ZyXEL Communications VPN Series Manuel utilisateur

1/810

www.zyxel.com

ZyWALL/USG/ATP /VPN Series

ATP200/ ATP500/ ATP800

USG20-VPN / USG20W-VPN / USG40 / USG40W /

USG60 / USG60W / USG110 / UGS210 / USG310/

USG1100 /USG1900 / USG2200-VPN

VPN50 / VPN100 /VPN300 /VPN1000

Security Firewalls

Firmware Version 4.60

Edition 1, 12/2020

Handbook

Default Login Details

LAN Port IP Address

https://192.168.1.1

User Name

admin

Password

1234

 
 
 
2/810 
 
 
 
www.zyxel.com 
copyright © 2018 ZyXEL Communications Corporation 
Table of Content 
How to Configure Site-to-site IPSec VPN with Amazon VPC ..................19 
Set Up the IPSec VPN Tunnel on the Amazon VPC............................20 
Set Up the IPSec VPN Tunnel on the ZyWALL/USG.............................24 
Test the IPSec VPN Tunnel ....................................................................30 
What Could Go Wrong? ......................................................................31 
How to Configure Site-to-site IPSec VPN with Microsoft (MS) Azure......32 
Set Up the IPSec VPN Tunnel on the ZyWALL/USG.............................33 
Set Up the IPSec VPN Tunnel on the MS Azure...................................38 
Test the IPSec VPN Tunnel ....................................................................45 
What Could Go Wrong?......................................................................48 
How to Configure GRE over IPSec VPN Tunnel.........................................49 
Set Up the ZyWALL/USG GRE over IPSec VPN Tunnel of Corporate 
Network (HQ) ........................................................................................50 
Set Up the ZyWALL/USG GRE over IPSec VPN Tunnel of Corporate 
Network (Branch) .................................................................................55 
Test the GRE over IPSec VPN Tunnel ....................................................59 
What Could Go Wrong? ......................................................................60 
How to Configure Site-to-site IPSec VPN Where the Peer has a Static IP 
Address........................................................................................................62 
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network 
(Branch).................................................................................................67 
Test the IPSec VPN Tunnel ....................................................................71 
What Could Go Wrong?......................................................................72 
How to Configure Site-to-site IPSec VPN Where the Peer has a Dynamic 
IP Address....................................................................................................74 
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network 
(HQ) .......................................................................................................74 
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network 
(Branch has a Dynamic IP Address) ...................................................78 
Test the IPSec VPN Tunnel ....................................................................82 

 
 
 
3/810 
 
 
 
www.zyxel.com 
What Could Go Wrong?......................................................................84 
How to Configure IPSec Site to Site VPN while one Site is behind a NAT 
router............................................................................................................86 
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network 
(HQ) .......................................................................................................86 
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network 
(Branch).................................................................................................90 
Set Up the NAT Router (Using ZyWALL USG device in this example)94 
Test the IPSec VPN Tunnel ....................................................................96 
What Could Go Wrong? ......................................................................97 
How to Configure Hub-and-Spoke IPSec VPN.........................................98 
Set Up the IPSec VPN Tunnel on the ZyWALL/USG by Using VPN 
Concentrator Hub_HQ-to-Branch_A ..................................................99 
Hub_HQ-to-Branch_B .........................................................................103 
Hub_HQ Concentrator....................................................................... 107 
Spoke_Branch_A ................................................................................108 
Spoke_Branch_B .................................................................................113 
Test the IPSec VPN Tunnel ..................................................................118 
What Could Go Wrong?....................................................................122 
Set Up the IPSec VPN Tunnel of ZyWALL/USG without Using VPN 
Concentrator Hub_HQ-to-Branch_A ................................................124 
Hub_HQ-to-Branch_B .........................................................................127 
Spoke_Branch_A ................................................................................130 
Spoke_Branch_B .................................................................................133 
Test the IPSec VPN Tunnel ..................................................................136 
What Could Go Wrong?....................................................................139 
How to Use Dual-WAN to Perform Fail-Over on VPN Using the VPN 
Concentrator.............................................................................................141 
Set Up the IPSec VPN Tunnel on the ZyWALL/USG Hub_HQ-to-
Branch_A.............................................................................................142 
Hub_HQ-to-Branch_B .........................................................................145 
Hub_HQ Concentrator....................................................................... 148 
Spoke_Branch_A ................................................................................149 
Spoke_Branch_B .................................................................................152 

