Zyxel USG Flex 200 User Manual

Displayed below is the user manual for USG Flex 200 by Zyxel which is a product in the Hardware Firewalls category. This manual has pages.

Related Manuals

Zyxel USG Flex 200 Manual

Zyxel USG FLEX 100W Manual

Zyxel USG FLEX 700 Manual

Zyxel USG-20 Manual

Default Login Details

User’s Guide

ZyWALL USG FLEX

Series

LAN Port IP Address https://192.168.1.1

User Name admin

Password 1234

Version 4.55 Edition 1, 6/2020

ZyWALL USG FLEX Series User’s Guide

IMPORTANT!

READ CAREFULLY BEFORE USE.

KEEP THIS GUIDE FOR FUTURE REFERENCE.

This is a User’s Guide for a series of products. Not all products support all firmware features. Screenshots

and graphics in this book may differ slightly from your product due to differences in product features or

web configurator brand style. Every effort has been made to ensure that the information in this manual

is accurate.

Note: The version number on the cover page refers to the Zyxel Device’s latest firmware

version to which this User’s Guide applies.

Related Documentation

•Quick Start Guide

The Quick Start Guide shows how to connect the Zyxel Device and access the Web Configurator

wizards. (See the wizard real time help for information on configuring each screen.) It also contains a

connection diagram and package contents list.

•CLI Reference Guide

The CLI Reference Guide explains how to use the Command-Line Interface (CLI) to configure the

Zyxel Device.

Note: It is recommended you use the Web Configurator to configure the Zyxel Device.

• Web Configurator Online Help

Click the help icon in any screen for help in configuring that screen and supplementary information.

•More Information

Go to support.zyxel.com to find other information on Zyxel Device.

ZyWALL USG FLEX Series User’s Guide

Document Conventions

Warnings and Notes

These are how warnings and notes are shown in this guide.

Warnings tell you about things that could harm you or your device.

Note: Notes tell you other important information (for example, other things you may need to

configure or helpful tips) or recommendations.

Syntax Conventions

• All models in this series may be referred to as the “Zyxel Device” in this guide.

• Product labels, screen names, field labels and field choices are all in bold font.

• A right angle bracket ( > ) within a screen name denotes a mouse click. For example, Configuration >

Network > Interface > Ethernet means you first click Configuration in the navigation panel, then

Network, then the Interface sub menu and finally the Ethernet tab to get to that screen.

Icons Used in Figures

Figures in this user guide may use the following generic icons. The Zyxel Device icon is not an exact

representation of your device.

Zyxel Device Generic Router Wireless Router / Access Point

Switch Firewall Server

Internet Network Cloud Smartphone

USB Dongle

Contents Overview

ZyWALL USG FLEX Series User’s Guide

Contents Overview

Introduction ........................................................................................................................................... 26

Initial Setup Wizard ............................................................................................................................... 49

Hardware, Interfaces and Zones ........................................................................................................ 68

Quick Setup Wizards ............................................................................................................................. 76

Dashboard .......................................................................................................................................... 110

Monitor ................................................................................................................................................. 121

Licensing .............................................................................................................................................. 188

Wireless ................................................................................................................................................. 193

Interfaces ............................................................................................................................................. 216

Routing ................................................................................................................................................. 313

DDNS ................................................................................................................................................... 340

NAT ....................................................................................................................................................... 346

Redirect Service .................................................................................................................................. 354

ALG ....................................................................................................................................................... 360

UPnP ..................................................................................................................................................... 367

IP/MAC Binding ................................................................................................................................... 382

Layer 2 Isolation .................................................................................................................................. 387

DNS Inbound LB .................................................................................................................................. 391

IPSec VPN ............................................................................................................................................ 397

SSL VPN ................................................................................................................................................ 433

L2TP VPN .............................................................................................................................................. 439

BWM (Bandwidth Management) ..................................................................................................445

Web Authentication .......................................................................................................................... 461

Hotspot ................................................................................................................................................ 493

Printer Manager .................................................................................................................................. 511

Free Time ............................................................................................................................................. 523

IPnP ....................................................................................................................................................... 528

Walled Garden ................................................................................................................................... 531

Advertisement Screen ....................................................................................................................... 537

Security Policy ..................................................................................................................................... 540

Application Patrol ............................................................................................................................... 566

Content Filter ....................................................................................................................................... 575

Anti-Malware ....................................................................................................................................... 600

Reputation Filter .................................................................................................................................. 614

IDP ........................................................................................................................................................ 618

Email Security ...................................................................................................................................... 636

SSL Inspection ...................................................................................................................................... 647

IP Exception ......................................................................................................................................... 659

Object .................................................................................................................................................. 662

Contents Overview

ZyWALL USG FLEX Series User’s Guide

Device HA ........................................................................................................................................... 765

Cloud CNM ........................................................................................................................................ 772

System .................................................................................................................................................. 780

Log and Report ................................................................................................................................... 841

File Manager ....................................................................................................................................... 854

Diagnostics ......................................................................................................................................... 869

Packet Flow Explore ........................................................................................................................... 888

Shutdown ............................................................................................................................................. 895

Troubleshooting .................................................................................................................................. 897

Table of Contents

ZyWALL USG FLEX Series User’s Guide

Table of Contents

Document Conventions ... .... .................. .... .... ... .... .................. .... .... ... ................... .... ... .... .... ...............3

Contents Overview .............................................................................................................................4

Table of Contents.................................................................................................................................6

Part I: User’s Guide..........................................................................................25

Chapter 1

Introduction ........................................................................................................................................26

1.1 Overview ......................................................................................................................................... 26

1.1.1 Model Feature Differences .................................................................................................. 26

1.2 Registration at myZyxel .................................................................................................................. 27

1.2.1 Grace Period ......................................................................................................................... 27

1.2.2 Applications ........................................................................................................................... 27

1.3 Management Overview ................................................................................................................ 30

1.4 Web Configurator ........................................................................................................................... 31

1.4.1 Web Configurator Access .................................................................................................... 32

1.4.2 Web Configurator Screens Overview ................................................................................. 34

1.4.3 Navigation Panel .................................................................................................................. 38

1.4.4 Tables and Lists ...................................................................................................................... 46

Chapter 2

Initial Setup Wizard.............................................................................................................................49

2.1 Initial Setup Wizard Screens .......................................................................................................... 49

2.1.1 Internet Access Setup - WAN Interface ............................................................................. 49

2.1.2 Internet Access: Ethernet .................................................................................................... 50

2.1.3 Internet Access: PPPoE ......................................................................................................... 51

2.1.4 Internet Access: PPTP ........................................................................................................... 53

2.1.5 Internet Access: L2TP ............................................................................................................ 55

2.1.6 Internet Access Setup - Second WAN Interface ............................................................... 57

2.1.7 Internet Access: Congratulations ....................................................................................... 58

2.1.8 Date and Time Settings ........................................................................................................ 59

2.1.9 Register Device ..................................................................................................................... 59

2.1.10 Activate Service .................................................................................................................. 61

2.1.11 Service Settings .................................................................................................................... 62

2.1.12 Service Settings: SecuReporter ..........................................................................................63

2.1.13 Wireless Settings: Management Mode ............................................................................. 64

Table of Contents

ZyWALL USG FLEX Series User’s Guide

2.1.14 Wireless Settings: AP Controller ......................................................................................... 65

2.1.15 Wireless Settings: SSID & Security ...................................................................................... 65

2.1.16 Remote Management ......................................................................................................66

Chapter 3

Hardware, Interfaces and Zones......................................................................................................68

3.1 Hardware Overview ....................................................................................................................... 68

3.1.1 Front Panels ............................................................................................................................ 68

3.1.2 Rear Panels ............................................................................................................................ 70

3.2 Installation Scenarios ..................................................................................................................... 71

3.2.1 Desktop Installation Procedure ...........................................................................................72

3.2.2 Rack-mounting ...................................................................................................................... 72

3.2.3 Wall-mounting ....................................................................................................................... 73

3.3 Default Zones, Interfaces, and Ports ............................................................................................ 75

3.4 Stopping the Zyxel Device ............................................................................................................ 75

Chapter 4

Quick Setup Wizards............................................................................................................ ..............76

4.1 Quick Setup Overview ................................................................................................................... 76

4.2 WAN Interface Quick Setup .......................................................................................................... 77

4.2.1 Choose an Ethernet Interface .............................................................................................77

4.2.2 Select WAN Type ................................................................................................................... 78

4.2.3 Configure WAN IP Settings ................................................................................................... 78

4.2.4 ISP and WAN and ISP Connection Settings ........................................................................ 79

4.2.5 Quick Setup Interface Wizard: Summary ........................................................................... 82

4.3 VPN Setup Wizard ........................................................................................................................... 83

4.3.1 Welcome ................................................................................................................................ 83

4.3.2 VPN Setup Wizard: Wizard Type .......................................................................................... 84

4.3.3 VPN Express Wizard - Scenario ............................................................................................ 85

4.3.4 VPN Express Wizard - Configuration ................................................................................... 86

4.3.5 VPN Express Wizard - Summary ........................................................................................... 86

4.3.6 VPN Express Wizard - Finish .................................................................................................. 87

4.3.7 VPN Advanced Wizard - Scenario ..................................................................................... 88

4.3.8 VPN Advanced Wizard - Phase 1 Settings ........................................................................ 89

4.3.9 VPN Advanced Wizard - Phase 2 ....................................................................................... 91

4.3.10 VPN Advanced Wizard - Summary .................................................................................. 92

4.3.11 VPN Advanced Wizard - Finish ......................................................................................... 94

4.4 VPN Settings for Configuration Provisioning Wizard: Wizard Type ............................................. 95

4.4.1 Configuration Provisioning Express Wizard - VPN Settings ............................................... 95

4.4.2 Configuration Provisioning VPN Express Wizard - Configuration .................................... 96

4.4.3 VPN Settings for Configuration Provisioning Express Wizard - Summary ........................ 97

4.4.4 VPN Settings for Configuration Provisioning Express Wizard - Finish ................................ 98

4.4.5 VPN Settings for Configuration Provisioning Advanced Wizard - Scenario ................... 99

Table of Contents

ZyWALL USG FLEX Series User’s Guide

4.4.6 VPN Settings for Configuration Provisioning Advanced Wizard - Phase 1 Settings .... 100

4.4.7 VPN Settings for Configuration Provisioning Advanced Wizard - Phase 2 .................. 101

4.4.8 VPN Settings for Configuration Provisioning Advanced Wizard - Summary ................ 102

4.4.9 VPN Settings for Configuration Provisioning Advanced Wizard - Finish ....................... 105

4.5 VPN Settings for L2TP VPN Settings Wizard ................................................................................. 105

4.5.1 L2TP VPN Settings ................................................................................................................ 106

4.5.2 L2TP VPN Settings ................................................................................................................ 107

4.5.3 VPN Settings for L2TP VPN Setting Wizard - Summary .................................................... 107

4.5.4 VPN Settings for L2TP VPN Setting Wizard - Completed ................................................ 109

Chapter 5

Dashboard........................................................................................................................................110

5.1 Overview ....................................................................................................................................... 110

5.1.1 What You Can Do in this Chapter ..................................................................................... 110

5.2 The General Screen ..................................................................................................................... 110

5.2.1 Device Information Screen ................................................................................................112

5.2.2 System Status Screen .......................................................................................................... 113

5.2.3 Tx/Rx Statistics ...................................................................................................................... 113

5.2.4 The Latest Logs Screen ....................................................................................................... 114

5.2.5 System Resources Screen ................................................................................................... 114

5.2.6 DHCP Table Screen ............................................................................................................. 115

5.2.7 Number of Login Users Screen ........................................................................................... 116

5.2.8 Current Login User ............................................................................................................... 117

5.2.9 VPN Status ............................................................................................................................ 117

5.2.10 SSL VPN Status .................................................................................................................... 118

5.3 The Advanced Threat Protection Screen .................................................................................. 118

Part II: Technical Reference.........................................................................120

Chapter 6

Monitor..............................................................................................................................................121

6.1 Overview ....................................................................................................................................... 121

6.1.1 What You Can Do in this Chapter ..................................................................................... 121

6.2 The Port Statistics Screen ............................................................................................................ 123

6.2.1 The Port Statistics Graph Screen ....................................................................................... 124

6.3 Interface Status Screen ................................................................................................................ 125

6.4 The Traffic Statistics Screen .......................................................................................................... 129

6.5 The Session Monitor Screen ........................................................................................................ 131

6.6 The Login Users Screen ................................................................................................................ 133

6.7 Dynamic Guest ............................................................................................................................ 135

6.8 IGMP Statistics ............................................................................................................................... 136

Table of Contents

ZyWALL USG FLEX Series User’s Guide

6.9 The DDNS Status Screen ............................................................................................................... 137

6.10 IP/MAC Binding ........................................................................................................................... 138

6.11 Cellular Status Screen ................................................................................................................ 138

6.11.1 More Information .............................................................................................................. 141

6.12 The UPnP Port Status Screen ..................................................................................................... 142

6.13 USB Storage Screen .................................................................................................................... 143

6.14 Ethernet Neighbor Screen ........................................................................................................ 144

6.15 FQDN Object Screen ................................................................................................................ 145

6.16 AP Information: AP List ............................................................................................................... 147

6.16.1 AP List: More Information ................................................................................................ 150

6.16.2 AP List: Config AP ............................................................................................................. 153

6.17 AP Information: Radio List .......................................................................................................... 155

6.17.1 Radio List: More Information ............................................................................................157

6.18 AP Information: Top N APs ........................................................................................................ 159

6.19 AP Information: Single AP .......................................................................................................... 160

6.20 ZyMesh ......................................................................................................................................... 161

6.21 SSID Info ....................................................................................................................................... 162

6.22 Station Info: Station List .............................................................................................................. 163

6.23 Station Info: Top N Stations ........................................................................................................ 163

6.24 Station Info: Single Station ......................................................................................................... 164

6.25 Detected Device ....................................................................................................................... 165

6.26 The Printer Status Screen ........................................................................................................... 166

6.27 The IPSec Screen ........................................................................................................................ 167

6.28 The SSL Screen ............................................................................................................................. 168

6.29 The L2TP over IPSec Screen ....................................................................................................... 169

6.30 The App Patrol Screen ............................................................................................................... 170

6.31 The Content Filter Screen .......................................................................................................... 171

6.32 The Anti-Malware Screen .......................................................................................................... 172

6.33 The Reputation Filter Screen ...................................................................................................... 175

6.34 The IDP Screen ............................................................................................................................ 176

6.35 The Email Security Screens ......................................................................................................... 178

6.35.1 Email Security Summary ................................................................................................... 178

6.35.2 The Email Security Status Screen ..................................................................................... 180

6.36 The SSL Inspection Screens ........................................................................................................ 181

6.36.1 Certificate Cache List ....................................................................................................... 182

6.37 Log Screens ................................................................................................................................. 183

6.37.1 View Log ............................................................................................................................ 184

6.37.2 View AP Log ....................................................................................................................... 185

Chapter 7

Licensing...........................................................................................................................................188

7.1 Registration Overview .................................................................................................................. 188

7.1.1 What you Need to Know ....................................................................................................188

Table of Contents

ZyWALL USG FLEX Series User’s Guide

7.1.2 Registration Screen ............................................................................................................. 188

7.1.3 Service Screen ..................................................................................................................... 189

7.2 Signature Update ......................................................................................................................... 191

7.2.1 What you Need to Know ....................................................................................................191

7.2.2 The Signature Screen .......................................................................................................... 191

7.2.3 Auto Update ........................................................................................................................ 192

Chapter 8

Wireless .............................................................................................................................................193

8.1 Overview ....................................................................................................................................... 193

8.1.1 What You Can Do in this Chapter ..................................................................................... 193

8.2 Controller Screen ........................................................................................................................ 193

8.2.1 Connecting an AP to the Zyxel Device ............................................................................ 194

8.2.2 Connecting an AP to the Zyxel Device Manually ........................................................... 194

8.2.3 Connecting an AP to the Zyxel Device Using DHCP Option 138 .................................. 194

8.3 AP Management Screens ........................................................................................................... 195

8.3.1 Mgnt. AP List ....................................................................................................................... 195

8.3.2 AP Policy .............................................................................................................................. 200

8.3.3 AP Group ............................................................................................................................. 201

8.3.4 Firmware ............................................................................................................................... 207

8.4 Rogue AP ....................................................................................................................................... 208

8.4.1 Add/Edit Rogue/Friendly List .............................................................................................. 210

8.5 Auto Healing ................................................................................................................................. 211

8.6 RTLS Overview ............................................................................................................................... 212

8.6.1 What You Can Do in this Chapter ..................................................................................... 212

8.6.2 Before You Begin ................................................................................................................. 212

8.6.3 Configuring RTLS .................................................................................................................. 213

8.7 Technical Reference .................................................................................................................... 214

8.7.1 Dynamic Channel Selection .............................................................................................. 214

8.7.2 Load Balancing ................................................................................................................... 215

Chapter 9

Interfaces..........................................................................................................................................216

9.1 Interface Overview ...................................................................................................................... 216

9.1.1 What You Can Do in this Chapter ..................................................................................... 216

9.1.2 What You Need to Know ................................................................................................... 216

9.1.3 What You Need to Do First ................................................................................................. 221

9.2 Port Role ......................................................................................................................................... 221

9.3 Port Configuration ........................................................................................................................ 222

9.4 Ethernet Summary Screen ........................................................................................................... 223

9.4.1 Ethernet Edit ........................................................................................................................ 225

9.4.2 Proxy ARP ............................................................................................................................. 241

9.4.3 Virtual Interfaces ................................................................................................................ 242

Table of Contents

ZyWALL USG FLEX Series User’s Guide

9.4.4 References ........................................................................................................................... 243

9.4.5 Add/Edit DHCPv6 Request/Release Options ................................................................... 244

9.4.6 Add/Edit DHCP Extended Options ................................................................................... 245

9.5 PPP Interfaces ............................................................................................................................... 246

9.5.1 PPP Interface Summary ...................................................................................................... 247

9.5.2 PPP Interface Add or Edit .................................................................................................. 248

9.6 Cellular Configuration Screen ..................................................................................................... 253

9.6.1 Cellular Choose Slot ........................................................................................................... 256

9.6.2 Add / Edit Cellular Configuration ...................................................................................... 256

9.7 Tunnel Interfaces .......................................................................................................................... 262

9.7.1 Configuring a Tunnel .......................................................................................................... 264

9.7.2 Tunnel Add or Edit Screen .................................................................................................. 265

9.8 VLAN Interfaces ........................................................................................................................... 269

9.8.1 VLAN Summary Screen ....................................................................................................... 270

9.8.2 VLAN Add/Edit ................................................................................................................... 271

9.9 Bridge Interfaces .......................................................................................................................... 282

9.9.1 Bridge Summary .................................................................................................................. 284

9.9.2 Bridge Add/Edit .................................................................................................................. 285

9.10 VTI ................................................................................................................................................. 296

9.10.1 Restrictions for IPSec Virtual Tunnel Interface ................................................................ 296

9.10.2 VTI Screen .......................................................................................................................... 297

9.10.3 VTI Add/Edit ....................................................................................................................... 297

9.11 Trunk Overview ........................................................................................................................... 301

9.11.1 What You Need to Know ................................................................................................. 301

9.12 The Trunk Summary Screen ........................................................................................................ 304

9.12.1 Configuring a User-Defined Trunk ................................................................................... 305

9.12.2 Configuring the System Default Trunk ............................................................................ 307

9.13 Interface Technical Reference ................................................................................................. 308

Chapter 10

Routing..............................................................................................................................................313

10.1 Policy and Static Routes Overview ........................................................................................... 313

10.1.1 What You Can Do in this Chapter ................................................................................... 313

10.1.2 What You Need to Know ................................................................................................ 314

10.2 Policy Route Screen ................................................................................................................... 315

10.2.1 Policy Route Edit Screen .................................................................................................. 317

10.3 IP Static Route Screen ................................................................................................................ 322

10.3.1 Static Route Add/Edit Screen .......................................................................................... 322

10.4 Policy Routing Technical Reference ........................................................................................324

10.5 Routing Protocols Overview ..................................................................................................... 324

10.5.1 What You Need to Know ................................................................................................. 325

10.6 The RIP Screen ............................................................................................................................. 325

10.7 The OSPF Screen ......................................................................................................................... 327

Table of Contents

ZyWALL USG FLEX Series User’s Guide

10.7.1 Configuring the OSPF Screen .......................................................................................... 330

10.7.2 OSPF Area Add/Edit Screen ........................................................................................... 331

10.7.3 Virtual Link Add/Edit Screen ...........................................................................................333

10.8 BGP (Border Gateway Protocol) .............................................................................................. 334

10.8.1 Allow BGP Packets to Enter the Zyxel Device ................................................................ 335

10.8.2 Configuring the BGP Screen ............................................................................................ 335

10.8.3 The BGP Neighbors Screen .............................................................................................. 337

10.8.4 Example Scenario ............................................................................................................. 338

Chapter 11

DDNS ................................................................................................................................................340

11.1 DDNS Overview ........................................................................................................................... 340

11.1.1 What You Can Do in this Chapter ................................................................................... 340

11.1.2 What You Need to Know ................................................................................................. 340

11.2 The DDNS Screen ........................................................................................................................ 341

11.2.1 The Dynamic DNS Add/Edit Screen ................................................................................ 342

Chapter 12

NAT ....................................................................................................................................................346

12.1 NAT Overview ............................................................................................................................. 346

12.1.1 What You Can Do in this Chapter ................................................................................... 346

12.1.2 What You Need to Know ................................................................................................. 346

12.2 The NAT Screen ........................................................................................................................... 347

12.2.1 The NAT Add/Edit Screen .................................................................................................349

12.3 NAT Technical Reference .......................................................................................................... 352

Chapter 13

Redirect Service...............................................................................................................................354

13.1 Overview ..................................................................................................................................... 354

13.1.1 HTTP Redirect ..................................................................................................................... 354

13.1.2 SMTP Redirect .................................................................................................................... 354

13.1.3 What You Can Do in this Chapter ................................................................................... 355

13.1.4 What You Need to Know ................................................................................................. 355

13.2 The Redirect Service Screen ..................................................................................................... 357

13.2.1 The Redirect Service Edit Screen ..................................................................................... 358

Chapter 14

ALG....................................................................................................................................................360

14.1 ALG Overview ............................................................................................................................. 360

14.1.1 What You Need to Know ................................................................................................. 360

14.1.2 Before You Begin ............................................................................................................... 363

14.2 The ALG Screen .......................................................................................................................... 363

14.3 ALG Technical Reference ......................................................................................................... 365

Table of Contents

ZyWALL USG FLEX Series User’s Guide

Chapter 15

UPnP...................................................................................................................................................367

15.1 UPnP and NAT-PMP Overview ................................................................................................... 367

15.2 What You Need to Know ........................................................................................................... 367

15.2.1 NAT Traversal ..................................................................................................................... 367

15.2.2 Cautions with UPnP and NAT-PMP .................................................................................. 368

15.3 UPnP Screen ................................................................................................................................ 368

15.4 Technical Reference .................................................................................................................. 369

15.4.1 Turning on UPnP in Windows 7 Example ......................................................................... 369

15.4.2 Turn on UPnP in Windows 10 Example ............................................................................ 373

15.4.3 Auto-discover Your UPnP-enabled Network Device .................................................... 375

15.4.4 Web Configurator Easy Access in Windows 7 ............................................................... 378

15.4.5 Web Configurator Easy Access in Windows 10 ............................................................. 380

Chapter 16

IP/MAC Binding................................................................................................................................382

16.1 IP/MAC Binding Overview ......................................................................................................... 382

16.1.1 What You Can Do in this Chapter ................................................................................... 382

16.1.2 What You Need to Know ................................................................................................. 382

16.2 IP/MAC Binding Summary ......................................................................................................... 383

16.2.1 IP/MAC Binding Edit .......................................................................................................... 384

16.2.2 Static DHCP Edit ................................................................................................................ 385

16.3 IP/MAC Binding Exempt List ....................................................................................................... 386

Chapter 17

Layer 2 Isolation...............................................................................................................................387

17.1 Overview ..................................................................................................................................... 387

17.1.1 What You Can Do in this Chapter ................................................................................... 387

17.2 Layer-2 Isolation General Screen ............................................................................................. 387

17.3 White List Screen ......................................................................................................................... 388

17.3.1 Add/Edit White List Rule ................................................................................................... 389

Chapter 18

DNS Inbound LB................................................................................................................................391

18.1 DNS Inbound Load Balancing Overview ................................................................................. 391

18.1.1 What You Can Do in this Chapter ................................................................................... 391

18.2 The DNS Inbound LB Screen ...................................................................................................... 392

18.2.1 The DNS Inbound LB Add/Edit Screen ............................................................................ 393

18.2.2 The DNS Inbound LB Add/Edit Member Screen ............................................................ 395

Chapter 19

IPSec VPN .........................................................................................................................................397

19.1 Virtual Private Networks (VPN) Overview ................................................................................. 397

Table of Contents

ZyWALL USG FLEX Series User’s Guide

19.1.1 What You Can Do in this Chapter ................................................................................... 399

19.1.2 What You Need to Know ................................................................................................. 399

19.1.3 Before You Begin ............................................................................................................... 402

19.2 The VPN Connection Screen ..................................................................................................... 402

19.2.1 The VPN Connection Add/Edit Screen .......................................................................... 404

19.3 The VPN Gateway Screen ......................................................................................................... 411

19.3.1 The VPN Gateway Add/Edit Screen ............................................................................... 412

19.4 VPN Concentrator ..................................................................................................................... 419

19.4.1 VPN Concentrator Requirements and Suggestions ...................................................... 419

19.4.2 VPN Concentrator Screen ............................................................................................... 420

19.4.3 The VPN Concentrator Add/Edit Screen ........................................................................ 420

19.5 Zyxel Device IPSec VPN Client Configuration Provisioning .................................................... 421

19.6 IPSec VPN Background Information ......................................................................................... 423

Chapter 20

SSL VPN..............................................................................................................................................433

20.1 Overview ..................................................................................................................................... 433

20.1.1 What You Can Do in this Chapter ................................................................................... 433

20.1.2 What You Need to Know ................................................................................................. 433

20.2 The SSL Access Privilege Screen ................................................................................................ 434

20.2.1 The SSL Access Privilege Policy Add/Edit Screen ......................................................... 435

20.3 The SSL Global Setting Screen ................................................................................................... 437

Chapter 21

L2TP VPN.............. .... ................... ... .... .... .................. .... ... .... .................. .... .... ... ..................................439

21.1 Overview ..................................................................................................................................... 439

21.1.1 What You Can Do in this Chapter ................................................................................... 439

21.1.2 What You Need to Know ................................................................................................. 439

21.2 L2TP VPN Screen ......................................................................................................................... 440

21.2.1 Example: L2TP and Zyxel Device Behind a NAT Router ................................................ 442

Chapter 22

BWM (Bandwidth Management) .................................................................................................445

22.1 Overview ..................................................................................................................................... 445

22.1.1 What You Can Do in this Chapter ................................................................................... 445

22.1.2 What You Need to Know ................................................................................................ 445

22.2 The Bandwidth Management Configuration .......................................................................... 449

22.2.1 The Bandwidth Management Add/Edit Screen ............................................................ 452

Chapter 23

Web Authentication ........................................................................................................................461

23.1 Web Auth Overview ................................................................................................................... 461

23.1.1 What You Can Do in this Chapter ................................................................................... 461

Table of Contents

ZyWALL USG FLEX Series User’s Guide

23.1.2 What You Need to Know ................................................................................................. 462

23.2 Web Authentication General Screen ...................................................................................... 462

23.2.1 User-aware Access Control Example ............................................................................. 467

23.2.2 Authentication Type Screen ............................................................................................ 473

23.2.3 Custom Web Portal / User Agreement File Screen ....................................................... 477

23.2.4 Facebook Wi-Fi Screen ..................................................................................................... 478

23.3 SSO Overview .............................................................................................................................. 482

23.4 SSO - Zyxel Device Configuration ............................................................................................. 483

23.4.1 Configuration Overview ................................................................................................... 484

23.4.2 Configure the Zyxel Device to Communicate with SSO .............................................. 484

23.4.3 Enable Web Authentication ............................................................................................ 485

23.4.4 Create a Security Policy ................................................................................................... 486

23.4.5 Configure User Information ..............................................................................................487

23.4.6 Configure an Authentication Method ........................................................................... 488

23.4.7 Configure Active Directory ..............................................................................................489

23.5 SSO Agent Configuration .......................................................................................................... 490

Chapter 24

Hotspot..............................................................................................................................................493

24.1 Overview ..................................................................................................................................... 493

24.2 Billing Overview ........................................................................................................................... 493

24.2.1 What You Need to Know ................................................................................................. 493

24.3 The Billing > General Screen ...................................................................................................... 494

24.4 The Billing > Billing Profile Screen ............................................................................................... 496

24.4.1 The Account Generator Screen ...................................................................................... 497

24.4.2 The Account Redeem Screen ......................................................................................... 500

24.4.3 The Billing Profile Add/Edit Screen ................................................................................... 502

24.5 The Billing > Discount Screen ..................................................................................................... 503

24.5.1 The Discount Add/Edit Screen ......................................................................................... 505

24.6 The Billing > Payment Service Screen ....................................................................................... 505

24.6.1 The Payment Service > Desktop / Mobile View Screen ............................................... 507

Chapter 25

Printer Manager ...............................................................................................................................511

25.1 Printer Manager Overview ........................................................................................................ 511

25.1.1 What You Can Do in this Chapter ................................................................................... 511

25.2 The Printer Manager > General Screen ................................................................................... 511

25.2.1 Add Printer Rule ................................................................................................................. 514

25.2.2 Edit Printer Rule .................................................................................................................. 514

25.2.3 Discover Printer ................................................................................................................. 515

25.2.4 Edit Printer Manager (Discover Printer) .......................................................................... 517

25.3 The Printout Configuration Screen ............................................................................................ 518

25.4 Printer Reports Overview ........................................................................................................... 519

Table of Contents

ZyWALL USG FLEX Series User’s Guide

25.4.1 Key Combinations ............................................................................................................. 519

25.4.2 Daily Account Summary .................................................................................................. 519

25.4.3 Monthly Account Summary ............................................................................................. 520

25.4.4 Account Report Notes ..................................................................................................... 520

25.4.5 System Status ..................................................................................................................... 521

Chapter 26

Free Time...........................................................................................................................................523

26.1 Free Time Overview .................................................................................................................... 523

26.1.1 What You Can Do in this Chapter ................................................................................... 523

26.2 The Free Time Screen ................................................................................................................. 523

Chapter 27

IPnP....................................................................................................................................................528

27.1 IPnP Overview ............................................................................................................................ 528

27.1.1 What You Can Do in this Chapter ................................................................................... 529

27.1.2 IPnP Screen ........................................................................................................................ 529

Chapter 28

Walled Garden........... ... .... .... .................. .... .... ... ................... ... .... .... .................. .... .... ... ...................531

28.1 Walled Garden Overview ........................................................................................................ 531

28.2 Walled Garden > General Screen ........................................................................................... 531

28.3 Walled Garden > URL Base Screen .......................................................................................... 532

28.3.1 Adding/Editing a Walled Garden URL ........................................................................... 533

28.4 Walled Garden > Domain/IP Base Screen .............................................................................. 534

28.4.1 Adding/Editing a Walled Garden Domain or IP ........................................................... 535

28.4.2 Walled Garden Login Example ....................................................................................... 535

Chapter 29

Advertisement Screen.......... .... ... .... .... .................................... .... .... ... .... .........................................537

29.1 Advertisement Overview ........................................................................................................... 537

29.1.1 Adding/Editing an Advertisement URL .......................................................................... 538

Chapter 30

Security Policy..................................................................................................................................540

30.1 Overview ..................................................................................................................................... 540

30.2 One Security ................................................................................................................................ 541

30.3 What You Can Do in this Chapter ............................................................................................ 544

30.3.1 What You Need to Know ................................................................................................. 544

30.4 The Security Policy Screen ......................................................................................................... 546

30.4.1 Configuring the Security Policy Control Screen ............................................................ 547

30.4.2 The Security Policy Control Add/Edit Screen ................................................................. 551

30.5 Anomaly Detection and Prevention Overview ...................................................................... 552

Table of Contents

ZyWALL USG FLEX Series User’s Guide

30.5.1 The Anomaly Detection and Prevention General Screen ........................................... 553

30.5.2 Creating New ADP Profiles ..............................................................................................554

30.5.3 Traffic Anomaly Profiles ................................................................................................... 555

30.5.4 Protocol Anomaly Profiles ................................................................................................ 558

30.6 The Session Control Screen ........................................................................................................ 561

30.6.1 The Session Control Add/Edit Screen .............................................................................. 562

30.7 Security Policy Example Applications ......................................................................................563

Chapter 31

Application Patrol ............................................................................................................................566

31.1 Overview ..................................................................................................................................... 566

31.1.1 What You Can Do in this Chapter ................................................................................... 566

31.1.2 What You Need to Know ................................................................................................ 566

31.2 Application Patrol Profile ........................................................................................................... 567

31.2.1 Profile Action: Apply to a Security Policy ....................................................................... 568

31.2.2 Application Patrol Profile > Add/Edit - My Application ............................................... 571

31.2.3 Application Patrol Profile > Add/Edit - Query Result ..................................................... 572

Chapter 32

Content Filter ....................................................................................................................................575

32.1 Overview ..................................................................................................................................... 575

32.1.1 What You Can Do in this Chapter ................................................................................... 575

32.1.2 What You Need to Know ................................................................................................. 575

32.1.3 Before You Begin ............................................................................................................... 577

32.2 Content Filter Profile Screen ...................................................................................................... 577

32.2.1 Apply to a Security Policy ................................................................................................ 578

32.2.2 Content Filter Add Profile Category Service .................................................................. 581

32.2.3 Content Filter Add Filter Profile Custom Service ........................................................... 594

32.3 Content Filter Trusted Web Sites Screen ................................................................................. 596

32.4 Content Filter Forbidden Web Sites Screen ............................................................................ 597

32.5 Content Filter Technical Reference ......................................................................................... 598

Chapter 33

Anti-Malware....................................................................................................................................600

33.1 Overview ..................................................................................................................................... 600

33.1.1 What You Can Do in this Chapter ................................................................................... 604

33.2 Anti-Malware Screen ................................................................................................................. 605

33.3 The White List Screen .................................................................................................................. 608

33.4 The Black List Screen .................................................................................................................. 610

33.5 Anti-Malware Signature Searching ........................................................................................... 611

33.6 Anti-Malware Technical Reference ......................................................................................... 612

Chapter 34

Reputation Filter ...............................................................................................................................614

Table of Contents

ZyWALL USG FLEX Series User’s Guide

34.1 Overview ..................................................................................................................................... 614

34.1.1 What You Need to Know ................................................................................................. 614

34.1.2 What You Can Do in this Chapter ................................................................................... 614

34.2 URL Threat Filter Screen .............................................................................................................. 614

34.2.1 URL Threat Filter White List Screen ................................................................................... 616

34.2.2 URL Threat Filter Black List Screen .................................................................................... 617

Chapter 35

IDP .....................................................................................................................................................618

35.1 Overview ..................................................................................................................................... 618

35.1.1 What You Can Do in this Chapter ................................................................................... 618

35.1.2 What You Need To Know ................................................................................................. 618

35.1.3 Before You Begin ............................................................................................................... 618

35.2 The IDP Screen ............................................................................................................................ 619

35.2.1 Query Example .................................................................................................................. 623

35.3 IDP Custom Signatures .............................................................................................................. 624

35.3.1 Add / Edit Custom Signatures ......................................................................................... 625

35.3.2 Custom Signature Example ............................................................................................. 629

35.3.3 Applying Custom Signatures ............................................................................................ 631

35.3.4 Verifying Custom Signatures ............................................................................................ 632

35.4 The White List Screen ................................................................................................................. 632

35.5 IDP Technical Reference ........................................................................................................... 633

Chapter 36

Email Security...................................................................................................................................636

36.1 Overview ..................................................................................................................................... 636

36.1.1 What You Can Do in this Chapter ................................................................................... 636

36.1.2 What You Need to Know ................................................................................................. 636

36.2 Before You Begin ........................................................................................................................ 637

36.3 The Email Security Screen .......................................................................................................... 638

36.4 The Black List / White List Screen ............................................................................................... 640

36.4.1 The Black or White List Add/Edit Screen ......................................................................... 641

36.4.2 Regular Expressions in Black or White List Entries ........................................................... 643

36.5 Email Security Technical Reference ......................................................................................... 643

Chapter 37

SSL Inspection...................................................................................................................................647

37.1 Overview ..................................................................................................................................... 647

37.1.1 What You Can Do in this Chapter ................................................................................... 647

37.1.2 What You Need To Know ................................................................................................. 647

37.1.3 Before You Begin ............................................................................................................... 648

37.2 The SSL Inspection Profile Screen .............................................................................................. 648

37.2.1 Apply to a Security Policy ................................................................................................ 649

Table of Contents

ZyWALL USG FLEX Series User’s Guide

37.2.2 Add / Edit SSL Inspection Profiles .................................................................................... 652

37.3 Exclude List Screen .................................................................................................................... 653

37.4 Certificate Update Screen ....................................................................................................... 655

37.5 Install a CA Certificate in a Browser ......................................................................................... 656

Chapter 38

IP Exception......................................................................................................................................659

38.1 Overview ..................................................................................................................................... 659

38.2 The IP Exception Screen ............................................................................................................. 659

38.2.1 The IP Exception Add/Edit Screen ................................................................................. 660

Chapter 39

Object...............................................................................................................................................662

39.1 Zones Overview .......................................................................................................................... 662

39.1.1 What You Need to Know ................................................................................................. 662

39.1.2 The Zone Screen ................................................................................................................ 663

39.2 User/Group Overview ................................................................................................................ 665

39.2.1 What You Need To Know ................................................................................................. 665

39.2.2 User/Group User Summary Screen .................................................................................. 667

39.2.3 User/Group Group Summary Screen .............................................................................. 672

39.2.4 User/Group Setting Screen ............................................................................................. 673

39.2.5 User/Group MAC Address Summary Screen ................................................................ 678

39.2.6 User /Group Technical Reference .................................................................................. 680

39.3 AP Profile Overview .................................................................................................................... 680

39.3.1 Radio Screen ..................................................................................................................... 681

39.3.2 SSID Screen ....................................................................................................................... 687

39.4 MON Profile ................................................................................................................................ 696

39.4.1 Overview ............................................................................................................................ 696

39.4.2 Configuring MON Profile ................................................................................................. 697

39.4.3 Add/Edit MON Profile ....................................................................................................... 698

39.4.4 Technical Reference ........................................................................................................ 699

39.5 ZyMesh Overview ....................................................................................................................... 700

39.5.1 ZyMesh Profile .................................................................................................................... 702

39.5.2 Add/Edit ZyMesh Profile ................................................................................................... 703

39.6 Address/Geo IP Overview ......................................................................................................... 703

39.6.1 What You Need To Know ................................................................................................. 704

39.6.2 Address Summary Screen ................................................................................................ 704

39.6.3 Address Group Summary Screen .................................................................................... 708

39.6.4 Geo IP Summary Screen .................................................................................................. 710

39.7 Service Overview ........................................................................................................................ 713

39.7.1 What You Need to Know ................................................................................................. 713

39.7.2 The Service Summary Screen .......................................................................................... 714

39.7.3 The Service Group Summary Screen ............................................................................. 716

Table of Contents

ZyWALL USG FLEX Series User’s Guide

39.8 Schedule Overview ................................................................................................................... 718

