ZyXEL Communications ZyWALL USG 2000 Manuel

ZyWALL USG 2000 Support Notes

ZyWALL USG 2000

Unified Security Gateway

Support Notes

Revision 2.10

Dec, 2008

ZyWALL USG 2000 Support Notes

INDEX

The comparison of ZyNOS and ZLD.............................................................................................8

1. Deploying VPN..........................................................................................................................9

1.1 Extended Intranets..........................................................................................................11

1.1.2 Site to Site VPN solutions (ZyWALL 1050 ÙZyWALL USG 2000):..............11

1.2 Extranet Deployment .....................................................................................................18

1.2.1 Site to site VPN solutions (ZyWALL USG 2000 to ZyWALL70)......................19

1.2.2 Interoperability – VPN with other vendors.........................................................23

1.2.2.1 ZyWALL with FortiGate VPN Tunneling................................................23

1.2.2.2 ZyWALL with NetScreen VPN Tunneling ..............................................30

1.2.2.3 ZyWALL with SonicWall VPN Tunneling...............................................38

1.3 Remote Access VPN ......................................................................................................45

1.3.1 IPSec VPN for RemoteAccess ...........................................................................45

1.3.1.1 Steps to configure.....................................................................................47

1.3.2 SSL VPN Application - Reverse Proxy...............................................................52

1.3.2.1 Scenario topology.....................................................................................52

1.3.2.2 Configuration flow...................................................................................52

1.3.2.3 Configuration procedure ..........................................................................52

1.3.3 SSL VPN Application – Network Extension ......................................................55

1.3.3.1 Scenario topology.....................................................................................55

1.3.3.2 Configuration flow...................................................................................55

1.3.3.3 Configuration procedure ..........................................................................56

1.3.4 L2TP over IPSec Application..............................................................................62

1.3.4.1 Scenario topology.....................................................................................62

1.3.4.2 Configuration flow...................................................................................62

1.3.4.3 Configuration Procedure..........................................................................62

1.4 Large-scale VPN Deployment .......................................................................................73

1.4.1 Fully Meshed Topology ...................................................................................73

1.4.2 Star Topology...................................................................................................74

1.4.3 Star-Mesh Mixed Topology..............................................................................83

1.5 Device HA......................................................................................................................99

1.5.1 Device HA.........................................................................................................101

1.5.1.1 Configuration procedure ........................................................................101

1.5.2 Device High Availability (HA) Active-Passive mode.......................................113

1.5.2.1 Scenario Topology.................................................................................113

ZyWALL USG 2000 Support Notes

1.5.2.2 Configuration Flow................................................................................113

1.5.2.3 Configuration procedure ........................................................................114

1.5.2.4 Steps to configure...................................................................................115

2. Security Policy Enforcement..................................................................................................125

2.1 Managing IM/P2PApplications...................................................................................125

2.1.1 Why bother with managing IM/P2P applications?............................................125

2.1.2 What does ZyWALL USG 2000 provide for managing IM/P2P applications? 126

2.1.3 Configuration Example.....................................................................................126

2.2 Zone-based Anti-Virus Protection................................................................................134

2.2.1 Applying Zone-Based Anti-Virus to ZyWALL USG 2000...............................134

2.2.2 Enabling Black and White List .........................................................................141

2.2.3 Enabling Anti-Virus Statistics Report...............................................................142

2.2.4 Dual AV.............................................................................................................143

2.3 Configuring ZyWALL USG 2000 as a Wireless Router..............................................143

2.3.1 Configuration procedure ...................................................................................143

2.3.2 MAC filter in WLAN........................................................................................145

2.4 Mobility Internet Access..............................................................................................147

2.4.1 Utilize 3G Wireless forAccessing the Internet.................................................148

2.4.1.1 Configuration procedure ........................................................................149

3. Seamless Incorporation..........................................................................................................156

3.1 Transparent Firewall.....................................................................................................156

3.1.1 Bridge mode & Router (NAT) mode co-exist...................................................156

3.1.2 NAT & Virtual Server........................................................................................159

3.2 Zone-based IDP Protection ..........................................................................................162