 
 
 
4/810 
 
 
 
www.zyxel.com 
Test the IPSec VPN Tunnel ..................................................................156 
What Could Go Wrong?....................................................................159 
How to Configure IPSec VPN with ZyWALL IPSec VPN Client................160 
Set Up the ZyWALL/USG IPSec VPN Tunnel .......................................161 
Set Up the ZyWALL IPSec VPN Client.................................................165 
Test the IPSec VPN Tunnel ..................................................................168 
What Can Go Wrong? .......................................................................170 
How to Configure Site-to-site IPSec VPN with FortiGate .......................172 
Set Up the IPSec VPN Tunnel on the ZyWALL/USG........................... 173 
Set Up the IPSec VPN Tunnel on the FortiGate ................................176 
Test the IPSec VPN Tunnel ..................................................................181 
What Could Go Wrong?....................................................................182 
How to Configure Site-to-site IPSec VPN with WatchGuard .................184 
Set Up the IPSec VPN Tunnel on the ZyWALL/USG........................... 185 
Set Up the IPSec VPN Tunnel on the WatchGuard..........................188 
Test the IPSec VPN Tunnel ..................................................................194 
What Could Go Wrong?....................................................................195 
How to Configure Site-to-site IPSec VPN with Cisco .............................197 
Set Up the IPSec VPN Tunnel on the ZyWALL/USG........................... 198 
Set Up the IPSec VPN Tunnel on the Cisco....................................... 203 
Test the IPSec VPN Tunnel ..................................................................208 
What Could Go Wrong?....................................................................210 
How to Configure Site-to-site IPSec VPN with a SonicWALL router ......211 
Set Up the IPSec VPN Tunnel on the ZyWALL/USG........................... 212 
Set Up the IPSec VPN Tunnel on the SonicWALL..............................219 
Test the IPSec VPN Tunnel ..................................................................223 
What Could Go Wrong?....................................................................225 
How to Configure IPSec VPN Failover.....................................................228 
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network 
(HQ) .....................................................................................................229 
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network 
(Branch)............................................................................................... 232 
Set up the WAN Trunk (ZyWALL/USG_HQ)........................................237 

 
 
 
5/810 
 
 
 
www.zyxel.com 
Set up the Failover Command Line (ZyWALL/USG HQ)..................238 
Test the IPSec VPN Tunnel ..................................................................239 
What Could Go Wrong?....................................................................241 
How to Configure L2TP over IPSec VPN while the ZyWALL/USG is behind 
a NAT router...............................................................................................243 
Set Up the L2TP VPN Tunnel on the ZyWALL/USG_HQ......................244 
Set Up the NAT Router (Using ZyWALL USG device in this example)
..............................................................................................................248 
Test the L2TP over IPSec VPN Tunnel ..................................................251 
What Could Go Wrong? ....................................................................254 
How to Configure L2TP VPN with Android 5.0 Mobile Devices .............256 
Set Up the L2TP VPN Tunnel on the ZyWALL/USG .............................257 
Set Up the L2TP VPN Tunnel on the Android Device........................ 261 
Test the L2TP over IPSec VPN Tunnel.................................................264 
What Could Go Wrong?....................................................................266 
How to Configure L2TP VPN with iOS 8.4 Mobile Devices .....................268 
Set Up the L2TP VPN Tunnel on the ZyWALL/USG .............................268 
Set Up the L2TP VPN Tunnel on the iOS Device ................................274 
Test the L2TP over IPSec VPN Tunnel.................................................275 
What Could Go Wrong?....................................................................278 
How to Import ZyWALL/USG Certificate for L2TP over IPsec in Windows 10
....................................................................................................................280 
Set Up the L2TP VPN Tunnel on the ZyWALL/USG .............................280 
Export a Certificate from ZyWALL/USG and Import it to Windows 10 
Operating System...............................................................................285 
Set Up the L2TP VPN Tunnel on the Windows 10...............................290 
Test the L2TP over IPSec VPN Tunnel.................................................294 
What Could Go Wrong?....................................................................296 
How to Import ZyWALL/USG Certificate for L2TP over IPsec in IOS mobile 
phone.........................................................................................................298 
Set Up the L2TP VPN Tunnel on the ZyWALL/USG .............................298 
Export a Certificate from ZyWALL/USG and Import it to iOS Mobile 
Phone ..................................................................................................303 