39.8.1 What You Need to Know ................................................................................................. 718

39.8.2 The Schedule Screen ........................................................................................................ 719

39.8.3 The Schedule Group Screen ............................................................................................ 722

39.9 AAA Server Overview ............................................................................................................... 723

39.9.1 Directory Service (AD/LDAP) ........................................................................................... 724

39.9.2 RADIUS Server .................................................................................................................... 724

39.9.3 ASAS .................................................................................................................................... 724

39.9.4 What You Need To Know ................................................................................................. 725

39.9.5 Active Directory or LDAP Server Summary ..................................................................... 726

39.9.6 RADIUS Server Summary ...................................................................................................730

39.10 Auth. Method Overview ........................................................................................................ 733

39.10.1 Before You Begin ............................................................................................................. 733

39.10.2 Example: Selecting a VPN Authentication Method ................................................... 733

39.10.3 Authentication Method Objects ................................................................................... 734

39.10.4 Two-Factor Authentication VPN Access ...................................................................... 736

39.10.5 Two-Factor Authentication Admin Access .................................................................. 739

39.11 Certificate Overview ............................................................................................................... 741

39.11.1 What You Need to Know ............................................................................................... 741

39.11.2 Verifying a Certificate .................................................................................................... 743

39.11.3 The My Certificates Screen ............................................................................................ 744

39.11.4 The Trusted Certificates Screen .................................................................................... 753

39.11.5 Certificates Technical Reference ................................................................................. 758

39.12 ISP Account Overview ............................................................................................................ 758

39.12.1 ISP Account Summary ....................................................................................................758

39.13 DHCPv6 Overview .................................................................................................................... 761

39.13.1 The DHCPv6 Request Screen ......................................................................................... 761

39.13.2 The DHCPv6 Lease Screen ............................................................................................. 763

Chapter 40

Device HA.........................................................................................................................................765

40.1 Device HA Overview .................................................................................................................. 765

40.1.1 What You Can Do in These Screens ................................................................................ 765

40.2 Device HA Status ........................................................................................................................ 765

40.3 Device HA Pro ............................................................................................................................. 767

40.3.1 Deploying Device HA Pro ................................................................................................ 768

40.3.2 Configuring Device HA Pro .............................................................................................. 768

40.4 View Log ...................................................................................................................................... 770

Chapter 41

Cloud CNM......................................................................................................................................772

41.1 Cloud CNM Overview ................................................................................................................ 772

41.1.1 What You Can Do in this Chapter ................................................................................... 772

Table of Contents

ZyWALL USG FLEX Series User’s Guide

41.2 Cloud CNM SecuManager ....................................................................................................... 772

41.3 Cloud CNM SecuReporter ......................................................................................................... 775

Chapter 42

System...............................................................................................................................................780

42.1 Overview ..................................................................................................................................... 780

42.1.1 What You Can Do in this Chapter ................................................................................... 780

42.2 Host Name ................................................................................................................................... 781

42.3 USB Storage ................................................................................................................................. 781

42.4 Date and Time ............................................................................................................................ 782

42.4.1 Pre-defined NTP Time Servers List ..................................................................................... 785

42.4.2 Time Server Synchronization ............................................................................................ 785

42.5 Console Port Speed ................................................................................................................... 786

42.6 DNS Overview ............................................................................................................................. 787

42.6.1 DNS Server Address Assignment ...................................................................................... 787

42.6.2 Configuring the DNS Screen ............................................................................................ 787

42.6.3 (IPv6) Address Record ...................................................................................................... 791

42.6.4 PTR Record ......................................................................................................................... 791

42.6.5 Adding an (IPv6) Address/PTR Record .......................................................................... 791

42.6.6 CNAME Record ................................................................................................................. 792

42.6.7 Adding a CNAME Record ................................................................................................ 792

42.6.8 Domain Zone Forwarder ................................................................................................. 793

42.6.9 Adding a Domain Zone Forwarder ................................................................................. 793

42.6.10 MX Record ...................................................................................................................... 794

42.6.11 Adding a MX Record ...................................................................................................... 794

42.6.12 Security Option Control .................................................................................................. 795

42.6.13 Editing a Security Option Control .................................................................................. 795

42.6.14 Adding a DNS Service Control Rule .............................................................................. 796

42.7 WWW Overview .......................................................................................................................... 797

42.7.1 Service Access Limitations ............................................................................................... 797

42.7.2 System Timeout .................................................................................................................. 797

42.7.3 HTTPS ................................................................................................................................... 797

42.7.4 Configuring WWW Service Control ................................................................................. 798

42.7.5 Service Control Rules ........................................................................................................ 801

42.7.6 Customizing the WWW Login Page ................................................................................ 802

42.7.7 HTTPS Example ................................................................................................................... 807

42.8 SSH ............................................................................................................................................. 814

42.8.1 How SSH Works .................................................................................................................. 815

42.8.2 SSH Implementation on the Zyxel Device ...................................................................... 816

42.8.3 Requirements for Using SSH ..............................................................................................816

42.8.4 Configuring SSH ................................................................................................................. 816

42.8.5 Service Control Rules ........................................................................................................ 817

42.8.6 Secure Telnet Using SSH Examples .................................................................................. 818

Table of Contents

ZyWALL USG FLEX Series User’s Guide

42.9 Telnet ........................................................................................................................................... 819

42.9.1 Configuring Telnet ............................................................................................................. 819

42.9.2 Service Control Rules ........................................................................................................ 821

42.10 FTP .............................................................................................................................................. 821

42.10.1 Configuring FTP ................................................................................................................ 821

42.10.2 Service Control Rules ...................................................................................................... 823

42.11 SNMP ......................................................................................................................................... 823

42.11.1 SNMPv3 and Security ...................................................................................................... 824

42.11.2 Supported MIBs ............................................................................................................... 825

42.11.3 SNMP Traps ....................................................................................................................... 825

42.11.4 Configuring SNMP ........................................................................................................... 825

42.11.5 Add SNMPv3 User ............................................................................................................ 828

42.11.6 Service Control Rules ...................................................................................................... 828

42.12 Authentication Server .............................................................................................................. 829

42.12.1 Add/Edit Trusted RADIUS Client .................................................................................... 831

42.13 Notification > Mail Server ......................................................................................................... 831

42.14 Notification > SMS ..................................................................................................................... 833

42.15 Language Screen ..................................................................................................................... 834

42.16 IPv6 Screen ................................................................................................................................ 835

42.17 Zyxel One Network (ZON) Utility ............................................................................................. 835

42.17.1 Requirements ................................................................................................................... 836

42.17.2 Run the ZON Utility ........................................................................................................... 836

42.17.3 Zyxel One Network (ZON) System Screen .................................................................... 840

Chapter 43

Log and Report.......................... ... .... .... .................. .... ... .... .................. .... .... ... ..................................841

43.1 Overview ..................................................................................................................................... 841

43.1.1 What You Can Do In this Chapter .................................................................................. 841

43.2 Email Daily Report ....................................................................................................................... 841

43.3 Log Setting Screens ................................................................................................................... 843

43.3.1 Log Setting Summary ........................................................................................................ 843

43.3.2 Edit System Log Settings .................................................................................................. 844

43.3.3 Edit Log on USB Storage Setting ..................................................................................... 848

43.3.4 Edit Remote Server Log Settings ..................................................................................... 849

43.3.5 Log Category Settings Screen ......................................................................................... 851

Chapter 44

File Manager ....................................................................................................................................854

44.1 Overview ..................................................................................................................................... 854

44.1.1 What You Can Do in this Chapter ................................................................................... 854

44.1.2 What you Need to Know .................................................................................................. 854

44.2 The Configuration File Screen ................................................................................................... 856

44.3 Firmware Management ........................................................................................................... 860

Table of Contents

ZyWALL USG FLEX Series User’s Guide

44.3.1 Cloud Helper ..................................................................................................................... 860

44.3.2 The Firmware Management Screen ............................................................................... 863

44.3.3 Firmware Upgrade via USB Stick ...................................................................................... 866

44.4 The Shell Script Screen .............................................................................................................. 866

Chapter 45

Diagnostics ......................................................................................................................................869

45.1 Overview ..................................................................................................................................... 869

45.1.1 What You Can Do in this Chapter ................................................................................... 869

45.2 The Diagnostics Screens ............................................................................................................ 869

45.2.1 The Diagnostics Collect Screen ....................................................................................... 870

45.2.2 The Diagnostics Collect on AP Screen ........................................................................... 871

45.2.3 The Diagnostics Files Screen ............................................................................................872

45.3 The Packet Capture Screen ...................................................................................................... 873

45.3.1 The Packet Capture on AP Screen ................................................................................. 876

45.3.2 The Packet Capture Files Screen .................................................................................... 879

45.4 The CPU / Memory Status Screen ............................................................................................. 880

45.5 The System Log Screen .............................................................................................................. 882

45.6 The Network Tool Screen ........................................................................................................... 882

45.7 The Routing Traces Screen ........................................................................................................ 885

45.8 The Wireless Frame Capture Screen ........................................................................................886

45.8.1 The Wireless Frame Capture Files Screen ...................................................................... 887

Chapter 46

Packet Flow Explore ........................................................................................................................888

46.1 Overview ..................................................................................................................................... 888

46.1.1 What You Can Do in this Chapter ................................................................................... 888

46.2 Routing Status ............................................................................................................................ 888

46.3 The SNAT Status Screen .............................................................................................................. 892

Chapter 47

Shutdown..........................................................................................................................................895

47.1 Overview ..................................................................................................................................... 895

47.1.1 What You Need To Know ................................................................................................. 895

47.2 The Shutdown Screen ................................................................................................................ 895

Part III: Appendices and Troubleshooting..................................................896

Chapter 48

Troubleshooting................................................................................................................................897

48.1 Resetting the Zyxel Device ........................................................................................................ 910

Table of Contents

ZyWALL USG FLEX Series User’s Guide

48.2 Getting More Troubleshooting Help .........................................................................................911

Appendix A Customer Support ..................................................................................................... 912

Appendix B Product Features........................................................................................................ 918

Appendix C Legal Information ...................................................................................................... 921

Index .................................................................................................................................................929

PART I

User’s Guide

ZyWALL USG FLEX Series User’s Guide

CHAPTER 1

Introduction

1.1 Overview

Zyxel Device refers to these models as outlined below.

• USG FLEX 100

• USG FLEX 200

• USG FLEX 500

1.1.1 Model Feature Differences

Note the following differences between the USG FLEX models:

For information on interface names by model, default port / interface name mapping, and default

interface / zone mapping please see Section 3.3 on page 75.

Table 1 USG FLEX Model Feature Comparison

FEATURE/MODEL USG FLEX 100 USG FLEX 200 USG FLEX 500

Microsoft Azure YES YES YES

Amazon VPC YES YES YES

Anomaly Detection & Prevention YES YES YES

Anti-Spam YES YES YES

IDP YES YES YES

Anti-Malware YES YES YES

App Patrol YES YES YES

Content Filtering YES YES YES

SecuReporter Premium YES YES YES

Reputation Filter YES YES YES

URL Threat Filter YES YES YES

IP Exception YES YES YES

AP Controller YES YES YES

Device HA Pro NO NO YES

Hotspot Management NO YES YES

Port Group YES YES YES

Port Role YES YES YES

SSL Application YES YES YES

SSL encrypted traffic inspection YES YES YES

Bundled UTM Feature License Validity 1 year 1 year 1 year

Chapter 1 Introduction

ZyWALL USG FLEX Series User’s Guide

See the product’s datasheet for detailed information on a specific model.

1.2 Registration at myZyxel

myZyxel is Zyxel’s online services center where you can register your Zyxel Device and manage

subscription services available for your Zyxel Device (see Configuration > Licensing > Registration >

Service for services available for your Zyxel Device).

• For Zyxel Devices that already have firmware version 4.25 or later, you have to register your Zyxel

Device and activate the corresponding service at myZyxel (through your Zyxel Device).

• For Zyxel Devices upgrading to firmware version 4.25 or later, you may skip registering your Zyxel

Device and activating the corresponding service at myZyxel (through your Zyxel Device). However, it

is highly recommended to at least register your Zyxel Device. At the time of writing, the Firmware

Upgrade license providing Cloud Helper new firmware notifications, is free when you register your

Zyxel Device.

Note: You need to create a myZyxel account at http://portal.myZyxel.com before you can

You may need your Zyxel Device’s serial number and LAN MAC address to register it at

myZyxel. See the label at the back of the Zyxel Device’s for details.

Figure 1 myZyxel Login

1.2.1 Grace Period

SecuReporter and service licenses have a 15-day grace period after a license expires. Services will

continue to work in this period during which you will receive notifications to renew your license(s). New

license(s) are valid for 1 year from the date of purchase.

1.2.2 Applications

These are some Zyxel Device application scenarios.

Chapter 1 Introduction

ZyWALL USG FLEX Series User’s Guide

Security Router

Security includes a Stateful Packet Inspection (SPI) firewall.

Figure 2 Applications: Security Router Applications: Security Router

IPv6 Routing

The Zyxel Device supports IPv6 Ethernet, PPP, VLAN, and bridge routing. You may also create IPv6 policy

routes and IPv6 objects. The Zyxel Device can also route IPv6 packets through IPv4 networks using

different tunneling methods.

Figure 3 Applications: IPv6 Routing

VPN Connectivity

Set up VPN tunnels with other companies, branch offices, telecommuters, and business travelers to

provide secure access to your network. AS is an Authentication Server in the below figure.

Chapter 1 Introduction

ZyWALL USG FLEX Series User’s Guide

Figure 4 Applications: VPN Connectivity

SSL VPN Network Access

SSL VPN lets remote users use their web browsers for a very easy-to-use VPN solution. A user just browses

to the Zyxel Device’s web address and enters his user name and password to securely connect to the

Zyxel Device’s network. Here full tunnel mode creates a virtual connection for a remote user and gives

him a private IP address in the same subnet as the local network so he can access network resources in

the same way as if he were part of the internal network.

Figure 5 SSL VPN With Full Tunnel Mode

User-Aware Access Control

Set up security policies to restrict access to sensitive information and shared resources based on the user

who is trying to access it. In the following figure user A can access both the Internet and an internal file

server. User B has a lower level of access and can only access the Internet. User C is not even logged in,

so and cannot access either the Internet or the file server.

Figure 6 Applications: User-Aware Access Control

Web Mail File Share

Web-based Application

https://

Application Server

Non-Web

LAN (192.168.1.X)

Chapter 1 Introduction

ZyWALL USG FLEX Series User’s Guide

Load Balancing

Set up multiple connections to the Internet on the same port, or different ports, including cellular

interfaces. In either case, you can balance the traffic loads between them.

Figure 7 Applications: Multiple WAN Interfaces

1.3 Management Overview

You can manage the Zyxel Device in the following ways.

Web Configurator

The Web Configurator allows easy Zyxel Device setup and management using an Internet browser. This

User’s Guide provides information about the Web Configurator.

Figure 8 Managing the Zyxel Device: Web Configurator

Chapter 1 Introduction

ZyWALL USG FLEX Series User’s Guide

Command-Line Interface (CLI)

The CLI allows you to use text-based commands to configure the Zyxel Device. Access it using remote

management (for example, SSH or Telnet) or via the physical or Web Configurator console port. See the

Command Reference Guide for CLI details. The default settings for the console port are:

FTP

Use File Transfer Protocol for firmware upgrades and configuration backup/restore.

SNMP

The device can be monitored and/or managed by an SNMP manager. See Section 42.11 on page 823.

CloudCNM

Use the CloudCNM screen (see Section 42.15 on page 834) to enable and configure management of

the Zyxel Device by a Central Network Management system.

Management Authentication

Managers must be authenticated with a username and password, using one of:

•Local Zyxel Device authentication

• An external RADIUS server

• An external LDAP server

• Certificates

1.4 Web Configurator

In order to use the Web Configurator, you must:

• Use one of the following web browser versions or later:

• Internet Explorer 10.x, 11.x

• Chrome latest version (45 or above)

• Firefox latest version (45 or above)

• Safari latest version (9.0 or above)

• Allow pop-up windows (blocked by default in some browsers)

Table 2 Console Port Default Settings

SETTING VALUE

Speed 115200 bps

Data Bits 8

Parity None

Stop Bit 1

Flow Control Off

Chapter 1 Introduction

ZyWALL USG FLEX Series User’s Guide

• Enable JavaScripts, Java permissions, and cookies

The recommended screen resolution is 1024 x 768 pixels.

Note: Screenshots and graphics in this book may differ slightly from your product due to

differences in product features or web configurator brand style. Most screen shots in this

guide come from the USG110 and USG60W.

1.4.1 Web Configurator Access

1Make sure your Zyxel Device hardware is properly connected. See the Quick Start Guide.

2In your browser go to http://192.168.1.1. By default, the Zyxel Device automatically routes this request to

its HTTPS server, and it is recommended to keep this setting. The Login screen appears.

3Type the user name (default: “admin”) and password (default: “1234”).

4Click Login. After you log in for the first time using the default user name and password, you must

change the default admin password in the Update Admin Info screen. Enter a new password of from 1

to 64 characters.

In Configuration > Object > User/Group > Setting, you can enable Password Complexity to require a

new password to consist of at least 8 characters and at most 64, where at least 1 character must be a

number, at least 1 a lower case letter, at least 1 an upper case letter and at least 1 a special character

from the keyboard, such as !@#$%^&*()_+. You can also require periodic changing of the password in

that screen by configuring Password must changed every (days).

Make a note of your new password, enter it in the following screen, then click Apply.

5A Terms of Use screen displays. Read the statement, then click Acknowledge to proceed.

Note: If you are using an Internet Explorer browser, the Terms of Use will be downloaded

automatically.

Chapter 1 Introduction

ZyWALL USG FLEX Series User’s Guide

6The Network Risk Warning screen displays any unregistered or disabled security services. If your Zyxel

Device is not registered, you will see a prompt to register it. Select how often to display the screen and

click OK.

Chapter 1 Introduction

ZyWALL USG FLEX Series User’s Guide

If you select Never and you later want to bring this screen back, use these commands (note the space

before the underscore).

See the Command Line Interface (CLI) Reference Guide (RG) for details on all supported commands.

7Follow the directions in the Update Admin Info screen. If you change the default password, the Login

screen appears after you click Apply. If you click Ignore, the Installation Setup Wizard opens if the

ZyWALL is using its default configuration; otherwise the dashboard appears.

1.4.2 Web Configurator Screens Overview

The Web Configurator screen is divided into these parts:

•A - title bar

•B - navigation panel

•C - main window

Router> enable

Router#

Router# configure terminal

Router(config)#

Router(config)# service-register _setremind

after-10-days

after-180-days

after-30-days

every-time

never

Router(config)# service-register _setremind every-time

Router(config)#

Chapter 1 Introduction

ZyWALL USG FLEX Series User’s Guide

Figure 9 Web Configurator Screen Overview

Title Bar

Figure 10 Title Bar

The title bar icons in the upper right corner provide the following functions.

Table 3 Title Bar: Web Configurator Icons

LABEL DESCRIPTION

SecuReporter Click this to open the SecuReporter portal page.

This icon shows when the Zyxel Device is added to an organization.

Web Console Click this to open one or multiple console windows from which you can run command line

interface (CLI) commands. You will be prompted to enter your user name and password. See

the Command Reference Guide for information about the commands.

Logging in to the Zyxel Device with HTTPS, so you can open one or multiple console windows.

CLI Click this to open a popup window that displays the CLI commands sent by the Web

Configurator to the Zyxel Device.

Reference Click this to check which configuration items reference an object.

Site Map Click this to see an overview of links to the Web Configurator screens.

Forum Go to https://businessforum.zyxel.com for product discussions.

Help Click this to open the help page for the current screen.

About Click this to display basic information about the Zyxel Device.

Logout Click this to log out of the Web Configurator.

Chapter 1 Introduction

ZyWALL USG FLEX Series User’s Guide

About

Click About to display basic information about the Zyxel Device.

Figure 11 About

Site Map

Click Site MAP to see an overview of links to the Web Configurator screens. Click a screen’s link to go to

that screen.

Figure 12 Site Map

Web Console

Click Web Console to open one or multiple console windows from which you can run CLI commands.

You will be prompted to enter your user name and password. See the Command Reference Guide for

information about the commands. Logging in to the Zyxel Device with HTTPS, so you can open one or

multiple console windows.

Table 4 About

LABEL DESCRIPTION

Current Version This shows the firmware version of the Zyxel Device.

Released Date This shows the date (yyyy-mm-dd) and time (hh:mm:ss) when the firmware is released.

OK Click this to close the screen.

Chapter 1 Introduction

ZyWALL USG FLEX Series User’s Guide

Figure 13 Web Console Window

Reference

Click Reference to open the Reference screen. Select the type of object and the individual object and

click Refresh to show which configuration settings reference the object.

Figure 14 Reference

The fields vary with the type of object. This table describes labels that can appear in this screen.

Table 5 Reference

LABEL DESCRIPTION

Type Select an object type to see the services.

Name This identifies the object for which the configuration settings that use it are displayed. Click the

object’s name to display the object’s configuration screen in the main window.

#This field is a sequential value, and it is not associated with any entry.

Service This is the type of setting that references the selected object. Click a service’s name to display the

service’s configuration screen in the main window.

Priority If it is applicable, this field lists the referencing configuration item’s position in its list, otherwise N/A

displays.

Name This field identifies the configuration item that references the object.

Description If the referencing configuration item has a description configured, it displays here.

Chapter 1 Introduction

ZyWALL USG FLEX Series User’s Guide

CLI Messages

Click CLI to look at the CLI commands sent by the Web Configurator. Open the pop-up window and

then click some menus in the web configurator to display the corresponding commands.

Figure 15 CLI Messages

1.4.3 Navigation Panel

Use the navigation panel menu items to open status and configuration screens. Click the arrow in the

middle of the right edge of the navigation panel to hide the panel or drag to resize it. The following

sections introduce the Zyxel Device’s navigation panel menus and their screens.

Figure 16 Navigation Panel

Refresh Click this to update the information in this screen.

Cancel Click Cancel to close the screen.

Table 5 Reference (continued)

LABEL DESCRIPTION

Chapter 1 Introduction

ZyWALL USG FLEX Series User’s Guide

Dashboard

The dashboard displays general device information, system status, system resource usage, licensed

service status, and interface status in widgets that you can re-arrange to suit your needs. See the Web

Help for details on the dashboard.

Monitor Menu

The monitor menu screens display status and statistics information.

Table 6 Monitor Menu Screens Summary

FOLDER OR LINK TAB FUNCTION

System Status

Port Statistics Port Statistics Displays packet statistics for each physical port.

Interface Status Interface

Summary

Displays general interface information and packet statistics.

Traffic Statistics Traffic

Statistics

Collect and display traffic statistics.

Session Monitor Session

Monitor

Displays the status of all current sessions.

Dynamic Guest Dynamic

Guest

List the dynamic guest accounts in the Zyxel Device’s local database. These

are accounts that are created automatically and allowed to access the

Zyxel Device’s services for a certain period of time.

IGMP Statistics IGMP

Statistics

Collect and display IGMP statistics.

DDNS Status DDNS Status Displays the status of the Zyxel Device’s DDNS domain names.

IP/MAC Binding IP/MAC

Binding

Lists the devices that have received an IP address from Zyxel Device

interfaces using IP/MAC binding.

Cellular Status Cellular

Status

Displays details about the Zyxel Device’s mobile broadband connection

status.

UPnP Port Status Port Statistics Displays details about UPnP connections going through the Zyxel Device.

USB Storage Storage

Information

Displays details about USB device connected to the Zyxel Device.

Ethernet

Neighbor Ethernet

Neighbor

View and manage the Zyxel Device’s neighboring devices via Smart

Connect (Layer Link Discovery Protocol (LLDP)). Use the Zyxel One Network

(ZON) utility to view and manage the Zyxel Device’s neighboring devices via

the Zyxel Discovery Protocol (ZDP).

FQDN Object FQDN

Object

Displays FQDN (Fully Qualified Domain Name) object cache lists used in DNS

queries.

Wireless

AP Information AP List Lists APs managed by the Zyxel Device.

Radio List Lists wireless details of APs managed by the Zyxel Device.

Built-in AP Displays associated wireless client usage and number. (For Zyxel Device

model names containing ‘W’.)

Top N APs Lists managed APs with the most wireless traffic usage and most associated

wireless stations.

Single AP Lists APs wireless traffic usage and associated wireless stations for a managed

AP.

Chapter 1 Introduction

ZyWALL USG FLEX Series User’s Guide

Configuration Menu

Use the configuration menu screens to configure the Zyxel Device’s features.

ZyMesh ZyMesh Link

Info Display statistics about ZyMesh wireless connections between managed APs.

SSID Info SSID Info Display information about the AP’s wireless clients.

Station Info Station List Lists wireless clients associated with the APs managed by the Zyxel Device.

Top N

Stations

Lists wireless stations with the most wireless traffic usage.

Single

Station

Lists wireless traffic usage for an associated wireless station.

Detected

Device Detected

Device

Display information about suspected rogue APs.

Printer Status Printer Status Display information about the connected statement printers.

VPN Monitor

IPSec IPSec Displays and manages the active IPSec SAs.

SSL SSL Lists users currently logged into the VPN SSL client portal. You can also log out

individual users and delete related session information.

L2TP over IPSec L2TP over

IPSec

Displays details about current L2TP sessions.

Security Statistics

App Patrol Summary Displays application patrol statistics.

Content Filter Summary Collect and display content filter statistics

Anti-Malware Summary Collect and display statistics on the malware that the Zyxel Device has

detected.

Reputation Filter Summary Displays counts and URLs that are blocked by the Zyxel Device.

IDP Summary Collect and display statistics on the intrusions that the Zyxel Device has

detected.

Email Security Summary Collect and display spam statistics.

Status Displays how many mail sessions the ZyWALL is currently checking and DNSBL

(Domain Name Service-based spam Black List) statistics.

SSL Inspection Report Collect and display SSL Inspection statistics.

Certificate

Cache List

Displays traffic to destination servers using certificates.

Log View Log Lists log entries.

View AP Log Lists AP log entries.

Table 7 Configuration Menu Screens Summary

FOLDER OR LINK TAB FUNCTION

Quick Setup Quickly configure WAN interfaces or VPN connections.

Licensing

Registration Registration Register the device and activate trial services.

Service View the licensed service status and upgrade licensed services.

Signature

Update Signature Update signatures immediately or by a schedule.

Table 6 Monitor Menu Screens Summary (continued)

FOLDER OR LINK TAB FUNCTION

Chapter 1 Introduction

ZyWALL USG FLEX Series User’s Guide

Wireless

Built-in AP General Allow WiFi clients to access your Zyxel Device wirelessly to connect to

the network.

Controller Configuration Configure manual or automatic controller registration.

Management Mgnt AP List Edit or remove entries in the lists of APs managed by the Zyxel Device.

AP Policy Configure the AP controller’s IP address on the managed APs and

determine the action the managed APs take if the current AP

controller fails.

AP Group Create groups of APs, define their radio, VLAN, port and load

balancing settings.

Firmware Update the firmware on APs connected to your Zyxel Device.

Rogue AP Rogue/Friendly AP

List

Configure how the Zyxel Device monitors rogue APs.

Auto Healing Auto Healing Enable auto healing to extend the wireless service coverage area of

the managed APs when one of the APs fails.

RTLS Real Time Location

System

Use the managed APs as part of an Ekahau RTLS to track the location

of Ekahau Wi-Fi tags.

Network

Interface Port

Port Role/Port

Configuration

Use this screen to set the Zyxel Device’s flexible ports such as LAN, OPT,

WLAN, or DMZ.

Ethernet Manage Ethernet interfaces and virtual Ethernet interfaces.

PPP Create and manage PPPoE and PPTP interfaces.

Cellular Configure a cellular Internet connection for an installed mobile

broadband card.

Tunnel Configure tunneling between IPv4 and IPv6 networks.

VLAN Create and manage VLAN interfaces and virtual VLAN interfaces.

Bridge Create and manage bridges and virtual bridge interfaces.

VTI Configure IP address assignment and interface parameters for VTI

(Virtual Tunnel Interface).

Trunk Create and manage trunks (groups of interfaces) for load balancing.

Routing Policy Route Create and manage routing policies.

Static Route Create and manage IP static routing information.

RIP Configure device-level RIP settings.

OSPF Configure device-level OSPF settings, including areas and virtual links.

BGP Configure exchange of Border Gateway Protocol (BGP) information

over an IPSec tunnel.

DDNS DDNS Define and manage the Zyxel Device’s DDNS domain names.

NAT NAT Set up and manage port forwarding rules.

Redirect

Service Redirect Service Set up and manage HTTP and SMTP redirection rules.

ALG ALG Configure SIP, H.323, and FTP pass-through settings.

UPnP UPnP Configure interfaces that allow UPnP and NAT-PMP connections.

Table 7 Configuration Menu Screens Summary (continued)

FOLDER OR LINK TAB FUNCTION

Chapter 1 Introduction

ZyWALL USG FLEX Series User’s Guide

IP/MAC Binding Summary Configure IP to MAC address bindings for devices connected to each

supported interface.

Exempt List Configure ranges of IP addresses to which the Zyxel Device does not

apply IP/MAC binding.

Layer 2 Isolation General Enable layer-2 isolation on the Zyxel Device and the internal

interface(s).

White List Enable and configure the white list.

DNS Inbound LB DNS Load Balancing Configure DNS Load Balancing.

VPN

IPSec VPN VPN Connection Configure IPSec tunnels.

VPN Gateway Configure IKE tunnels.

Concentrator Combine IPSec VPN connections into a single secure network

Configuration

Provisioning

Set who can retrieve VPN rule settings from the Zyxel Device using the

Zyxel Device IPSec VPN Client.

SSL VPN Access Privilege Configure SSL VPN access rights for users and groups.

Global Setting Configure the Zyxel Device’s SSL VPN settings that apply to all

connections.

L2TP VPN L2TP VPN Configure L2TP over IPSec tunnels.

BWM BWM Enable and configure bandwidth management rules.

Web

Authentication

Web Authentication

General/

Authentication

Type/Custom

Web Portal File/

Custom User

Agreement File/

Facebook WiFi

Define a web portal and exempt services from authentication.

SSO Configure the Zyxel Device to work with a Single Sign On agent.

Hotspot

Billing General Configure the general billing settings, such as the accounting

method.

Billing Profile Configure the billing profiles for the web-based account generator

and each button on the connected statement printer.

Discount Configure discount price plans.

Payment Service Enable online payment service and configure the service pages.

Printer

Manager General Configure the printer list, enable printer management and customize

the account printout.

Printout

Configuration

Detect the connected statement printers, change their IP addresses

and/or add them to the managed printer list.

Free Time Free Time Allow users to get a free account for Internet surfing during the

specified time period.

IPnP IPnP Enable IPnP on the Zyxel Device and the internal interface(s).

Walled Garden Walled Garden

General/URL Base/

Domain/IP Base

Create walled garden links that display in the login screen.

Advertisement Advertisement Enable and set advertisement links.

Security Policy

Table 7 Configuration Menu Screens Summary (continued)

FOLDER OR LINK TAB FUNCTION

Chapter 1 Introduction

ZyWALL USG FLEX Series User’s Guide

Policy Control Policy Create and manage level-3 traffic rules and apply Security Service

profiles.

ADP General Display and manage ADP bindings.

Profile Create and manage ADP profiles.

Session Control Session Control Limit the number of concurrent client NAT/security policy sessions.

Security Service

AppPatrol Profile Manage different types of traffic in this screen. Create App Patrol

template(s) of settings to apply to a traffic flow using a security policy.

Content Filter Profile Create and manage the detailed filtering rules for content filtering

profiles and then apply to a traffic flow using a security policy.

Trusted Web Sites Create a list of allowed web sites that bypass content filtering policies.

Forbidden Web Sites Create a list of web sites to block regardless of content filtering

policies.

Anti-Malware Anti-Malware Enable, specify actions to take when encountering malware or

compressed files, and set up a black list to identify files with malware

file patterns and a white list to identify files that should not be checked

for malware.

Black/White List Set up a black list to identify spam and a white list to identify

legitimate e-mail.

Signature Search for particular signatures to get more information about them.

Reputation

Filter URL Threat Filter

General/White List/

Black List

Enable URL filtering and specify what action the Zyxel Device takes

when a access attempt to a blocked website is detected.

You can also set up a white list to identify which IPv4 addresses and/or

URLs should be allowed, and a black list to identify which IPv4

addresses and/or URLs should be blocked.

IDP IDP Enable and configure IDP settings. Create, import, or export custom

signatures.

White List

Email Security Email Security Turn email security on or off and manage email security policies.

Create email security template(s) of settings to apply to a traffic flow

using a security policy.

Black/White List Set up a black list to identify spam and a white list to identify

legitimate email.

SSL Inspection Profile Decrypt HTTPS traffic for Security Service inspection. Create SSL

Inspection template(s) of settings to apply to a traffic flow using a

security policy.

Exclude List Configure services to be excluded from SSL Inspection.

Certificate Update Use this screen to update the latest certificates of servers using SSL

connections to the Zyxel Device network.

IP Exception IP Exception Use this screen to view the IP exception list for the anti-malware and

IDP (Intrusion, Detection, and Prevention) features.

The Zyxel Device won’t intercept nor inspect the incoming packets

that match the rules in the IP exception list for the anti-malware and/

or IDP (Intrusion, Detection, and Prevention) features.

Object

Zone Zone Configure zone template(s) used to define various policies.

Table 7 Configuration Menu Screens Summary (continued)

FOLDER OR LINK TAB FUNCTION

Chapter 1 Introduction

ZyWALL USG FLEX Series User’s Guide

User/Group User Create and manage users.

Group Create and manage groups of users.

Setting Manage default settings for all users, general settings for user sessions,

and rules to force user authentication.

MAC Address Configure the MAC addresses of wireless clients for MAC

authentication using the local user database.

AP Profile Radio Create template(s) of radio settings to apply to policies as an object.

SSID Create template(s) of wireless settings to apply to radio profiles or

policies as an object.

MON Profile MON Profile Create and manage rogue AP monitoring files that can be

associated with different APs.

ZyMesh Profile ZyMesh Profile Create and manage ZyMesh files that can be associated with

different APs.

Address/Geo IP Address Create and manage host, range, and network (subnet) addresses.

Address Group Create and manage groups of addresses to apply to policies as a

single objects.

Geo IP Update the database of country-to-IP address mappings and

manually configure country-to-IP address mappings for geographic

address objects that can be used in security policies.

Service Service Create and manage TCP and UDP services.

Service Group Create and manage groups of services to apply to policies as a single

object.

Schedule Schedule Create one-time and recurring schedules.

Schedule Group Create and manage groups of schedules to apply to policies as a

single object.

AAA Server Active Directory Configure the Active Directory settings.

LDAP Configure the LDAP settings.

RADIUS Configure the RADIUS settings.

Auth. Method Authentication

Method

Create and manage ways of authenticating users.

Two-factor

Authentication

Configure SMS/email authentication to access a secured network

behind the Zyxel Device via a VPN tunnel.

Certificate My Certificates Create and manage the Zyxel Device’s certificates.

Trusted Certificates Import and manage certificates from trusted sources.

ISP Account ISP Account Create and manage ISP account information for PPPoE/PPTP

interfaces.

DHCPv6 Request Configure IPv6 DHCP request type and interface information.

Lease Configure IPv6 DHCP lease type and interface information.

Device HA Device HA Status See the license status for Device HA Pro, and see the status of the

active and passive devices.

Use the screen (Section 36.4 on page 723) to

Device HA Pro Configure Device HA Pro global settings, monitored interfaces and

synchronization settings.

View Log See logs of the active and passive devices

Table 7 Configuration Menu Screens Summary (continued)

FOLDER OR LINK TAB FUNCTION

Chapter 1 Introduction

ZyWALL USG FLEX Series User’s Guide

Maintenance Menu

Use the maintenance menu screens to manage configuration and firmware files, run diagnostics, and

reboot or shut down the Zyxel Device.

Cloud CNM SecuManager Enable and configure management of the Zyxel Device by a Central

Network Management system.

SecuReporter Enable SecuReporter logging and access the SecuReporter security

analytics portal that collects and analyzes logs from your Zyxel Device

in order to identify anomalies, alert on potential internal / external

threats, and report on network usage.

System

Host Name Host Name Configure the system and domain name for the Zyxel Device.

USB Storage Settings Configure the settings for the connected USB devices.

Date/Time Date/Time Configure the current date, time, and time zone in the Zyxel Device.

Console Speed Console Speed Set the console speed.

DNS DNS Configure the DNS server and address records for the Zyxel Device.

WWW Service Control Configure HTTP, HTTPS, and general authentication.

SSH SSH Configure SSH server and SSH service settings.

TELNET TELNET Configure telnet server settings for the Zyxel Device.

FTP FTP Configure FTP server settings.

SNMP SNMP Configure SNMP communities and services.

Auth. Server Auth. Server Configure the Zyxel Device to act as a RADIUS server.

Notification Mail Server Configure a mail server with authentication to send reports and

password expiration notification emails.

SMS Enable the SMS service to send dynamic guest account information in

text messages and authorization for VPN tunnel access to a secured

network.

Language Language Select the Web Configurator language.

IPv6 IPv6 Enable IPv6 globally on the Zyxel Device here.

ZON ZON Use the Zyxel One Network (ZON) utility to view and manage the Zyxel

Device’s neighboring devices via the Zyxel Discovery Protocol (ZDP).

Log & Report

Email Daily

Report Email Daily Report Configure where and how to send daily reports and what reports to

send.

Log Settings Log Settings Configure the system log, email logs, and remote syslog servers.

Table 8 Maintenance Menu Screens Summary

FOLDER

OR LINK TAB FUNCTION

File

Manager

Configuration File Manage and upload configuration files for the Zyxel Device.

Firmware

Management

View the current firmware version and upload firmware. Reboot with your

choice of firmware.

Shell Script Manage and run shell script files for the Zyxel Device.

Table 7 Configuration Menu Screens Summary (continued)

FOLDER OR LINK TAB FUNCTION

Chapter 1 Introduction

ZyWALL USG FLEX Series User’s Guide

1.4.4 Tables and Lists

Web Configurator tables and lists are flexible with several options for how to display their entries.

Click a column heading to sort the table’s entries according to that column’s criteria.

Figure 17 Sorting Table Entries by a Column’s Criteria

Click the down arrow next to a column heading for more options about how to display the entries. The

options available vary depending on the type of fields in the column. Here are some examples of what

you can do:

• Sort in ascending or descending (reverse) alphabetical order

• Select which columns to display

•Group entries by field

Diagnostics Diagnostics

Collect

Collect on AP

Files

Collect diagnostic information.

Packet Capture Capture packets for analysis.

CPU/Memory

Status

View CPU and memory usage statistics.

System Log Connect a USB device to the Zyxel Device and archive the Zyxel Device system

logs to it here.

Network Tool Identify problems with the connections. You can use Ping or Traceroute to help

you identify problems.

Routing Traces Configure traceroute to identify where packets are dropped for

troubleshooting.

Wireless Frame

Capture

Capture wireless frames from APs for analysis.

Packet

Flow

Explore

Routing Status Check how the Zyxel Device determines where to route a packet.

SNAT Status View a clear picture on how the Zyxel Device converts a packet’s source IP

address and check the related settings.

Shutdown Shutdown Turn off the Zyxel Device.