3.2.1 Applying Zone-Based IDP to ZyWALL USG 2000..........................................163

3.3 Anti-spam on the ZyWALL USG 2000........................................................................169

3.3.1 How Anti-Spam works on ZyWALL USG .......................................................170

3.3.2 Using DNSBL (DNS-based blacklist)...............................................................170

3.3.2.1 Application scenario to apply DNSBL...................................................170

3.3.2.1.1 Scenario I: Email server is located in the ISP/ Internet ......................170

3.3.2.1.2 Scenario II: Company’s Email server located in the DMZ.................173

3.3.3 Using Black/White list (B/W list).....................................................................176

3.3.3.1 Configuration procedure ........................................................................176

3.3.3.2 Scenario topology...................................................................................177

3.3.3.3 Steps to configure B/W list....................................................................177

3.4 Guaranteed Quality of Service.....................................................................................180

3.4.1 Priority & Bandwidth management ..................................................................181

ZyWALL USG 2000 Support Notes

FAQ............................................................................................................................................188

A. Device Management FAQ.............................................................................................188

A01. How can I connect to ZyWALL USG 2000 to perform administrator’s tasks? 188

A02. Why can’t I login into ZyWALL USG 2000? ...................................................188

A03. What’s difference between “Admin Service Control” and “User Service

Control” configuration in GUI menu System > WWW?...........................................189

A04. Why ZyWALL USG 2000 redirects me to the login page when I am

performing the management tasks in GUI? ...............................................................190

A05. Why do I lose my configuration setting after ZyWALL USG 2000 restarts?...190

A06. How can I do if the system is keeping at booting up stage for a long time?.....190

B. Registration FAQ...........................................................................................................192

B01. Why do I need to do the Device Registration?..................................................192

B02. Why do I need to activate services? ..................................................................192

B03. Why can’t I active trial service?........................................................................192

B04. Will the UTM service registration information be reset once restore

configuration in ZyWALL USG 2000 back to manufactory default?........................192

C. File Manager FAQ.........................................................................................................193

C01. How can ZyWALL USG 2000 manage multiple configuration files? ..............193

C02. What are the configuration files like startup-config.conf, system-default.conf

and lastgood.conf?......................................................................................................193

C03. Why can’t I update firmware?...........................................................................193

C04. What is the Shell Scripts for in GUI menu File manager > Shell Scripts?........194

C05. How to write a shell script?...............................................................................194

C06. Why can’t I run shell script successfully?.........................................................194

D. Object FAQ....................................................................................................................195

D01. Why does ZyWALL USG 2000 use object?......................................................195

D02. What’s the difference between Trunk and the Zone Object? ............................196

D03. What is the difference between the default LDAP and the group LDAP? What

is the difference between the default RADIUS and the group RADIUS?.................196

E. Interface FAQ ................................................................................................................197

E01. How to setup the WAN interface with PPPoE or PPTP?...................................197

E02. How to add a virtual interface (IP alias)? ..........................................................197

E03. Why can’t I get IP address via DHCP relay?.....................................................197

E04. Why can’t I get DNS options from ZyWALL’s DHCP server?.........................197

E05. Why does the PPP interface dials successfully even its base interface goes

down?.........................................................................................................................198

F. Routing and NAT FAQ...................................................................................................199

ZyWALL USG 2000 Support Notes

F01. How to add a policy route?................................................................................199

F02. How to configure local loopback in ZyWALL USG 2000?...............................199

F03. How to configure a NAT?..................................................................................203

F04. After I installed a HTTP proxy server and set a http redirect rule, I still can’t

access web. Why? ......................................................................................................204

F05. How to limit some application (for example, FTP) bandwidth usage? .............204

F06. What’s the routing order of policy route, dynamic route, and static route and

direct connect subnet table?.......................................................................................204

F07. Why ZyWALL USG 2000 cannot ping the Internet host, but PC from LAN side

can browse internet WWW? ......................................................................................205

F08. Why can’t I ping to the, Internet, after I shutdown the primary WAN interface?205

F09. Why the virtual server or port trigger does not work?.......................................205

F10. Why port trigger does not work? .......................................................................205

F11. How do I use the traffic redirect feature in ZyWALL USG 2000?....................206

