security Ramifications ..........................................................................175
12.4.9 Key Fields For Configuring Rules .........................................................176
12.4.9.1 Action ..........................................................................................176
12.4.9.2 Service ........................................................................................176
12.4.9.3 Source Address ...........................................................................176
12.4.9.4 Destination Address ....................................................................176
12.4.10 Alerts ...................................................................................................176
12.4.11 Services and Port Numbers ................................................................176
12.5 Firewall Configuration Screens ......................................................................177
12.5.1 Firewall Summary Screen .....................................................................177
12.5.1.1 Ordering Rules ............................................................................177
12.5.2 DoS Settings .........................................................................................179
12.5.3 Add/Edit a Firewall Rule .......................................................................181
12.5.4 Add/Edit Source/Destination IP Addresses ..........................................183
12.5.5 Custom Ports ........................................................................................184
Chapter 13
Configuration > Device Log ................................................................................186
13.1 Device Logs ...................................................................................................186
13.2 Device Logging Options .................................................................................187
13.3 Purge Logs .....................................................................................................189