Table 8 Maintenance Menu Screens Summary (continued)

FOLDER

OR LINK TAB FUNCTION

Chapter 1 Introduction

ZyWALL USG FLEX Series User’s Guide

•Show entries in groups

• Filter by mathematical operators (<, >, or =) or searching for text

Figure 18 Common Table Column Options

Select a column heading cell’s right border and drag to re-size the column.

Figure 19 Resizing a Table Column

Select a column heading and drag and drop it to change the column order. A green check mark

displays next to the column’s title when you drag the column to a valid new location.

Figure 20 Moving Columns

Use the icons and fields at the bottom of the table to navigate to different pages of entries and control

how many entries display at a time.

Figure 21 Navigating Pages of Table Entries

The tables have icons for working with table entries. You can often use the [Shift] or [Ctrl] key to select

multiple entries to remove, activate, or deactivate.

Figure 22 Common Table Icons

Chapter 1 Introduction

ZyWALL USG FLEX Series User’s Guide

Here are descriptions for the most common table icons.

Working with Lists

When a list of available entries displays next to a list of selected entries, you can often just double-click

an entry to move it from one list to the other. In some lists you can also use the [Shift] or [Ctrl] key to

select multiple entries, and then use the arrow button to move them to the other list.

Figure 23 Working with Lists

Table 9 Common Table Icons

LABEL DESCRIPTION

Add Click this to create a new entry. For features where the entry’s position in the numbered list is

important (features where the Zyxel Device applies the table’s entries in order like the security policy

for example), you can select an entry and click Add to create a new entry after the selected entry.

Edit Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s

settings. In some tables you can just click a table entry and edit it directly in the table. For those types

of tables small red triangles display for table entries with changes that you have not yet applied.

Remove To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it

before doing so.

Activate To turn on an entry, select it and click Activate.

Inactivate To turn off an entry, select it and click Inactivate.

Connect To connect an entry, select it and click Connect.

Disconnect To disconnect an entry, select it and click Disconnect.

References Select an entry and click References to check which settings use the entry.

Move To change an entry’s position in a numbered list, select it and click Move to display a field to type a

number for where you want to put that entry and press [ENTER] to move the entry to the number that

you typed. For example, if you type 6, the entry you are moving becomes number 6 and the previous

entry 6 (if there is one) gets pushed up (or down) one.

ZyWALL USG FLEX Series User’s Guide

CHAPTER 2

Initial Setup Wizard

2.1 Initial Setup Wizard Screens

When you log into the Web Configurator for the first time or when you reset the Zyxel Device to its

default configuration, the Initial Setup Wizard screen displays. This wizard helps you configure Internet

connection settings and activate subscription services.

Note: For Zyxel Devices that already have firmware version 4.25 or later, you have to register

your Zyxel Device and activate the corresponding service at myZyxel (through your

Zyxel Device).

This chapter provides information on configuring the Web Configurator's Initial Setup Wizard. See the

feature-specific chapters in this User’s Guide for background information.

• Click the double arrow in the upper right corner to display or hide the help.

• Click Logout to exit the Initial Setup Wizard or click Next to continue the wizard. Click Finish at the end

of the wizard to complete the wizard.

Figure 24 Initial Setup Wizard

2.1.1 Internet Access Setup - WAN Interface

Use this screen to set how many WAN interfaces to configure and the first WAN interface’s type of

encapsulation and method of IP address assignment.

Chapter 2 Initial Setup Wizard

ZyWALL USG FLEX Series User’s Guide

The screens vary depending on the encapsulation type. Refer to information provided by your ISP to

know what to enter in each field.

Note: Enter the Internet access information exactly as your ISP gave it to you. Leave a field

blank if you don’t have that information.

•I have two ISPs: Select this option to configure two Internet connections. Leave it cleared to configure

just one. This option appears when you are configuring the first WAN interface.

•Encapsulation: Choose the Ethernet option when the WAN port is used as a regular Ethernet. Choose

PPPoE, PPTP or L2TP for a dial-up connection according to the information from your ISP.

•WAN Interface: This is the interface you are configuring for Internet access.

•Zone: This is the security zone to which this interface and Internet connection belong.

•IP Address Assignment: Select Auto if your ISP did not assign you a fixed IP address.

Select Static if the ISP assigned a fixed IP address.

Figure 25 Internet Access

2.1.2 Internet Access: Ethernet

This screen is read-only if you set the previous screen’s IP Address Assignment field to Auto. If you set the

previous screen’s IP Address Assignment field to Static, use this screen to configure your IP address

settings.

•Encapsulation: This displays the type of Internet connection you are configuring.

•First WAN Interface: This is the number of the interface that will connect with your ISP.

•Zone: This is the security zone to which this interface and Internet connection will belong.

•IP Address: Enter your (static) public IP address. Auto displays if you selected Auto as the IP Address

Assignment in the previous screen.

The following fields display if you selected static IP address assignment.

•IP Subnet Mask: Enter the subnet mask for this WAN connection's IP address.

Chapter 2 Initial Setup Wizard

ZyWALL USG FLEX Series User’s Guide

•Gateway IP Address: Enter the IP address of the router through which this WAN connection will send

traffic (the default gateway).

•First / Second DNS Server: These fields display if you selected static IP address assignment. The Domain

Name System (DNS) maps a domain name to an IP address and vice versa. Enter a DNS server's IP

address(es). The DNS server is extremely important because without it, you must know the IP address

of a computer before you can access it. The Zyxel Device uses these (in the order you specify here) to

resolve domain names for VPN, DDNS and the time server. Leave the field as 0.0.0.0 if you do not want

to configure DNS servers.

2.1.2.1 Possible Errors

• Check that your cable connection is coming from the correct interface you’re using for the WAN

connection on the Zyxel Device.

• Check that the interface is connected to the device you’re using for Internet access such as a

broadband router and that the router is turned on. The LED of the interface you’re using for the WAN

connection on the Zyxel Device should be orange.

• If your Zyxel Device was not able to obtain an IP address, check that your Internet access information

uses DHCP as the WAN connection type. If it fails again, check with your Internet service provider or

administrator for correct WAN settings.

• If your Zyxel Device was not able to use the IP address entered, check that you were given an IP

address, subnet mask and gateway address as part of your Internet access information. Re-enter your

IP address, subnet mask and gateway IP address exactly as given. If it fails again, check with your

Internet service provider or administrator for correct IP address, subnet mask and gateway address

and other WAN settings.

Figure 26 Internet Access: Ethernet Encapsulation

2.1.3 Internet Access: PPPoE

2.1.3.1 ISP Parameters

• Type the PPPoE Service Name from your service provider. PPPoE uses a service name to identify and

reach the PPPoE server. You can use alphanumeric and -_@$./ characters, and it can be up to 64

characters long.

Chapter 2 Initial Setup Wizard

ZyWALL USG FLEX Series User’s Guide

•Authentication Type - Select an authentication protocol for outgoing connection requests. Options

are:

•Chap/PAP - Your Zyxel Device accepts either CHAP or PAP when requested by the remote node.

•Chap - Your Zyxel Device accepts CHAP only.

•PAP - Your Zyxel Device accepts PAP only.

•MSCHAP - Your Zyxel Device accepts MSCHAP only.

•MSCHAP-V2 - Your Zyxel Device accepts MSCHAP-V2 only.

• Type the User Name given to you by your ISP. You can use alphanumeric and -_@$./ characters, and

it can be up to 31 characters long.

•Type the Password associated with the user name. Use up to 64 ASCII characters except the [] and ?.

This field can be blank.

•Select Nailed-Up if you do not want the connection to time out. Otherwise, type the Idle Timeout in

seconds that elapses before the router automatically disconnects from the PPPoE server.

2.1.3.2 WAN IP Address Assignments

•WAN Interface: This is the name of the interface that will connect with your ISP.

•Zone: This is the security zone to which this interface and Internet connection will belong.

•IP Address: Enter your (static) public IP address. Auto displays if you selected Auto as the IP Address

Assignment in the previous screen.

•First / Second DNS Server: These fields display if you selected static IP address assignment. The Domain

Name System (DNS) maps a domain name to an IP address and vice versa. Enter a DNS server's IP

address(es). The DNS server is extremely important because without it, you must know the IP address

of a computer before you can access it. The Zyxel Device uses these (in the order you specify here) to

resolve domain names for VPN, DDNS and the time server. Leave the field as 0.0.0.0 if you do not want

to configure DNS servers. If you do not configure a DNS server, you must know the IP address of a

machine in order to access it.

2.1.3.3 Possible Errors

• Check that you’re using the correct PPPoE Service Name and Authentication Type.

• Make sure that your Internet access information uses PPPoE as the WAN connection type. Re-enter

your PPPoE user name and password exactly as given. If it fails again, check with your Internet service

provider or administrator for correct WAN settings and user credentials.

• If you were given an IP address and DNS server information as part of your Internet access

information, re-enter them exactly as given. If it fails again, check with your Internet service provider

or administrator for correct IP address, subnet mask and gateway address and other WAN settings.

Chapter 2 Initial Setup Wizard

ZyWALL USG FLEX Series User’s Guide

Figure 27 Internet Access: PPPoE Encapsulation

2.1.4 Internet Access: PPTP

2.1.4.1 ISP Parameters

•Authentication Type - Select an authentication protocol for outgoing calls. Options are:

•Chap/PAP - Your Zyxel Device accepts either CHAP or PAP when requested by the remote node.

•Chap - Your Zyxel Device accepts CHAP only.

•PAP - Your Zyxel Device accepts PAP only.

•MSCHAP - Your Zyxel Device accepts MSCHAP only.

•MSCHAP-V2 - Your Zyxel Device accepts MSCHAP-V2 only.

• Type the User Name given to you by your ISP. You can use alphanumeric and -_@$./ characters, and

it can be up to 31 characters long.

•Type the Password associated with the user name. Use up to 64 ASCII characters except the [] and ?.

This field can be blank. Re-type your password in the next field to confirm it.

•Select Nailed-Up if you do not want the connection to time out. Otherwise, type the Idle Timeout in

seconds that elapses before the router automatically disconnects from the PPTP server.

2.1.4.2 PPTP Configuration

•Base Interface: This identifies the Ethernet interface you configure to connect with a modem or router.

•Type a Base IP Address (static) assigned to you by your ISP.

• Type the IP Subnet Mask assigned to you by your ISP (if given).

•Gateway IP Address: Enter the IP address of the router through which this WAN connection will send

traffic (the default gateway).

•Server IP: Type the IP address of the PPTP server.

Chapter 2 Initial Setup Wizard

ZyWALL USG FLEX Series User’s Guide

•Type a Connection ID or connection name. It must follow the “c:id” and “n:name” format. For

example, C:12 or N:My ISP. This field is optional and depends on the requirements of your broadband

modem or router. You can use alphanumeric and -_: characters, and it can be up to 31 characters

long.

2.1.4.3 WAN IP Address Assignments

•First WAN Interface: This is the connection type on the interface you are configuring to connect with

your ISP.

•Zone This is the security zone to which this interface and Internet connection will belong.

•IP Address: Enter your (static) public IP address. Auto displays if you selected Auto as the IP Address

Assignment in the previous screen.

•First / Second DNS Server: These fields display if you selected static IP address assignment. The Domain

Name System (DNS) maps a domain name to an IP address and vice versa. Enter a DNS server's IP

address(es). The DNS server is extremely important because without it, you must know the IP address

of a computer before you can access it. The Zyxel Device uses these (in the order you specify here) to

resolve domain names for VPN, DDNS and the time server. Leave the field as 0.0.0.0 if you do not want

to configure DNS servers.

2.1.4.4 Possible Errors

• Check that you’re using the correct PPPT Service IP, Base IP Address, IP Subnet Mask, Gateway IP

Address, Connection ID and Authentication Type.

• Make sure that your Internet access information uses PPTP as the WAN connection type. Re-enter your

PPTP user name and password exactly as given. If it fails again, check with your Internet service

provider or administrator for correct WAN settings and user credentials.

• If you were given an IP address and DNS server information as part of your Internet access

information, re-enter them exactly as given. If it fails again, check with your Internet service provider

or administrator for correct IP address, subnet mask and gateway address and other WAN settings.

Chapter 2 Initial Setup Wizard

ZyWALL USG FLEX Series User’s Guide

Figure 28 Internet Access: PPTP Encapsulation

2.1.5 Internet Access: L2TP

2.1.5.1 ISP Parameters

•Authentication Type - Select an authentication protocol for outgoing connection requests. Options

are:

•Chap/PAP - Your Zyxel Device accepts either CHAP or PAP when requested by the remote node.

•Chap - Your Zyxel Device accepts CHAP only.

•PAP - Your Zyxel Device accepts PAP only.

•MSCHAP - Your Zyxel Device accepts MSCHAP only.

•MSCHAP-V2 - Your Zyxel Device accepts MSCHAP-V2 only.

• Type the User Name given to you by your ISP. You can use alphanumeric and -_@$./ characters, and

it can be up to 31 characters long.

•Type the Password associated with the user name. Use up to 64 ASCII characters except the [] and ?.

This field can be blank.

•Select Nailed-Up if you do not want the connection to time out. Otherwise, type the Idle Timeout in

seconds that elapses before the router automatically disconnects from the PPPoE server.

2.1.5.2 L2TP Configuration

•Base Interface: This identifies the Ethernet interface you configure to connect with a modem or router.

•Type a Base IP Address (static) assigned to you by your ISP.

Chapter 2 Initial Setup Wizard

ZyWALL USG FLEX Series User’s Guide

•IP Subnet Mask: Enter the subnet mask for this WAN connection's IP address.

•Gateway IP Address: Enter the IP address of the router through which this WAN connection will send

traffic (the default gateway).

•Server IP: Type the IP address of the L2TP server.

2.1.5.3 WAN IP Address Assignments

•WAN Interface: This is the name of the interface that will connect with your ISP.

•Zone: This is the security zone to which this interface and Internet connection will belong.

•IP Address: Enter your (static) public IP address. Auto displays if you selected Auto as the IP Address

Assignment in the previous screen.

•First / Second DNS Server: These fields display if you selected static IP address assignment. The Domain

Name System (DNS) maps a domain name to an IP address and vice versa. Enter a DNS server's IP

address(es). The DNS server is extremely important because without it, you must know the IP address

of a computer before you can access it. The Zyxel Device uses these (in the order you specify here) to

resolve domain names for VPN, DDNS and the time server. Leave the field as 0.0.0.0 if you do not want

to configure DNS servers.

2.1.5.4 Possible Errors

• Check that you’re using the correct L2PT Server IP, Subnet Mask, Gateway IP Address, IP S ubnet Mask

and Authentication Type.

• Make sure that your Internet access information uses L2TP as the WAN connection type. Re-enter your

L2TP user name and password exactly as given. If it fails again, check with your Internet service

provider or administrator for correct WAN settings and user credentials.

• If you were given an IP address and DNS server information as part of your Internet access

information, re-enter them exactly as given. If it fails again, check with your Internet service provider

or administrator for correct IP address, subnet mask and gateway address and other WAN settings.

Chapter 2 Initial Setup Wizard

ZyWALL USG FLEX Series User’s Guide

Figure 29 Internet Access: L2TP Encapsulation

2.1.6 Internet Access Setup - Second WAN Interface

If you selected I have two ISPs, after you configure the First WAN Interface, you can configure the

Second WAN Interface. The screens for configuring the second WAN interface are similar to the first (see

Section 2.1.1 on page 49).

Chapter 2 Initial Setup Wizard

ZyWALL USG FLEX Series User’s Guide

Figure 30 Internet Access: Step 3: Second WAN Interface

2.1.7 Internet Access: Congratulations

You have set up your Zyxel Device to access the Internet. A screen displays with your settings. Click

Connection Test to check that you can access the Internet. If you cannot, click Back and confirm that

you entered the settings correctly. If you have, check that you got the correct settings from your ISP or

network administrator.

Figure 31 Internet Access: Summary

Chapter 2 Initial Setup Wizard

ZyWALL USG FLEX Series User’s Guide

2.1.8 Date and Time Settings

It’s important to have correct date and time values in the logs. The Zyxel Device can automatically

update the time and date by detecting your time zone and whether Daylight Savings is in effect in that

time zone.

If your Zyxel Device cannot get the correct date and time, it may not able to connect to a time server.

Check that the Zyxel Device has Internet access, then click Sync. Now.

Figure 32 Date and Time Settings

2.1.9 Register Device

Click the Register button in this screen to register your device at portal.myzyxel.com.

Note: The Zyxel Device must be connected to the Internet in order to register.

Chapter 2 Initial Setup Wizard

ZyWALL USG FLEX Series User’s Guide

Figure 33 Register Device

You may need the Zyxel Device’s serial number and LAN MAC address to register it at myZyxel if you

have not already done so. Refer to the label at the back of the Zyxel Device’s for details.

Figure 34 myZyxel Login

Click Refresh or use the Configuration > Licensing > Registration screen to update your Zyxel Device

registration status.

Chapter 2 Initial Setup Wizard

ZyWALL USG FLEX Series User’s Guide

Figure 35 Registered Device

2.1.10 Activate Service

After you register your Zyxel Device, you can register for the services supported by your model. See

Subscription Services Available on page 188 for more information on the subscription services for the two

types of security packs.

Here are the services available for the Zyxel Device.

• Web Filtering (CF): access a database that can block websites by category.

• IPS (IDP): use this feature to detect Intrusion Detection and Prevention attacks.

• Application Patrol: use signatures for Application Patrol inspection to manage the use of various

applications on the network.

• Anti-Malware: use signatures to detect malware patterns in files.

• Email Security (Anti-Spam): use anti-spam signatures to mark or discard spam (unsolicited commercial

or junk email).

• SecuReporter: collect and analyze logs from your Zyxel Device in order to identify anomalies, notify

you of potential internal or external threats, and report on network usage.

Chapter 2 Initial Setup Wizard

ZyWALL USG FLEX Series User’s Guide

Figure 36 USG FLEX 500 Activate Service

Click Refresh and wait a few moments for the registration information to update in this screen. If the

page does not refresh, make sure the Internet connection is working and click Refresh again. To check

your Internet connection, try to access the Internet from a computer connected to a LAN port on the

Zyxel Device. If you cannot, then check your Internet access settings on the Zyxel Device.

2.1.11 Service Settings

You can enable or disable the following features in this screen. This screen varies depending on the

security pack that you purchase. See Subscription Services Available on page 188 for more information

on the subscription services for the two types of security packs.

Note: Select the I have read SecuReporter GDPR and agree policy check box to have

SecuReporter collect and analyze logs from this Zyxel Device. This check box won’t

appear again if you have already selected this before.

•URL Threat Filter: Use this feature to detect and block access to specific URLs, by comparing URL

addresses of sites that users attempt to access with a database of either permitted or blocked sites.

•Anti-Malware: Use this feature to detect malware patterns in files.

•IDP: Use this feature to detect Intrusion Detection and Prevention attacks.

•Content Filter: Use this feature to access a database that can block websites by category.

•App Patrol: Use this feature to manage the use of various applications on the network.

•Email Security: Use this feature to mark or discard spam (unsolicited commercial or junk email).

•SecuReporter: Use this feature to collect and analyze logs from your Zyxel Device in order to identify

anomalies, notify you of potential internal or external threats, and report on network usage.

Chapter 2 Initial Setup Wizard

ZyWALL USG FLEX Series User’s Guide

Figure 37 USG FLEX Service Settings

2.1.12 Service Settings: SecuReporter

Use this screen to add the Zyxel Device to a new or existing organization, and choose the level of data

protection for traffic going through this Zyxel Device.

•Server Status: This is the connection status between the Zyxel Device and the SecuReporter server. This

field shows Connected when the Zyxel Device can synchronize with the SecuReporter server. This field

shows Timeout when the Zyxel Device can’t synchronize with the SecuReporter server. This field shows

Fail when the connection between the Zyxel Device and the SecuReporter server is down.

•Device Name: Enter the name of the Zyxel Device. This Zyxel Device will be added to a new or existing

organization.

•Organization: This field appears if you haven’t created an organization in the SecuReporter server.

Type a name of up to 255 characters and description to create a new organization.

•Select from existing organization: Select an existing organization from the drop-down list box to add

the Zyxel Device to the selected organization.

•Create new organization: Type a name of up to 255 characters and description to create a new

organization.

•Partially Anonymous: Select this and personal data, such as user names, MAC addresses, email

addresses, and host names, will be replaced with artificial identifiers in downloaded logs.

•Fully Anonymous: Select this and personal data, such as user names, MAC addresses, email

addresses, and host names, will be replaced with anonymized information in downloaded logs.

•Non-Anonymous: Select this and personal data, such as user names, MAC addresses, email

addresses, and host names, will be identifiable in downloaded logs.

Chapter 2 Initial Setup Wizard

ZyWALL USG FLEX Series User’s Guide

Figure 38 SecuReporter Settings

The following screen appears when the Zyxel Device is already added in an organization.

Figure 39 SecuReporter Settings

2.1.13 Wireless Settings: Management Mode

The Manag ement Mode screen appears for Zyxel Devices that have a built-in AP. Select Built -in AP if you

want WiFi clients to access your Zyxel Device wirelessly. Select AP Controller to allow the Zyxel Device to

manage APs in the same network as the Zyxel Device. Both modes cannot work simultaneously. Click

Next to continue the wizard.

Chapter 2 Initial Setup Wizard

ZyWALL USG FLEX Series User’s Guide

Figure 40 Wireless Setup Wizard > Management Mode (Models with Built-in AP)

2.1.14 Wireless Settings: AP Controller

The Zyxel Device can act as an AP Controller that can manage APs in the same network as the Zyxel

Device. Select Yes if you want your Zyxel Device to manage APs in your network; otherwise select No.

Figure 41 Wireless Setup Wizard > Management Mode

2.1.15 Wireless Settings: SSID & Security

Configure SSID and wireless security in this screen.

SSID Setting

•SSID - Enter a descriptive name of up to 32 printable characters for the wireless LAN.

•Security Mode - Select Pre-Shared Key to add security on this wireless network. Otherwise, select None

to allow any wireless client to associate this network without authentication.

•Pre-Shared Key - Enter a pre-shared key of between 8 and 63 case-sensitive ASCII characters

(including spaces and symbols) or 64 hexadecimal characters.

Chapter 2 Initial Setup Wizard

ZyWALL USG FLEX Series User’s Guide

•Hidden SSID - Select this option if you want to hide the SSID in the outgoing beacon frame. A wireless

client then cannot obtain the SSID through scanning using a site survey tool.

•Enable Intra-BSS Traffic Blocking - Select this option if you want to prevent crossover traffic from within

the same SSID. Wireless clients can still access the wired network but cannot communicate with each

other.

For Zyxel Devices with Built-in AP Only

Bridged to: Zyxel Devices with W in the model name have a built-in AP. Select an interface to bridge with

the built-in AP wireless network. Devices connected to this interface will then be in the same broadcast

domain as devices in the AP wireless network.

Figure 42 Wireless Settings: SSID & Security

2.1.16 Remote Management

Select this to allow access to the Zyxel Device using HTTP or HTTPS from the Internet.

Chapter 2 Initial Setup Wizard

ZyWALL USG FLEX Series User’s Guide

Figure 43 Remote Management

HTTPS is added to the Default_Allow_WAN_to_ZyWALL rule in Object > Service > Service Group screen

when you enable Remote Management.

Figure 44 Object > Service > Service Group - HTTPS

ZyWALL USG FLEX Series User’s Guide

CHAPTER 3

Hardware, Interfaces and

Zones

3.1 Hardware Overview

This section describes the front and rear panels for each model.

The following table summarizes the port features of the Zyxel Device by model.

For information on interface names by model, default port / interface name mapping, and default

interface / zone mapping please see Section 3.3 on page 75.

3.1.1 Front Panels

The LED indicators are located on the front panel.

Figure 45 USG FLEX 100 Front Panel

Figure 46 USG FLEX 200 Front Panel

Figure 47 USG FLEX 500 Front Panel

Table 10 USG FLEX Series Port Comparison Table

USG FLEX MODELS USG FLEX 100 USG FLEX 200 USG FLEX 500

USB 3.0 Ports 1 2 2

1 Gbps SFP interface 1 1 1

10/100/1000 Mbps Ethernet WAN Ports 1 2 -

10/100/1000 Mbps Ethernet Ports 4 4 7

Console Port 1 1 1

Chapter 3 Hardware, Interfaces and Zones

ZyWALL USG FLEX Series User’s Guide

The following table describes the front panel LEDs.

Table 11 LED Descriptions

LED COLOR STATUS DESCRIPTION

PWR Off The Zyxel Device is turned off.

Green On The Zyxel Device is turned on.

Red On There is a hardware component failure. Shut down the device, wait for a few

minutes and then restart the device. If the LED turns red again, then please

contact your vendor.

SYS Green Off The Zyxel Device is not ready or has failed.

On The Zyxel Device is ready and running.

Blinking The Zyxel Device is booting.

Red On The Zyxel Device has an error or has failed.

2.4G Green Off The 2.4G wireless interface is off.

On The 2.4G wireless interface is ready.

Blinking The 2.4G wireless connection is active.

5G Green Off The 5G wireless interface is off.

On The 5G wireless interface is ready.

Blinking The 5G wireless connection is active.

P1 (SFP)

LINK Yellow Off There is no connection on this port.

On This port has a successful 1000 Mbps link.

Green Off There is no connection on this port.

On This port has a successful 100 Mbps link.

ACT Green Off There is no traffic on this port.

Blinking The Zyxel Device is sending or receiving packets on this port at 100/1000 Mbps.

P2, P3...

(WAN/

LAN/

DMZ)

Yellow Off There is no connection on this port.

On This port has a successful 1000 Mbps link.

Blinking The Zyxel Device is sending or receiving packets on this port at 1000 Mbps.

Green Off There is no connection on this port.

On This port has a successful 10/100 Mbps link.

Blinking The Zyxel Device is sending or receiving packets on this port at 10/100 Mbps.

Chapter 3 Hardware, Interfaces and Zones

ZyWALL USG FLEX Series User’s Guide

The following table describes the ports on the front panel.

3.1.2 Rear Panels

The connection ports are located on the rear panel.

Figure 48 USG FLEX 100 Rear Panel

Figure 49 USG FLEX 200 Rear Panel

Figure 50 USG FLEX 500 Rear Panel

Note: Make sure you connect the Zyxel Device's power cord to a socket-outlet with an

earthing connection or its equivalent.

Table 12 Front Panel Ports

LABEL DESCRIPTION

RESET Press the button in for about 5 seconds (or until the SYS LED starts to blink), then release it to

return the Zyxel Device to the factory defaults (password is 1234, LAN IP address 192.168.1.1

etc.)

CONSOLE You can use the console port to manage the Zyxel Device using CLI commands. You will be

prompted to enter your user name and password. See the Command Reference Guide for

more information about the CLI.

When configuring using the console port, you need a computer equipped with

communications software configured to the following parameters:

• Speed 115200 bps

• Data Bits 8

•Parity None

•Stop Bit 1

• Flow Control Off

USB Connect a storage device for system logs (see Maintenance > Diagnostics > System Log) and

storage (see Configuration > System > USB Storage).

P2-P7 ( USG FLEX

200)

P2-P8 ( USG FLEX

500)

P1-P12 ()

These are 1G RJ-45 Ethernet ports.

Chapter 3 Hardware, Interfaces and Zones

ZyWALL USG FLEX Series User’s Guide

The following table describes the items on the rear panel.

Note: Use an 8-wire Ethernet cable to run your Gigabit Ethernet connection at 1000 Mbps.

Using a 4-wire Ethernet cable limits your connection to 100 Mbps. Note that the

connection speed also depends on what the Ethernet device at the other end can

support.

3.2 Installation Scenarios

The Zyxel Device can be:

• Placed on a desktop.

• Wall-mounted on a wall.

• Rack-mounted on a standard EIA rack.

The following table summarizes the installation scenarios of the Zyxel Device by model.

WARNING! Do NOT block the ventilation holes on the Zyxel Device.

Allow 100 mm clearance for the ventilation holes to prevent your Zyxel

Device from overheating. Do not store things on the Zyxel Device. Do

not place a Zyxel Device on another high temperature device.

Overheating could affect the performance of your Zyxel Device, or

even damage it.

Table 13 Rear Panel Items

LABEL DESCRIPTION

Console You can use the console port to manage the Zyxel Device using CLI commands. You will be

prompted to enter your user name and password. See the Command Reference Guide for

more information about the CLI.

When configuring using the console port, you need a computer equipped with

communications software configured to the following parameters:

• Speed 115200 bps

• Data Bits 8

•Parity None

•Stop Bit 1

• Flow Control Off

Power Use the included power cord to connect the power socket to a power outlet. Turn the power

switch on if your Zyxel Device has a power switch.

Lock Attach a lock-and-cable from the Kensington lock (the small, metal-reinforced, oval hole) to a

permanent object, such as a pole, to secure the Zyxel Device in place.

Fan The fans are for cooling the Zyxel Device. Make sure they are not obstructed to allow maximum

ventilation.

Table 14 USG FLEX Series Installation Comparison Table

USG FLEX MODELS USG FLEX 100 USG FLEX 200 USG FLEX 500

Rubber feet for desktop placement Yes Yes Yes

Wall Mounting Yes Yes No

Rack Mounting No Yes Yes

Chapter 3 Hardware, Interfaces and Zones

ZyWALL USG FLEX Series User’s Guide

3.2.1 Desktop Installation Procedure

1Make sure the Zyxel Device is clean and dry.

2Remove the adhesive backing from the rubber feet.

3Attach the rubber feet to each corner on the bottom of the Zyxel Device. These rubber feet help

protect the Zyxel Device from shock or vibration, and allow air circulation.

Figure 51 Attaching Rubber Feet

4Set the Zyxel Device on a smooth, level surface strong enough to support the weight of the Zyxel Device

and the connected cables. Make sure there is a power outlet nearby.

Note: Make sure to use the rubber feet when stacking the Zyxel Devices on a desk.

3.2.2 Rack-mounting

Use the following steps to mount the Zyxel Device on an EIA standard size, 19-inch rack or in a wiring

closet with other equipment using a rack-mounting kit. Make sure the rack will safely support the

combined weight of all the equipment it contains and that the position of the ZyWALL does not make

the rack unstable or top-heavy. Take all necessary precautions to anchor the rack securely before

installing the unit.

Use a #2 Phillips screwdriver to install the screws.

Note: Failure to use the proper screws may damage the unit.

1Align one bracket with the holes on one side of the Zyxel Device and secure it with the included bracket

screws (smaller than the rack-mounting screws).

Chapter 3 Hardware, Interfaces and Zones

ZyWALL USG FLEX Series User’s Guide

2Attach the other bracket in a similar fashion.

Figure 52 Attach Brackets

3After attaching both mounting brackets, position the Zyxel Device in the rack and match up the bracket

holes with the rack holes. Secure the Zyxel Device to the rack with the rack-mounting screws.

Figure 53 Mount on Rack

Note: Make sure there is at least 100 mm of clearance at the sides and 100 mm in the rear to

allow air circulation and the attachment of cables and the power cord. When stacking

in a rack, make sure there is at least 40 mm of clearance between Zyxel Devices.

3.2.3 Wall-mounting

Do the following to attach your Zyxel Device to a wall.

The following table lists the distance “X” between mounting holes for each model:

1Drill into a wall two holes 3 mm - 4 mm (0.12" - 0.16") wide, 20 mm - 30 mm (0.79” - 1.18”) deep and a

distance X (see the preceding table) apart. Place two screw anchors in the holes.

Table 15 Distance “X” Between FLEX Mounting Holes

MODEL NAME DISTANCE “X”

USG FLEX 100 174 mm (6.85”)

USG FLEX 200 206 mm (8.11”)

Chapter 3 Hardware, Interfaces and Zones

ZyWALL USG FLEX Series User’s Guide

Figure 54 Wall Mounting Screw Specifications

2Screw two screws with 6 mm - 8 mm (0.24" - 0.31") wide heads into the screw anchors. Do not screw the

screws all the way in to the wall; leave a small gap between the head of the screw and the wall.

The gap must be big enough for the screw heads to slide into the screw slots and the connection cables

to run down the back of the Zyxel Device.

Note: Make sure the screws are securely fixed to the wall and strong enough to hold the

weight of the Zyxel Device with the connection cables.

3Use the holes on the bottom of the Zyxel Device to hang the Zyxel Device on the screws.

Figure 55 Wall Mounting

Note: Wall-mount the Zyxel Device horizontally. The Zyxel Device's side panels with ventilation

slots should not be facing up or down as this position is less safe.

Make sure there is 100 mm of clearance at the sides and 1 - 1.5 mm distance between

the screw head and the wall to allow air circulation and the attachment of cables and

the power cord.

Chapter 3 Hardware, Interfaces and Zones

ZyWALL USG FLEX Series User’s Guide

3.3 Default Zones, Interfaces, and Ports

The default configurations for zones, interfaces, and ports are as follows. References to interfaces may

be generic rather than the specific name used in your model. For example, this guide may use “the

WAN interface” rather than “wan1” or “wan2”, “ge2” or” ge3”.

An OPT (optional) Ethernet port can be configured as an additional WAN port, LAN, WLAN, or DMZ port.

The following table shows the default physical port and interface mapping for each model at the time

of writing.

The following table shows the default interface and zone mapping for each model at the time of

writing.

3.4 Stopping the Zyxel Device

Always use Maintenance > Shutdown > Shutdown or the shutdown command before you turn off the

Zyxel Device or remove the power. Not doing so can cause the firmware to become corrupt.

Table 16 Default Physical Port - Interface Mapping

PORT / INTERFACE P1 P2 P3 P4 P5 P6 P7 P8

• USG FLEX 100 sfp wan lan1 lan1 lan1 opt

• USG FLEX 200 sfp wan wan lan1 lan1 lan1 lan1

• USG FLEX 500 ge1 ge2 ge3 ge4 ge5 ge6 ge7 ge8

Table 17 Default Zone - Interface Mapping

ZONE / INTERFACE SFP WAN LAN1 LAN2 DMZ OPT

• USG FLEX 100 sfp_ppp WAN1_PPP LAN1 LAN2 DMZ opt_ppp

Table 18 Default Zone - Interface Mapping

ZONE / INTERFACE WAN LAN1 LAN2 DMZ OPT NO

DEFAULT

ZONE

• USG FLEX 200 WAN1

WAN1_PPP

WAN2

WAN2_PPP

LAN1 LAN2 DMZ SFP

SFP_PPP

GE7

GE7_PPP

GE8

GE8_PPP

Table 19 Default Zone - Interface Mapping

ZONE / INTERFACE WAN LAN DMZ OPT NO DEFAULT ZONE

• USG FLEX 500 GE2

GE2_PPP

GE3

GE3_PPP

GE4

GE5

GE6 GE1

GE1_PPP

GE7

GE7_PPP

GE8

GE8_PPP

ZyWALL USG FLEX Series User’s Guide

CHAPTER 4

Quick Setup Wizards

4.1 Quick Setup Overview

The Web Configurator's quick setup wizards help you configure Internet and VPN connection settings.

This chapter provides information on configuring the quick setup screens in the Web Configurator. See

the feature-specific chapters in this User’s Guide for background information.

In the Web Configurator, click Quick Setup to open the first Quick Setup screen.

Figure 56 USG FLEX Quick Setup

• WAN Interface

Click this link to open a wizard to set up a WAN (Internet) connection. This wizard creates matching ISP

account settings in the Zyxel Device if you use PPPoE or PPTP. See Section 4.2 on page 77.

• VPN Setup

Use VPN Setup to configure a VPN (Virtual Private Network) rule for a secure connection to another

computer or network. Use VPN Settings for Configuration Provisioning to set up a VPN rule that can be

retrieved with the Zyxel Device IPSec VPN Client. You only need to enter a user name, password and

the IP address of the Zyxel Device in the IPSec VPN Client to get all VPN settings automatically from

the Zyxel Device. See Section 4.3 on page 83. Use VPN Settings for L2TP VPN Settings to configure the

L2TP VPN for clients.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

• Wizard Help

If the help does not automatically display when you run the wizard, click the arrow to display it.

4.2 WAN Interface Quick Setup

Click WAN Interface in the main Quick Setup screen to open the WAN Interface Quick Setup Wizard

Welcome screen. Use these screens to configure an interface to connect to the Internet. Click Next.

Figure 57 WAN Interface Quick Setup Wizard

4.2.1 Choose an Ethernet Interface

Select a WAN interface (names vary by model) that you want to configure for a WAN connection and

click Next.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

Figure 58 Choose an Ethernet Interface

4.2.2 Select WAN Type

WAN Type Selection: Select the type of encapsulation this connection is to use. Choose Ethernet when

the WAN port is used as a regular Ethernet.

Otherwise, choose PPPoE, PPTP or L2TP for a dial-up connection according to the information from your

ISP.

Figure 59 WAN Interface Setup: Step 2

The screens vary depending on what encapsulation type you use. Refer to information provided by your

ISP to know what to enter in each field. Leave a field blank if you don’t have that information.

Note: Enter the Internet access information exactly as your ISP gave it to you.

4.2.3 Configure WAN IP Settings

Use this screen to select whether the interface should use a fixed or dynamic IP address.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

Figure 60 WAN Interface Setup: Step 2 Ethernet Dynamic IP

Figure 61 WAN Interface Setup: Step 2 Ethernet Static IP

•WAN Interface: This is the interface you are configuring for Internet access.

•Zone: This is the security zone to which this interface and Internet connection belong.

•IP Address Assignment: Select Auto If your ISP did not assign you a fixed IP address.

Select Static if you have a fixed IP address and enter the IP address, subnet mask, gateway IP address

(optional) and DNS server IP address(es).

4.2.4 ISP and WAN and ISP Connection Settings

Use this screen to configure the ISP and WAN interface settings. This screen is read-only if you select

Ethernet and set the IP Address Assignment to Auto. If you set the IP Address Assignment to Static and/or

select PPTP or PPPoE, enter the Internet access information exactly as your ISP gave it to you.

Note: Enter the Internet access information exactly as your ISP gave it to you.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

Figure 62 WAN and ISP Connection Settings: (PPTP)

Figure 63 WAN and ISP Connection Settings: (PPPoE)

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

Figure 64 WAN and ISP Connection Settings: (L2TP)

ISP Parameter: This section appears if the interface uses a PPPoE or PPTP Internet connection.

•Encapsulation: This displays the type of Internet connection you are configuring.

•Service Name: Type the PPPoE service name if you were given one by your ISP.

•Authentication Type: Use the drop-down list box to select an authentication protocol for outgoing

calls. Options are:

•CHAP/PAP - Your Zyxel Device accepts either CHAP or PAP when requested by this remote node.

•CHAP - Your Zyxel Device accepts CHAP only.

•PAP - Your Zyxel Device accepts PAP only.

•MSCHAP - Your Zyxel Device accepts MSCHAP only.

•MSCHAP-V2 - Your Zyxel Device accepts MSCHAP-V2 only.

•User Name: Type the user name given to you by your ISP. You can use alphanumeric and -_@$./

characters, and it can be up to 31 characters long.

•Password: Type the password associated with the user name above. Use up to 64 ASCII characters

except the [] and ?. This field can be blank.

•Retype to Confirm: Type your password again for confirmation.

•Nailed-Up: Select Nailed-Up if you do not want the connection to time out.

•Idle Timeout: Type the time in seconds that elapses before the router automatically disconnects from

the PPPoE server. 0 means no timeout.

•PPTP Configuration: This section only appears if the interface uses a PPTP Internet connection.

•Base Interface: This displays the identity of the Ethernet interface you configure to connect with a

modem or router.

•Base IP Address: Type the (static) IP address assigned to you by your ISP.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

•IP Subnet Mask: Type the subnet mask assigned to you by your ISP (if given).