F12. Why can’t ZyWALL learn the route from RIP and/or OSPF?...........................206

G. VPN and Certificate......................................................................................................207

G01. Why can't the VPN connections dial to a remote gateway?..............................207

G02. VPN connections are dialed successfully, but the traffic still cannot go through

the IPsec tunnel..........................................................................................................207

G03. Why ZyWALL USG 2000 VPN tunnel had been configured correctly and the

VPN connection status is connected but the traffic still can not reach the remote

VPN subnet?...............................................................................................................207

G04. VPN connections are dialed successfully, and the policy route is set. But the

traffic is lost or there is no response from remote site...............................................208

G05. Why don’t the Inbound/Outbound traffic NAT in VPN work?.........................208

H. Firewall FAQ.................................................................................................................209

H01. Why doesn’t my LAN to WAN or WAN to LAN rule work?...........................209

H02. Why does the intra-zone blocking malfunction after I disable the firewall? ....209

H03. Can I have access control rules to the device in firewall? ................................209

I. Application Patrol FAQ...................................................................................................210

I01. What is Application Patrol? ................................................................................210

I02. What applications can the Application Patrol function inspect? ........................210

I03. Why does the application patrol fail to drop/reject invalid access for some

applications?...............................................................................................................211

I04. What is the difference between “Auto” and “Service Ports” settings in the

Application Patrol configuration page? .....................................................................212

I05. What is the difference between BWM (bandwidth management) in Policy Route

ZyWALL USG 2000 Support Notes

and App. Patrol ?........................................................................................................213

I06. Do I have to purchase iCards specifically for using AppPatrol feature?............214

I07. Can I configure different access level based on application for different users?214

I08. Can I migrate AppPatrol policy and bandwidth management control from

ZLD1.0x to ZLD2.0x? ...............................................................................................214

J. lDP FAQ .........................................................................................................................215

J01. Why doesn’t the IDP work? Why has the signature updating failed?................215

J02. When I use a web browser to configure the IDP, sometimes it will popup

"wait data timeout".....................................................................................................215

J03. When I want to configure the packet inspection (signatures), the GUI becomes

very slow. ...................................................................................................................215

J04. After I select "Auto Update" for IDP, when will it update the signatures? ........215

J05. If I want to use IDP service, will it is enough if I just complete the registration

and turn on IDP? ........................................................................................................215

J06. What are the major design differences in IDP in ZLD1.0x and latest IDP/ADP

in ZLD2.0x?...............................................................................................................215

J07. Does IDP subscription have anything to do with AppPatrol? ............................216

J08. How to get a detailed description of an IDP signature? .....................................217

J09. After an IDP signature updated, does it require ZyWALL to reboot to make new

signatures take effect?................................................................................................217

K. Content Filtering FAQ...................................................................................................218

K01. Why can’t I enable external web filtering service? Why does the external web

filtering service seem not to be working?..................................................................218

K02. Why can’t I use MSN after I enabled content filter and allowed trusted

websites only?............................................................................................................218

L. Device HA FAQ.............................................................................................................219

L01. What does the “Preempt” mean?.......................................................................219

L02. What is the password in Synchronization?........................................................219

L03. What is “Link Monitor” and how to enable it?..................................................219

L04. Can Link Monitor of Device HA be used in backup VRRP interfaces?............220

L05. Why do both the VRRP interfaces of master ZW USG 2000 and backup ZW

USG 2000 are activated at the same time?.................................................................220

M. User Management FAQ................................................................................................221

M01. What is the difference between user and guest account?..................................221

M02. What is the “re-authentication time” and “lease time”?...................................221

M03. Why can’t I sign in to the device?....................................................................221

M04. Why is the TELNET/SSH/FTP session to the device disconnected? Why is the

ZyWALL USG 2000 Support Notes

GUI redirected to login page after I click a button/link? ...........................................221

M05. What is AAA?...................................................................................................222

M06. What are ldap-users and radius-users used for? ...............................................222

M07. What privileges will be given for ldap-users and radius-users?.......................222

N. Centralized Log FAQ ....................................................................................................224

N01. Why can’t I enable e-mail server in system log settings?.................................224

N02. After I have the entire required field filled, why can’t I receive the log mail?.224