 
 
 
6/810 
 
 
 
www.zyxel.com 
Set Up the L2TP VPN Tunnel on the iOS Mobile Device ...................303 
Test the L2TP over IPSec VPN Tunnel.................................................306 
What Could Go Wrong?....................................................................308 
How to Configure 2 factor for VPN connection? ...................................309 
Set up the ZyWALL/USG IPSec VPN Tunnel....................................... 310 
Set up the ZyWALL IPSec VPN Client ................................................ 315 
Set up notification for 2 factor authentication................................ 319 
Set up authentication for 2 factor VPN connection.......................320 
Test the Result .....................................................................................321 
What could went wrong.................................................................... 324 
How to Import ZyWALL/USG Certificate for L2TP over IPsec in Android 
mobile phone............................................................................................324 
Set Up the L2TP VPN Tunnel on the ZyWALL/USG .............................325 
Export a Certificate from ZyWALL/USG and Import it to Android 
Mobile Phone......................................................................................329 
Set Up the L2TP VPN Tunnel on the Android Mobile Device ...........330 
Test the L2TP over IPSec VPN Tunnel.................................................334 
What Could Go Wrong?....................................................................336 
How to Configure the L2TP VPN with Apple MAC OS X 10.11 Operating 
System........................................................................................................338 
Set Up the L2TP VPN Tunnel on the ZyWALL/USG .............................338 
Set Up the L2TP VPN Tunnel on the Apple MAC OS X 10.11 El 
Capitan Operating System ...............................................................343 
Test the L2TP over IPSec VPN Tunnel.................................................346 
What Could Go Wrong?....................................................................348 
How to configure if I want user can only see SSL VPN Login button in 
web portal login page .............................................................................350 
Set Up the DNS Service ....................................................................... 351 
Set Up the ZyWALL/USG SSL VPN Setting............................................351 
Set Up the ZyWALL/USG System Setting .............................................352 
Test the SSL VPN ..................................................................................353 
How to Deploy SSL VPN with Apple Mac OS X 10.10 Operating System
....................................................................................................................357 

 
 
 
7/810 
 
 
 
www.zyxel.com 
Set Up the SSL VPN Tunnel on the ZyWALL/USG ............................... 358 
Set Up the SSL VPN Tunnel on the Apple MAC OS X 10.10 Operating 
System.................................................................................................. 361 
Test the SSL VPN Tunnel ......................................................................365 
What Could Go Wrong?....................................................................368 
How To Configure SSL VPN for Remote Access Mobile Devices..........370 
Set Up the SSL VPN Tunnel on the ZyWALL/USG ............................... 371 
Test the SSL VPN Tunnel ......................................................................374 
What Could Go Wrong?....................................................................376 
How to Configure an SSL VPN Tunnel (with SecuExtender version 4.0.0.1) 
on the Windows 10 Operating System....................................................377 
Set up the SSL VPN Tunnel with Windows 10 ....................................377 
What Can Go Wrong?....................................................................... 381 
How to redirect multiple LAN interface traffic to the VPN tunnel .........383 
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network 
(HQ) .....................................................................................................384 
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network 
(Branch)............................................................................................... 387 
Set up the Policy Route (ZyWALL/USG_HQ).....................................391 
Set up the Policy Route (ZyWALL/USG_Branch) ..............................392 
Test the IPSec VPN Tunnel ..................................................................394 
What Could Go Wrong?....................................................................395 
How to Create VTI and Configure VPN Failover with VTI ......................397 
VTI Deployment Flow.......................................................................... 397 
Set Up the ZyWALL/USG VTI of Corporate Network (HQ) ............... 398 
Set Up the ZyWALL/USG VTI of Corporate Network (Branch) ........403 
Test the IPSec VPN Tunnel..................................................................409 
What Can Go Wrong?....................................................................... 411 
How to configure the USG when using a Cloud Based SIP system ......413 
Set Up the SIP ALG ..............................................................................414 
Test result ............................................................................................. 414 
What could go wrong?......................................................................415 