•Gateway IP Address: For PPTP or L2TP, type the gateway IP address if you were given one by your ISP.

•Server IP: Type the IP address of the PPTP server.

•Connection ID: Enter the connection ID or connection name in this field. It must follow the "c:id" and

"n:name" format. For example, C:12 or N:My ISP. This field is optional and depends on the

requirements of your DSL modem. You can use alphanumeric and -_: characters, and it can be up to

31 characters long.

IP Address Assignment

•WAN Interface: This displays the identity of the interface you configure to connect with your ISP.

•Zone: This field displays to which security zone this interface and Internet connection will belong.

•IP Address: This field is read-only when the WAN interface uses a dynamic IP address. If your WAN

interface uses a static IP address, enter it in this field.

•IP Subnet Mask: If your WAN interface uses Ethernet encapsulation with a static IP address, enter the

subnet mask in this field.

•Gateway IP Address: Type the IP address of the Ethernet device connected to this WAN port.

•First DNS Server / Second DNS Server: These fields only display for an interface with a static IP address.

Enter the DNS server IP address(es) in the field(s) to the right. Leave the field as 0.0.0.0 if you do not

want to configure DNS servers. If you do not configure a DNS server, you must know the IP address of

a machine in order to access it.

4.2.5 Quick Setup Interface Wizard: Summary

This screen displays an example WAN interface’s settings.

Figure 65 Interface Wizard: Summary WAN

•Encapsulation: This displays what encapsulation this interface uses to connect to the Internet.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

•Service Name: This field only appears for a PPPoE interface. It displays the PPPoE service name

specified in the ISP account.

•Server IP: This field only appears for a PPTP interface. It displays the IP address of the PPTP server.

•User Name: This is the user name given to you by your ISP.

•Nailed-Up: If No displays the connection will not time out. Yes means the Zyxel Device uses the idle

timeout.

•Idle Timeout: This is how many seconds the connection can be idle before the router automatically

disconnects from the PPPoE server. 0 means no timeout.

•Connection ID: If you specified a connection ID, it displays here.

•WAN Interface: This identifies the interface you configure to connect with your ISP.

•Zone: This field displays to which security zone this interface and Internet connection will belong.

•IP Address Assignment: This field displays whether the WAN IP address is static or dynamic (Auto).

•IP Address: This field displays the current IP address of the Zyxel Device WAN interface selected in this

wizard.

•IP Subnet Mask: This field displays the subnet mask of the Zyxel Device WAN interface selected in this

wizard.

•Gateway IP Address: This field displays the IP address of the Ethernet device connected to this WAN

port.

•First DNS Server /Second DNS Serve r: If the IP Address Assignment is Static, these fields display the DNS

server IP address(es).

4.3 VPN Setup Wizard

Click VPN Setup in the main Quick Setup screen to open the VPN Setup Wizard Welcome screen.

Figure 66 VPN Setup Wizard

4.3.1 Welcome

Use wizards to create Virtual Private Network (VPN) rules. After you complete the wizard, the Phase 1 rule

settings appear in the Configuration > VPN > IPSec VPN > VPN Gateway screen and the Phase 2 rule

settings appear in the Configuration > VPN > IPSec VPN > VPN Connection screen.

•VPN Settings configures a VPN tunnel for a secure connection to another computer or network.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

•VPN Settings for Configuration Provisioning sets up a VPN rule the Zyxel Device IPSec VPN Client can

retrieve. Just enter a user name, password and the IP address of the Zyxel Device in the IPSec VPN

Client to get the VPN settings automatically from the Zyxel Device.

•VPN Settings for L2TP VPN Settings sets up a L2TP VPN rule that the Zyxel Device IPSec L2TP VPN client

can retrieve.

Figure 67 VPN Setup Wizard Welcome

4.3.2 VPN Setup Wizard: Wizard Type

Choose Express to create a VPN rule with the default phase 1 and phase 2 settings to connect to

another ZLD-based Zyxel Device using a pre-shared key.

Choose Advanced to change the default settings and/or use certificates instead of a pre-shared key to

create a VPN rule to connect to another IPSec device.

Figure 68 VPN Setup Wizard: Wizard Type

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

4.3.3 VPN Express Wizard - Scenario

Click the Express radio button as shown in Figure 68 on page 84 to display the following screen.

Figure 69 VPN Express Wizard: Scenario

IKE (Internet Key Exchange) Version: IKEv1 and IKEv2

IKE (Internet Key Exchange) is a protocol used in security associations to send data securely. IKE uses

certificates or pre-shared keys for authentication and a Diffie–Hellman key exchange to set up a shared

session secret from which encryption keys are derived.

IKEv2 supports Extended Authentication Protocol (EAP) authentication, and IKEv1 supports X-Auth. EAP is

important when connecting to existing enterprise authentication systems.

Scenario

Rule Name: Type the name used to identify this VPN connection (and VPN gateway). You may use 1-31

alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a number.

This value is case-sensitive.

Select the scenario that best describes your intended VPN connection. The figure on the left of the

screen changes to match the scenario you select.

•Site-to-site - The remote IPSec device has a static IP address or a domain name. This Zyxel Device can

initiate the VPN tunnel.

•Site-to-site with Dynamic Peer - The remote IPSec device has a dynamic IP address. Only the remote

IPSec device can initiate the VPN tunnel.

•Remote Access (Server Role) - Allow incoming connections from IPSec VPN clients. The clients have

dynamic IP addresses and are also known as dial-in users. Only the clients can initiate the VPN tunnel.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

•Remote Access (Client Role) - Connect to an IPSec server. This Zyxel Device is the client (dial-in user)

and can initiate the VPN tunnel.

4.3.4 VPN Express Wizard - Configuration

Figure 70 VPN Express Wizard: Configuration

•My Address (interface): Select an interface from the drop-down list box to use on your Zyxel Device.

•Secure Gateway: Any displays in this field if it is not configurable for the chosen scenario. Otherwise,

enter the WAN IP address or domain name of the remote IPSec device (secure gateway) to identify

the remote IPSec router by its IP address or a domain name. Use 0.0.0.0 if the remote IPSec router has

a dynamic WAN IP address.

•Pre-Shared Key: Type the password. Both ends of the VPN tunnel must use the same password. Use 8

to 31 case-sensitive ASCII characters or 8 to 31 pairs of hexadecimal (“0-9”, “A-F”) characters.

Proceed a hexadecimal key with “0x”. You will receive a PYLD_MALFORMED (payload malformed)

packet if the same pre-shared key is not used on both ends.

•Local Policy (IP/Mask): Type the IP address of a computer on your network that can use the tunnel.

You can also specify a subnet. This must match the remote IP address configured on the remote IPSec

device.

•Remote Policy (IP/Mask): Any displays in this field if it is not configurable for the chosen scenario.

Otherwise, type the IP address of a computer behind the remote IPSec device. You can also specify

a subnet. This must match the local IP address configured on the remote IPSec device.

4.3.5 VPN Express Wizard - Summary

This screen provides a read-only summary of the VPN tunnel’s configuration and commands that you

can copy and paste into another ZLD-based Zyxel Device’s command line interface to configure it.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

Figure 71 VPN Express Wizard: Summary

•Rule Name: Identifies the VPN gateway policy.

•Secure Gateway: IP address or domain name of the remote IPSec device. If this field displays Any,

only the remote IPSec device can initiate the VPN connection.

•Pre-Shared Key: VPN tunnel password. It identifies a communicating party during a phase 1 IKE

negotiation.

•Local Policy: IP address and subnet mask of the computers on the network behind your Zyxel Device

that can use the tunnel.

•Remote Policy: IP address and subnet mask of the computers on the network behind the remote

IPSec device that can use the tunnel. If this field displays Any, only the remote IPSec device can

initiate the VPN connection.

• Copy and paste the Configuration for Secure Gateway commands into another ZLD-based Zyxel

Device’s command line interface to configure it to serve as the other end of this VPN tunnel. You can

also use a text editor to save these commands as a shell script file with a “.zysh” filename extension.

Use the file manager to run the script in order to configure the VPN connection. See the commands

reference guide for details on the commands displayed in this list.

4.3.6 VPN Express Wizard - Finish

Now the rule is configured on the Zyxel Device. The Phase 1 rule settings appear in the VPN > IPSec VPN

> VPN Gateway screen and the Phase 2 rule settings appear in the VPN > IPSec VPN > VPN Connection

screen.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

Figure 72 VPN Express Wizard: Finish

Click Close to exit the wizard.

4.3.7 VPN Advanced Wizard - Scenario

Click the Advanced radio button as shown in Figure 68 on page 84 to display the following screen.

Figure 73 VPN Advanced Wizard: Scenario

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

IKE (Internet Key Exchange) Version: IKEv1 and IKEv2

IKE (Internet Key Exchange) is a protocol used in security associations to send data securely. IKE uses

certificates or pre-shared keys for authentication and a Diffie–Hellman key exchange to set up a shared

session secret from which encryption keys are derived.

IKEv2 supports Extended Authentication Protocol (EAP) authentication, and IKEv1 supports X-Auth. EAP is

important when connecting to existing enterprise authentication systems.

Scenario

Rule Name: Type the name used to identify this VPN connection (and VPN gateway). You may use 1-31

alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a number.

This value is case-sensitive.

Select the scenario that best describes your intended VPN connection. The figure on the left of the

screen changes to match the scenario you select.

•Site-to-site - The remote IPSec device has a static IP address or a domain name. This Zyxel Device can

initiate the VPN tunnel.

•Site-to-site with Dynamic Peer - The remote IPSec device has a dynamic IP address. Only the remote

IPSec device can initiate the VPN tunnel.

•Remote Access (Server Role) - Allow incoming connections from IPSec VPN clients. The clients have

dynamic IP addresses and are also known as dial-in users. Only the clients can initiate the VPN tunnel.

•Remote Access (Client Role) - Connect to an IPSec server. This Zyxel Device is the client (dial-in user)

and can initiate the VPN tunnel.

4.3.8 VPN Advanced Wizard - Phase 1 Settings

There are two phases to every IKE (Internet Key Exchange) negotiation – phase 1 (Authentication) and

phase 2 (Key Exchange). A phase 1 exchange establishes an IKE SA (Security Association).

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

Figure 74 VPN Advanced Wizard: Phase 1 Settings

•Secure Gateway: Any displays in this field if it is not configurable for the chosen scenario. Otherwise,

enter the WAN IP address or domain name of the remote IPSec device (secure gateway) to identify

the remote IPSec device by its IP address or a domain name. Use 0.0.0.0 if the remote IPSec device

has a dynamic WAN IP address.

•My Address (interface): Select an interface from the drop-down list box to use on your Zyxel Device.

•Negotiation Mode: This displays Main or Aggressive:

•Main encrypts the ZyWALL/USG’s and remote IPSec router’s identities but takes more time to

establish the IKE SA.

•Aggressive is faster but does not encrypt the identities.

The ZyWALL/USG and the remote IPSec router must use the same negotiation mode. Multiple SAs

connecting through a secure gateway must have the same negotiation mode.

•Encryption Algorithm: 3DES and AES use encryption. The longer the key, the higher the security (this

may affect throughput). Both sender and receiver must use the same secret key, which can be used

to encrypt and decrypt the message or to generate and verify a message authentication code. The

DES encryption algorithm uses a 56-bit key. Triple DES (3DES) is a variation on DES that uses a 168-bit

key. As a result, 3DES is more secure than DES. It also requires more processing power, resulting in

increased latency and decreased throughput. AES128 uses a 128-bit key and is faster than 3DES.

AES192 uses a 192-bit key, and AES256 uses a 256-bit key.

•Authentication Algorithm: MD5 gives minimal security and SHA512 gives the highest security. MD5

(Message Digest 5) and SHA (Secure Hash Algorithm) are hash algorithms used to authenticate

packet data. The stronger the algorithm the slower it is.

•Key Group: DH5 is more secure than DH1 or DH2 (although it may affect throughput). DH1 (default)

refers to Diffie-Hellman Group 1 a 768 bit random number. DH2 refers to Diffie-Hellman Group 2 a 1024

bit (1Kb) random number. DH5 refers to Diffie-Hellman Group 5 a 1536 bit random number.

•SA Life Time: Set how often the Zyxel Device renegotiates the IKE SA. A short SA life time increases

security, but renegotiation temporarily disconnects the VPN tunnel.

•NAT Traversal: Select this if the VPN tunnel must pass through NAT (there is a NAT router between the

IPSec devices).

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

Note: The remote IPSec device must also have NAT traversal enabled. See the help in the

main IPSec VPN screens for more information.

•Dead Peer Detection (DPD) has the Zyxel Device make sure the remote IPSec device is there before

transmitting data through the IKE SA. If there has been no traffic for at least 15 seconds, the Zyxel

Device sends a message to the remote IPSec device. If it responds, the Zyxel Device transmits the

data. If it does not respond, the Zyxel Device shuts down the IKE SA.

•Authentication Method: Select Pre-Shared Key to use a password or Certificate to use one of the Zyxel

Device’s certificates.

4.3.9 VPN Advanced Wizard - Phase 2

Phase 2 in an IKE uses the SA that was established in phase 1 to negotiate SAs for IPSec.

Figure 75 VPN Advanced Wizard: Phase 2 Settings

•Active Protocol: ESP is compatible with NAT, AH is not.

•Encapsulation: Tunnel is compatible with NAT, Transport is not.

•Encryption Algorithm: 3DES and AES use encryption. The longer the AES key, the higher the security

(this may affect throughput). Null uses no encryption.

•Authentication Algorithm: MD5 gives minimal security and SHA512 gives the highest security. MD5

(Message Digest 5) and SHA (Secure Hash Algorithm) are hash algorithms used to authenticate

packet data. The stronger the algorithm the slower it is.

•SA Life Time: Set how often the Zyxel Device renegotiates the IKE SA. A short SA life time increases

security, but renegotiation temporarily disconnects the VPN tunnel.

•Perfect Forward Secrecy (PFS): Disabling PFS allows faster IPSec setup, but is less secure. Select DH1,

DH2 or DH5 to enable PFS. DH5 is more secure than DH1 or DH2 (although it may affect throughput).

DH1 refers to Diffie-Hellman Group 1 a 768 bit random number. DH2 refers to Diffie-Hellman Group 2 a

1024 bit (1Kb) random number. DH5 refers to Diffie-Hellman Group 5 a 1536 bit random number (more

secure, yet slower).

•Local Policy (IP/Mask): Type the IP address of a computer on your network. You can also specify a

subnet. This must match the remote IP address configured on the remote IPSec device.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

•Remote Policy (IP/Mask): Type the IP address of a computer behind the remote IPSec device. You

can also specify a subnet. This must match the local IP address configured on the remote IPSec

device.

•Nailed-Up: This displays for the site-to-site and remote access client role scenarios. Select this to have

the Zyxel Device automatically renegotiate the IPSec SA when the SA life time expires.

4.3.10 VPN Advanced Wizard - Summary

This is a read-only summary of the VPN tunnel settings.

Figure 76 VPN Advanced Wizard: Summary

•Rule Name: Identifies the VPN connection (and the VPN gateway).

•Secure Gateway: IP address or domain name of the remote IPSec device.

•Pre-Shared Key: VPN tunnel password.

•Certificate: The certificate the Zyxel Device uses to identify itself when setting up the VPN tunnel.

•Local Policy: IP address and subnet mask of the computers on the network behind your Zyxel Device

that can use the tunnel.

•Remote Policy: IP address and subnet mask of the computers on the network behind the remote

IPSec device that can use the tunnel.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

Phase 1

•Negotiation Mode: This displays Main or Aggressive:

•Main encrypts the ZyWALL/USG’s and remote IPSec router’s identities but takes more time to

establish the IKE SA.

•Aggressive is faster but does not encrypt the identities.

The ZyWALL/USG and the remote IPSec router must use the same negotiation mode. Multiple SAs

connecting through a secure gateway must have the same negotiation mode.

•Encryption Algorithm: This displays the encryption method used. The longer the key, the higher the

security, the lower the throughput (possibly).

•DES uses a 56-bit key.

•3DES uses a 168-bit key.

•AES128 uses a 128-bit key.

•AES192 uses a 192-bit key.

•AES256 uses a 256-bit key.

•Authentication Algorithm: This displays the authentication algorithm used. The stronger the algorithm,

the slower it is.

•MD5 gives minimal security.

•SHA1 gives higher security.

•SHA256 gives the highest security.

•Key Group: This displays the Diffie-Hellman (DH) key group used. DH5 is more secure than DH1 or DH2

(although it may affect throughput).

•DH1 uses a 768 bit random number.

•DH2 uses a 1024 bit (1Kb) random number.

•DH5 uses a 1536 bit random number.

Phase 2

•Active Protocol: This displays ESP (compatible with NAT) or AH.

•Encapsulation: This displays Tunnel (compatible with NAT) or Transport.

•Encryption Algorithm: This displays the encryption method used. The longer the key, the higher the

security, the lower the throughput (possibly).

•DES uses a 56-bit key.

•3DES uses a 168-bit key.

•AES128 uses a 128-bit key.

•AES192 uses a 192-bit key.

•AES256 uses a 256-bit key.

•Null uses no encryption.

•Authentication Algorithm: This displays the authentication algorithm used. The stronger the algorithm,

the slower it is.

•MD5 gives minimal security.

•SHA1 gives higher security.

•SHA256 gives the highest security.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

Copy and paste the Configuration for Remote Gateway commands into another ZLD-based Zyxel

Device’s command line interface.

Click Save to save the VPN rule.

4.3.11 VPN Advanced Wizard - Finish

Now the rule is configured on the Zyxel Device. The Phase 1 rule settings appear in the VPN > IPSec VPN

> VPN Gateway screen and the Phase 2 rule settings appear in the VPN > IPSec VPN > VPN Connection

screen.

Figure 77 VPN Wizard: Finish

Click Close to exit the wizard.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

4.4 VPN Settings for Configuration Provisioning Wizard:

Wizard Type

Use VPN Settings for Configuration Provisioning to set up a VPN rule that can be retrieved with the Zyxel

Device IPSec VPN Client.

VPN rules for the Zyxel Device IPSec VPN Client have certain restrictions. They must not contain the

following settings:

•AH active protocol

•NULL encryption

•SHA512 authentication

• A subnet or range remote policy

Choose Express to create a VPN rule with the default phase 1 and phase 2 settings and to use a pre-

shared key.

Choose Advanced to change the default settings and/or use certificates instead of a pre-shared key in

the VPN rule.

Figure 78 VPN Settings for Configuration Provisioning Express Wizard: Wizard Type

4.4.1 Configuration Provisioning Express Wizard - VPN Settings

Click the Express radio button as shown in the previous screen to display the following screen.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

Figure 79 VPN for Configuration Provisioning Express Wizard: Settings Scenario

•IKE (Internet Key Exchange) is a protocol used in security associations to send data securely. IKE uses

certificates or pre-shared keys for authentication and a Diffie–Hellman key exchange to set up a

shared session secret from which encryption keys are derived.

•IKEv2 supports Extended Authentication Protocol (EAP) authentication, and IKEv1 supports X-Auth.

EAP is important when connecting to existing enterprise authentication systems.

•Rule Name: Type the name used to identify this VPN connection (and VPN gateway). You may use 1-

31 alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a

number. This value is case-sensitive.

•Application Scenario: Only the Remote Access (Server Role) is allowed in this wizard. It allows

incoming connections from the Zyxel Device IPSec VPN Client.

4.4.2 Configuration Provisioning VPN Express Wizard - Configuration

Click Next to continue the wizard.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

Figure 80 VPN for Configuration Provisioning Express Wizard: Configuration

•My Address (interface): Select an interface from the drop-down list box to use on your Zyxel Device.

•Secure Gateway: Any displays in this field because it is not configurable in this wizard. It allows

incoming connections from the Zyxel Device IPSec VPN Client.

•Pre-Shared Key: Type the password. Both ends of the VPN tunnel must use the same password. Use 8

to 31 case-sensitive ASCII characters or 8 to 31 pairs of hexadecimal (“0-9”, “A-F”) characters.

Proceed a hexadecimal key with “0x”. You will receive a PYLD_MALFORMED (payload malformed)

packet if the same pre-shared key is not used on both ends.

•Local Policy (IP/Mask): Type the IP address of a computer on your network. You can also specify a

subnet. This must match the remote IP address configured on the remote IPSec device.

•Remote Policy (IP/Mask): Any displays in this field because it is not configurable in this wizard.

4.4.3 VPN Settings for Configuration Provisioning Express Wizard - Summary

This screen has a read-only summary of the VPN tunnel’s configuration and commands you can copy

and paste into another ZLD-based Zyxel Device’s command line interface to configure it.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

Figure 81 VPN for Configuration Provisioning Express Wizard: Summary

•Rule Name: Identifies the VPN gateway policy.

•Secure Gateway: Any displays in this field because it is not configurable in this wizard. It allows

incoming connections from the Zyxel Device IPSec VPN Client.

•Pre-Shared Key: VPN tunnel password. It identifies a communicating party during a phase 1 IKE

negotiation.

•Local Policy: (Static) IP address and subnet mask of the computers on the network behind your Zyxel

Device that can be accessed using the tunnel.

•Remote Policy: Any displays in this field because it is not configurable in this wizard.

• The Configuration for Secure Gateway displays the configuration that the Zyxel Device IPSec VPN

Client will get from the Zyxel Device.

• Click Save to save the VPN rule.

4.4.4 VPN Settings for Configuration Provisioning Express Wizard - Finish

The rule is now configured on the Zyxel Device. The Phase 1 rule settings appear in the Configuration >

VPN > IPSec VPN > VPN Gateway screen and the Phase 2 rule settings appear in the Configuration > VPN

> IPSec VPN > VPN Connection screen. Enter the IP address of the Zyxel Device in the Zyxel Device IPSec

VPN Client to get all these VPN settings automatically from the Zyxel Device.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

Figure 82 VPN for Configuration Provisioning Express Wizard: Finish

Click Close to exit the wizard.

4.4.5 VPN Settings for Configuration Provisioning Advanced Wizard -

Scenario

Click the Advanced radio button as shown in Figure 78 on page 95 to display the following screen.

Figure 83 VPN for Configuration Provisioning Advanced Wizard: Scenario Settings

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

100

•IKE (Internet Key Exchange) is a protocol used in security associations to send data securely. IKE uses

certificates or pre-shared keys for authentication and a Diffie–Hellman key exchange to set up a

shared session secret from which encryption keys are derived.

•IKEv2 supports Extended Authentication Protocol (EAP) authentication, and IKEv1 supports X-Auth.

EAP is important when connecting to existing enterprise authentication systems.

•Rule Name: Type the name used to identify this VPN connection (and VPN gateway). You may use 1-

31 alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a

number. This value is case-sensitive.

•Application Scenario: Only the Remote Access (Server Role) is allowed in this wizard. It allows

incoming connections from the Zyxel Device IPSec VPN Client.

Click Next to continue the wizard.

4.4.6 VPN Settings for Configuration Provisioning Advanced Wizard - Phase

1 Settings

There are two phases to every IKE (Internet Key Exchange) negotiation – phase 1 (Authentication) and

phase 2 (Key Exchange). A phase 1 exchange establishes an IKE SA (Security Association).

Figure 84 VPN for Configuration Provisioning Advanced Wizard: Phase 1 Settings

•Secure Gateway: Any displays in this field because it is not configurable in this wizard. It allows

incoming connections from the Zyxel Device IPSec VPN Client.

•My Address (interface): Select an interface from the drop-down list box to use on your Zyxel Device.

•Negotiation Mode: This displays Main or Aggressive:

•Main encrypts the ZyWALL/USG’s and remote IPSec router’s identities but takes more time to

establish the IKE SA.

•Aggressive is faster but does not encrypt the identities.

The ZyWALL/USG and the remote IPSec router must use the same negotiation mode. Multiple SAs

connecting through a secure gateway must have the same negotiation mode.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

101

•Encryption Algorithm: 3DES and AES use encryption. The longer the key, the higher the security (this

may affect throughput). Both sender and receiver must know the same secret key, which can be

used to encrypt and decrypt the message or to generate and verify a message authentication code.

The DES encryption algorithm uses a 56-bit key. Triple DES (3DES) is a variation on DES that uses a 168-

bit key. As a result, 3DES is more secure than DES. It also requires more processing power, resulting in

increased latency and decreased throughput. AES128 uses a 128-bit key and is faster than 3DES.

AES192 uses a 192-bit key and AES256 uses a 256-bit key.

•Authentication Algorithm: MD5 (Message Digest 5) and SHA (Secure Hash Algorithm) are hash

algorithms used to authenticate packet data. MD5 gives minimal security. SHA1 gives higher security

and SHA256 gives the highest security. The stronger the algorithm, the slower it is.

•Key Group: DH5 is more secure than DH1 or DH2 (although it may affect throughput). DH1 (default)

refers to Diffie-Hellman Group 1 a 768 bit random number. DH2 refers to Diffie-Hellman Group 2 a 1024

bit (1Kb) random number. DH5 refers to Diffie-Hellman Group 5 a 1536 bit random number.

•SA Life Time: Set how often the Zyxel Device renegotiates the IKE SA. A short SA life time increases

security, but renegotiation temporarily disconnects the VPN tunnel.

•Authentication Method: Select Pre-Shared Key to use a password or Certificate to use one of the Zyxel

Device’s certificates.

4.4.7 VPN Settings for Configuration Provisioning Advanced Wizard - Phase

Phase 2 in an IKE uses the SA that was established in phase 1 to negotiate SAs for IPSec.

Figure 85 VPN for Configuration Provisioning Advanced Wizard: Phase 2 Settings

•Active Protocol: ESP is compatible with NAT. AH is not available in this wizard.

•Encapsulation: Tunnel is compatible with NAT, Transport is not.

•Encryption Algorithm: 3DES and AES use encryption. The longer the AES key, the higher the security

(this may affect throughput). Null uses no encryption.

•Authentication Algorithm: MD5 (Message Digest 5) and SHA (Secure Hash Algorithm) are hash

algorithms used to authenticate packet data. MD5 gives minimal security. SHA1 gives higher security

and SHA256 gives the highest security. The stronger the algorithm, the slower it is.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

102

•SA Life Time: Set how often the Zyxel Device renegotiates the IKE SA. A short SA life time increases

security, but renegotiation temporarily disconnects the VPN tunnel.

•Perfect Forward Secrecy (PFS): Disabling PFS allows faster IPSec setup, but is less secure. Select DH1,

DH2 or DH5 to enable PFS. DH5 is more secure than DH1 or DH2 (although it may affect throughput).

DH1 refers to Diffie-Hellman Group 1 a 768 bit random number. DH2 refers to Diffie-Hellman Group 2 a

1024 bit (1Kb) random number. DH5 refers to Diffie-Hellman Group 5 a 1536 bit random number (more

secure, yet slower).

•Local Policy (IP/Mask): Type the IP address of a computer on your network. You can also specify a

subnet. This must match the remote IP address configured on the remote IPSec device.

•Remote Policy (IP/Mask): Any displays in this field because it is not configurable in this wizard.

•Nailed-Up: This displays for the site-to-site and remote access client role scenarios. Select this to have

the Zyxel Device automatically renegotiate the IPSec SA when the SA life time expires.

4.4.8 VPN Settings for Configuration Provisioning Advanced Wizard -

Summary

This is a read-only summary of the VPN tunnel settings.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

103

Figure 86 VPN for Configuration Provisioning Advanced Wizard: Summary

Summary

•Rule Name: Identifies the VPN connection (and the VPN gateway).

•Secure Gateway: Any displays in this field because it is not configurable in this wizard. It allows

incoming connections from the Zyxel Device IPSec VPN Client.

•Pre-Shared Key: VPN tunnel password.

•Local Policy: IP address and subnet mask of the computers on the network behind your Zyxel Device

that can use the tunnel.

•Remote Policy: Any displays in this field because it is not configurable in this wizard.

Phase 1

•Negotiation Mode: This displays Main or Aggressive:

•Main encrypts the ZyWALL/USG’s and remote IPSec router’s identities but takes more time to

establish the IKE SA.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

104

•Aggressive is faster but does not encrypt the identities.

The ZyWALL/USG and the remote IPSec router must use the same negotiation mode. Multiple SAs

connecting through a secure gateway must have the same negotiation mode.

•Encryption Algorithm: This displays the encryption method used. The longer the key, the higher the

security, the lower the throughput (possibly).

•DES uses a 56-bit key.

•3DES uses a 168-bit key.

•AES128 uses a 128-bit key.

•AES192 uses a 192-bit key.

•AES256 uses a 256-bit key.

•Authentication Algorithm: This displays the authentication algorithm used. The stronger the algorithm,

the slower it is.

•MD5 gives minimal security.

•SHA1 gives higher security.

•SHA256 gives the highest security.

•Key Group: This displays the Diffie-Hellman (DH) key group used. DH5 is more secure than DH1 or DH2

(although it may affect throughput).

•DH1 uses a 768 bit random number.

•DH2 uses a 1024 bit (1Kb) random number.

•DH5 uses a 1536 bit random number.

Phase 2

•Active Protocol: This displays ESP (compatible with NAT) or AH.

•Encapsulation: This displays Tunnel (compatible with NAT) or Transport.

•Encryption Algorithm: This displays the encryption method used. The longer the key, the higher the

security, the lower the throughput (possibly).

•DES uses a 56-bit key.

•3DES uses a 168-bit key.

•AES128 uses a 128-bit key.

•AES192 uses a 192-bit key.

•AES256 uses a 256-bit key.

•Null uses no encryption.

•Authentication Algorithm: This displays the authentication algorithm used. The stronger the algorithm,

the slower it is.

•MD5 gives minimal security.

•SHA1 gives higher security.

•SHA256 gives the highest security.

The Configuration for Secure Gateway displays the configuration that the Zyxel Device IPSec VPN Client

will get from the Zyxel Device.

Click Save to save the VPN rule.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

105

4.4.9 VPN Settings for Configuration Provisioning Advanced Wizard - Finish

The rule is now configured on the Zyxel Device. The Phase 1 rule settings appear in the VPN > IPSec VPN

> VPN Gateway screen and the Phase 2 rule settings appear in the VPN > IPSec VPN > VPN Connection

screen. Enter the IP address of the Zyxel Device in the Zyxel Device IPSec VPN Client to get all these VPN

settings automatically from the Zyxel Device.

Figure 87 VPN for Configuration Provisioning Advanced Wizard: Finish

Click Close to exit the wizard.

4.5 VPN Settings for L2TP VPN Settings Wizard

Use VPN Settings for L2TP VPN Settings to set up an L2TP VPN rule. Click Configuration > Quick Setup >

VPN Setup and select VPN Settings for L2TP VPN Settings to see the following screen.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

106

Figure 88 VPN Settings for L2TP VPN Settings Wizard: L2TP VPN Settings

Click Next to continue the wizard.

4.5.1 L2TP VPN Settings

Figure 89 VPN Settings for L2TP VPN Settings Wizard: L2TP VPN Settings

•Rule Name: Type the name used to identify this L2TP VPN connection (and L2TP VPN gateway). You

may use 1-31 alphanumeric characters, underscores (_), or dashes (-), but the first character cannot

be a number. This value is case-sensitive.

•My Address (interface): Select one of the interfaces from the pull down menu to apply the L2TP VPN

rule.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

107

•Pre-Shared Key: Type the password. Both ends of the VPN tunnel must use the same password. Use 8

to 31 case-sensitive ASCII characters or 8 to 31 pairs of hexadecimal (“0-9”, “A-F”) characters.

Proceed a hexadecimal key with “0x”. You will receive a PYLD_MALFORMED (payload malformed)

packet if the same pre-shared key is not used on both ends.

• Click Next to continue the wizard.

4.5.2 L2TP VPN Settings

Figure 90 VPN Settings for L2TP VPN Settings Wizard: L2TP VPN Settings

•IP Address Pool: Select RANGE or SUBNET from the pull down menu. This IP address pool is used to

assign to the L2TP VPN clients.

•Starting IP Address: Enter the starting IP address in the field.

•End IP Address: Enter the ending IP address in the field.

•Network: Enter the IPv4 IP address in this field if you selected SUBNET.

•Netmask: Enter the associated subnet mask of the subnet in this field.

•First DNS Server (Optional): Enter the first DNS server IP address in the field. Leave the field as 0.0.0.0 if

you do not want to configure DNS servers. If you do not configure a DNS server you must know the IP

address of a machine in order to access it.

•Second DNS Server (Optional): Enter the second DNS server IP address in the field. Leave the field as

0.0.0.0 if you do not want to configure DNS servers. If you do not configure a DNS server you must

know the IP address of a machine in order to access it.

•Allow L2TP traffic Through WAN: Select this check box to allow traffic from L2TP clients to go to the

Internet.

Click Next to continue the wizard.

Note: DNS (Domain Name System) is for mapping a domain name to its corresponding IP

address and vice versa. The DNS server is extremely important because without it, you

must know the IP address of a computer before you can access it. The Zyxel Device

uses a system DNS server (in the order you specify here) to resolve domain names for

VPN, DDNS and the time server.

4.5.3 VPN Settings for L2TP VPN Setting Wizard - Summary

This is a read-only summary of the L2TP VPN settings.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

108

Figure 91 VPN Settings for L2TP VPN Settings Advanced Settings Wizard: Summary

•Rule Name: Identifies the L2TP VPN connection (and the L2TP VPN gateway).

•Secure Gateway: Any displays in this field because it is not configurable in this wizard. It allows

incoming connections from the L2TP VPN Client.

•Pre-Shared Key: L2TP VPN tunnel password.

•My Address (Interface): This displays the interface to use on your Zyxel Device for the L2TP tunnel.

•IP Address Pool: This displays the IP address pool used to assign to the L2TP VPN clients.

Click Save to complete the L2TP VPN Setting and the following screen will show.

Chapter 4 Quick Setup Wizards

ZyWALL USG FLEX Series User’s Guide

109

4.5.4 VPN Settings for L2TP VPN Setting Wizard - Completed

Figure 92 VPN Settings for L2TP VPN Settings Wizard: Finish

Te rule is now configured on the Zyxel Device. The L2TP VPN rule settings appear in the Configuration >

VPN > L2TP VPN screen and also in the Configuration > VPN > IPSec VPN > VPN Connection and VPN

Gateway screen.

ZyWALL USG FLEX Series User’s Guide

110

CHAPTER 5

Dashboard

5.1 Overview

Use the Dashboard screens to check status information about the Zyxel Device.

5.1.1 What You Can Do in this Chapter

Use the main Dashboard screen to see the Zyxel Device’s general device information, system status, and

system resource usage. You can also display other status screens for more information.

Use the Dashboard screens to view the following.

•Device Information Screen on page 112

•System Status Screen on page 113

•Tx/Rx Statistics on page 113

•The Latest Logs Screen on page 114

•System Resources Screen on page 114

•DHCP Table Screen on page 115

•Number of Login Users Screen on page 116

•Current Login User on page 117

•VPN Status on page 117

•SSL VPN Status on page 118

•The Advanced Threat Protection Screen on page 118

5.2 The General Screen

The Dashboard screen displays when you log into the Zyxel Device or click Dashboard in the navigation

panel. The dashboard displays general device information, system status, system resource usage,

licensed service status, and interface status in widgets that you can re-arrange to suit your needs. You

can also collapse, refresh, and close individual widgets.

Click on the icon to go to the OneSecurity website where there is guidance on configuration

walkthroughs, troubleshooting, and other information.

The following screen is an example of a Brand 2.0 web configurator web style.

Chapter 5 Dashboard

ZyWALL USG FLEX Series User’s Guide

111

Figure 93 Dashboard USG FLEX

The following table describes the labels in this screen.

Table 20 Dashboard

LABEL DESCRIPTION

Refresh Now Click this to update the widget’s information immediately.

Virtual Device

Rear Panel Click this to view details about the Zyxel Device’s rear panel. Hover your cursor over a

connected interface or slot to display status details.

Front Panel Click this to view details about the status of the Zyxel Device’s front panel LEDs and

connections. See Section 3.1.1 on page 68 for LED descriptions. An unconnected interface or

slot appears grayed out.

The following front and rear panel labels display when you hover your cursor over a connected

interface or slot.

Name This field displays the name of each interface.

Chapter 5 Dashboard

ZyWALL USG FLEX Series User’s Guide

112

5.2.1 Device Information Screen

The Device Information screen displays Zyxel Device’s system and model name, serial number, MAC

address and firmware version shown in the below screen.

Figure 94 Dashboard > Device Information (Example)

This table describes the fields in the above screen.

Status This field displays the current status of each interface or device installed in a slot. The possible

values depend on what type of interface it is.

Inactive - The Ethernet interface is disabled.

Down - The Ethernet interface does not have any physical ports associated with it or the

Ethernet interface is enabled but not connected.

Speed / Duplex - The Ethernet interface is enabled and connected. This field displays the port

speed and duplex setting (Full or Half).

The status for a WLAN card is none.

For cellular (mobile broadband) interfaces, see Section 9.6 on page 253 for the status that can

appear.

For the auxiliary interface:

Inactive - The auxiliary interface is disabled.

Connected - The auxiliary interface is enabled and connected.

Disconnected - The auxiliary interface is not connected.

Zone This field displays the zone to which the interface is currently assigned.

IP Address/

Mask This field displays the current IP address and subnet mask assigned to the interface. If the

interface is a member of an active virtual router, this field displays the IP address it is currently

using. This is either the static IP address of the interface (if it is the master) or the management

IP address (if it is a backup).

Table 20 Dashboard (continued)

LABEL DESCRIPTION

Table 21 Dashboard > Device Information

LABEL DESCRIPTION

System Name This field displays the name used to identify the Zyxel Device on any network. Click

the link and open the Host Name screen where you can edit and make changes to

the system and domain name.

Serial Number This field displays the serial number of this Zyxel Device. The serial number is used for

device tracking and control.

Chapter 5 Dashboard

ZyWALL USG FLEX Series User’s Guide

113

5.2.2 System Status Screen

Figure 95 Dashboard > System Status (Example)

This table describes the fields in the above screen.

5.2.3 Tx/Rx Statistic s

This screen displays a line graph of packet statistics for each physical port.

MAC Address Range This field displays the MAC addresses used by the Zyxel Device. Each physical port

has one MAC address. The first MAC address is assigned to physical port 1, the

second MAC address is assigned to physical port 2, and so on.

Firmware Version This field displays the version number and date of the firmware the Zyxel Device is

currently running. Click the link to open the Firmware Package screen where you

can upload firmware.

Table 21 Dashboard > Device Information

LABEL DESCRIPTION

Table 22 Dashboard > System Status

LABEL DESCRIPTION

Boot Status This field displays details about the Zyxel Device’s startup state.

OK - The Zyxel Device started up successfully.

Firmware update OK - A firmware update was successful.

Problematic configuration after firmware update - The application of the

configuration failed after a firmware upgrade.

System default configuration - The Zyxel Device successfully applied the system

default configuration. This occurs when the Zyxel Device starts for the first time or you

intentionally reset the Zyxel Device to the system default settings.

Fallback to lastgood configuration - The Zyxel Device was unable to apply the

startup-config.conf configuration file and fell back to the lastgood.conf

configuration file.

Fallback to system default configuration - The Zyxel Device was unable to apply the

lastgood.conf configuration file and fell back to the system default configuration file

(system-default.conf).

Booting in progress - The Zyxel Device is still applying the system configuration.

System Uptime This field displays how long the Zyxel Device has been running since it last restarted

or was turned on.

Current Date/Time This field displays the current date and time in the Zyxel Device. The format is yyyy-

mm-dd hh:mm:ss. Click on the link to see the Date/Time screen where you can make

edits and changes to the date, time and time zone information.