O. Traffic Statistics FAQ....................................................................................................225

O01. When I use "Flush Data" in Report, not all the statistic data are cleared..........225

O02. Why isn't the statistic data of "Report" exact?..................................................225

O03. Does Report collect the traffic from/to ZyWALL itself? ..................................225

O04. Why cannot I see the connections from/to ZyWALL itself?.............................225

P. Anti-Virus FAQ ..............................................................................................................226

P01. Is there any file size or amount of concurrent files limitation with ZyWALL

USG 2000 Anti-Virus engine? ...................................................................................226

P02. Does ZyWALL USG 2000 Anti-Virus support compressed file scanning?.......226

P03. What is the maximum concurrent session of ZyWALL USG 2000 Anti-Virus

engine? .......................................................................................................................226

P04. How many type of viruses can be recognized by the ZyWALL USG 2000? ....226

P05. How frequent the AV signature will be updated? ..............................................226

P06. How to retrieve the virus information in detail?................................................226

P07. I cannot download a file from Internet through ZyWALL USG 2000 because

the Anti-Virus engine considers this file has been infected by the virus; however, I

am very sure this file is not infected because the file is nothing but a plain text file.

How do I resolve this problem?.................................................................................226

P08. Does ZyWALL USG 2000 Anti-Virus engine support Passive FTP?................227

P09. What kinds of protocol are currently supported on ZyWALL USG 2000

Anti-Virus engine? .....................................................................................................227

P10. If the Anti-Virus engine detects a virus, what action it may take? Can it cure the

file?.............................................................................................................................227

ZyWALL USG 2000 Support Notes

The comparison of ZyNOS and ZLD

Since ZyXEL USG 2000 adopt ZLD 2.10 as their network operating system. Additionally,

ZLD 2.10 provides many new features and new design in GUI. Hence, the layout in ZyNOS

might not be the same as the one in ZLD 2.10. Accordingly, we provide a comparison table for

your reference.

Platform

Feature/Term ZyNOS ZLD Chapter in

Support Note

NAT Advanced > NAT >

Address Mapping

Network > Routing >

Policy Route SNAT

Advanced > NAT Port

forwarding

Network > Virtual

Server

3.1.2 NAT &

Virtual Server

Advanced > NAT Port

Trigger

Network > Routing >

Policy Route Port

Triggering

VPN Security> VPN >

Gateway Policy

VPN > IPSec VPN>

VPN Gateway

1.1.2 Site to site

VPN solutions

Security> VPN >

Network Policy

VPN > IPSec VPN>

VPN Connection

1.1.2 Site to site

VPN solutions

Security> VPN >

Gateway Policy &

Network Policy

(Hub & Spoke VPN

network)

VPN > IPSec VPN>

Concentrator

Others Advanced > BW MGMT AppPatrol & Network >

Policy Route

Network >

LAN/DMZ/WLAN> IP

alias

Network > Interface >

LAN/DMZ/VLAN/Brid

ge> Virtual Interface

Wireless > Wi-Fi Network > Interface >

WLAN

Wireless > 3G Network > Interface >

Cellular

2.4 Mobility

Internet Access

Security > Auth Server Object > AAA Server

ZyWALL USG 2000 Support Notes

1. Deploying VPN

VPN (Virtual Private Network) allows you to establish a virtual direct connection to remote

locations or for the telecommuters to access the internal network in the office. VPN is a

replacement for the traditional site-to-site lease lines like T1 or ISDN. Through the VPN

applications, it reduces setup cost, works for various types of Internet connection devices

(ISDN modem, ADSL modem and FTTX…) and is easy to troubleshoot.

VPN gives you site-to-site connection flexibility. However, with multiple VPN connections

between sites, it can become more difficult to maintain. Typically, an administrator has to

configure many site-to-site VPN connections to allow a truly global VPN network.