 
 
 
8/810 
 
 
 
www.zyxel.com 
How to block HTTPS websites by Domain Filter without applying SSL 
Inspection..................................................................................................415 
Set Up the Content Filter on the ZyWALL/USG................................. 416 
Set Up the Security Policy on the ZyWALL/USG ...............................419 
Set Up the System Policy on the ZyWALL/USG................................. 419 
Test the Result .....................................................................................419 
How to Configure Content Filter 2.0 with Geo IP Blocking....................422 
Set Up the Address Objet with Geo IP on the ZyWALL/USG........... 423 
Set Up the Security Policy on the ZyWALL/USG ...............................423 
Test the Result .....................................................................................424 
What Could Go Wrong?....................................................................425 
How to Configure Content Filter 2.0 with HTTPs Domain Filter...............426 
Application Scenario .........................................................................426 
Set Up the Content Filter on the ZyWALL/USG..................................427 
Set Up the Security Policy on the ZyWALL/USG ...............................429 
Set Up the System Policy on the ZyWALL/USG................................. 430 
Test the Result .....................................................................................431 
What Could Wrong? ..........................................................................431 
How to block the client accessing to certain country using Geo IP and 
Content Filter .............................................................................................432 
Check Geo IP License Status on the ZyWALL/USG...........................433 
Set Up the Address Objet with Geo IP on the ZyWALL/USG........... 434 
Set Up the Security Policy on the ZyWALL/USG ...............................435 
Test the Result .....................................................................................436 
How to Restrict Web Portal access from the Internet ............................439 
Set Up the ZyWALL/USG System Setting .............................................439 
Test the Web Access .......................................................................... 440 
How to Setup and Configure Daily Report .............................................443 
Set Up the ZyWALL/USG Email Daily Report Setting...........................444 
Test the Daily Log Report ................................................................... 445 
What Could Go Wrong?....................................................................447 
How to Setup and Configure Email Logs ................................................448 

 
 
 
9/810 
 
 
 
www.zyxel.com 
Set Up the ZyWALL/USG Email Logs Setting .......................................449 
Test the Email Log ............................................................................... 450 
What Could Go Wrong?....................................................................451 
How to Setup and send logs to a Syslog Server ....................................452 
Set Up the Syslog Server (Use Papertrail syslog in this example) ....... 452 
Set Up the ZyWALL/USG Remote Server Setting ................................ 455 
Test the Remote Server.......................................................................456 
What Could Go Wrong?....................................................................457 
How to Setup and send logs to a Vantage Reports Server...................458 
Set Up the VRPT Server........................................................................ 459 
Set Up the ZyWALL/USG Remote Server Setting ................................ 462 
Test the Remote Server.......................................................................463 
What Could Go Wrong?....................................................................463 
How to Setup and send logs to the USB storage....................................464 
Set Up the USB System Settings...........................................................465 
Set Up the USB Log Storage................................................................466 
Check the USG Log Files....................................................................467 
How to Activate a Free Access Hotspot.................................................467 
Set up the Free Access Hotspot........................................................ 469 
Test the User Agreement and Advertisement Webpage............... 470 
What could Go Wrong?.....................................................................472 
Set up Enable the Free Time Feature ...............................................472 
Test Free Time Feature........................................................................ 478 
What Can Go Wrong?....................................................................... 481 
How to Setup IPv6 Interfaces for Pure IPv6 Routing ...............................483 
Setting Up the IPv6 Interface.............................................................484 
Set up the Prefix Delegation and Router Advertisement ...............486 
Test .......................................................................................................490 
What Can Go Wrong?....................................................................... 491 
Test .......................................................................................................493 
How to Perform and Use the Packet Capture Feature on the 
ZyWALL/USG ..............................................................................................493 
Set Up the Packet Capture Feature ..................................................494 

 
 