Chapter 5 Dashboard

ZyWALL USG FLEX Series User’s Guide

114

Figure 96 Dashboard > Tx/Rx Statistics

This table describes the fields in the above screen.

5.2.4 The Latest Logs Screen

Figure 97 Dashboard > The Lastest Logs

This table describes the fields in the above screen.

5.2.5 System Resources Screen

Click the bar to see a graphic on that resource.

Table 23 Dashboard > The Lastest Logs

LABEL DESCRIPTION

Mbps The y-axis represents the speed of transmission or reception.

Time The x-axis shows the time period over which the transmission or reception occurred.

Table 24 Dashboard > The Lastest Logs

LABEL DESCRIPTION

#This is the entry’s rank in the list of alert logs.

Time This field displays the date and time the log was created.

Priority This field displays the severity of the log.

Category This field displays the type of log generated.

Message This field displays the actual log message.

Source This field displays the source address (if any) in the packet that generated the log.

Destination This field displays the destination address (if any) in the packet that generated the

log.

Chapter 5 Dashboard

ZyWALL USG FLEX Series User’s Guide

115

Figure 98 Dashboard > System Resources

This table describes the fields in the above screen.

5.2.6 DHCP Table Screen

Click on the number to look at the IP addresses currently assigned to DHCP clients and the IP addresses

reserved for specific MAC addresses. The following screen will show.

Table 25 Dashboard > System Resources

LABEL DESCRIPTION

CPU Usage This field displays what percentage of the Zyxel Device’s processing capability is

currently being used. Hover your cursor over this field to display the Show CPU Usage

icon that takes you to a chart of the Zyxel Device’s recent CPU usage.

Memory Usage This field displays what percentage of the Zyxel Device’s RAM is currently being used.

Hover your cursor over this field to display the Show Memory Usage icon that takes

you to a chart of the Zyxel Device’s recent memory usage.

Flash Usage This field displays what percentage of the Zyxel Device’s onboard flash memory is

currently being used.

USB Storage Usage This field shows how much storage in the USB device connected to the Zyxel Device

is in use.

Active Sessions This field shows how many sessions, established and non-established, that pass

through/from/to/within the ZyWALL. Hover your cursor over this field to display icons.

Click the Detail icon to go to the Session Monitor screen to see details about the

active sessions. Click the Show Active Sessions icon to display a chart of Zyxel

Device’s recent session usage.

Chapter 5 Dashboard

ZyWALL USG FLEX Series User’s Guide

116

Figure 99 Dashboard > DHCP Table

This table describes the fields in the above screen.

5.2.7 Number of Login Users Screen

Click the Number of Login Users link to see the following screen.

Table 26 Dashboard > DHCP Table

LABEL DESCRIPTION

Refresh Interval Select how often you want this window to be updated automatically.

Refresh Now Click this to update the information in the window right away.

#This field is a sequential value, and it is not associated with a specific entry.

Interface This field identifies the interface that assigned an IP address to a DHCP client.

IP Address This field displays the IP address currently assigned to a DHCP client or reserved for a

specific MAC address. Click the column’s heading cell to sort the table entries by IP

address. Click the heading cell again to reverse the sort order.

Host Name This field displays the name used to identify this device on the network (the

computer name). The Zyxel Device learns these from the DHCP client requests.

“None” shows here for a static DHCP entry.

MAC Address This field displays the MAC address to which the IP address is currently assigned or for

which the IP address is reserved. Click the column’s heading cell to sort the table

entries by MAC address. Click the heading cell again to reverse the sort order.

Expiration Time This is the period of time DHCP-assigned addresses is used.

Description For a static DHCP entry, the host name or the description you configured shows

here. This field is blank for dynamic DHCP entries.

Reserve If this field is selected, this entry is a static DHCP entry. The IP address is reserved for

the MAC address.

If this field is clear, this entry is a dynamic DHCP entry. The IP address is assigned to a

DHCP client.

To create a static DHCP entry using an existing dynamic DHCP entry, select this field,

and then click Apply.

To remove a static DHCP entry, clear this field, and then click Apply.

Chapter 5 Dashboard

ZyWALL USG FLEX Series User’s Guide

117

Figure 100 Dashboard > Number of Login Users

This table describes the fields in the above screen.

5.2.8 Current Login User

This field displays the user name used to log in to the current session, the amount of reauthentication

time remaining, and the amount of lease time remaining.

Figure 101 Dashboard > Current Login User

5.2.9 VPN Status

Click on the link to look at the VPN tunnels that are currently established.

Figure 102 Dashboard > VPN Status

Table 27 Dashboard > Number of Login Users

LABEL DESCRIPTION

#This field is a sequential value and is not associated with any entry.

User ID This field displays the user name of each user who is currently logged in to the Zyxel

Device.

Reauth/Lease Time This field displays the amount of reauthentication time remaining and the amount of

lease time remaining for each user.

Session Timeout This field displays the total account of time the account (authenticated by an

external server) can use to log into the UAG or access the Internet through the Zyxel

Device.

This shows unlimited for an administrator account.

Type This field displays the way the user logged in to the Zyxel Device.

IP address This field displays the IP address of the computer used to log in to the Zyxel Device.

User Info This field displays the types of user accounts the Zyxel Device uses. If the user type is

ext-user (external user), this field will show its external-group information when you

move your mouse over it.

If the external user matches two external-group objects, both external-group object

names will be shown.

Force Logout Click this icon to end a user’s session.

Chapter 5 Dashboard

ZyWALL USG FLEX Series User’s Guide

118

This table describes the fields in the above screen.

5.2.10 SSL VPN Status

The first number is the actual number of VPN tunnels up and the second number is the maximum

number of SSL VPN tunnels allowed.

Figure 103 Dashboard > SSL VPN Status

5.3 The Advanced Threat Protection Screen

Use the Advanced Threat Protection screen to check security status information about the Zyxel Device.

Figure 104 Dashboard > Advanced Threat Protection - USG FLEX Series

This screen gives the following information:

Table 28 Dashboard > VPN Status

LABEL DESCRIPTION

#This field is a sequential value and is not associated with any entry.

Name This field displays the name of the VPN tunnel.

Encapsulation This field displays the type of encapsulation the VPN tunnel uses.

Algorithm This field displays the hash algorithm that the VPN tunnel uses to authenticate

packet data.

Refresh Interval Select how often you want this window to be updated automatically.

Refresh Now Click this to update the information in the window right away.

Chapter 5 Dashboard

ZyWALL USG FLEX Series User’s Guide

119

• The amount of scanned traffic

• The number of scanned connections for URL Threat filtering

• The number of scanned files for anti-malware

• The number of scanned connections for IDP

• The number of scanned emails for email security

• The number of the scanned sites for content filtering

• Top 5 applications that are used the most

• Top 5 URLs that are detected the most

• Reputation filter reports

• URL Threat filter reports

• Threat statistics

Click the Refresh icon to update the information in the window right away.

120

PART II

Technical Reference

ZyWALL USG FLEX Series User’s Guide

121

CHAPTER 6

Monitor

6.1 Overview

Use the Monitor screens to check status and statistics information.

6.1.1 What You Can Do in this Chapter

Use the Monitor screens for the following.

• Use the System Status > Port Statistics screen (see Section 6.2 on page 123) to look at packet statistics

for each physical port.

• Use the System Status > Port Statistics > Graph View screen (see Section 6.2 on page 123) to look at a

line graph of packet statistics for each physical port.

• Use the System Status > Interface Status screen (Section 6.3 on page 125) to see all of the Zyxel

Device’s interfaces and their packet statistics.

• Use the System Status > Traffic Statistics screen (see Section 6.4 on page 129) to start or stop data

collection and view statistics.

• Use the System Status > Session Monitor screen (see Section 6.5 on page 131) to view sessions by user

or service.

• Use the System Status > IGMP Statistics screen (see Section 6.8 on page 136) to view multicasting

details.

• Use the System Status > DDNS Status screen (see Section 6.9 on page 137) to view the status of the

Zyxel Device’s DDNS domain names.

• Use the System Status > IP/MAC Binding screen (Section 6.10 on page 138) to view a list of devices

that have received an IP address from Zyxel Device interfaces with IP/MAC binding enabled.

• Use the System Status > Login Users screen (Section 6.6 on page 133) to look at a list of the users

currently logged into the Zyxel Device.

• Use the System Status > Dynamic Guest screen (Section 6.7 on page 135) to look at a list of the

automatically created users allowed to access the Zyxel Device’s service.

• Use the System Status > Cellular Status screen (Section 6.11 on page 138) to check your mobile

broadband connection status.

• Use the System Status > UPnP Port Status screen (see Section 6.12 on page 142) to look at a list of the

NAT port mapping rules that UPnP creates on the Zyxel Device.

• Use the System Status > USB Storage screen (Section 6.13 on page 143) to view information about a

connected USB storage device.

•Use the System Status > Ethernet Neighbor screen (Section 6.14 on page 144) to view and manage

the Zyxel Device’s neighboring devices via Layer Link Discovery Protocol (LLDP).

• Use the System Status > FQDN Object screen (Section 6.15 on page 145) to display fully qualified

domain name (FQDN) object cache lists used in DNS queries.

• Use the Wireless > AP Inform ation > AP List screen (Section 6.16 on page 147) to display which APs are

currently connected to the Zyxel Device.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

122

• Use the Wireless > AP Information > Radio List screen (Section 6.17 on page 155) to display statistics

about the wireless radio transmitters in each of the APs connected to the Zyxel Device.

• Use the Wireless > AP Information > Top N APs screen (Section 6.18 on page 159) to view managed

APs with the most wireless traffic usage and most associated wireless stations.

• Use the Wireless > AP Information > Single AP screen (Section 6.19 on page 160) to view APs wireless

traffic usage and associated wireless stations for a managed AP.

• Use the Wireless > ZyMesh screen (Section 6.20 on page 161) to display statistics about the ZyMesh

wireless connections between the managed APs.

• Use the Wireless > SSID Info screen (Section 6.21 on page 162) to display the number of wireless clients

that are currently connected to an SSID and the SSID’s security mode.

• Use the Wireless > Station Info > Station List screen (Section 6.22 on page 163) to view information on

connected wireless stations.

• Use the Wireless > Station Info > Top N Stations screen (Section 6.23 on page 163) to view wireless

stations with the most wireless traffic usage.

• Use the Wireless > Station Info > Single Station screen (Section 6.24 on page 164) to view wireless traffic

usage for an associated wireless station.

• Use the Wireless > Detected Device screen (Section 6.25 on page 165) to view information about

suspected rogue APs.

• Use the Printer Status screen (see Section 6.26 on page 166) to view information about the connected

statement printers.

• Use the VPN Monitor > IPSec screen (Section 6.27 on page 167) to display and manage active IPSec

SAs.

• Use the VPN Monitor > SSL screen (see Section 6.28 on page 168) to list the users currently logged into

the VPN SSL client portal. You can also log out individual users and delete related session information.

• Use the VPN Monitor > L2TP over IPSec screen (see Section 6.29 on page 169) to display and manage

the Zyxel Device’s connected L2TP VPN sessions.

• Use the Security Statistics > Content Filter screen (Section 6.31 on page 171) to start or stop data

collection and view content filter statistics.

• Use the Security Statistics > App Patrol screen (see Section 6.30 on page 170) to start or stop data

collection and view application statistics

• Use the Security Statistics > Anti-Malware screen (see Section 6.32 on page 172) to start or stop data

collection and view malware statistics.

• Use the Security Statistics > Reputation Filter screen (see Section 6.33 on page 175) to view statistics of

IP reputation and URL Threat filtering.

• Use the Security Statistics > IDP screen (Section 6.34 on page 176) to start or stop data collection and

view IDP statistics.

• Use the Security Statistics > Email Security > Summary screen (Section 6.35 on page 178) to start or

stop data collection and view spam statistics.

• Use the Security Statistics > Email Security > Status screen (Section 6.35.2 on page 180) to see how

many mail sessions the Zyxel Device is currently checking and DNSBL statistics.

• Use the Security Statistics > SSL Inspection screen (Section 6.36 on page 181) to see a report on SSL

Inspection and a certificate cache list.

• Use the Log > View Log screen (see Section 6.37.1 on page 184) to view the Zyxel Device’s current log

messages. You can change the way the log is displayed, you can email the log, and you can also

clear the log in this screen.

• Use the Log > View AP Log screen (see Section 6.37.2 on page 185) to view the Zyxel Device’s current

wireless AP log messages.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

123

6.2 The Port Statistics Screen

Use this screen to look at packet statistics for each Gigabit Ethernet port. To access this screen, click

Monitor > System Status > Port Statistics.

Figure 105 Monitor > System Status > Port Statistics

The following table describes the labels in this screen.

Table 29 Monitor > System Status > Port Statistics

LABEL DESCRIPTION

Poll Interval Enter how often you want this window to be updated automatically, and click Set Interval.

Set Interval Click this to set the Poll Interval the screen uses.

Stop Click this to stop the window from updating automatically. You can start it again by setting the

Poll Interval and clicking Set Interval.

Switch to Graphic

View

Click this to display the port statistics as a line graph.

#This field is a sequential value, and it is not associated with a specific port.

Port This field displays the physical port number.

Status This field displays the current status of the physical port.

Down - The physical port is not connected.

Speed / Duplex - The physical port is connected. This field displays the port speed and duplex

setting (Full or Half).

TxPkts This field displays the number of packets transmitted from the Zyxel Device on the physical port

since it was last connected.

RxPkts This field displays the number of packets received by the Zyxel Device on the physical port

since it was last connected.

Collisions This field displays the number of collisions on the physical port since it was last connected.

Tx B/s This field displays the transmission speed, in bytes per second, on the physical port in the one-

second interval before the screen updated.

Rx B/s This field displays the reception speed, in bytes per second, on the physical port in the one-

second interval before the screen updated.

Up Time This field displays how long the physical port has been connected.

System Up Time This field displays how long the Zyxel Device has been running since it last restarted or was

turned on.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

124

6.2.1 The Port Statistics Graph Screen

Use this screen to look at a line graph of packet statistics for each physical port. To access this screen,

click Port Statistics on the Status screen and then the Switch to Graphic View Button.

Figure 106 Monitor > System Status > Port Statistics > Switch to Graphic View

The following table describes the labels in this screen.

Table 30 Monitor > System Status > Port Statistics > Switch to Graphic View

LABEL DESCRIPTION

Refresh Interval Enter how often you want this window to be automatically updated.

Refresh Now Click this to update the information in the window right away.

Port Selection Select the number of the physical port for which you want to display graphics.

Switch to Grid

View

Click this to display the port statistics as a table.

bps The y-axis represents the speed of transmission or reception.

time The x-axis shows the time period over which the transmission or reception occurred

TX This line represents traffic transmitted from the Zyxel Device on the physical port since it was last

connected.

RX This line represents the traffic received by the Zyxel Device on the physical port since it was last

connected.

Last Update This field displays the date and time the information in the window was last updated.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

125

6.3 Interface Status Screen

This screen lists all of the Zyxel Device’s interfaces and gives packet statistics for them. Click Monitor >

System Status > Interface Summary to access this screen.

Figure 107 Monitor > System Status > Interface Summary

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

126

Each field is described in the following table.

Table 31 Monitor > System Status > Interface Summary

LABEL DESCRIPTION

Interface Status

If an Ethernet interface does not have any physical ports associated with it, its entry is displayed in light gray text.

Name This field displays the name of each interface. If there is an Expand icon (plus-sign) next to the

name, click this to look at the status of virtual interfaces on top of this interface.

Port/Binding This field displays the physical port number.

Status This field displays the current status of each interface. The possible values depend on what

type of interface it is.

For Ethernet interfaces:

•Inactive - The Ethernet interface is disabled.

•Down - The Ethernet interface does not have any physical ports associated with it or the

Ethernet interface is enabled but not connected.

•Speed / Duplex - The Ethernet interface is enabled and connected. This field displays the

port speed and duplex setting (Full or Half).

For cellular (mobile broadband) interfaces, see Section 6.13 on page 143 the Web Help for the

status that can appear.

For the auxiliary interface:

•Inactive - The auxiliary interface is disabled.

•Connected - The auxiliary interface is enabled and connected.

•Disconnected - The auxiliary interface is not connected.

For virtual interfaces, this field always displays Up. If the virtual interface is disabled, it does not

appear in the list.

For VLAN and bridge interfaces, this field always displays Up. If the VLAN or bridge interface is

disabled, it does not appear in the list.

For PPP interfaces:

•Connected - The PPP interface is connected.

•Disconnected - The PPP interface is not connected.

If the PPP interface is disabled, it does not appear in the list.

For WLAN interfaces:

•Up - The WLAN interface is enabled.

•Down - The WLAN interface is disabled.

Zone This field displays the zone to which the interface is assigned.

IP Addr/Netmask This field displays the current IP address and subnet mask assigned to the interface. If the IP

address and subnet mask are 0.0.0.0, the interface is disabled or did not receive an IP address

and subnet mask via DHCP.

If this interface is a member of an active virtual router, this field displays the IP address it is

currently using. This is either the static IP address of the interface (if it is the master) or the

management IP address (if it is a backup).

IP Assignment This field displays how the interface gets its IP address.

•Static - This interface has a static IP address.

•DHCP Client - This interface gets its IP address from a DHCP server.

Services This field lists which services the interface provides to the network. Examples include DHCP

relay, DHCP server, DDNS, RIP, and OSPF. This field displays n/a if the interface does not provide

any services to the network.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

127

Action Use this field to get or to update the IP address for the interface. Click Renew to send a new

DHCP request to a DHCP server. Click Connect to try to connect a PPPoE/PPTP interface. If the

interface cannot use one of these ways to get or to update its IP address, this field displays n/a.

Tunnel Interface Status

This displays the details of the Zyxel Device’s configured tunnel interfaces.

Name This field displays the name of the interface.

Status The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is

inactive.

Zone This field displays the zone to which the interface is assigned.

IP Address This is the IP address of the interface. If the interface is active (and connected), the Zyxel

Device tunnels local traffic sent to this IP address to the Remote Gateway Address.

My Address This is the interface or IP address uses to identify itself to the remote gateway. The Zyxel Device

uses this as the source for the packets it tunnels to the remote gateway.

Remote

Gateway

Address

This is the IP address or domain name of the remote gateway to which this interface tunnels

traffic.

Mode This field displays the tunnel mode that you are using.

IPv6 Interface Status

If an Ethernet interface does not have any physical ports associated with it, its entry is displayed in light gray text.

Name This field displays the name of each interface. If there is an Expand icon (plus-sign) next to the

name, click this to look at the status of virtual interfaces on top of this interface.

Port This field displays the physical port number.

Table 31 Monitor > System Status > Interface Summary

LABEL DESCRIPTION

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

128

Status This field displays the current status of each interface. The possible values depend on what

type of interface it is.

For Ethernet interfaces:

•Inactive - The Ethernet interface is disabled.

•Down - The Ethernet interface does not have any physical ports associated with it or the

Ethernet interface is enabled but not connected.

•Speed / Duplex - The Ethernet interface is enabled and connected. This field displays the

port speed and duplex setting (Full or Half).

For cellular (mobile broadband) interfaces, see Section 6.13 on page 143 the Web Help for the

status that can appear.

For the auxiliary interface:

•Inactive - The auxiliary interface is disabled.

•Connected - The auxiliary interface is enabled and connected.

•Disconnected - The auxiliary interface is not connected.

For virtual interfaces, this field always displays Up. If the virtual interface is disabled, it does not

appear in the list.

For VLAN and bridge interfaces, this field always displays Up. If the VLAN or bridge interface is

disabled, it does not appear in the list.

For PPP interfaces:

•Connected - The PPP interface is connected.

•Disconnected - The PPP interface is not connected.

If the PPP interface is disabled, it does not appear in the list.

For WLAN interfaces:

•Up - The WLAN interface is enabled.

•Down - The WLAN interface is disabled.

Zone This field displays the zone to which the interface is assigned.

IP Address This field displays the current IPv6 address assigned to the interface. If the IPv6 address is ::, the

interface is disabled or did not receive an IPv6 address via DHCP.

If this interface is a member of an active virtual router, this field displays the IPv6 address it is

currently using. This is either the static IPv6 address of the interface (if it is the master) or the

management IPv6 address (if it is a backup).

Services This field lists which services the interface provides to the network. Examples include DHCP

relay, DHCP server, DDNS, RIP, and OSPF. This field displays n/a if the interface does not provide

any services to the network.

Action Use this field to get or to update the IP address for the interface. Click Renew to send a new

DHCP request to a DHCP server. Click Connect to try to connect a PPPoE/PPTP interface. If the

interface cannot use one of these ways to get or to update its IP address, this field displays n/a.

Interface Statistics

This table provides packet statistics for each interface.

Refresh Click this button to update the information on the screen.

Name This field displays the name of each interface. If there is a Expand icon (plus-sign) next to the

name, click this to look at the statistics for virtual interfaces on top of this interface.

Table 31 Monitor > System Status > Interface Summary

LABEL DESCRIPTION

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

129

6.4 The Traffic Statistics Screen

Click Monitor > System Status > Traffic Statistics to display the Traffic Stat istics screen. This screen provides

basic information about the following for example:

• Most-visited Web sites and the number of times each one was visited. This count may not be accurate

in some cases because the Zyxel Device counts HTTP GET packets. Please see Table 32 on page 130

for more information.

• Most-used protocols or service ports and the amount of traffic on each one

• LAN IP with heaviest traffic and how much traffic has been sent to and from each one

You use the Traffic Statistics screen to tell the Zyxel Device when to start and when to stop collecting

information for these reports. You cannot schedule data collection; you have to start and stop it

manually on the Traffic Statistics screen.

Figure 108 Monitor > System Status > Traffic Statistics

Status This field displays the current status of the interface.

•Down - The interface is not connected.

•Speed / Duplex - The interface is connected. This field displays the port speed and duplex

setting (Full or Half).

This field displays Connected and the accumulated connection time (hh:mm:ss) when the PPP

interface is connected.

TxPkts This field displays the number of packets transmitted from the Zyxel Device on the interface

since it was last connected.

RxPkts This field displays the number of packets received by the Zyxel Device on the interface since it

was last connected.

Tx B/s This field displays the transmission speed, in bytes per second, on the interface in the one-

second interval before the screen updated.

Rx B/s This field displays the reception speed, in bytes per second, on the interface in the one-second

interval before the screen updated.

Table 31 Monitor > System Status > Interface Summary

LABEL DESCRIPTION

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

130

There is a limit on the number of records shown in the report. Please see Table 33 on page 131 for more

information. The following table describes the labels in this screen.

Table 32 Monitor > System Status > Traffic Statistics

LABEL DESCRIPTION

Data Collection

Collect Statistics Select this to have the Zyxel Device collect data for the report. If the Zyxel Device has already

been collecting data, the collection period displays to the right. The progress is not tracked

here real-time, but you can click the Refresh button to update it.

Apply Click Apply to save your changes back to the Zyxel Device.

Reset Click Reset to return the screen to its last-saved settings.

Statistics

Interface Select the interface from which to collect information. You can collect information from

Ethernet, VLAN, bridge and PPPoE/PPTP interfaces.

Sort By Select the type of report to display. Choices are:

•Host IP Address/User - displays the IP addresses or users with the most traffic and how much

traffic has been sent to and from each one.

•Service/Port - displays the most-used protocols or service ports and the amount of traffic for

each one.

•Web Site Hits - displays the most-visited Web sites and how many times each one has been

visited.

•Country - displays the countries with the most traffic and the amount of traffic for each

one.

Each type of report has different information in the report (below).

Refresh Click this button to update the report display.

Flush Data Click this button to discard all of the screen’s statistics and update the report display.

These fields are available when the Traffic Type is Host IP Address/User.

#This field is the rank of each record. The IP addresses and users are sorted by the amount of

traffic.

Direction This field indicates whether the IP address or user is sending or receiving traffic.

•Ingress- traffic is coming from the IP address or user to the Zyxel Device.

•Egress - traffic is going from the Zyxel Device to the IP address or user.

IP Address/

User This field displays the IP address or user in this record. The maximum number of IP addresses or

users in this report is indicated in Table 33 on page 131.

Amount This field displays how much traffic was sent or received from the indicated IP address or user. If

the Direction is Ingress, a red bar is displayed; if the Direction is Egress, a blue bar is displayed.

The unit of measure is bytes, Kbytes, Mbytes or Gbytes, depending on the amount of traffic for

the particular IP address or user. The count starts over at zero if the number of bytes passes the

byte count limit. See Table 33 on page 131.

These fields are available when the Traffic Type is Service/Port.

#This field is the rank of each record. The protocols and service ports are sorted by the amount

of traffic.

Service/Port This field displays the service and port in this record. The maximum number of services and

service ports in this report is indicated in Table 33 on page 131.

Protocol This field indicates what protocol the service was using.

Direction This field indicates whether the indicated protocol or service port is sending or receiving traffic.

•Ingress - traffic is coming into the Zyxel Devicethrough the interface

•Egress - traffic is going out from the Zyxel Device through the interface

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

131

The following table displays the maximum number of records shown in the report, the byte count limit,

and the hit count limit.

6.5 The Session Monitor Screen

The Session Monitor screen displays all established sessions that pass through the Zyxel Device for

debugging or statistical analysis. It is not possible to manage sessions in this screen. The following

information is displayed.

• User who started the session

• Protocol or service port used

Amount This field displays how much traffic was sent or received from the indicated service / port. If the

Direction is Ingress, a red bar is displayed; if the Direction is Egress, a blue bar is displayed. The

unit of measure is bytes, Kbytes, Mbytes, Gbytes, or Tbytes, depending on the amount of traffic

for the particular protocol or service port. The count starts over at zero if the number of bytes

passes the byte count limit. See Table 33 on page 131.

These fields are available when the Traffic Type is Web Site Hits.

#This field is the rank of each record. The domain names are sorted by the number of hits.

Web Site This field displays the domain names most often visited. The Zyxel Device counts each page

viewed on a Web site as another hit. The maximum number of domain names in this report is

indicated in Table 33 on page 131.

Hits This field displays how many hits the Web site received. The Zyxel Device counts hits by

counting HTTP GET packets. Many Web sites have HTTP GET references to other Web sites, and

the Zyxel Device counts these as hits too. The count starts over at zero if the number of hits

passes the hit count limit. See Table 33 on page 131.

These fields are available when the Traffic Type is Country.

#This field is the rank of each record. The country name is sorted by the amount of traffic.

Direction This field indicates whether the indicated protocol or service port is sending or receiving traffic.

•Ingress - traffic is coming into the Zyxel Devicethrough the interface

•Egress - traffic is going out from the Zyxel Device through the interface

Country

Name This field displays the name of the country.

Country This field displays the country code.

Amount This field displays how much traffic was sent or received from the indicated country. If the

Direction is Ingress, a red bar is displayed; if the Direction is Egress, a blue bar is displayed. The

unit of measure is bytes, Kbytes, Mbytes, Gbytes, or Tbytes, depending on the amount of traffic

for the particular protocol or service port. The count starts over at zero if the number of bytes

passes the byte count limit. See Table 33 on page 131.

•Ingress - traffic is coming into the Zyxel Device from the country.

•Egress - traffic is going from the Zyxel Device to the country.

Table 33 Maximum Values for Reports

LABEL DESCRIPTION

Maximum Number of Records 20

Byte Count Limit 264 bytes; this is just less than 17 million terabytes.

Hit Count Limit 264 hits; this is over 1.8 x 1019 hits.

Table 32 Monitor > System Status > Traffic Statistics (continued)

LABEL DESCRIPTION

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

132

• Source address

• Destination address

• Number of bytes received (so far)

• Number of bytes transmitted (so far)

• Duration (so far)

You can look at all established sessions that passed through the Zyxel Device by user, service, source IP

address, or destination IP address. You can also filter the information by user, protocol / service or service

group, source address, and/or destination address and view it by user.

Click Monitor > System Status > Session Monitor to display the following screen.

Figure 109 Monitor > System Status > Session Monitor

The following table describes the labels in this screen.

Table 34 Monitor > System Status > Session Monitor

LABEL DESCRIPTION

View Select how you want the established sessions that passed through the Zyxel Device to be

displayed. Choices are:

•sessions by users - display all active sessions grouped by user

•sessions by services - display all active sessions grouped by service or protocol

•sessions by source IP - display all active sessions grouped by source IP address

•session by source region - display all active sessions grouped by where the traffic is coming

from by country

•sessions by destination IP - display all active sessions grouped by destination IP address

•sessions by destination region - display all active sessions grouped by where the traffic is

going to by country

•all sessions - filter the active sessions by the User, Service, Source Address, and Destination

Address, and display each session individually (sorted by user).

Refresh Click this button to update the information on the screen. The screen also refreshes

automatically when you open and close the screen.

The User, Service, Source Address, Destination Address, Source Country and Destination

Country fields display if you view all sessions. Select your desired filter criteria and click the

Refresh button to filter the list of sessions.

User This field displays when View is set to all sessions. Type the user whose sessions you want to view.

It is not possible to type part of the user name or use wildcards in this field; you must enter the

whole user name.

Service This field displays when View is set to all sessions. Select the service or service group whose

sessions you want to view. The Zyxel Device identifies the service by comparing the protocol

and destination port of each packet to the protocol and port of each services that is defined.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

133

6.6 The Login Users Screen

Use this screen to look at a list of the users currently logged into the Zyxel Device. To access this screen,

click Monitor > System Status > Login Users.

Source

Address This field displays when View is set to all sessions. Type the source IP address whose sessions you

want to view. You cannot include the source port.

Source

Country This field displays when View is set to all sessions. Select the country where the traffic is coming

from.

Destination

Address This field displays when View is set to all sessions. Type the destination IP address whose sessions

you want to view. You cannot include the destination port.

Destination

Country This field displays when View is set to all sessions. Select the country where the traffic is going to.

Search Click this to display all sessions in the table below according to the criteria you defined above.

Clear

Clear All

Administrators can use these buttons to forcibly terminate selected TCP/UDP connections.

Select one or multiple connections and then click Clear; click Clear All to terminate all

connections displayed. Cleared sessions display on the Log > View Log screen.

#This field is the rank of each record. The names are sorted by the name of user in active session.

You can use the pull down menu on the right to choose sorting method.

User This field displays the user in each active session.

If you are looking at the sessions by users (or all sessions) report, click + or - to display or hide

details about a user’s sessions.

Service This field displays the protocol used in each active session.

If you are looking at the sessions by services report, click + or - to display or hide details about

a protocol’s sessions.

Source This field displays the source IP address and port in each active session.

If you are looking at the sessions by source IP report, click + or - to display or hide details about

a source IP address’s sessions.

Source

Country This field displays the source country in each active session.

Destination This field displays the destination IP address and port in each active session.

If you are looking at the sessions by destination IP report, click + or - to display or hide details

about a destination IP address’s sessions.

Destination

Country This field displays the destination country in each active session.

Rx This field displays the amount of information received by the source in the active session.

Tx This field displays the amount of information transmitted by the source in the active session.

Duration This field displays the length of the active session in seconds.

Table 34 Monitor > System Status > Session Monitor (continued)

LABEL DESCRIPTION

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

134

Figure 110 Monitor > System Status > Login Users

The following table describes the labels in this screen.

Table 35 Monitor > System Status > Login Users

LABEL DESCRIPTION

Force Logout Select a user ID and click this icon to end a user’s session.

#This field is a sequential value and is not associated with any entry.

User ID This field displays the user name of each user who is currently logged in to the Zyxel

Device.

Reauth/Lease Time This field displays the amount of reauthentication time remaining and the amount of

lease time remaining for each user.

Session Timeout This field displays the total account of time the account (authenticated by an external

server) can use to log into the Zyxel Device or access the Internet through the Zyxel

Device.

This shows unlimited for an administrator account.

Type This field displays the way the user logged in to the Zyxel Device.

IP Address This field displays the IP address of the computer used to log in to the Zyxel Device.

Country The Internet Assigned Numbers Authority (IANA) has reserved the following blocks of

Private IP addresses specifically for private networks:

• 10.0.0.0-10.255.255.255

• 172.16.0.0-172.31.255.255

• 192.168.0.0-192.168.255.255

• 224.0.0.0-239.255.255.255

MAC This field displays the MAC address of the computer used to log in to the Zyxel Device.

User Info This field displays the types of user accounts the Zyxel Device uses. If the user type is ext-

user (external user), this field will show its external-group information when you move your

mouse over it.

If the external user matches two external-group objects, both external-group object

names will be shown.

Acct. Status For a captive portal login, this field displays the accounting status of the account used to

log into the Zyxel Device.

Accounting-on means accounting is being performed for the user login.

Accounting-off means accounting has stopped for this user login.

A “-” displays if accounting is not enabled for this login.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

135

6.7 Dynamic Guest

A dynamic guest account has a dynamically-created user name and password that allows a guest user

to access the Internet or the Zyxel Device’s services in a specified period of time. Multiple dynamic guest

accounts can be automatically generated at one time for guest users by using the web configurator

and the guest-manager account. Guest users can log in with the dynamic accounts when connecting

to an SSID for a specified time unit. Use this screen to look at a list of dynamic guest user accounts on the

Zyxel Device’s local database. To access this screen, click Monitor > System Status > Dynamic Guest.

Figure 111 Monitor > System Status > Dynamic Guest

The following table describes the labels in this screen.

RADIUS Profile Name This field displays the name of the RADIUS profile used to authenticate the login through

the captive portal. N/A displays for logins that do not use the captive portal and RADIUS

server authentication.

Refresh Click this button to update the information on the screen.

Table 35 Monitor > System Status > Login Users (continued)

LABEL DESCRIPTION

Table 36 Monitor > System Status > Dynamic Guest

LABEL DESCRIPTION

Dynamic Guest List

Remove Select an entry and click this button to remove it from the list.

Note: If you delete a valid user account which is in use, the Zyxel Device ends the

user session.

#This field is a sequential value and is not associated with any entry.

Status This field displays whether the dynamic user account is active or not.

Username This field displays the user name of the dynamic user account.

Create Time This field displays when the dynamic user account was created.

Remaining Time This field displays the amount of Internet access time remaining for each dynamic user

account.

Time Period This field displays the duration of Internet access for the dynamic user account.

Expiration Time This field displays the date and time the Internet access becomes invalid. Once the time

allocated to a dynamic account is used up or a dynamic account remains unused after the

expiration time, the account is deleted from the account list.

Quota (T/U/D) This field displays how much data in both directions (Total) or upstream data (Upload) and

downstream data (Download) can be transmitted through the WAN interface before the

Internet access expires.

Remaining Quota This field displays how much more data can be transmitted through the WAN interface before

the Internet access expires.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

136

6.8 IGMP Statistics

The Internet Group Management Protocol (IGMP) Statistics is used by Zyxel Device IP hosts to inform

adjacent router about multicast group memberships. It can also be used for one-to-many networking

applications such as online streaming video and gaming, distribution of company newsletters, updating

address book of mobile computer users in the field allowing more efficient use of resources when

supporting these types of applications. Click Monitor > System Status > IGMP Statistics to open the

following screen.

Figure 112 Monitor > System Status > IGMP Statistics

The following table describes the labels in this screen.

Bandwidth (U/D) This field displays the maximum upstream (Upload) and downstream (Download) bandwidth

allowed for the dynamic user account in kilobits per second.

Charge This field displays access price per time unit.

Phone Number This displays the user’s phone number.

IP Address This field displays the IP address of the computer used to log in to the Zyxel Device.

Group This field displays the name of the dynamic guest group to which the account belongs.

Guest Name This field displays the name of the person that uses the account.

Phone This field displays the telephone number for the user account.

Email This field displays the E-mail address for the user account.

Address This field displays the geographic address for the user account.

Company This field displays the company name for the user account.

Other This field displays the additional information for the user account.

Refresh Click this button to update the information in the screen.

Table 36 Monitor > System Status > Dynamic Guest

LABEL DESCRIPTION

Table 37 Monitor > System Status > IGMP Statistics

LABEL DESCRIPTION

#This field is a sequential value, and it is not associated with a specific I GMP Statistics.

Group This field displays the group of devices in the IGMP.

Source IP This field displays the host source IP information of the IGMP.

Incoming Interface This field displays the incoming interface that’s connected on the IGMP.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

137

6.9 The DDNS Status Screen

The DDNS Status screen shows the status of the Zyxel Device’s DDNS domain names. Click Monitor >

System Status > DDNS Status to open the following screen.

Figure 113 Monitor > System Status > DDNS Status

The following table describes the labels in this screen.

Packet Count This field displays the packet size of the data being transferred.

Bytes This field displays the size of the data being transferred in Byes.

Outgoing Interface This field displays the outgoing interface that’s connected on the IGMP.

Refresh Click this button to update the information on the screen.

Table 37 Monitor > System Status > IGMP Statistics

LABEL DESCRIPTION

Table 38 Monitor > System Status > DDNS Status

LABEL DESCRIPTION

Update Click this to have the Zyxel Device update the profile to the DDNS server. The Zyxel

Device attempts to resolve the IP address for the domain name.

#This field is a sequential value, and it is not associated with a specific DDNS server.

Profile Name This field displays the descriptive profile name for this entry.

Domain Name This field displays each domain name the Zyxel Device can route.

Effective IP This is the (resolved) IP address of the domain name.

Last Update This shows whether the last attempt to resolve the IP address for the domain name was

successful or not. Updating means the Zyxel Device is currently attempting to resolve the

IP address for the domain name.

Last Update Time This shows when the last attempt to resolve the IP address for the domain name

occurred (in year-month-day hour:minute:second format).

Refresh Click this button to update the information on the screen.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

138

6.10 IP/MAC Binding

Click Monitor > System Status > IP/MAC Binding to open the IP/MAC Binding screen. This screen lists the

devices that have received an IP address from Zyxel Device interfaces with IP/MAC binding enabled

and have ever established a session with the Zyxel Device. Devices that have never established a

session with the Zyxel Device do not display in the list.

Figure 114 Monitor > System Status > IP/MAC Binding

The following table describes the labels in this screen.

6.11 Cellular Status Screen

This screen displays your mobile broadband connection status. Click Monitor > System Status > Cellular

Status to display this screen.

Table 39 Monitor > System Status > IP/MAC Binding

LABEL DESCRIPTION

Interface Select a Zyxel Device interface that has IP/MAC binding enabled to show to which

devices it has assigned an IP address.

#This field is a sequential value, and it is not associated with a specific IP/MAC binding

entry.

IP Address This is the IP address that the Zyxel Device assigned to a device.

Host Name This field displays the name used to identify this device on the network (the computer

name). The Zyxel Device learns these from the DHCP client requests.

MAC Address This field displays the MAC address to which the IP address is currently assigned.

Last Access This is when the device last established a session with the Zyxel Device through this

interface.

Description This field displays the description of the IP/MAC binding.

Refresh Click this button to update the information on the screen.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

139

Figure 115 Monitor > System Status > Cellular Status

The following table describes the labels in this screen.

Table 40 Monitor > System Status > Cellular Status

LABEL DESCRIPTION

Refresh Click this button to update the information on the screen.

More Information Click this to display more information on your mobile broadband, such as the signal

strength, IMEA/ESN and IMSI. This is only available when the mobile broadband device

attached and activated on your Zyxel Device. Refer to Section 6.11.1 on page 141.

#This field is a sequential value, and it is not associated with any interface.

Extension Slot This field displays where the entry’s cellular card is located.

Connected Device This field displays the model name of the cellular card.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

140

Status •No device - no mobile broadband device is connected to the Zyxel Device.

•No Service - no mobile broadband network is available in the area; you cannot

connect to the Internet.