VPN connection management is made easily using the VPN concentrator. The VPN

concentrator routes VPN traffic across multiple remote sites without complex setting, thus

reduces the configuration overhead and the possibility of improper configuration. The VPN

concentrator is also a centralized management tool for administrators because all the traffic

sent between remote sites has to go through the central office first and administrators can set

up different access control rules. These are based on the source address, remote address, user

and schedule to enhance VPN security. To help to reduce network intrusion attacks,

administrators can configure the built-in IDP engine to inspect VPN traffic. For easy

troubles

network

The VP

setting

possibili

For SM

people fi



ooting and

status for f

concentr

p a globa

ies.

customer,

rewall whe

enefit

ll contents c

monitorin

rther easy

tor enhanc

VPN net

ZyXEL pr

e all of th

rom deplo

pyright (c) 2

, the VPN

troublesho

s the VP

ork with

vides a tot

se devices

ment of Z

08 ZyXEL

concentrat

ting and a

routing a

less effort

l VPN sol

ave the V

XEL VPN

WALL

ommunicati

r logs and

alysis.

ility and h

but stron

tion from

N connect

solutions

SG 200

ns Corporati

stores syst

lps networ

er securit

personal

on ability.

Suppor

m informa

administ

and man

lient to a 5

Notes

ion and

ators in

gement

Autres manuels pour ZyWALL USG 2000

Table des matières

Autres manuels ZyXEL Communications Porte

ZyXEL Communications

ZyXEL Communications Prestige 792H Manuel utilisateur

ZyXEL Communications

ZyXEL Communications Prestige 662H Series Manuel utilisateur

ZyXEL Communications

ZyXEL Communications ISG50 Instructions d'installation et d'utilisation

ZyXEL Communications

ZyXEL Communications P-870HW-51A V2 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications C4000LZ Manuel utilisateur

ZyXEL Communications

ZyXEL Communications Internet Security Gateway ZyWALL 100 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications ZYWALL USG CLI Manuel utilisateur

ZyXEL Communications

ZyXEL Communications NSG50 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications P-660HW-DX V2 - V3.40 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications ZyWALL 70 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications PMG5622GA Manuel utilisateur

ZyXEL Communications

ZyXEL Communications P-793H 601156 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications P-660H-T1 v3s Manuel utilisateur

ZyXEL Communications

ZyXEL Communications P-661HNU-FX Manuel

ZyXEL Communications

ZyXEL Communications P-2302R-P1 Series Manuel

ZyXEL Communications

ZyXEL Communications P-661HNU Series Manuel utilisateur

ZyXEL Communications

ZyXEL Communications ZyWALL USG 100 Series Manuel

ZyXEL Communications

ZyXEL Communications AMG1202-T series Manuel utilisateur

ZyXEL Communications

ZyXEL Communications P-793H 601156 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications VMG1312-B Series Manuel utilisateur

ZyXEL Communications

ZyXEL Communications UAG2100 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications P-660HWP-D1 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications VMG3625-T50B Manuel utilisateur

ZyXEL Communications

ZyXEL Communications VSG-1200 Manuel utilisateur

Manuels Porte populaires d'autres marques

LST

LST M500RFE-AS Manuel utilisateur

Kinnex

Kinnex Media Gateway Manuel utilisateur

2N Telekomunikace

2N Telekomunikace 2N StarGate Manuel utilisateur

Mitsubishi Heavy Industries

Mitsubishi Heavy Industries Superlink SC-WBGW256 Manuel utilisateur

Telsey

Telsey CPVA 500 - SIP Manuel utilisateur

RTA

RTA 460A-NNA4 Fiche technique

Shaw

Shaw Gateway HDPVR Manuel utilisateur

ABB

ABB VSN900 Guide de démarrage rapide

Commander

Commander Pulse Manuel utilisateur

2N Telekomunikace

2N Telekomunikace ATEUS EasyGate 501309E Manuel utilisateur

NETGEAR

NETGEAR C6300BD Manuel utilisateur

Amit

Amit CDW531AM Manuel utilisateur

HMS

HMS Netbiter EasyConnect EC150 Manuel utilisateur

Huawei

Huawei EchoLife HG620 Manuel utilisateur

AT&T

AT&T U-verse 3801 Manuel d'utilisation et d'entretien

Logic IO

Logic IO RTCU MX2 turbo Manuel utilisateur

Suttle

Suttle MediaMAX MXM-521 Manuel utilisateur

RTA

RTA 460MCBC-N2E Fiche technique