 
10/810 
 
 
 
www.zyxel.com 
Check the Capture Files ....................................................................497 
How to Automatically Reboot the ZyWALL/USG by Schedule .............498 
Set Up the Shell Script.......................................................................... 499 
Set Up the Schedule Run .................................................................... 500 
Check the Reboot Status ..................................................................502 
How To Schedule YouTube Access.........................................................504 
Set Up the Schedule on the ZyWALL/USG ........................................504 
Create the Application Objects on the ZyWALL/USG ..................... 505 
Set Up SSL Inspection on the ZyWALL/USG........................................505 
Set Up the Security Policy on the ZyWALL/USG.................................506 
Export Certificate from ZyWALL/USG and Import it to Windows 7 
Operation System...............................................................................507 
Test the Result...................................................................................... 512 
What Could Go Wrong?....................................................................512 
How to continuously run a ZySH script....................................................514 
Set Up the Shell Script.......................................................................... 514 
Set Up the Schedule Run .................................................................... 516 
Check the Result ................................................................................ 516 
How To Register Your Device and Services at myZyXEL.com ..............517 
Account Creation ..............................................................................518 
Device Registration ............................................................................ 520 
Service Registration (In the Case of Standard License) .................521 
Device Management (In the Case of Registering Bundled Licenses)
..............................................................................................................522 
Refresh Service....................................................................................523 
What Could Go Wrong?....................................................................523 
How To Exempt Specific Users From Security Control ...........................525 
Set Up the Security Policy on the ZyWALL/USG for Employees .......526 
Set Up the Security Policy on the ZyWALL/USG for Executives........528 
Test the Result...................................................................................... 530 
What Could Go Wrong?....................................................................531 
How To Detect and Prevent TCP Port Scanning with ADP .....................532 
Set Up the ADP Profile on the ZyWALL/USG ......................................533 

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels ZyXEL Communications Matériel réseau

ZyXEL Communications

ZyXEL Communications VMG4005-B50B Manuel utilisateur

ZyXEL Communications

ZyXEL Communications RS-1612 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications PM7516 Series Manuel utilisateur

ZyXEL Communications

ZyXEL Communications IES-6000 Series Manuel utilisateur

ZyXEL Communications

ZyXEL Communications PM7516-R0 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications WAP6405 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications VMG4005-B60A Manuel utilisateur

ZyXEL Communications

ZyXEL Communications NSA-2401 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications Network Storage Appliance NSA-220 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications Network Storage Appliance NSA-220 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications NSA325 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications NSA-220 Series Manuel utilisateur

ZyXEL Communications

ZyXEL Communications VES1724-56 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications PLA450 Series Manuel utilisateur

ZyXEL Communications

ZyXEL Communications P-660HW-D1 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications ZYAIR Manuel utilisateur

ZyXEL Communications

ZyXEL Communications P-2802HWL-I - V3.70 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications G-4100 v2 Manuel de l'opérateur

ZyXEL Communications

ZyXEL Communications WAP6405 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications ZyWall Manuel utilisateur

ZyXEL Communications

ZyXEL Communications NSA-220 Plus Manuel utilisateur

ZyXEL Communications

ZyXEL Communications EOC350 Series Manuel utilisateur

ZyXEL Communications

ZyXEL Communications PoE12 Series Manuel utilisateur

ZyXEL Communications

ZyXEL Communications NSA-2400 Manuel utilisateur

Manuels Matériel réseau populaires d'autres marques

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Manuel utilisateur

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Manuel utilisateur

Yudor

Yudor YDS-16 Manuel utilisateur

D-Link

D-Link ShareCenter DNS-320L Manuel utilisateur

Samsung

Samsung ES1642dc Instructions d'utilisation

Honeywell Home

Honeywell Home LTEM-PV Instructions de montage

evertz

evertz 7700 Series Manuel utilisateur

D-Link

D-Link ShareCenter DNS-343 Manuel utilisateur

Asante

Asante AsanteBridge 1012 Manuel utilisateur

FireBrick

FireBrick FB2700 Manuel utilisateur

Audiovox Electronics

Audiovox Electronics ARWH2T Manuel utilisateur

ADC

ADC DSX-1 Manuel

NetComm

NetComm NF2 Manuel utilisateur

Alcatel-Lucent

Alcatel-Lucent 5620 Manuel utilisateur

Dell EMC

Dell EMC XC6420 Series Manuel utilisateur

Lanner

Lanner NCA-1020A Manuel utilisateur

Allied Telesis

Allied Telesis AT-TN121-A Manuel utilisateur

Arista

Arista CCA-ETM-Q12 Manuel utilisateur