•Limited Service - returned by the service provider in cases where the SIM card is

expired, the user failed to pay for the service and so on; you cannot connect to

the Internet.

•Device detected - displays when you connect a mobile broadband device.

•Device error - a mobile broadband device is connected but there is an error.

•Probe device fail - the Zyxel Device’s test of the mobile broadband device failed.

•Probe device ok - the Zyxel Device’s test of the mobile broadband device

succeeded.

•Init device fail - the Zyxel Device was not able to initialize the mobile broadband

device.

•Init device ok - the Zyxel Device initialized the mobile broadband card.

•Check lock fail - the Zyxel Device’s check of whether or not the mobile

broadband device is locked failed.

•Device locked - the mobile broadband device is locked.

•SIM error - there is a SIM card error on the mobile broadband device.

•SIM locked-PUK - the PUK is locked on the mobile broadband device’s SIM card.

•SIM locked-PIN - the PIN is locked on the mobile broadband device’s SIM card.

•Unlock PUK fail - Your attempt to unlock a WCDMA mobile broadband device’s

PUK failed because you entered an incorrect PUK.

•Unlock PIN fail - Your attempt to unlock a WCDMA mobile broadband device’s

PIN failed because you entered an incorrect PIN.

•Unlock device fail - Your attempt to unlock a CDMA2000 mobile broadband

device failed because you entered an incorrect device code.

•Device unlocked - You entered the correct device code and unlocked a

CDMA2000 mobile broadband device.

•Get dev-info fail - The Zyxel Device cannot get cellular device information.

•Get dev-info ok - The Zyxel Device succeeded in retrieving mobile broadband

device information.

•Searching network - The mobile broadband device is searching for a network.

•Get signal fail - The mobile broadband device cannot get a signal from a network.

•Network found - The mobile broadband device found a network.

•Apply config - The Zyxel Device is applying your configuration to the mobile

broadband device.

•Inactive - The mobile broadband interface is disabled.

•Active - The mobile broadband interface is enabled.

•Incorrect device - The connected mobile broadband device is not compatible

with the Zyxel Device.

•Correct device - The Zyxel Device detected a compatible mobile broadband

device.

•Set band fail - Applying your band selection was not successful.

•Set band ok - The Zyxel Device successfully applied your band selection.

•Set profile fail - Applying your ISP settings was not successful.

•Set profile ok - The Zyxel Device successfully applied your ISP settings.

•PPP fail - The Zyxel Device failed to create a PPP connection for the cellular

interface.

•Need auth-password - You need to enter the password for the mobile broadband

card on the cellular edit screen.

•Device ready - The Zyxel Device successfully applied all of your configuration and

you can use the mobile broadband connection.

Service Provider This displays the name of your network service provider. This shows Limited Service if

the service provider has stopped service to the mobile broadband card. For example

if the bill has not been paid or the account has expired.

Table 40 Monitor > System Status > Cellular Status (continued)

LABEL DESCRIPTION

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

141

6.11.1 More Information

This screen displays more information on your mobile broadband, such as the signal strength, IMEA/ESN

and IMSI that helps identify your mobile broadband device and SIM card. Click Monitor > System Status

> Cellular Status > More Information to display this screen.

Note: This screen is only available when the mobile broadband device is attached to and

activated on the Zyxel Device.

Figure 116 Monitor > System Status > Cellular Status > More Information

The following table describes the labels in this screen.

Cellular System This field displays what type of cellular network the mobile broadband connection is

using. The network type varies depending on the mobile broadband card you inserted

and could be UMTS, UMTS/HSDPA, GPRS or EDGE when you insert a GSM mobile

broadband card, or 1xRTT, EVDO Rev.0 or EVDO Rev.A when you insert a CDMA

mobile broadband card.

Signal Quality This displays the strength of the signal. The signal strength mainly depends on the

antenna output power and the distance between your Zyxel Device and the service

provider’s base station.

Table 40 Monitor > System Status > Cellular Status (continued)

LABEL DESCRIPTION

Table 41 Monitor > System Status > Cellular Status > More Information

LABEL DESCRIPTION

Extension Slot This field displays where the entry’s cellular card is located.

Service Provider This displays the name of your network service provider. This shows Limited Service if the

service provider has stopped service to the mobile broadband card. For example if the

bill has not been paid or the account has expired.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

142

6.12 The UPnP Port Status Screen

Use this screen to look at the NAT port mapping rules that UPnP creates on the Zyxel Device. To access

this screen, click Monitor > System Status > UPnP Port Status.

Figure 117 Monitor > System Status > UPnP Port Status

The following table describes the labels in this screen.

Cellular System This field displays what type of cellular network the mobile broadband connection is

using. The network type varies depending on the mobile broadband card you inserted

and could be UMTS, UMTS/HSDPA, GPRS or EDGE when you insert a GSM mobile

broadband card, or 1xRTT, EVDO Rev.0 or EVDO Rev.A when you insert a CDMA mobile

broadband card.

Signal Strength This is the Signal Quality measured in dBm.

Signal Quality This displays the strength of the signal. The signal strength mainly depends on the

antenna output power and the distance between your Zyxel Device and the service

provider’s base station.

Device Manufacturer This shows the name of the company that produced the mobile broadband device.

Device Model This field displays the model name of the cellular card.

Device Firmware This shows the software version of the mobile broadband device.

Device IMEI/ESN IMEI (International Mobile Equipment Identity) is a 15-digit code in decimal format that

identifies the mobile broadband device.

ESN (Electronic Serial Number) is an 8-digit code in hexadecimal format that identifies

the mobile broadband device.

SIM Card IMSI IMSI (International Mobile Subscriber Identity) is a 15-digit code that identifies the SIM

card.

Table 41 Monitor > System Status > Cellular Status > More Information (continued)

LABEL DESCRIPTION

Table 42 Monitor > System Status > UPnP Port Status

LABEL DESCRIPTION

Remove Select an entry and click this button to remove it from the list.

#This is the index number of the UPnP-created NAT mapping rule entry.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

143

6.13 USB Storage Screen

This screen displays information about a connected USB storage device. Click Monitor > System Status >

USB Storage to display this screen.

Figure 118 Monitor > System Status > USB Storage

The following table describes the labels in this screen.

Remote Host This field displays the source IP address (on the WAN) of inbound IP packets. Since this is often

a wild-card, the field may be blank.

When the field is blank, the Zyxel Device forwards all traffic sent to the External Port on the

WAN interface to the Internal Client on the Internal Port.

When this field displays an external IP address, the NAT rule has the Zyxel Device forward

inbound packets to the Internal Client from that IP address only.

External Port This field displays the port number that the Zyxel Device “listens” non the WAN port) for

connection requests destined for the NAT rule’s Internal Port and Internal Client. The Zyxel

Device forwards incoming packets (from the WAN) with this port number to the Internal Client

on the Internal Port (on the LAN). If the field displays “0”, the Zyxel Device ignores the Internal

Port value and forwards requests on all external port numbers (that are otherwise unmapped)

to the Internal Client.

Protocol This field displays the protocol of the NAT mapping rule (TCP or UDP).

Internal Port This field displays the port number on the Internal Client to which the Zyxel Device should

forward incoming connection requests.

Internal Client This field displays the DNS host name or IP address of a client on the LAN. Multiple NAT clients

can use a single port simultaneously if the internal client field is set to 255.255.255.255 for UDP

mappings.

Internal Client Type This field displays the type of the client application on the LAN.

Description This field displays a text explanation of the NAT mapping rule.

Delete All Click this to remove all mapping rules from the NAT table.

Refresh Click this button to update the information on the screen.

Table 42 Monitor > System Status > UPnP Port Status (continued)

LABEL DESCRIPTION

Table 43 Monitor > System Status > USB Storage

LABEL DESCRIPTION

Device description This is a basic description of the type of USB device.

Usage This field displays how much of the USB storage device’s capacity is currently being

used out of its total capacity and what percentage that makes.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

144

6.14 Ethernet Neighbor Screen

The Ethernet Neighbor screen allows you to view the Zyxel Device’s neighboring devices in one place.

It uses Smart Connect, that is Link Layer Discovery Protocol (LLDP) for discovering and configuring LLDP-

aware devices in the same broadcast domain as the Zyxel Device that you’re logged into using the

web configurator.

LLDP is a layer-2 protocol that allows a network device to advertise its identity and capabilities on the

local network. It also allows the device to maintain and store information from adjacent devices which

are directly connected to the network device. This helps you discover network changes and perform

necessary network reconfiguration and management.

Note: Enable Smart Connect on the System > ZON screen.

See also System > ZON for more information on the Zyxel One Network (ZON) utility that uses the Zyxel

Discovery Protocol (ZDP) for discovering and configuring ZDP-aware Zyxel devices on the same network

as the computer on which the ZON utility is installed.

Click Monitor > System Status > Ethernet Neighbor to see the following screen

Filesystem This field displays what file system the USB storage device is formatted with. This field

displays Unknown if the file system of the USB storage device is not supported by the

Zyxel Device, such as NTFS.

Speed This field displays the connection speed the USB storage device supports.

Status Ready - you can have the Zyxel Device use the USB storage device.

Click Remove Now to stop the Zyxel Device from using the USB storage device so you

can remove it.

Unused - the connected USB storage device was manually unmounted by using the

Remove Now button or for some reason the Zyxel Device cannot mount it.

Click Use It to have the Zyxel Device mount a connected USB storage device. This

button is grayed out if the file system is not supported (unknown) by the Zyxel Device.

none - no USB storage device is connected.

Detail This field displays any other information the Zyxel Device retrieves from the USB storage

device.

•Deactivated - the use of a USB storage device is disabled (turned off) on the Zyxel

Device.

•OutofSpace - the available disk space is less than the disk space full threshold.

•Mounting - the Zyxel Device is mounting the USB storage device.

•Removing - the Zyxel Device is unmounting the USB storage device.

•none - the USB device is operating normally or not connected.

Table 43 Monitor > System Status > USB Storage (continued)

LABEL DESCRIPTION

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

145

Figure 119 Monitor > System Status > Ethernet Neighbor

The following table describes the fields on the previous screen.

6.15 FQDN Object Screen

Click Monitor > System Statu s > FQDN Object to open the FQ DN Object screen. View FQDN-to-IP address

mappings cached in this screen. An FQDN is resolved to its IP address using the DNS server configured on

the Zyxel Device. If the Zyxel Device receives a DNS query for an FQDN and the Zyxel Device has an

FQDN cache entry, the Zyxel Device can map the IP address in a DNS response without having to query

a DNS name server. The Zyxel Device updates FQDN-to-IP address mappings when the TTL (Time To Live)

setting expires.

You can configure FQDN objects in Configuration > Object > Address/Geo IP > Address or Configuration

> Object > Address/Geo IP > Address Group.

Table 44 Monitor > System Status > Ethernet Neighbor

LABEL DESCRIPTION

Local Port (Description) This field displays the port of the Zyxel Device, on which the neighboring device is

discovered.

For Zyxel Devices that support Port Role, if ports 3 to 5 are grouped together and there

is a connection to P5 only, the Zyxel Device will display P3 as the interface port

number (even though there is no connection to that port).

Model Name This field displays the model name of the discovered device.

System Name This field displays the system name of the discovered device.

Firmware Version This field displays the firmware version of the discovered device.

Port (Description) This field displays the first internal port on the discovered device. Internal is an

interface type displayed on the Network > Interface > Ethernet > Edit screen. For

example, if P1 and P2 are WAN, P3 to P5 are LAN, and P6 is DMZ, then Zyxel Device will

display P3 as the first internal interface port number.

For Zyxel Devices that support Port Role, if ports 3 to 5 are grouped together and there

is a connection to P5 only, the Zyxel Device will display P3 as the first internal interface

port number (even though there is no connection to that port).

IP Address This field displays the IP address of the discovered device.

MAC Address This field displays the MAC address of the discovered device.

Refresh Click this button to update the information on the screen.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

146

FQDN can be used in Security Policy, Policy Route, BWM and Web Authentication profiles as source and

destination criteria. FQDN with a wildcard (for example, *.zyxel.com) can be used in these profiles as

destination criteria only.

Suppose you want to block certain users from going to a website with a dynamically updated IP address

using DDNS. Create an FQDN object for the website in Object > Address, and then create a Security

Policy in Security Policy > Policy Control > Add. Use the FQDN object to identify the website as a

destination, and configure specific users to block. When a user tries to connect to the forbidden

website, the Zyxel Device first checks the IP address - website mapping in response to the DNS query

and then finds the FQDN object match. The Security Policy that has this FQDN object match can then

block the configured users from accessing the website.

Figure 120 Monitor > System Status > FQDN Object

The following table describes the fields on the previous screen.

Table 45 Monitor > System Status > FQDN Object

LABEL DESCRIPTION

IPv4 FQDN Object Cache List

You must first configure IPv4 FQDN objects in Configuration > Object > Address/Geo IP in the IPv4 Address

Configuration field.

FQDN Object Select a previously created object from the drop-down list box to display related

FQDN object caches used in DNS queries.

#This is the index number of the FQDN entry.

Name This field displays the name of the selected FQDN object used in DNS queries.

FQDN This field displays a host’s fully qualified domain name.

IP Address This field displays the mapping of the FQDN to an IP address. This is the IP address of a

host.

TTL This field displays the number of seconds the Zyxel Device holds IP address - FQDN

object mapping in its cache. The mapping is updated when the TTL (Time To Live)

setting expires.

IPv6 FQDN Object Cache List

You must first configure IPv6 FQDN objects in Configuration > Object > Address/Geo IP in the IPv6 Address

Configuration field.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

147

6.16 AP Information: AP List

The AP Information menu contains AP List, Radio List, Top N APs and Single AP screens. Click Monitor >

Wireless > AP Information to display the AP List screen.

Figure 121 Monitor > Wireless > AP Information > AP List

The following table describes the labels in this screen.

FQDN Object Select an object from the drop-down list box to display related IPv6 FQDN object

caches used in DNS queries.

#This is the index number of the IPv6 FQDN entry.

Name This field displays the name of the selected IPv6 FQDN object used in DNS queries.

FQDN This field displays a host’s fully qualified domain name.

IP Address This field displays the mapping of the FQDN to an IPv6 address. This is the IPv6 address

of a host.

TTL This field displays the number of seconds the Zyxel Device holds IP address - FQDN

object mapping in its cache. The mapping is updated when the TTL (Time To Live)

setting expires.

Refresh Click this button to update the information on the screen.

Table 45 Monitor > System Status > FQDN Object

LABEL DESCRIPTION

Table 46 Monitor > Wireless > AP Information > AP List

LABEL DESCRIPTION

Filter Click Show Advanced Settings to reveal Filter fields where you can display managed APs by

status, keyword or those managed by the Nebula portal.

AP List Select the type of APs you want to display.

Select All to show all kinds of APs that are currently or used to be connected to the Zyxel

Device.

Select NebulaFlexPRO to show the APs that can work in Nebula cloud management mode.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

148

Status Select the status of APs you want to display.

You can display APs managed by the Zyxel Device according to the following:

•Online All: APs that are online now + APs with configuration conflict + APs with non-

supported features + APs that are now updating firmware

•Online: APs that are online now

•Conflict: APs with configurations in conflict with the Zyxel Device (see More Details)

•Non Support: APs with features not supported by the Zyxel Device (see More Details)

•Updating: APs that are have updated firmware and rebooted

•Offline All: Offline + Offline for Firmware Update

•Offline: The CAPWAP server did not receive keep-alive packets from these APs in the

last 2 minutes (Offline All - Offline for Firmware Update)

•Offline for Firmware Update: APs that were rebooted before updating firmware

•Un-Mgmt: APs that are not managed by the Zyxel Device

Keyword Enter a keyword to display the APs that include it in their AP information, such as model

number, firmware version, MAC address and so on. This field is case-sensitive.

Search Click this to update the list of APs based on the search criteria.

Your search criteria is retained when navigating between screens.

Reset Click this to return the search criteria to the factory defaults and display all currently or

previously connected APs without a filter.

Enable Column

Freeze

Select this to lock the index columns in place while scrolling to the right.

Edit the selected rule Select an AP and click this to change the selected AP’s properties, such as its group, radio,

VLAN and port settings.

Add to Mgmt AP List Select an AP and click this to add the selected AP to the managed AP list.

Reboot device Select one or multiple APs and click this button to force the AP(s) to restart.

Remove the

selected rule

Select one or multiple APs and click this button to remove the AP(s) from the manged AP

list.

Note: If on the Configuration > Wireless > Controller screen you set the

Registration Type to Always Accept, then as soon as you remove an AP

from this list it reconnects.

DCS Now Select one or multiple APs and click this button to use DCS (Dynamic Channel Selection) to

allow the AP to automatically find a less-used channel in an environment where there are

many APs and there may be interference.

Note: You should have enabled DCS in the applied AP radio profile before the

APs can use DCS.

Note: DCS is not supported on the radio which is working in repeater AP mode.

More Information Select an AP and click this to view a daily station count about the selected AP. The count

records station activity on the AP over a consecutive 24 hour period.

Radio Information Select an online AP and click this button to go to the Monitor > Wireless > AP Information >

Radio List screen to view detailed information about the AP’s radios.

Query Controller Log Select one or multiple APs and click this button to go to the Monitor > Log > View Log screen

to view the selected AP’s current log messages.

Nebula Select an AP and click this to open a screen where you can set whether the AP’s IP address

and VLAN settings will be changed when it goes into Nebula cloud management mode. .

Note: The AP will be set to Nebula cloud management mode and removed from

the managed AP list right after you click OK.

Table 46 Monitor > Wireless > AP Information > AP List (continued)

LABEL DESCRIPTION

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

149

Upgrade Firmware

Now

Select one or more APs and click this button to update the APs’ firmware version.

Suppression On Select an AP and click this button to enable the AP’s LED suppression mode. All the LEDs of

the AP will turn off after the AP is ready. This button is not available if the selected AP

doesn’t support suppression mode.

Suppression Off Select an AP and click this button to disable the AP’s LED suppression mode. The AP LEDs

stay lit after the AP is ready. This button is not available if the selected AP doesn’t support

suppression mode.

Locator On Select an AP and click this button to run the locator feature. The AP’s Locator LED will start

to blink for 10 minutes by default. It will show the actual location of the AP between several

devices on the network.

#This field is a sequential value, and it is not associated with any entry.

Status This field displays the status of AP.

•Online All: APs that are online now + APs with configuration conflict + APs with non-

supported features + APs that are now updating firmware

•Online: APs that are online now

•Conflict: APs with configurations in conflict with the Zyxel Device (see More Details)

•Non Support: APs with features not supported by the Zyxel Device (see More Details)

•Updating: APs that are have updated firmware and rebooted

•Offline All: Offline + Offline for Firmware Update

•Offline: The CAPWAP server did not receive keep-alive packets from these APs in the

last 2 minutes (Offline All - Offline for Firmware Update)

•Offline for Firmware Update: APs that were rebooted before updating firmware

•Un-Mgmt: APs that are not managed by the Zyxel Device

Description This field displays the AP’s description, which you can configure by selecting the AP’s entry

and clicking the Edit button.

CPU Usage This field displays the CPU Usage of the AP.

IP Address This field displays the IP address of the AP.

MAC Address This field displays the MAC address of the AP.

Station 2.4G This field displays the number of 2.4G wireless clients connected to the AP.

Station 5G This field displays the number of 5G wireless clients connected to the AP.

Recent Online Time This displays the most recent time the AP came on-line. N/A displays if the AP has not come

on-line since the Zyxel Device last started up.

LED Status This displays the AP LED status.

N/A displays if the AP does not support LED suppression mode and/or have a locator LED to

show the actual location of the AP.

A gray LED icon signifies that the AP LED suppression mode is enabled. All the LEDs of the AP

will turn off after the AP is ready.

A green LED icon signifies that the AP LED suppression mode is disabled and the AP LEDs

stay lit after the AP is ready.

A sun icon signifies that the AP’s locator LED is blinking.

A circle signifies that the AP’s locator LED is extinguished.

Model This field displays the AP’s hardware model information. It displays N/A (not applicable) only

when the AP disconnects from the Zyxel Device and the information is unavailable as a

result.

Apply Click Apply to save your changes back to the Zyxel Device.

Refresh Click Refresh to update the AP list.

Table 46 Monitor > Wireless > AP Information > AP List (continued)

LABEL DESCRIPTION

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

150

The following table describes the icons in this screen.

6.16.1 AP List: More Information

Use this screen to look at station statistics for the connected AP. To access this screen, select an entry

and click the More Information button on the AP List screen. Use this screen to look at configuration

Table 47 Monitor > Wireless > AP Information > AP List Icons

LABEL DESCRIPTION

This AP is not on the management list.

This AP is on the management list and online.

This AP is in the process of having its firmware updated.

This AP is on the management list but offline.

This indicates one of the following cases:

• This AP has a runtime management VLAN ID setting that conflicts with the VLAN ID setting on the

Access Controller (the Zyxel Device).

• A setting the Zyxel Device assigns to this AP does not match the AP’s capability.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

151

information, port status and station statistics for the connected AP. To access this screen, select an entry

and click the More Information button on the AP List screen.

Figure 122 Monitor > Wireless > AP Information > AP List > More Information

The following table describes the labels in this screen.

Table 48 Monitor > Wireless > AP Information > AP List > More Information

LABEL DESCRIPTION

Configuration

Status

This displays whether or not any of the AP’s configuration is in conflict with the Zyxel Device’s

settings for the AP.

Non Support If any of the AP’s configuration conflicts with the Zyxel Device’s settings for the AP, this field

displays which configuration conflicts. It displays n/a if none of the AP’s configuration

conflicts with the Zyxel Device’s settings for the AP.

Port Status

Port This shows the name of the physical Ethernet port on the Zyxel Device.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

152

Status This field displays the current status of each physical port on the AP.

Down - The port is not connected.

Speed / Duplex - The port is connected. This field displays the port speed and duplex setting

(Full or Half).

PVID This shows the port’s PVID.

A PVID (Port VLAN ID) is a tag that adds to incoming untagged frames received on a port so

that the frames are forwarded to the VLAN group that the tag defines.

Up Time This field displays how long the physical port has been connected.

VLAN

Configuration

Name This shows the name of the VLAN.

Status This displays whether or not the VLAN is activated.

VID This shows the VLAN ID number.

Member This field displays the Ethernet port(s) that is a member of this VLAN.

Ethernet Neighbor

Local Port

(Description) This field displays the port of the Zyxel Device, on which the neighboring device is discovered.

For Zyxel Devices that support Port Role, if ports 3 to 5 are grouped together and there is a

connection to P5 only, the Zyxel Device will display P3 as the interface port number (even

though there is no connection to that port).

Model Name This field displays the model name of the discovered device.

System Name This field displays the system name of the discovered device.

Firmware

Version This field displays the firmware version of the discovered device.

Port

(Description) This field displays the first internal port on the discovered device. Internal is an interface type

displayed on the Network > Interface > Ethernet > Edit screen. For example, if P1 and P2 are

WAN, P3 to P5 are LAN, and P6 is DMZ, then Zyxel Device will display P3 as the first internal

interface port number.

For Zyxel Devices that support Port Role, if ports 3 to 5 are grouped together and there is a

connection to P5 only, the Zyxel Device will display P3 as the first internal interface port

number (even though there is no connection to that port).

IP Address This field displays the IP address of the discovered device.

MAC Address This field displays the MAC address of the discovered device.

Station Count

The y-axis represents the number of connected stations.

The x-axis shows the time over which a station was connected.

Last Update This field displays the date and time the information in the window was last updated.

OK Click OK to save your changes back to the Zyxel Device.

Cancel Click Cancel to exit this screen without saving your changes.

Table 48 Monitor > Wireless > AP Information > AP List > More Information (continued)

LABEL DESCRIPTION

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

153

6.16.2 AP List: Config AP

Select an AP and click the Config AP button in the Monitor > Wireless > AP Information > AP List table to

display this screen.

Figure 123 Monitor > Wireless > AP Information > AP List > Config AP

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

154

Each field is described in the following table.

Table 49 Monitor > Wireless > AP Information > AP List > Config AP

LABEL DESCRIPTION

Create new Object Use this menu to create a new Radio Profile object to associate with this AP.

MAC This displays the MAC address of the selected AP.

Model This field displays the AP’s hardware model information. It displays N/A (not applicable) only

when the AP disconnects from the Zyxel Device and the information is unavailable as a

result.

Description Enter a description for this AP. You can use up to 31 characters, spaces and underscores

allowed.

Group Setting Select an AP group to which you want this AP to belong.

Radio 1/2 Setting

Override Group

Radio Setting

Select this option to overwrite the AP radio settings with the settings you configure here.

Radio 1/2 OP Mode Select the operating mode for radio 1 or radio 2.

AP Mode means the AP can receive connections from wireless clients and pass their data

traffic through to the Zyxel Device to be managed (or subsequently passed on to an

upstream gateway for managing).

MON Mode means the AP monitors the broadcast area for other APs, then passes their

information on to the Zyxel Device where it can be determined if those APs are friendly or

rogue. If an AP is set to this mode it cannot receive connections from wireless clients.

Radio 1/2 Profile Select a profile from the list. If no profile exists, you can create a new one through the

Create new Object menu.

Override Group

Output Power

Setting

Select this option to overwrite the AP output power setting with the setting you configure

here.

Output Power Set the output power of the AP.

Override Group SSID

Setting

Select this option to overwrite the AP SSID profile setting with the setting you configure here.

This section allows you to associate an SSID profile with the radio.

Edit Select an SSID and click this button to reassign it. The selected SSID becomes editable

immediately upon clicking.

#This is the index number of the SSID profile. You can associate up to eight SSID profiles with

an AP radio.

SSID Profile Indicates which SSID profile is associated with this radio profile.

Override Group

VLAN Setting

Select this option to overwrite the AP VLAN setting with the setting you configure here.

Force Overwrite

VLAN Config

Select this to have the Zyxel Device change the AP’s management VLAN to match the

configuration in this screen.

Management VLAN

Enter a VLAN ID for this AP.

As Native VLAN Select this option to treat this VLAN ID as a VLAN created on the Zyxel Device and not one

assigned to it from outside the network.

Suppression On Select this option to enable the AP's LED suppression mode. All the LEDs of the AP will turn off

after the AP is ready.

If the check box is unchecked, it means the LEDs will stay lit after the AP is ready.

OK Click OK to save your changes back to the Zyxel Device.

Cancel Click Cancel to close the window with changes unsaved.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

155

6.17 AP Information: Radio List

Click Monitor > Wireless > AP Information > Radio List to display the Radio List screen.

Figure 124 Monitor > Wireless > AP Information > Radio List

The following table describes the labels in this screen.

Table 50 Monitor > Wireless > AP Information > Radio List

LABEL DESCRIPTION

More Information Click this icon to see the traffic statistics, station count, SSID, Security Mode and

VLAN ID information on the AP.

Enable Column Freeze Select this to lock the index columns in place while scrolling to the right.

#This field is a sequential value, and it is not associated with a specific radio.

Loading This indicates the AP’s load balance status (UnderLoad or OverLoad) when load

balancing is enabled on the AP. Otherwise, it shows - when load balancing is

disabled or the radio is in monitor mode.

AP Description Enter a description for this AP. You can use up to 31 characters, spaces and

underscores allowed.

Frequency Band This field displays the WLAN frequency band using the IEEE 802.11 a/b/g/n standard

of 2.4 or 5 GHz.

Channel ID This field displays the WLAN channels using the IEEE 802.11 protocols.

Tx Power This shows the radio’s output power (in dBm).

Station This field displays the station count information.

Rx This field displays the total number of bytes received by the radio.

Tx This field displays the total number of bytes transmitted by the radio.

Model This field displays the AP’s hardware model information. It displays N/A (not

applicable) only when the AP disconnects from the Zyxel Device and the

information is unavailable as a result.

MAC Address This field displays the MAC address of the AP.

Radio This field displays the Radio number. For example 1.

OP Mode This field displays the operating mode of the AP. It displays n/a for the profile for a

radio not using an AP profile.

AP Mode means the AP can receive connections from wireless clients and pass their

data traffic through to the Zyxel Device to be managed (or subsequently passed on

to an upstream gateway for managing).

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

156

AP / ZyMesh Profile This indicates the AP radio and ZyMesh profile names to which the radio belongs.

Antenna This indicates the antenna orientation for the radio (Wall or Ceiling).

This shows N/A if the AP does not allow you to adjust coverage depending on the

orientation of the antenna for each radio using the web configurator or a physical

switch.

Table 50 Monitor > Wireless > AP Information > Radio List

LABEL DESCRIPTION

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

157

6.17.1 Radio List: More Information

This screen allows you to view detailed information about a selected radio’s SSID(s), wireless traffic and

wireless clients for the preceding 24 hours. To access this window, select an entry and click the More

Information button on the Radio List screen.

Figure 125 Monitor > Wireless > AP Information > Radio List > More Information

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

158

The following table describes the labels in this screen.

Click Monitor > Wireless > AP Information > Built-in AP to display this screen. The following table

describes the labels in this screen.

Table 51 Monitor > Wireless > AP Information > Radio List > More Information

LABEL DESCRIPTION

MBSSID Detail This list shows information about the SSID(s) that is associated with the radio over the preceding

24 hours.

#This is the items sequential number in the list. It has no bearing on the actual data in this list.

SSID Name This displays an SSID associated with this radio. There can be up to eight maximum.

BSSID This displays the MAC address associated with the SSID.

Security

Mode This displays the security mode in which the SSID is operating.

Forwarding

Mode This field indicates the forwarding mode (Local Bridge or Tunnel) associated with the SSID

profile.

VLAN This displays the VLAN ID associated with the SSID.

Traffic Statistics This graph displays the overall traffic information about the radio over the preceding 24 hours.

y-axis This axis represents the amount of data moved across this radio in megabytes per second.

x-axis This axis represents the amount of time over which the data moved across this radio.

Station Count This graph displays information about all the wireless clients that have connected to the radio

over the preceding 24 hours.

y-axis The y-axis represents the number of connected wireless clients.

x-axis The x-axis shows the time over which a wireless client was connected.

Last Update This field displays the date and time the information in the window was last updated.

OK Click this to close this window.

Cancel Click this to close this window.

Table 52 Monitor > Wireless > AP Information > Built-in AP

LABEL DESCRIPTION

Single Station Status

Usage by Select the measure unit in GB or MB to display the graph.

Traffic Usage This graph displays traffic usage from associated wireless stations in the preceding 24

hours.

y-axis The y-axis represents the amount of traffic in megabytes/gigabytes.

x-axis The x-axis represents the time over which wireless traffic flows transmitting from/to

the AP.

Station Count This graph displays the number of wireless stations that have connected to the AP in

the preceding 24 hours.

y-axis The y-axis represents the number of connected wireless stations.

x-axis The x-axis represents the time over which a wireless client was connected.

Refresh Click Refresh to update this screen.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

159

6.18 AP Information: Top N APs

Use this screen to view the top five or top ten wireless traffic usage and associated wireless stations for

the preceding 24 hours. Click Monitor > Wireless > AP Information > Top N APs to display the Top N APs

screen.

Figure 126 Monitor > Wireless > AP Information > Top N APs

The following table describes the labels in this screen.

Table 53 Monitor > Wireless > AP Information > Top N APs

LABEL DESCRIPTION

View Select this to view the top five or top ten wireless traffic usage and associated

wireless stations for the preceding 24 hours.

Usage by If you view the data usage by Usage, select the frequency band and the measure

unit in GB or MB to display the graph.

If you view the date usage by Stat ion Number, select the measure unit in GB or MB to

display the graph.

Traffic Usage This graph displays the overall traffic information about the top five or top ten

wireless traffic for the preceding 24 hours.

y-axis The y-axis represents the amount of traffic in megabytes/gigabytes.

x-axis The x-axis represents the time over which wireless traffic flows transmitting from/to

the AP.

Station Count This graph displays information about all the wireless stations that have connected

to the AP for the preceding 24 hours.

y-axis The y-axis represents the number of connected wireless stations.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

160

6.19 AP Information: Single AP

Use this screen to view wireless traffic usage and wireless stations for a managed AP. Click Monitor >

Wireless > AP Information > Single AP to display the Single AP screen.

Figure 127 Monitor > Wireless > AP Information > Single AP

The following table describes the labels in this screen.

x-axis The x-axis represents the time over which a wireless client was connected.

Refresh Click Refresh to update this screen.

Table 53 Monitor > Wireless > AP Information > Top N APs

LABEL DESCRIPTION

Table 54 Monitor > Wireless > AP Information > Single AP

LABEL DESCRIPTION

AP Selection Select a managed AP from the drop-down list box to view its wireless traffic usage

and wireless stations.

Usage by Select the measure unit in GB or MB to display the graph.

Traffic Usage This graph displays the overall traffic information about the AP you specified for the

preceding 24 hours.

y-axis The y-axis represents the amount of traffic in megabytes/gigabytes.

x-axis The x-axis represents the time over which wireless traffic flows transmitting from/to

the AP.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

161

6.20 ZyMesh

Use this screen to view the ZyMesh traffic statistics between the managed APs. Click Monitor > Wireless >

ZyMesh to display this screen.

Figure 128 Monitor > Wireless > ZyMesh

The following table describes the labels in this screen.

Station Count This graph displays information about all the wireless stations that have connected

to the AP for the preceding 24 hours.

y-axis The y-axis represents the number of connected wireless stations.

x-axis The x-axis represents the time over which a wireless client was connected.

Refresh Click Refresh to update this screen.

Table 54 Monitor > Wireless > AP Information > Single AP

LABEL DESCRIPTION

Table 55 Monitor > Wireless > ZyMesh

LABEL DESCRIPTION

#This field displays the index number of the managed AP (in repeater mode) in this list.

Description This field displays the descriptive name of the managed AP (in repeater mode).

IP Address This field displays the IP address of the managed AP (in repeater mode).

Channel ID This field displays the number of the channel used by the managed AP (in repeater

mode).

Hop This is the hop count of the managed AP. For example, “1” means the managed AP

is connected to a root AP directly. “2” means there is another repeater AP between

the managed AP and the root AP.

Uplink AP Info This shows the role and descriptive name of the managed AP to which this

managed AP is connected wirelessly.

SSID Name This indicates the name of the wireless network (SSID) the managed AP uses to

associated with another managed AP.

Signal Strength Before the slash, this shows the signal strength the uplink AP (a root AP or a repeater)

receives from this managed AP (in repeater mode).

After the slash, this shows the signal strength this managed AP (in repeater mode)

receives from the uplink AP.

Link Up Time This field displays the time the managed AP first associated with the root AP or

repeater.

MAC Address This field displays the MAC address of the managed AP (in repeater mode).

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

162

6.21 SSID Info

Use this screen to view the number of wireless clients currently connected to an SSID and the security

type used by the SSID. Click Monitor > Wireless > SSID Info to display this screen.

Figure 129 Monitor > Wireless > SSID Info

The following table describes the labels in this screen.

Tx Power This field displays the output power of the managed AP (in repeater mode).

Root AP This field displays the descriptive name of the root AP to which the managed AP is

connected wirelessly.

Tx Rate This field displays the maximum transmission rate of the root AP or repeater to which

the managed AP is connected.

Rx Rate This field displays the maximum reception rate of the root AP or repeater to which

the managed AP is connected.

Refresh Click Refresh to update this screen.

Table 55 Monitor > Wireless > ZyMesh

LABEL DESCRIPTION

Table 56 Monitor > Wireless > SSID Info

LABEL DESCRIPTION

#This is the SSID’s index number in this list.

SSID This indicates the name of the wireless network to which the client is connected. A

single AP can have multiple SSIDs or networks.

2.4GHz This shows the number of wireless clients which are currently connected to the SSID

using the 2.4 GHz frequency band, Click the number to go to the Station Info >

Station List screen. See Section 6.23 on page 163.

5GHz This shows the number of wireless clients which are currently connected to the SSID

using the 5 GHz frequency band, Click the number to go to the Station Info > Station

List screen. See Section 6.23 on page 163.

SSID Profile Name This indicates the name of the SSID profile in which the SSID is defined,

Security Mode This indicates which secure encryption methods is being used by the SSID.

Refresh Click Refresh to update this screen.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

163

6.22 Station Info: Station List

The Station Info menu contains Station List, Top N Stations and Single Station screens. This screen displays

information about connected wireless stations. Click Monitor > Wireless > Station Info > Station List to

display this screen.

Figure 130 Monitor > Wireless > Station Info > Station List

The following table describes the labels in this screen.

6.23 Station Info: Top N Stations

Use this screen to view the top five or top ten traffic statistics of the wireless stations. Click Monitor >

Wireless > Station Info > Top N Stations to display this screen.

Table 57 Monitor > Wireless > Station Info > Station List

LABEL DESCRIPTION

#This field is a sequential value, and it is not associated with a specific station.

MAC Address This field displays the MAC address of the station.

Associated AP This field displays the APs that are associated with the station.

SSID Name This field displays the SSID names of the station.

Security Mode This field displays the security mode the station is using.

Signal Strength This field displays the signal strength of the station.

Channel This field displays the number of the channel used by the station to connect to the

network.

Band This field displays the frequency band which is currently being used by the station.

IP Address This field displays the IP address of the station.

Tx Rate This field displays the transmit data rate of the station.

Rx Rate This field displays the receive data rate of the station.

Tx This field displays the number of bytes transmitted from the station.

Rx This field displays the number of bytes received by the station.

Association Time This field displays the time duration the station was online and offline.

Refresh Click Refresh to update this screen.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

164

Figure 131 Monitor > Wireless > Station Info > Top N Stations

The following table describes the labels in this screen.

6.24 Station Info: Single Station

Use this screen to view traffic statistics of the wireless station you specified. Click Monitor > Wireless >

Station Info > Single Station to display this screen.

Table 58 Monitor > Wireless > Station Info > Top N Stations

LABEL DESCRIPTION

View Select this to view the top five or top ten traffic statistics of the wireless stations.

Usage by Select the measure unit in GB or MB to display the graph.

Traffic Usage This graph displays the overall traffic information about the stations for the preceding

24 hours.

y-axis This axis represents the amount of data moved across stations in megabytes per

second.

Refresh Click Refresh to update this screen.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

165

Figure 132 Monitor > Wireless > Station Info > Single Station

The following table describes the labels in this screen.

6.25 Detected Device

Use this screen to view information about wireless devices detected by the AP. Click Monitor > Wireless >

Detected Device to access this screen.

Note: At least one radio of the APs connected to the Zyxel Device must be set to monitor

mode (on the Configuration > Wireless > AP Management screen) in order to detect

other wireless devices in its vicinity.

Figure 133 Monitor > Wireless > Detected Device

Table 59 Monitor > Wireless > Station Info > Single Station

LABEL DESCRIPTION

Station Selection Select this to view the traffic statistics of the wireless station.

Usage by Select the measure unit in GB or MB to display the graph.

Traffic Usage This graph displays the overall traffic information about the station over the

preceding 24 hours.

y-axis This axis represents the amount of data moved across this station in megabytes per

second.

Refresh Click Refresh to update this screen.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

166

The following table describes the labels in this screen.

6.26 The Printer Status Screen

This screen displays information about the connected statement printer. Click Monitor > Printer Status to

display this screen.

Figure 134 Monitor > Printer Status

The following table describes the labels in this screen.

Table 60 Monitor > Wireless > Detected Device

LABEL DESCRIPTION

Mark as Rogue

Click this button to mark the selected AP as a rogue AP. A rogue AP can be contained on the

Configuration > Wireless > MON Mode screen.

Mark as Friendly

Click this button to mark the selected AP as a friendly AP. For more on managing friendly APs,

see the Configuration > Wireless > MON Mode screen.

#This is the station’s index number in this list.

Status This indicates the detected device’s status.

Device This indicates the detected device’s network type (such as infrastructure or ad-hoc).

Role This indicates the detected device’s role (such as friendly or rogue).

MAC Address This indicates the detected device’s MAC address.

SSID Name This indicates the detected device’s SSID.

Channel ID This indicates the detected device’s channel ID.

802.11 Mode This indicates the 802.11 mode (a/b/g/n) transmitted by the detected device.

Security This indicates the encryption method (if any) used by the detected device.

Description This displays the detected device’s description. For more on managing friendly and rogue APs,

see the Configuration > Wireless > MON Mode screen.

Last Seen This indicates the last time the device was detected by the Zyxel Device.

Refresh Click this to refresh the items displayed on this page.

Table 61 Monitor > Printer Status

LABEL DESCRIPTION

#This is the index number of the printer in the list.

IPv4 Address This field displays the IP address of the printer that you configured in the screen.

Update Time This field displays the date and time the Zyxel Device last synchronized with the printer.

This shows n/a when the printer status is sync fail.

Status This field displays whether the Zyxel Device can connect to the printer and update the printer

information.

Description This field displays the descriptive name of the printer that you configured in the screen.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

167

6.27 The IPSec Screen

You can use the IPSec Monitor screen to display and to manage active IPSec SAs. To access this screen,

click Monitor > VPN Monitor > IPSec. The following screen appears. Click a column’s heading cell to sort

the table entries by that column’s criteria. Click the heading cell again to reverse the sort order.

Figure 135 Monitor > VPN Monitor > IPSec

Each field is described in the following table.

Nickname This field displays the nickname of the printer that you configured in the Edit screen.

Firmware Version This field displays the model number and firmware version of the printer.

This shows n/a when the printer status is sync fail.

MAC This field displays the MAC address of the printer.

Table 61 Monitor > Printer Status (continued)

LABEL DESCRIPTION

Table 62 Monitor > VPN Monitor > IPSec

LABEL DESCRIPTION

Name Type the name of a IPSec SA here and click Search to find it (if it is associated). You

can use a keyword or regular expression. Use up to 30 alphanumeric and _+-

.()!$*^:?|{}[]<>/ characters. See Section on page 168 for more details.

Policy Type the IP address(es) or names of the local and remote policies for an IPSec SA

and click Search to find it. You can use a keyword or regular expression. Use up to 30

alphanumeric and _+-.()!$*^:?|{}[]<>/ characters. See Section on page 168 for

more details.

Search Click this button to search for an IPSec SA that matches the information you

specified above.

Disconnect Select an IPSec SA and click this button to disconnect it.

Connection Check Select an IPSec SA and click this button to check the connection.

#This field is a sequential value, and it is not associated with a specific SA.

Serial Number This field displays the serial number of this Zyxel Device.

System Name This field displays the name used to identify the Zyxel Device.

Name This field displays the name of the IPSec SA.

Policy This field displays the content of the local and remote policies for this IPSec SA. The IP

addresses, not the address objects, are displayed.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

168

Regular Expressions in Searching IPSec SAs

A question mark (?) lets a single character in the VPN connection or policy name vary. For example, use

“a?c” (without the quotation marks) to specify abc, acc and so on.

Wildcards (*) let multiple VPN connection or policy names match the pattern. For example, use “*abc”

(without the quotation marks) to specify any VPN connection or policy name that ends with “abc”. A

VPN connection named “testabc” would match. There could be any number (of any type) of

characters in front of the “abc” at the end and the VPN connection or policy name would still match. A

VPN connection or policy name named “testacc” for example would not match.

A * in the middle of a VPN connection or policy name has the Zyxel Device check the beginning and

end and ignore the middle. For example, with “abc*123”, any VPN connection or policy name starting

with “abc” and ending in “123” matches, no matter how many characters are in between.

The whole VPN connection or policy name has to match if you do not use a question mark or asterisk.

6.28 The SSL Screen

The Zyxel Device keeps track of the users who are currently logged into the VPN SSL client. Click Monitor

> VPN Monitor > SSL to display the user list.

Use this screen to do the following:

• View a list of active SSL VPN connections.

• Log out individual users and delete related session information.

Once a user logs out, the corresponding entry is removed from the screen.

Figure 136 Monitor > VPN Monitor > SSL

My Address This field displays the IP address of local computer.

Secure Gateway This field displays the secure gateway information.

Up Time This field displays how many seconds the IPSec SA has been active. This field displays

N/A if the IPSec SA uses manual keys.

Timeout This field displays how many seconds remain in the SA life time, before the Zyxel

Device automatically disconnects the IPSec SA. This field displays N/A if the IPSec SA

uses manual keys.

Inbound (Bytes) This field displays the amount of traffic that has gone through the IPSec SA from the

remote IPSec router to the Zyxel Device since the IPSec SA was established.

Outbound (Bytes) This field displays the amount of traffic that has gone through the IPSec SA from the

Zyxel Device to the remote IPSec router since the IPSec SA was established.

Table 62 Monitor > VPN Monitor > IPSec (continued)

LABEL DESCRIPTION

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

169

The following table describes the labels in this screen.

6.29 The L2TP over IPSec Screen

Click Monitor > VPN Monitor > L2TP over IPSec to open the following screen. Use this screen to display

and manage the Zyxel Device’s connected L2TP VPN sessions.

Figure 137 Monitor > VPN Monitor > L2TP over IPSec

The following table describes the fields in this screen.

Table 63 Monitor > VPN Monitor > SSL

LABEL DESCRIPTION

Disconnect Select a connection and click this button to terminate the user’s connection and delete

corresponding session information from the Zyxel Device.

Refresh Click Refresh to update this screen.

#This field is a sequential value, and it is not associated with a specific SSL.

User This field displays the account user name used to establish this SSL VPN connection.

Access This field displays the name of the SSL VPN application the user is accessing.

Connected Time This field displays the time this connection was established.

Inbound (Bytes) This field displays the number of bytes received by the Zyxel Device on this connection.

Outbound (Bytes) This field displays the number of bytes transmitted by the Zyxel Device on this

connection.

Table 64 Monitor > VPN Monitor > L2TP over IPSec

LABEL DESCRIPTION

Disconnect Select a connection and click this button to disconnect it.

Refresh Click Refresh to update this screen.

#This field is a sequential value, and it is not associated with a specific L2TP VPN session.

User Name This field displays the remote user’s user name.

Hostname This field displays the name of the computer that has this L2TP VPN connection with the

Zyxel Device.

Assigned IP This field displays the IP address that the Zyxel Device assigned for the remote user’s

computer to use within the L2TP VPN tunnel.

Public IP This field displays the public IP address that the remote user is using to connect to the

Internet.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

170

6.30 The App Patrol Screen

Application patrol provides a convenient way to manage the use of various applications on the

network. It manages general protocols (for example, HTTP and FTP) and instant messenger (IM), peer-to-

peer (P2P), Voice over IP (VoIP), and streaming (RSTP) applications. You can even control the use of a

particular application’s individual features (like text messaging, voice, video conferencing, and file

transfers).

Click Monitor > Security Statistics > App Patrol > Summary to display the following screen. This screen

displays Application Patrol statistics based on the App Patrol profiles bound to Security Policy profiles.

Figure 138 Monitor > Security Statistics > App Patrol > Summary

The following table describes the labels in this screen.

Table 65 Monitor > Security Statistics > App Patrol > Summary

LABEL DESCRIPTION

Collect Statistics Select this check box to have the Zyxel Device collect app patrol statistics.

The collection starting time displays after you click Apply. All of the statistics in this

screen are for the time period starting at the time displayed here. The format is year,

month, day and hour, minute, second. All of the statistics are erased if you restart the

Zyxel Device or click Flush Data. Collecting starts over and a new collection start

time displays.

Apply Click Apply to save your changes back to the Zyxel Device.

Reset Click Reset to return the screen to its last-saved settings.

Refresh Click this button to update the report display.

Flush Data Click this button to discard all of the screen’s statistics and update the report display.

App Patrol Statistics

#This field is a sequential value, and it is not associated with a specific App Patrol

session.

Application This is the protocol.

Forwarded Data (KB) This is how much of the application’s traffic the Zyxel Device has sent (in kilobytes).

Dropped Data (KB) This is how much of the application’s traffic the Zyxel Device has discarded without

notifying the client (in kilobytes). This traffic was dropped because it matched an

application policy set to “drop”.

Rejected Data (KB) This is how much of the application’s traffic the Zyxel Device has discarded and

notified the client that the traffic was rejected (in kilobytes). This traffic was rejected

because it matched an application policy set to “reject”.

Matched Auto

Connection This is how much of the application’s traffic the Zyxel Device identified by examining

the IP payload.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

171

6.31 The Content Filter Screen

Click Monitor > Security Statistics > Content Filter to display the following screen. This screen displays

content filter statistics.

Figure 139 Monitor > Security Statistics > Content Filter

The following table describes the labels in this screen.

Inbound Kbps This field displays the amount of the application’s traffic that has gone to the ZyWALL

(in kilo bits per second).

Outbound Kbps This field displays the amount of the application’s traffic that has gone from the

ZyWALL (in kilo bits per second).

Table 65 Monitor > Security Statistics > App Patrol > Summary

LABEL DESCRIPTION

Table 66 Monitor > Security Statistics > Content Filter

LABEL DESCRIPTION

General Settings

Collect Statistics Select this check box to have the Zyxel Device collect content filtering statistics.

The collection starting time displays after you click Apply. All of the statistics in this

screen are for the time period starting at the time displayed here. The format is year,

month, day and hour, minute, second. All of the statistics are erased if you restart the

Zyxel Device or click Flush Data. Collecting starts over and a new collection start time

displays.

Apply Click Apply to save your changes back to the Zyxel Device.

Reset Click Reset to return the screen to its last-saved settings.

Refresh Click this button to update the report display.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

172

6.32 The Anti-Malware Screen

Click Monitor > Security Statistics > Anti-Malware > Summary to display the following screen. This screen

displays anti-malware statistics.

Flush Data Click this button to discard all of the screen’s statistics and update the report display.

Web Request Statistics

Total Submit File This field displays the number of web pages that the Zyxel Device’s content filter feature

has checked.

Blocked This is the number of web pages that the Zyxel Device blocked access.

Warned This is the number of web pages for which the Zyxel Device displayed a warning

message to the access requesters.

Passed This is the number of web pages to which the Zyxel Device allowed access.

Category Hit Summary

Managed Web Pages This is the number of requested web pages that the Zyxel Device’s content filtering

service identified as belonging to a category that was selected to be managed.

Block Hit Summary

Web Pages Warned by

Category Service

This is the number of web pages that matched an external database content filtering

category selected in the Zyxel Device and for which the Zyxel Device displayed a

warning before allowing users access.

Web Pages Blocked by

Custom Service

This is the number of web pages to which the Zyxel Device did not allow access due to

the content filtering custom service configuration.

Restricted Web

Features This is the number of web pages to which the ZyWALL limited access or removed

cookies due to the content filtering custom service's restricted web features

configuration.

Forbidden Web Sites This is the number of web pages to which the Zyxel Device did not allow access

because they matched the content filtering custom service’s forbidden web sites list.

URL Keywords This is the number of web pages to which the Zyxel Device did not allow access

because they contained one of the content filtering custom service’s list of forbidden

keywords.

Table 66 Monitor > Security Statistics > Content Filter (continued)

LABEL DESCRIPTION

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

173

Figure 140 Monitor > Security Statistics > Anti-Malware > Summary: Virus Name

The following table describes the labels in this screen.

Table 67 Monitor > Security Statistics > Anti-Malware > Summary: Virus Name

LABEL DESCRIPTION

Collect Statistics Select this check box to have the Zyxel Device collect anti-malware statistics.

The collection starting time displays after you click Apply. All of the statistics in this screen

are for the time period starting at the time displayed here. The format is year, month, day

and hour, minute, second. All of the statistics are erased if you restart the Zyxel Device or

click Flush Data. Collecting starts over and a new collection start time displays.

Apply Click Apply to save your changes back to the Zyxel Device.

Reset Click Reset to return the screen to its last-saved settings.

Refresh Click this button to update the report display.

Flush Data Click this button to discard all of the screen’s statistics and update the report display.

Total Viruses Detected This field displays the number of different viruses that the Zyxel Device has detected.

Top Entries By Use this field to have the following (read-only) table display the top anti-malware log

entries by Virus Name, Source IP, and Destination IP, Source IPv6 and Destination IPv6.

This table displays the most common, recent virus logs. See the log screen for less

common virus logs or use a syslog server to record all virus logs.

Select Virus Name to list the most common viruses that the Zyxel Device has detected.

Select Source IP to list the source IP addresses from which the Zyxel Device has detected

the most virus-infected files.

Select Destination IP to list the most common destination IP addresses for virus-infected

files that Zyxel Device has detected.

Select Source IPv6 to list the source IPv6 addresses from which the Zyxel Device has

detected the most virus-infected files.

Select Destination IPv6 to list the most common destination IPv6 addresses for virus-

infected files that Zyxel Device has detected.

Add to white list Select an entry and click this to add it to the anti-malware white list.

Remove from white list Select an entry and click this to remove it from the anti-malware white list.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

174

The statistics display as follows when you display the top entries by source IP.

Figure 141 Monitor > Security Statistics > Anti-Malware > Summary: Source IP

The statistics display as follows when you display the top entries by source IPv6.

Figure 142 Monitor > Security Statistics > Anti-Malware: Source IPv6

The statistics display as follows when you display the top entries by destination IP.

Figure 143 Monitor > Security Statistics > Anti-Malware > Summary: Destination IP

The statistics display as follows when you display the top entries by destination IPv6.

#This field displays the entry’s rank in the list of the top entries.

Virus name This column displays when you display the entries by Virus Name. This displays the name

of a detected virus.

Hash This column displays a hash value, MD5 (Message Digest 5) and SHA (Secure Hash

Algorithm), of the detected virus file.

MD5 and SHA are hash algorithms used to authenticate packet data.

Source IP This column displays when you display the entries by Source IP. It shows the source IP

address of virus-infected files that the Zyxel Device has detected.

Source IPv6 his column displays when you display the entries by Source IPv6. It shows the source IPv6

address of virus-infected files that the Zyxel Device has detected.

Destination IP This column displays when you display the entries by Destination IP. It shows the

destination IP address of virus-infected files that the Zyxel Device has detected.

Destination IPv6 This column displays when you display the entries by Destination IPv6. It shows the

destination IPv6 address of virus-infected files that the Zyxel Device has detected.

Occurrences This field displays how many times the Zyxel Device has detected the event described in

the entry.

White List Click this to add this signature to the anti-malware white list.

Click this to remove this signature from the anti-malware white list.

Table 67 Monitor > Security Statistics > Anti-Malware > Summary: Virus Name (continued)

LABEL DESCRIPTION

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

175

Figure 144 Monitor > Security Statistics > Anti-Malware: Destination IPv6

6.33 The Reputation Filter Screen

Click Monitor > Security Statistics > Reputation Filter > Summary to display the following screen. This

screen displays Reputation Filter statistics.

Figure 145 Monitor > Security Statistics > Reputation Filter > Summary

The following table describes the labels in this screen.

Table 68 Monitor > Security Statistics > Reputation Filter > Summary

LABEL DESCRIPTION

Collect Statistics Select this check box to have the Zyxel Device collect anti-malware statistics.

The collection starting time displays after you click Apply. All of the statistics in this screen

are for the time period starting at the time displayed here. The format is year, month, day

and hour, minute, second. All of the statistics are erased if you restart the Zyxel Device or

click Flush Data. Collecting starts over and a new collection start time displays.

Apply Click Apply to save your changes back to the Zyxel Device.

Reset Click Reset to return the screen to its last-saved settings.

Refresh Click this button to update the report display.

Flush Data Click this button to discard all of the screen’s statistics and update the report display.

Summary

IP Scanned This field displays the total number of IPv4 addresses that have been scanned.

IP Hit Count This field displays the total number of the hit counts on the scanned IPv4 addresses.

URL Scanned This field displays the total number of URLs that have been scanned.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

176

6.34 The IDP Screen

Click Monitor > Security Statistics > IDP > Summary to display the following screen. This screen displays

IDP (Intrusion Detection and Prevention) statistics.

Figure 146 Monitor > Security Statistics > IDP > Summary: Signature Name

URL Hit Count This field displays the total number of the hit counts on the scanned URLs.

IP Detected

Add to white list Select an entry and click this to add it to the IP reputation white list.

Remove from white list Select an entry and click this to remove it from the IP reputation white list.

Time This field displays the date and time the entry was created.

Malicious IP This field displays the IPv4 address with bad reputation.

Infected/Victim Host This field displays the MAC address of the infected host.

Threat Category This field displays the category of the entry.

Threat Level This field displays the threat level of the entry.

URL Detected

Add to white list Select an entry and click this to add it to the URL Threat filtering white list.

Remove from white list Select an entry and click this to remove it from the URL Threat filtering white list.

Time This field displays the date and time the entry was created.

Source IP This field displays the source IP address of traffic that you want to trace.

Destination IP This field displays the destination IP address of traffic.

Botnet URL This field displays the URL of an infected website or a botnet C&C server.

Threat Category This field displays the category of the entry.

Table 68 Monitor > Security Statistics > Reputation Filter > Summary (continued)

LABEL DESCRIPTION

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

177

The following table describes the labels in this screen.

Table 69 Monitor > Security Statistics > IDP > Summary

LABEL DESCRIPTION

Collect Statistics Select this check box to have the Zyxel Device collect IDP statistics.

The collection starting time displays after you click Apply. All of the statistics in this screen

are for the time period starting at the time displayed here. The format is year, month,

day and hour, minute, second. All of the statistics are erased if you restart the Zyxel

Device or click Flush Data. Collecting starts over and a new collection start time displays.

Apply Click Apply to save your changes back to the Zyxel Device.

Reset Click Reset to return the screen to its last-saved settings.

Refresh Click this button to update the report display.

Flush Data Click this button to discard all of the screen’s statistics and update the report display.

Total Session Scanned This field displays the number of sessions that the Zyxel Device has checked for intrusion

characteristics.

Total Packet Dropped The Zyxel Device can detect and drop malicious packets from network traffic. This field

displays the number of packets that the Zyxel Device has dropped.

Total Packet Reset The Zyxel Device can detect and drop malicious packets from network traffic. This field

displays the number of packets that the Zyxel Device has reset.

Top Entries By Use this field to have the following (read-only) table display the top IDP log entries by

Signature Name, Source IP or Destination IP. This table displays the most common, recent

IDP logs. See the log screen for less common IDP logs or use a syslog server to record all

IDP logs.

Select Signature Name to list the most common signatures that the Zyxel Device has

detected.

Select Source IP to list the source IP addresses from which the Zyxel Device has detected

the most intrusion attempts.

Select Destination IP to list the most common destination IP addresses for intrusion

attempts that the Zyxel Device has detected.

Add to white list Select a signature and click this to add the selected signature to the IDP white list.

Remove from white list Select a signature and click this to remove the selected signature from the IDP white list.

#This field displays the entry’s rank in the list of the top entries.

Signature Name This column displays when you display the entries by Signature Name. The signature

name identifies the type of intrusion pattern. Click the hyperlink for more detailed

information on the intrusion.

Signature ID This column displays when you display the entries by Signature Name. The signature ID is

a unique value given to each intrusion detected.

Type This column displays when you display the entries by Signature Name. It shows the

categories of intrusions.

Severity This column displays when you display the entries by Signature Name. It shows the level

of threat that the intrusions may pose.

Source IP This column displays when you display the entries by Source. It shows the source IP

address of the intrusion attempts.

Destination IP This column displays when you display the entries by Destination. It shows the destination

IP address at which intrusion attempts were targeted.

Occurrences This field displays how many times the Zyxel Device has detected the event described in

the entry.

White List Click this to add this signature to the IDP white list.

Click this to remove this signature from the IDP white list.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

178

The statistics display as follows when you display the top entries by source.

Figure 147 Monitor > Security Statistics > IDP > Summary: Source IP

The statistics display as follows when you display the top entries by destination.

Figure 148 Monitor > Security Statistics > IDP > Summary: Destination IP

6.35 The Email Security Screens

The Email Security menu contains the Summary and Status screens.

6.35.1 Email Security Summary

Click Monitor > Secu rity Statistics > Ema il Security > Summary to display the following screen. This screen

displays spam statistics.

Figure 149 Monitor > Security Statistics > Email Security > Summary

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

179

The following table describes the labels in this screen.

Table 70 Monitor > Security Statistics > Email Security > Summary

LABEL DESCRIPTION

Collect Statistics Select this check box to have the Zyxel Device collect email security statistics.

The collection starting time displays after you click Apply. All of the statistics in this

screen are for the time period starting at the time displayed here. The format is year,

month, day and hour, minute, second. All of the statistics are erased if you restart the

Zyxel Device or click Flush Data. Collecting starts over and a new collection start time

displays.

Apply Click Apply to save your changes back to the Zyxel Device.

Reset Click Reset to return the screen to its last-saved settings.

Refresh Click this button to update the report display.

Flush Data Click this button to discard all of the screen’s statistics and update the report display.

Email Summary

Total Mails Scanned This field displays the number of emails that the Zyxel Device’s email security feature has

checked.

Safe Mails This is the number of emails that the Zyxel Device has determined to not be spam.

Safe Mails Detected

by White list This is the number of emails that matched an entry in the Zyxel Device’s email security

white list.

Spam Mails This is the number of emails that the Zyxel Device has determined to be spam.

Spam Mails Detected

by Black List This is the number of emails that matched an entry in the Zyxel Device’s email security

black list.

Spam Mails Detected

by Malicious Mail This is the number of emails that the Zyxel Device has determined to have malicious

contents.

Spam Mails Detected

by DNSBL The Zyxel Device can check the sender and relay IP addresses in an email’s header

against DNS (Domain Name Service)-based spam Black Lists (DNSBLs). This is the

number of emails that had a sender or relay IP address in the header which matched

one of the DNSBLs that the Zyxel Device uses.

Query Timeout This is how many queries that were sent to the Zyxel Device’s configured list of DNSBL

domains or Mail Scan services and did not receive a response in time.

When mail session threshold is reached

Mail Sessions Forwarded This is how many email sessions the Zyxel Device allowed because they exceeded the

maximum number of email sessions that the email security feature can check at a time.

You can see the Zyxel Device’s threshold of concurrent email sessions on the Email

Security > Status screen.

Use the Email Security > Summary screen to set whether the Zyxel Device forwards or

drops sessions that exceed this threshold.

Mail Sessions Dropped This is how many email sessions the Zyxel Device dropped because they exceeded the

maximum number of email sessions that the email security feature can check at a time.

You can see the Zyxel Device’s threshold of concurrent email sessions on the Email

Security > Status screen.

Use the Email Security > Summary screen to set whether the Zyxel Device forwards or

drops sessions that exceed this threshold.

Statistics

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

180

6.35.2 The Email Security Status Screen

Click Monitor > Security Statistics > Email Security > Status to display the Email Security Status screen.

Use the Email Security Status screen to see how many email sessions the email security feature is

scanning and statistics for the DNSBLs.

Figure 150 Monitor > Security Statistics > Email Security > Status

The following table describes the labels in this screen.

Top Sender By Use this field to list the top email or IP addresses from which the Zyxel Device has

detected the most spam.

Select Sender IP to list the source IP addresses from which the Zyxel Device has

detected the most spam.

Select Sender Email Address to list the top email addresses from which the Zyxel Device

has detected the most spam.

#This field displays the entry’s rank in the list of the top entries.

Sender IP This column displays when you display the entries by Sender IP. It shows the source IP

address of spam emails that the Zyxel Device has detected.

Sender Email Address This column displays when you display the entries by Sender Email Address. This column

displays the email addresses from which the Zyxel Device has detected the most spam.

Occurrence This field displays how many spam emails the Zyxel Device detected from the sender.

Table 70 Monitor > Security Statistics > Email Security > Summary (continued)

LABEL DESCRIPTION

Table 71 Monitor > Security Statistics > Email Security > Status

LABEL DESCRIPTION

Resource Status

Concurrent Mail Session

Scanning

The darker shaded part of the bar shows how much of the Zyxel Device’s total spam

checking capability is currently being used.

The lighter shaded part of the bar and the pop-up show the historical high.

The first number to the right of the bar is how many email sessions the Zyxel Device is

presently checking for spam. The second number is the maximum number of email

sessions that the Zyxel Device can check at once. An email session is when an email

client and email server (or two email servers) connect through the Zyxel Device.

Refresh Click this button to update the information displayed on this screen.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

181

6.36 The SSL Inspection Screens

The Zyxel Device uses SSL Inspection to decrypt SSL traffic, sends it to the Security Service engines for

inspection, then encrypts traffic that passes inspection and forwards it. You must enable SSL Inspection if

you want to use Content Filtering 2.0 Safe Search.

Click Monitor > Security Statistics > SSL Inspection > Summary to display the following screen.

Figure 151 Monitor > Security Statistics > SSL Inspection > Summaryt

Flush Click this button to clear the DNSBL statistics. This also clears the concurrent mail

session scanning bar’s historical high.

Mail Scan Statistics These are the statistics for the service the Zyxel Device uses. These statistics are for

when the Zyxel Device actually queries the service servers.

#This is the entry’s index number in the list.

Service This displays the name of the service.

Total Queries This is the total number of queries the Zyxel Device has sent to this service.

Avg. Response Time (sec) This is the average for how long it takes to receive a reply from this service.

No Response This is how many queries the Zyxel Device sent to this service without receiving a reply.

DNSBL Statistics These are the statistics for the DNSBL the Zyxel Device uses. These statistics are for

when the Zyxel Device actually queries the DNSBL servers. Matches for DNSBL

responses stored in the cache do not affect these statistics.

#This is the entry’s index number in the list.

DNSBL Domain These are the DNSBLs the Zyxel Device uses to check sender and relay IP addresses in

emails.

Total Queries This is the total number of DNS queries the Zyxel Device has sent to this DNSBL.

Avg. Response Time (sec) This is the average for how long it takes to receive a reply from this DNSBL.

No Response This is how many DNS queries the Zyxel Device sent to this DNSBL without receiving a

reply.

Table 71 Monitor > Security Statistics > Email Security > Status

LABEL DESCRIPTION

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

182

The following table describes the labels in this screen.

6.36.1 Certificate Cache List

SSL traffic to a server to be excluded from SSL Inspection is identified by its certificate. Traffic in an

Exclude List is not intercepted by SSL Inspection.

Click Monitor > Security Statistics > SSL In spection > C ertificate Cache List to display a screen that shows

details on SSL traffic going to servers identified by its certificate and an option to add that traffic to the

Exclude List.

Table 72 Monitor > Security Statistics > SSL Inspection > Summary

LABEL DESCRIPTION

Collect Statistics Select this check box to have the Zyxel Device collect SSL Inspection statistics.

The collection starting time displays after you click Apply. All of the statistics in this

screen are for the time period starting at the time displayed here. The format is year,

month, day and hour, minute, second. All of the statistics are erased if you restart the

Zyxel Device or click Flush Data. Collecting starts over and a new collection start time

displays.

Apply Click Apply to save your changes back to the Zyxel Device.

Reset Click Reset to return the screen to its last-saved settings.

Refresh Click this button to update the report display.

Flush Data Click this button to discard all of the screen’s statistics and update the report display.

Status

Maximum Concurrent

Sessions This shows the maximum number of simultaneous SSL Inspection sessions allowed for

your Zyxel Device model.

Concurrent Sessions This shows the actual number of simultaneous SSL Inspection sessions in progress.

Summary

Total SSL Sessions This is the total of SSL sessions inspected and number of sessions blocked and number

of sessions passed since data was last flushed or the Zyxel Device last rebooted after

Collect Statistics was enabled.

Sessions Inspected This shows the total number of SSL sessions inspected since data was last flushed or the

Zyxel Device last rebooted after Collect Statistics was enabled

Decrypted (Kbytes) This shows the number of kilobytes (KB) of data that was decrypted for Security

Service inspection.

Encrypted (Kbytes) This shows the number of kilobytes (KB) of data that was re-encrypted after Security

Service inspection and then forwarded.

Sessions Blocked This shows the number of SSL sessions blocked.

Sessions Passed This shows the number of SSL sessions passed.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

183

Figure 152 Monitor > Security Statistics > SSL Inspection > Certificate Cache List

The following table describes the labels in this screen.

6.37 Log Screens

Log messages are stored in two separate logs, one for regular log messages and one for debugging

messages. In the regular log, you can look at all the log messages by selecting All Logs, or you can

select a specific category of log messages (for example, security policy or user). You can also look at

the debugging log by selecting Debug Log. All debugging messages have the same priority.

Table 73 Monitor > Security Statistics > SSL Inspection > Certificate Cache List

LABEL DESCRIPTION

Certificate Cache List

Add to Exclude list Select and item in the list and click this icon to add the common name (CN) to the

Exclude List.

#This field is a sequential value, and it is not associated with a specific entry.

In Exclude List If any one of common name, DNS name, email address or IP address of the

certificate is in the Ex cl ude Li s t, then traffic to the server identified by the certificate is

excluded from inspection.

The icons here are defined as follows:

• Gray: The identity of the certificate is not in the Exclude List

• Green: The common name of the certificate is in the Exclude List

• Yellow: The common name of certificate is not in the Exclude List but one of the

DNS name, email address or IP address is.

Time This is the latest date (yyyy-mm-dd) and time (hh-mm-ss) that the record in the

certificate cache list was met.

Common Name This displays the common name in the certificate of the SSL traffic destination server.

Server Name Indication Server Name Indication (SNI) is the domain name entered in the browser, FTP client,

etc. to begin the SSL session with the server. It allows multiple SSL sessions to the same

IP address and port number with different certificates from different SNI. This field

displays the SNI for this SSL session.

SSL Version This field shows the SSL version. SSLv3/TLS1.0 is currently supported.

Destination This displays the IP address and port number of the SSL traffic destination server.

Valid Time This displays the cache item expiry time in seconds. The cache item is deleted when

the remaining time expires.

Refresh Click this button to update the information on the screen.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

184

6.37.1 View Log

To access this screen, click Monitor > Log. The log is displayed on the following screen.

Note: When a log reaches the maximum number of log messages, new log messages

automatically overwrite existing log messages, starting with the oldest existing log

message first.

• The maximum possible number of log messages in the Zyxel Device varies by model.

Events that generate an alert (as well as a log message) display in red. Regular logs display in black.

Click a column’s heading cell to sort the table entries by that column’s criteria. Click the heading cell

again to reverse the sort order. The Web Configurator saves the filter settings if you leave the View Log

screen and return to it later.

Figure 153 Monitor > Log > View Log

The following table describes the labels in this screen.

Table 74 Monitor > Log > View Log

LABEL DESCRIPTION

Show (Hide) Filter Click this button to show or hide criteria that allow you to filter logs that will be

displayed.

If the filter settings are hidden, the Category, Email Log Now, Refresh, and Clear fields

are available.

If the filter settings are shown, the Category, Priority, Source Address, Destination

Address, Source Interface, Destination Interface, Service, Keyword, Protocol and Search

fields are available.

Category Select the type of log message(s) you want to view. You can also view All Logs at one

time, or you can view the Debug Log.

Priority This displays when you show the filter. Select the priority of log messages to display. The

log displays the log messages with this priority or higher. Choices are: any, emerg, alert,

crit, error, warn, notice, and info, from highest priority to lowest priority. This field is

grayed out if the Category is Debug Log.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

185

6.37.2 View AP Log

Click on Monitor > Log > View AP Log to open the following screen.

Source Address This displays when you show the filter. Type the source IP address of the incoming

packet that generated the log message. Do not include the port in this filter.

Destination Address This displays when you show the filter. Type the IP address of the destination of the

incoming packet when the log message was generated. Do not include the port in this

filter.

Source Interface This displays when you show the filter. Type the source interface of the incoming packet

that generated the log message.

Destination Interface This displays when you show the filter. Type the interface of the destination of the

incoming packet when the log message was generated.

Service This displays when you show the filter. Select the service whose log messages you would

like to see. The Web Configurator uses the protocol and destination port number(s) of

the service to select which log messages you see.

Keyword This displays when you show the filter. Type a keyword to look for in the Message,

Source, Destination and Note fields. If a match is found in any field, the log message is

displayed. You can use up to 63 alphanumeric characters and the underscore, as well

as punctuation marks ()’ ,:;?! +-*/= #$% @ ; the period, double quotes, and brackets are

not allowed.

Protocol This displays when you show the filter. Select a service protocol whose log messages

you would like to see.

Search This displays when you show the filter. Click this button to update the log using the

current filter settings.

Reset Click Reset to return the screen to its last-saved settings.

Email Log Now Click this button to send log message(s) to the Active email address(es) specified in the

Send Log To field on the Log Settings page.

Refresh Click this button to update the information on the screen.

Clear Click this button to clear the whole log, regardless of what is currently displayed on the

screen.

#This field is a sequential value, and it is not associated with a specific log message.

Time This field displays the time the log message was recorded.

Priority This field displays the priority of the log message. It has the same range of values as the

Priority field above.

Category This field displays the log that generated the log message. It is the same value used in

the Category field above.

Message This field displays the reason the log message was generated. The text “[count=x]”,

where x is a number, appears at the end of the Message field if log consolidation is

turned on and multiple entries were aggregated to generate into this one.

Source This field displays the source IP address and the port number in the event that

generated the log message.

Destination This field displays the destination IP address and the port number of the event that

generated the log message.

Note This field displays any additional information about the log message.

Table 74 Monitor > Log > View Log (continued)

LABEL DESCRIPTION

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

186

Figure 154 Monitor > Log > View AP Log

The following table describes the labels in this screen.

Table 75 Monitor > Log > View AP Log

LABEL DESCRIPTION

Show Filter Click this button to show or hide the filter settings.

If the filter settings are hidden, the Display, Email Log Now, Refresh, and Clear fields are

available.

If the filter settings are shown, the Display, Priority, Source Address, Destination Address,

Source Interface, Destination Interface, Service, Keyword, Protocol, and Search fields

are available.

Select an AP Click the pull down menu to choose an AP.

Query Click Query to create a Query log.

Log Query Status The field displays the

AP Information This field displays the AP information. N/A is displayed when

Log File Status This field displays how many logs are available. It will display Empty if there’s none.

Last Log Query Time This field displays the most recent time a log query was solicited.

Display Select the category of log message(s) you want to view. You can also view All Logs at

one time, or you can view the Debug Log.

Priority This displays when you show the filter. Select the priority of log messages to display. The

log displays the log messages with this priority or higher. Choices are: any, emerg, alert,

crit, error, warn, notice, and info, from highest priority to lowest priority. This field is read-

only if the Category is Debug Log.

Source Address Type the IP address of the source AP.

Destination Address This displays when you show the filter. Type the IP address of the destination of the

incoming packet when the log message was generated. Do not include the port in this

filter.

Source Interface This displays when you show the filter. Type the source interface of the incoming packet

that generated the log message.

Destination Interface This displays when you show the filter. Type the interface of the destination of the

incoming packet when the log message was generated.

Service Select a policy service available from Zyxel Device from the pull down menu.

Keyword Type a keyword of the policy service available from Zyxel Device to search for a log.

Protocol Select the protocol of the AP from the pull down menu.

Chapter 6 Monitor

ZyWALL USG FLEX Series User’s Guide

187

Search Click this to start the search.

Email Log Now Click this button to send log message(s) to the Active email address(es) specified in the

Send Log To field on the Log Settings page.

Refresh Click this button to update the information on the screen.

Clear Click this button to clear the whole log, regardless of what is currently displayed on the

screen.

#This field is a sequential value, and it is not associated with a specific log message.

Time This field displays the time the log message was recorded.

Priority This displays when you show the filter. Select the priority of log messages to display. The

log displays the log messages with this priority or higher. Choices are: any, emerg, alert,

crit, error, warn, notice, and info, from highest priority to lowest priority. This field is read-

only if the Category is Debug Log.

Category This field displays the log that generated the log message. It is the same value used in

the Display and (other) Category fields.

Message This field displays the message of the log.

Source This displays the source IP address of the selected log message.

Destination This displays the source IP address of the selected log message.

Note This field displays any additional information about the log message.

Table 75 Monitor > Log > View AP Log (continued)

LABEL DESCRIPTION

ZyWALL USG FLEX Series User’s Guide

188

CHAPTER 7

Licensing

7.1 Registration Overview

Use the Configuration > Licensing > Registration screens to register your Zyxel Device and manage its

service subscriptions.

• Use the Registration screen (see Section 7.1.2 on page 188) to refresh Zyxel Device registration, go to

portal.myZyxel.com to register your Zyxel Device and activate a service, such as content filtering.

• Use the Service screen (see Section 7.1.3 on page 189) to display the status of your service

registrations and upgrade licenses.

7.1.1 What you Need to Know

This section introduces the topics covered in this chapter.

Subscription Services Available

See Configuration > Licen sing > Registration > Service for the subscription services that your Zyxel Device

supports. Zyxel offers two types of security packs for your Zyxel Device. The subscription services you can

use on the Zyxel Device vary depending on the security pack license you purchase. See the table below

for services available in each pack.

You can purchase an iCard and enter its license key at myZyxel to extend a service.

USG FLEX Series

7.1.2 Registration Screen

Click the link in this screen to register your Zyxel Device at myZyxel. Then click Refresh in this screen and

wait a few moments for the registration information to update. If the page does not refresh, make sure

Table 76 USG FLEX Series Security Subscription Services

SERVICE MODULE SERVICE BUNDLE LICENSE

Web Filtering Content Filter V

Application Security App Patrol V

Anti-Malware Anti-Malware V

IPS IDP V

Email Security (Anti-

Spam)

Email Security V

SecuReporter

Premium

SecuReporter Premium 1-Year Standard Service

• Unlimited log retention period

• Log analysis for 30 days

Chapter 7 Licensing

ZyWALL USG FLEX Series User’s Guide

189

the Internet connection is working and click Refresh again. The Zyxel Device should already have

Internet access and be able to access myZyxel. Click Configuration > Licensing > Registration in the

navigation panel to open the screen as shown next.

Click on the icon to go to the OneSecurity website where there is guidance on configuration

walkthrough and other information.

Figure 155 Configuration > Licensing > Registration

7.1.3 Service Screen

Use this screen to display the status of your service registrations and upgrade licenses. To activate or

extend a standard service subscription, purchase an iCard and enter the iCard’s PIN number (license

key) at myZyxel. Click Activate in this screen to enable both Trial and Standard services on this Zyxel

Device. Click Configuration > Licensing > Registration > Service to open the screen as shown next.

Figure 156 Configuration > Licensing > Registration > Service - USG FLEX 500

Chapter 7 Licensing

ZyWALL USG FLEX Series User’s Guide

190

The following table describes the labels in this screen.

Table 77 Configuration > Licensing > Registration > Service

LABEL DESCRIPTION

Service Status

#This is the entry’s position in the list.

Service This lists the name of services or service modules that are available on the Zyxel

Device.

Web Filtering (CF): This is a license to a database that can block websites by category, such as

Gambling.

IPS (IDP) This is a license to detect Intrusion Detection and Prevention attacks.

Application Patrol This is a license to use signatures for Application Patrol inspection to manage the

use of various applications on the network.

Anti-Malware This is a license for signatures to detect malware patterns in files.

Email Security (Anti-

Spam) This is a license to use anti-spam signatures to mark or discard spam (unsolicited

commercial or junk email).

SecuReporter This is a license that allows SecuReporter to collect and analyze logs from your Zyxel

Device in order to identify anomalies, notify you of potential internal or external

threats, and report on network usage. The Zyxel Device retains logs up to 7 days.

SecuReporter Premium This is a license that allows SecuReporter to collect and analyze logs from your Zyxel

Device in order to identify anomalies, notify you of potential internal or external

threats, and report on network usage. The Zyxel Device retains logs up to 1 year.

Managed AP Service This is a license to manage more APs than the default for your Zyxel Device when

the AP controller is enabled.

Hotspot Management

Subscription Service This is a license to manage hotspot functions such as Billing, Printer Manager, Free

Time, IPnP, Walled Garden and Advertisement.

Concurrent Device

Upgrade This is a license to increase the number of devices (based on unique MAC address)

that can log in and use the Zyxel Device Hotspot at the same time.

Device HA Pro This is a license for professional High Availability (HA) that lets a backup Zyxel

Device automatically take over if the master Zyxel Device fails.

Firmware Upgrade

Service This is a free license to get Cloud Helper notifications when new firmware is

available. You must register your Zyxel Device at myZyxel.

Status This field displays whether a service license is enabled at myZyxel (Activated) or not

(Not Activated) or expired (Expired). It displays the remaining Grace Period if your

license has Expired. It displays Not Licensed if there isn’t a license to be activated

for this service.

Default displays for quantity-based licenses when the Zyxel Device is currently using

the allowed free number without a license. For example, if a Zyxel Device is allowed

to manage x number of APs without a license and it is currently using that number,

then Managed AP Service Status displays Default.

Service Type This field displays whether you applied for a trial application (Trial) or registered a

service with your iCard’s PIN number (Standard). This field is blank when a service is

not activated.

Expiration Date This field displays the date your service license expires or the date the grace period

expires if the license has already expired.

You can continue to use IDP/AppPatrol, Anti-Malware, Content Filter, Email Security

during the grace period. After the grace period ends, all of these features are

disabled.

Count This field displays how many instances of a service you can use with your current

license. N/A means a count does not apply to this service.

Chapter 7 Licensing

ZyWALL USG FLEX Series User’s Guide

191

7.2 Signature Update

This section shows you how to update the signature packages of the Zyxel Device.

• Use the Configuration > Licensing > Signature Update screen (Section 7.2.2 on page 191) to update

the signatures used for a service, such as IDP and application patrol.

7.2.1 What you Need to Know

• You need a valid service registration to update the anti-malware signatures, the URL Threat filter

signatures, the IDP signatures and the App-Patrol signatures.

• You do not need a service registration to update the system-protection signatures.

• Schedule signature updates for a day and time when your network is least busy to minimize disruption

to your network.

• Your custom signature configurations are not over-written when you download new signatures.

Note: The Zyxel Device does not have to reboot when you upload new signatures.

7.2.2 The Signature Screen

Click Configuration > Licensing > Signature Update to display the following screen.

Figure 157 Configuration > Licensing > Signature Update

Action If you need a license or a trial license has expired, click Buy to buy a new one. If a

Standard license has expired, click Renew to extend the license.

Then, click Activate to connect with the myZyxel server to activate the new license.

Service License Refresh Click this button to renew service license information (such as the registration status

and expiration day).

Note: It is recommended you use this button after you register for a new

service.

Table 77 Configuration > Licensing > Registration > Service (continued)

LABEL DESCRIPTION

Chapter 7 Licensing

ZyWALL USG FLEX Series User’s Guide

192

The following table describes the labels in this screen.

7.2.3 Auto Update

Click the Schedule icon of a service to display the following screen.

Figure 158 Configuration > Licensing > Signature Update: Schedule > Auto Update

The following table describes the labels in this screen.

Table 78 Configuration > Licensing > Signature Update

LABEL DESCRIPTION

Service Status The following fields display the status and information on the current signature set that

the Zyxel Device is using.

Feature This field displays the name of the services available on the Zyxel Device.

Type This field displays the type of service engine used by the Zyxel Device.

Current Version This field displays the signatures version number currently used by the Zyxel Device. This

number gets larger as new signatures are added.

Released Date This field displays the date and time the set was released.

Last Sync This field displays the date and time the Zyxel Device last checked for new signatures at

myZyxel.

Action Click the Update icon to have the Zyxel Device immediately check for new signatures

at myZyxel. If new signatures are found, they are then downloaded to the Zyxel Device.

Click the Schedule icon to have the Zyxel Device automatically check for new

signatures regularly at the time and day specified. You should select a time when your

network is not busy for minimal interruption.

Table 79 Configuration > Licensing > Signature Update: Schedule > Auto Update

LABEL DESCRIPTION

Auto Update Select this check box to have the Zyxel Device automatically check for new signatures

regularly at the time and day specified.

You should select a time when your network is not busy for minimal interruption.

Hourly Select this option to have the Zyxel Device check for new signatures every hour.

Daily Select this option to have the Zyxel Device check for new signatures every day at the

specified time. The time format is the 24 hour clock, so ‘23’ means 11 PM for example.

Weekly Select this option to have the Zyxel Device check for new signatures once a week on

the day and at the time specified.

OK Click this button to save your changes to the Zyxel Device.

ZyWALL USG FLEX Series User’s Guide

193

CHAPTER 8

Wireless

8.1 Overview

Use the Wireless screens to configure how the Zyxel Device manages supported Access Points (APs).

Supported APs should be in managed mode. See the product page Licenses tab for a list of supported

APs.

8.1.1 What You Can Do in this Chapter

• Use the Controller screen (Section 8.2 on page 193) to set how the Zyxel Device allows new APs to

connect to the network and set the country code of APs that are connected to the Zyxel Device.

• Use the AP Management screens (Section 3 on page 195) to manage all of the APs connected to the

Zyxel Device.

• Use the Rogue AP screen (Section 8.4 on page 208) to assign APs either to the rogue AP list or the

friendly AP list.

• Use the Auto Healing screen (Section 8.5 on page 211) to extend the wireless service coverage area

of the managed APs when one of the APs fails.

• Use the RTLS screen (Section 8.6 on page 212) to allow managed APs with battery-powered Wi-Fi tags

be part of Ekahau RTLS (Real Time Location Service). RTLS can track the location of APs managed by

the Zyxel Device to create maps, alerts, and reports.

8.2 Controller Screen

Use this screen to set how the Zyxel Device allows new APs to connect to the network. Click

Configuration > Wireless > Controller to access this screen.

Figure 159 Configuration > Wireless > Controller

Chapter 8 Wireless

ZyWALL USG FLEX Series User’s Guide

194

Each field is described in the following table.

8.2.1 Connecting an AP to the Zyxel Device

• You can connect an AP directly to one of the Ethernet ports on the Zyxel Device. You can also

connect an AP indirectly to the Zyxel Device through the local network.

• If an AP and the Zyxel Device are on the same subnet, the AP will automatically detect and connect

to the Zyxel Device.

• If an AP and the Zyxel Device are on different subnets, then you can must configure the AP to

connect to the Zyxel Device. You can do this manually or by configuring DHCP Option 138 on the

AP’s DHCP server.

• After an AP has successfully connected to the Zyxel Device, the AP appears in the AP List on MONITOR

> Wireless > AP Information.

8.2.2 Connecting an AP to the Zyxel Device Manually

1Ensure that the Zyxel Device has a static IP address.

2Connect to and log on to the AP using a web browser.

3On the AP, go to CONFIGURATION > Network > AC Discovery.

4Under Discovery Setting, select Manual.

5Under Primary static AC IP, enter the IP address of the Zyxel Device.

6Click Apply.

The Zyxel Device can now manage the AP.

8.2.3 Connecting an AP to the Zyxel Device Using DHCP Option 138

1Ensure that the Zyxel Device has a static IP address.

Table 80 Configuration > Wireless > Controller

LABEL DESCRIPTION

Country Code Select the country code of APs that are connected to the Zyxel Device to be the same as where

the Zyxel Device is located/installed. The available channels vary depending on the country you

selected.

Registration

Type

Select Manual to add each AP to the Zyxel Device for management, or Always Accept to

automatically add APs to the Zyxel Device for management.

If you select Manual, then go to Monitor > Wireless > AP Information > AP List, select an AP to be

managed and then click Add to Mgnt AP List. That AP will then appear in Configuration > Wireless

> Controller > Mgnt. AP List.

Note: Select the Manual option for managing a specific set of APs. This is

recommended as the registration mechanism cannot automatically differentiate

between friendly and rogue APs.

APs must be connected to the Zyxel Device by a wired connection or network.

Apply Click Apply to save your changes back to the Zyxel Device.

Reset Click Reset to return the screen to its last-saved settings.

Chapter 8 Wireless

ZyWALL USG FLEX Series User’s Guide

195

2Log on to the DHCP server and configure settings for the network in which the AP is located.

3Add a new DHCP option with the following values:

Name: Capwap AC

Code: 138

Type: IP Address

Value: <Zyxel Device IP address>

4Restart the AP.

The AP picks up a new DCHP-assigned IP address. The Zyxel Device can now manage the AP.

Use the AP Management screens to manage all of the APs connected to the Zyxel Device.

8.3 AP Management Screens

Use these screens to manage all of the APs connected to the Zyxel Device. Click Configuration >

Wireless > AP Management to access these screens.

Click on the icon to go to the OneSecurity website where there is guidance on configuration

walkthroughs and other information.

8.3.1 Mgnt. AP List

Figure 160 Configuration > Wireless > AP Management > Mgnt. AP List

Each field is described in the following table.

Table 81 Configuration > Wireless > AP Management > Mgnt. AP List

LABEL DESCRIPTION

Filter Click Show Advanced Settings to reveal Filter fields where you can display managed APs by

status, keyword or those managed by the Nebula portal.

AP List Select the type of APs you want to display.

Select All to show all kinds of APs that are currently or used to be connected to the Zyxel

Device.

Select NebulaFlexPRO to show the APs that can work in Nebula cloud management mode.

Chapter 8 Wireless

ZyWALL USG FLEX Series User’s Guide

196

Status Select the status of APs you want to display.

Keyword Enter a keyword to display the APs that include it in their AP information, such as model

number, firmware version, MAC address and so on. This field is case-sensitive.

Search Click this to update the list of APs based on the search criteria.

Your search criteria is retained when navigating between screens.

Reset Click this to return the search criteria to the factory defaults and display all currently or

previously connected APs without a filter.

Enable Column

Freeze

Select this to lock the index columns in place while scrolling to the right.

Edit the selected rule Select an AP and click this to change the selected AP’s properties, such as its group, radio,

VLAN and port settings.

Add to Mgmt AP List Select an AP and click this to add the selected AP to the managed AP list.

Reboot device Select one or multiple APs and click this button to force the AP(s) to restart.

Remove the

selected rule

Select one or multiple APs and click this button to remove the AP(s) from the manged AP

list.

Note: If on the Configuration > Wireless > Controller screen you set the

Registration Type to Always Accept, then as soon as you remove an AP

from this list it reconnects.

DCS Now Select one or multiple APs and click this button to use DCS (Dynamic Channel Selection) to

allow the AP to automatically find a less-used channel in an environment where there are

many APs and there may be interference.

Note: You should have enabled DCS in the applied AP radio profile before the

APs can use DCS.

Note: DCS is not supported on the radio which is working in repeater AP mode.

More Information Select an AP and click this to view a daily station count about the selected AP. The count

records station activity on the AP over a consecutive 24 hour period.

Radio Information Select an online AP and click this button to go to the Monitor > Wireless > AP Information >

Radio List screen to view detailed information about the AP’s radios.

Query Controller Log Select one or multiple APs and click this button to go to the Monitor > Log > View Log screen

to view the selected AP’s current log messages.

Nebula Select an AP and click this to open a screen where you can set whether the AP’s IP address

and VLAN settings will be changed when it goes into Nebula cloud management mode.

Note: The AP will be set to Nebula cloud management mode and removed from

the managed AP list right after you click OK.

Upgrade Firmware

Now

Select one or more APs and click this button to update the APs’ firmware version.

Suppression On Select an AP and click this button to enable the AP’s LED suppression mode. All the LEDs of

the AP will turn off after the AP is ready. This button is not available if the selected AP

doesn’t support suppression mode.

Suppression Off Select an AP and click this button to disable the AP’s LED suppression mode. The AP LEDs

stay lit after the AP is ready. This button is not available if the selected AP doesn’t support

suppression mode.

Locator On Select an AP and click this button to run the locator feature. The AP’s Locator LED will start

to blink for 10 minutes by default. It will show the actual location of the AP between several

devices on the network.

Table 81 Configuration > Wireless > AP Management > Mgnt. AP List (continued)

LABEL DESCRIPTION

Chapter 8 Wireless

ZyWALL USG FLEX Series User’s Guide

197

#This field is a sequential value, and it is not associated with any entry.

Status This field displays the status of AP.

•Online All

•Online

• Conflict

• Non Support

•Updating

• Offline All

• Offline

• Offline for Firmware Update

•Update

•Un-Mgmt

Description This field displays the AP’s description, which you can configure by selecting the AP’s entry

and clicking the Edit button.

CPU Usage This field displays the CPU Usage of the AP.

IP Address This field displays the IP address of the AP.

MAC Address This field displays the MAC address of the AP.

Station 2.4G This field displays the number of 2.4G wireless clients connected to the AP.

Station 5G This field displays the number of 5G wireless clients connected to the AP.

Recent Online Time This displays the most recent time the AP came on-line. N/A displays if the AP has not come

on-line since the Zyxel Device last started up.

LED Status This displays the AP LED status.

N/A displays if the AP does not support LED suppression mode and/or have a locator LED to

show the actual location of the AP.

A gray LED icon signifies that the AP LED suppression mode is enabled. All the LEDs of the AP

will turn off after the AP is ready.

A green LED icon signifies that the AP LED suppression mode is disabled and the AP LEDs

stay lit after the AP is ready.

A sun icon signifies that the AP’s locator LED is blinking.

A circle signifies that the AP’s locator LED is extinguished.

Model This field displays the AP’s hardware model information. It displays N/A (not applicable) only

when the AP disconnects from the Zyxel Device and the information is unavailable as a

result.

Apply Click Apply to save your changes back to the Zyxel Device.

Refresh Click Refresh to update the AP list.

Table 81 Configuration > Wireless > AP Management > Mgnt. AP List (continued)

LABEL DESCRIPTION

Chapter 8 Wireless

ZyWALL USG FLEX Series User’s Guide

198

8.3.1.1 Edit AP List

Select an AP and click the Edit button in the Configuration > Wireless > AP Mana gement table to display

this screen.

Figure 161 Configuration > Wireless > AP Management > Mgnt. AP List > Edit AP List

Chapter 8 Wireless

ZyWALL USG FLEX Series User’s Guide

199

Each field is described in the following table.

Table 82 Configuration > Wireless > AP Management > Mgnt. AP List > Edit AP List

LABEL DESCRIPTION

Create new Object Use this menu to create a new Radio Profile object to associate with this AP.

MAC This displays the MAC address of the selected AP.

Model This field displays the AP’s hardware model information. It displays N/A (not applicable) only

when the AP disconnects from the Zyxel Device and the information is unavailable as a

result.

Description Enter a description for this AP. You can use up to 31 characters, spaces and underscores

allowed.

Group Setting Select an AP group to which you want this AP to belong.

Radio 1/2 Setting

Override Group

Radio Setting

Select this option to overwrite the AP radio settings with the settings you configure here.

OP Mode Select the operating mode for radio 1 or radio 2.

AP Mode means the AP can receive connections from wireless clients and pass their data

traffic through to the Zyxel Device to be managed (or subsequently passed on to an

upstream gateway for managing).

MON Mode means the AP monitors the broadcast area for other APs, then passes their

information on to the Zyxel Device where it can be determined if those APs are friendly or

rogue. If an AP is set to this mode it cannot receive connections from wireless clients.

Root AP means the radio acts as an AP and also supports the wireless connections with

other APs (in repeater mode) to form a ZyMesh to extend its wireless network.

Repeater AP means the radio can establish a wireless connection with other APs (in either

root AP or repeater mode).

Note: To prevent bridge loops, do NOT set both radios on a managed AP to

Repeater AP mode.

Note: The root AP and repeater AP(s) in a ZyMesh must use the same country

code and AP radio profile settings in order to communicate with each

other.

Note: Ensure you restart the managed AP after you change its operating mode.

Radio 1/2 AP Profile Select an AP profile from the list. If no profile exists, you can create a new one through the

Create new Object menu.

Radio 1/2 Profile Select a monitor profile from the list. If no profile exists, you can create a new one through

the Create new Object menu.

Radio 1/2 ZyMesh

Profile

This field is available only when the radio is in Root AP or Repeater AP mode.

Select the ZyMesh profile the radio uses to connect to a root AP or repeater.

Enable Wireless

Bridging

This field is available only when the radio is in Repeater AP mode.

Select this option to enable wireless bridging on the radio.

The managed AP must support LAN provision and the radio should be in repeater mode.

VLAN and bridge interfaces are created automatically according to the LAN port’s VLAN

settings. When wireless bridging is enabled, the managed repeater AP can still transmit

data through its Ethernet port(s) after the ZyMesh link is up. Be careful to avoid bridge loops.

The managed APs in the same ZyMesh must use the same static VLAN ID.

Override Group

Output Power

Setting

Select this option to overwrite the AP output power setting with the setting you configure

here.

Chapter 8 Wireless

ZyWALL USG FLEX Series User’s Guide

200

8.3.2 AP Policy

Use this screen to configure the AP controller’s IP address on the managed APs and determine the

action the managed APs take if the current AP controller fails. Click Configuration > Wireless > AP

Management > AP Policy to access this screen.

Figure 162 Configuration > Wireless > AP Management > AP Policy

Output Power Set the output power of the AP.

Override Group SSID

Setting

Select this option to overwrite the AP SSID profile setting with the setting you configure here.

This section allows you to associate an SSID profile with the radio.

Edit Select an SSID and click this button to reassign it. The selected SSID becomes editable

immediately upon clicking.

#This is the index number of the SSID profile. You can associate up to eight SSID profiles with

an AP radio.

SSID Profile Indicates which SSID profile is associated with this radio profile.

Override Group

VLAN Setting

Select this option to overwrite the AP VLAN setting with the setting you configure here.

Force Overwrite

VLAN Config

Select this to have the Zyxel Device change the AP’s management VLAN to match the

configuration in this screen.

Management VLAN

Enter a VLAN ID for this AP.

As Native VLAN Select this option to treat this VLAN ID as a VLAN created on the Zyxel Device and not one

assigned to it from outside the network.

Suppression On Select this option to enable the AP’s LED suppression mode. All the LEDs of the AP will turn

off after the AP is ready.

If the check box is unchecked, it means the LEDs will stay lit after the AP is ready.

OK Click OK to save your changes back to the Zyxel Device.

Cancel Click Cancel to close the window with changes unsaved.

Table 82 Configuration > Wireless > AP Management > Mgnt. AP List > Edit AP List (continued)

LABEL DESCRIPTION

Chapter 8 Wireless

ZyWALL USG FLEX Series User’s Guide

201

Each field is described in the following table.

8.3.3 AP Group

Use this screen to configure AP groups, which define the radio, port, VLAN and load balancing settings

and apply the settings to all APs in the group. An AP can belong to one AP group at a time. Click

Configuration > Wireless > AP Management > AP Group to access this screen.

Figure 163 Configuration > Wireless > AP Management > AP Group

Table 83 Configuration > Wireless > AP Management > AP Policy

LABEL DESCRIPTION

Force Override AC IP

Config on AP

Select this to have the Zyxel Device change the AP controller’s IP address on the managed

AP(s) to match the configuration in this screen.

Override Type Select Auto to have the managed AP(s) automatically send broadcast packets to find any

other available AP controllers.

Select Manual to replace the AP controller’s IP address configured on the managed AP(s)

with the one(s) you specified below.

Primary Controller Specify the IP address of the primary AP controller if you set Override Type to Manual.

Secondary Controller Specify the IP address of the secondary AP controller if you set Override Type to Manual.

Fall back to Primary

Controller when

possible

Select this option to have the managed AP(s) change back to associate with the primary

AP controller as soon as the primary AP controller is available.

Fall Back Check

Interval

Set how often the managed AP(s) check whether the primary AP controller is available.

Firmware Updating

Updating Type Specify how you want the Zyxel Device to upgrade AP firmware.

Select CAPWAP to have the Zyxel Device use CAPWAP (Control and Provisioning of Wireless

Access Points protocol) to automatically update firmware on the managed APs.

Select FTP to allow the managed APs to download the latest firmware from the Zyxel Device

using FTP.

Apply Click Apply to save your changes back to the Zyxel Device.

Reset Click Reset to return the screen to its last-saved settings.

Chapter 8 Wireless

ZyWALL USG FLEX Series User’s Guide

202

Each field is described in the following table.

Table 84 Configuration > Wireless > AP Management > AP Group

LABEL DESCRIPTION

Group Setting

Default Group Select a group that is used as the default group.

Any AP that is not configured to associate with a specific AP group belongs to the default

group automatically.

Group Summary

Add Click this button to create a new AP group.

Edit Select an entry and click this button to edit its properties.

Remove Select an entry and click this button to remove it from the list.

Note: You cannot remove a group with which an AP is associated.

DCS Now Select one or multiple groups and click this button to use DCS (Dynamic Channel Selection)

to allow the APs in the group(s) to automatically find a less-used channel in an environment

where there are many APs and there may be interference.

Note: You should have enabled DCS in the applied AP radio profile before the

APs can use DCS.

Note: DCS is not supported on the radio which is working in repeater AP mode.

#This is the index number of the group in the list.

Group Name This is the name of the group.

Member Count This is the total number of APs which belong to this group.

Apply Click Apply to save your changes back to the Zyxel Device.

Reset Click Reset to return the screen to its last-saved settings.

Chapter 8 Wireless

ZyWALL USG FLEX Series User’s Guide

203

8.3.3.1 Add/Edit AP Group

Click Add or select an AP group and click the Edit button in the Configuration > Wireless > AP

Management > AP Group table to display this screen.

Figure 164 Configuration > Wireless > AP Management > AP Group > Add/Edit

Chapter 8 Wireless

ZyWALL USG FLEX Series User’s Guide

204

Each field is described in the following table.

Table 85 Configuration > Wireless > AP Management > AP Group > Add/Edit

LABEL DESCRIPTION

General Settings

Group Name Enter a name for this group. You can use up to 31 alphanumeric characters. Dashes and

underscores are also allowed. The name should start with a letter.

Description Enter a description for this group. You can use up to 31 characters, spaces and underscores

allowed.

Radio 1/2 Setting

OP Mode Select the operating mode for radio 1 or radio 2.

AP Mode means the AP can receive connections from wireless clients and pass their data

traffic through to the Zyxel Device to be managed (or subsequently passed on to an

upstream gateway for managing).

MON Mode means the AP monitors the broadcast area for other APs, then passes their

information on to the Zyxel Device where it can be determined if those APs are friendly or

rogue. If an AP is set to this mode it cannot receive connections from wireless clients.

Root AP means the radio acts as an AP and also supports the wireless connections with

other APs (in repeater mode) to form a ZyMesh to extend its wireless network.

Repeater AP means the radio can establish a wireless connection with other APs (in either

root AP or repeater mode).

Note: To prevent bridge loops, do NOT set both radios on a managed AP to

Repeater AP mode.

Note: The root AP and repeater AP(s) in a ZyMesh must use the same country

code and AP radio profile settings in order to communicate with each

other.

Note: Ensure you restart the managed AP after you change its operating mode.

Radio 1/2 AP Profile Select an AP profile from the list. If no profile exists, you can create a new one through the

Create new Object menu.

Radio 1/2 Profile Select a monitor profile from the list. If no profile exists, you can create a new one through

the Create new Object menu.

Radio 1/2 ZyMesh

Profile

This field is available only when the radio is in Root AP or Repeater AP mode.

Select the ZyMesh profile the radio uses to connect to a root AP or repeater.

Enable Wireless

Bridging

This field is available only when the radio is in Repeater AP mode.

Select this option to enable wireless bridging on the radio.

The managed AP must support LAN provision and the radio should be in repeater mode.

VLAN and bridge interfaces are created automatically according to the LAN port’s VLAN

settings. When wireless bridging is enabled, the managed repeater AP can still transmit

data through its Ethernet port(s) after the ZyMesh link is up. Be careful to avoid bridge loops.

The managed APs in the same ZyMesh must use the same static VLAN ID.

Output Power Set the maximum output power of the AP.

If there is a high density of APs in an area, decrease the output power of the managed AP

to reduce interference with other APs.

Note: Reducing the output power also reduces the Zyxel Device’s effective

broadcast radius.

Edit Select an SSID and click this button to reassign it. The selected SSID becomes editable

immediately upon clicking.

Chapter 8 Wireless

ZyWALL USG FLEX Series User’s Guide

205

#This is the index number of the SSID profile. You can associate up to eight SSID profiles with

an AP radio.

SSID Profile Indicates which SSID profile is associated with this radio profile.

VLAN Settings

Force Overwrite

VLAN Config

Select this to have the Zyxel Device change the AP’s management VLAN to match the

configuration in this screen.

Management VLAN

Enter a VLAN ID for this AP.

As Native VLAN Select this option to treat this VLAN ID as a VLAN created on the Zyxel Device and not one

assigned to it from outside the network.

Port Settings

Model Specific

Setting

Select the model of the managed AP to display the model-specific port and VLAN settings

in the tables below.

Port Setting You can activate or deactivate a non-uplink port.

Edit Double-click an entry or select it and click Edit to open a screen where you can modify the

entry’s settings.

Activate/Inactivate To turn on an entry, select it and click Activate. To turn off an entry, select it and click

Inactivate.

#This is the port’s index number in this list.

Status This displays whether or not the port is activated.

Port This shows the name of the physical Ethernet port on the managed AP.

PVID This shows the port’s PVID.

A PVID (Port VLAN ID) is a tag that adds to incoming untagged frames received on a port

so that the frames are forwarded to the VLAN group that the tag defines.

VLAN Configuration Use Add to create a new VLAN Configuration. Select a VLAN Configuration first to use the

Edit, Remove, Activate and Inactivate buttons.

#This is the VLAN’s index number in this list.

Status This displays whether or not the VLAN is activated.

Name This shows the name of the VLAN.

VID This shows the VLAN ID number.

Member This field displays the Ethernet port(s) that is a member of this VLAN.

Load Balancing

Setting

Enable Load

Balancing

Select this to enable load balancing on the Zyxel Device.

Use this section to configure wireless network traffic load balancing between the managed

APs in this group.

Note: Load balancing is not supported on the radio which is working in root AP or

repeater AP mode.

Table 85 Configuration > Wireless > AP Management > AP Group > Add/Edit (continued)

LABEL DESCRIPTION

Chapter 8 Wireless

ZyWALL USG FLEX Series User’s Guide

206

Mode Select a mode by which load balancing is carried out.

Select By Station Number to balance network traffic based on the number of specified

stations connected to an AP.

Select By Traffic Level to balance network traffic based on the volume generated by the

stations connected to an AP.

Select By Smart Classroom to balance network traffic based on the number of specified

stations connected to an AP. The AP ignores association request and authentication

request packets from any new station when the maximum number of stations is reached.

If you select By Station Number or By Traffic Level, once the threshold is crossed (either the

maximum station numbers or with network traffic), the AP delays association request and

authentication request packets from any new station that attempts to make a connection.

This allows the station to automatically attempt to connect to another, less burdened AP if

one is available.

Max Station

Number Enter the threshold number of stations at which an AP begins load balancing its

connections.

Traffic Level Select the threshold traffic level at which the AP begins load balancing its connections

(Low, Medium, High).

The maximum bandwidth allowed for each level is:

•Low - 11 Mbps,

•Medium - 23 Mbps

•High - 35M bps

Disassociate

station when

overloaded

This function is enabled by default and the disassociation priority is always Signal Strength

when you set Mode to By Smart Classroom.

Select this option to disassociate wireless clients connected to the AP when it becomes

overloaded. If you do not enable this option, then the AP simply delays the connection until

it can afford the bandwidth it requires, or it transfers the connection to another AP within its

broadcast radius.

The disassociation priority is determined automatically by the Zyxel Device and is as follows:

•Idle Timeout - Devices that have been idle the longest will be disassociated first. If none

of the connected devices are idle, then the priority shifts to Signal Strength.

•Signal Strength - Devices with the weakest signal strength will be disassociated first.

Note: If you enable this function, you should ensure that there are multiple APs

within the broadcast radius that can accept any rejected or kicked wireless

clients; otherwise, a wireless client attempting to connect to an overloaded

AP will be kicked continuously and never be allowed to connect.

AP List

Available This lists the APs that do not belong to this group. Select the APs that you want to add to the

group you are editing, and click the right arrow button to add them.

Member This lists the APs that belong to this group. Select any APs that you want to remove from the

group, and click the left arrow button to remove them.

OK Click OK to save your changes back to the Zyxel Device.

Cancel Click Cancel to close the window with changes unsaved.

Override Member AP

Setting

Click this button to overwrite the settings of all managed APs in this group with the settings

you configure here. All Override Group check boxes on the AP Management > Mgnt. AP Lis t

> Edit AP List screen for the APs in this group will be deselected.

Table 85 Configuration > Wireless > AP Management > AP Group > Add/Edit (continued)

LABEL DESCRIPTION

Chapter 8 Wireless

ZyWALL USG FLEX Series User’s Guide

207

8.3.4 Firmware

The Zyxel Device stores an AP firmware in order to manage supported APs. This screen allows the Zyxel

Device to check for and download new AP firmware when it becomes available on the firmware server.

All APs managed by the Zyxel Device must have the same firmware version as the AP firmware on the

Zyxel Device.

When an AP connects to the Zyxel Device wireless controller, the Zyxel Device will check if the AP has

the same firmware version as the AP firmware on the Zyxel Device. If yes, then the Zyxel Device can

manage it. If no, then the AP must upgrade (or downgrade) its firmware to be the same version as the

AP firmware on the Zyxel Device (and reboot).

The Zyxel Device should always have the latest AP firmware so that:

• APs don’t have to downgrade firmware in order to be managed

• All new APs are supported.

Use Check to see if the Zyxel Device has the latest AP firmware. Use Apply to have the Zyxel Device

download the latest AP firmware (see More Details for more information on the firmware) from the

firmware server. If the Zyxel Device does not have enough space for the latest AP firmware, then the

Zyxel Device will delete an existing firmware that no AP is using before downloading the new AP

firmware.

Click Configuration > Wireless > AP Management > Firmware to access this screen.

Figure 165 Configuration > Wireless > AP Management > Firmware

Chapter 8 Wireless

ZyWALL USG FLEX Series User’s Guide

208

Each field is described in the following table.

8.4 Rogue AP

Use this screen to assign APs either to the rogue AP list or the friendly AP list. A rogue AP is a wireless

access point operating in a network’s coverage area that is not under the control of the network

administrator, and which can potentially open up holes in a network’s security.

Click Configuration > Wireless > Rogue AP to access this screen.

Table 86 Configuration > Wireless > AP Management > Firmware

LABEL DESCRIPTION

AP Firmware

Runtime Firmware This displays the current AP firmware version on the Zyxel Device. The Zyxel Device must

have the latest AP firmware to manage all supported APs.

Available Firmware This field displays if there is a later AP firmware version available on the firmware server. It

displays N/A if the Zyxel Device cannot connect with the firmware server. Check that the

Zyxel Device has Internet access if N/A displays and then click the Check button below.

If a newer Zyxel Device AP firmware is available, its version number and a More Details icon

displays here.

Last Check Success This displays the date and time the last check for new firmware was made and whether the

check is in progress (checking), was successful (success), or has failed (fail).

Check Click this button to have the Zyxel Device display the latest AP firmware version available on

the firmware server.

Apply AP Firmware Due to space limitations, the Zyxel Device only downloads and keeps AP firmware for APs it

is currently managing. If you connect a new AP to the Zyxel Device, the Zyxel Device may

need to download a new AP firmware. Please wait while downloading new firmware as the

speed depends on your Internet connection speed. Make sure to maintain the Internet

connection while downloading new firmware.

Apply Click this to download newer Available Firmware from the firmware server and update the

Runtime Firmware version.

#This is an index number of a managed AP.

Model This displays the name of all manageable AP models.

Runtime Firmware This displays the firmware version that the managed AP must have in order to be managed

by the Zyxel Device. Firmware for APs that the Zyxel Device already has displays in bold;

firmware that the Zyxel Device doesn’t have or is still downloading is grayed out. Firmware

that is in the download queue will show To be downloaded.

Refresh Click this to update the model firmware table.

Chapter 8 Wireless

ZyWALL USG FLEX Series User’s Guide

209

Figure 166 Configuration > Wireless > Rogue AP

Each field is described in the following table.

Table 87 Configuration > Wireless > Rogue AP

LABEL DESCRIPTION

Suspected Rogue AP

Classification Rule

Click the check boxes (Weak Security (Open, WEP, WPA-PSK), Un-managed AP,

Hidden SSID, SSID Keyword) of the characteristics an AP should have for the Zyxel

Device to rule it as a rogue AP.

Add Click this to add an SSID Keyword.

Edit Select an SSID Keyword and click this button to modify it.

Remove Select an existing SSID keyword and click this button to delete it.

#This is the SSID Keyword’s index number in this list.

SSID Keyword This field displays the SSID Keyword.

Rogue/Friendly AP List

Add Click this button to add an AP to the list and assign it either friendly or rogue status.

Edit Select an AP in the list to edit and reassign its status.

Remove Select an AP in the list to remove.

Chapter 8 Wireless

ZyWALL USG FLEX Series User’s Guide

210

8.4.1 Add/Edit Rogue /Friendly List

Select an AP and click the Edit button in the Configuration > Wireless > Rogue AP table to display this

screen.

Figure 167 Configuration > Wireless > Rogue AP > Add/Edit Rogue/Friendly

Each field is described in the following table.

Containment Click this button to quarantine the selected AP.

A quarantined AP cannot grant access to any network services. Any stations that

attempt to connect to a quarantined AP are disconnected automatically.

Dis-Containment Click this button to take the selected AP out of quarantine.

An unquarantined AP has normal access to the network.

#This field is a sequential value, and it is not associated with any interface.

Containment This field indicates the selected AP’s containment status.

Role This field indicates whether the selected AP is a rogue-ap or a friendly-ap. To change

the AP’s role, click the Edit button.

MAC Address This field indicates the AP’s radio MAC address.

Description This field displays the AP’s description. You can modify this by clicking the Edit button.

Rogue/Friendly AP List

Importing/Exporting

These controls allow you to export the current list of rogue and friendly APs or import

existing lists.

File Path / Browse /

Importing Enter the file name and path of the list you want to import or click the Browse button

to locate it. Once the File Path field has been populated, click Importing to bring the

list into the Zyxel Device.

Exporting Click this button to export the current list of either rogue APs or friendly APS.

Monitor Mode Settings

Enable Rogue AP

Containment

Select this to enable rogue AP containment.

Apply Click Apply to save your changes back to the Zyxel Device.

Reset Click Reset to return the screen to its last-saved settings.

Table 87 Configuration > Wireless > Rogue AP (continued)

LABEL DESCRIPTION

Table 88 Configuration > Wireless > Rogue AP > Add/Edit Rogue/Friendly

LABEL DESCRIPTION

MAC Enter the MAC address of the AP you want to add to the list. A MAC address is a unique hardware

identifier in the following hexadecimal format: xx:xx:xx:xx:xx:xx where xx is a hexadecimal number

separated by colons.

Description Enter up to 60 characters for the AP’s description. Spaces and underscores are allowed.

Chapter 8 Wireless

ZyWALL USG FLEX Series User’s Guide

211

8.5 Auto Healing

Use this screen to enable auto healing, which allows you to extend the wireless service coverage area

of the managed APs when one of the APs fails. Click Configuration > Wireless > Auto Healing to access

this screen.

Figure 168 Configuration > Wireless > Auto Healing

Each field is described in the following table.

Role Select either Rogue AP or Friendly AP for the AP’s role.

OK Click OK to save your changes back to the Zyxel Device.

Cancel Click Cancel to close the window with changes unsaved.

Table 88 Configuration > Wireless > Rogue AP > Add/Edit Rogue/Friendly (continued)

LABEL DESCRIPTION

Table 89 Configuration > Wireless > Auto Healing

LABEL DESCRIPTION

Enable Auto

Healing

Select this option to turn on the auto healing feature.

Save Current

State

Click this button to have all manged APs immediately scan their neighborhoods three times in

a row and update their neighbor lists to the AP controller (Zyxel Device).

Auto Healing

Interval

Set the time interval (in minutes) at which the managed APs scan their neighborhoods and

report the status of neighbor APs to the AP controller (Zyxel Device).

An AP is considered “failed” if the AP controller obtains the same scan result that the AP is

missing from the neighbor list of other APs three times.

Power Threshold Set the power level (in dBm) to which the neighbor APs of the failed AP increase their output

power in order to extend their wireless service coverage areas.

When the failed AP is working again, its neighbor APs return their output power to the original

level.

Apply Click Apply to save your changes back to the Zyxel Device.

Reset Click Reset to return the screen to its last-saved settings.

Chapter 8 Wireless

ZyWALL USG FLEX Series User’s Guide

212

8.6 RTLS Overview

Ekahau RTLS (Real Time Location Service) tracks battery-powered Wi-Fi tags attached to APs managed

by the Zyxel Device to create maps, alerts, and reports.

The Ekahau RTLS Controller is the centerpiece of the RTLS system. This server software runs on a Windows

computer to track and locate Ekahau tags from Wi-Fi signal strength measurements. Use the Zyxel

Device with the Ekahau RTLS system to take signal strength measurements at the APs (Integrated

Approach / Blink Mode).

The following example shows the Ekahau RTLS Integrated Approach (Blink Mode).

1The Wi-Fi tag sends blink packets at specified intervals (or triggered by something like motion or button

presses).

2The APs pick up the blink packets, measure the signal strength, and send it to the Zyxel Device.

3The Zyxel Device forwards the signal measurements to the Ekahau RTLS Controller.

4The Ekahau RTLS Controller calculates the tag positions.

Figure 169 RTLS Example

8.6.1 What You Can Do in this Chapter

Use the RTLS screen (Section 8.6.3 on page 213) to use the managed APs as part of an Ekahau RTLS (Real

Time Location Service) to track the location of Ekahau Wi-Fi tags.

8.6.2 Before You Begin

You need:

• At least three APs managed by the Zyxel Device (the more APs the better since it increases the

amount of information the Ekahau RTLS Controller has for calculating the location of the tags)

• IP addresses for the Ekahau Wi-Fi tags

• A dedicated RTLS SSID is recommended

Chapter 8 Wireless

ZyWALL USG FLEX Series User’s Guide

213

• Ekahau RTLS Controller in blink mode with TZSP Updater enabled

• Security policies to allow RTLS traffic if the Zyxel Device security policy control is enabled or the Ekahau

RTLS Controller is behind a firewall.

For example, if the Ekahau RTLS Controller is behind a firewall, open ports 8550, 8553, and 8569 to allow

traffic the APs send to reach the Ekahau RTLS Controller.

The following table lists default port numbers and types of packets RTLS uses.

8.6.3 Configuring RTLS

Click Configura tion > Wireless > RTLS to open this screen. Use this screen to turn RTLS (Real Time Location

System) on or off and specify the IP address and server port of the Ekahau RTLS Controller.

Figure 170 Configuration > Wireless > RTLS

The following table describes the labels in this screen.

Table 90 RTLS Traffic Port Numbers

PORT NUMBER TYPE DESCRIPTION

8548 TCP Ekahau T201 location update.

8549 UDP Ekahau T201 location update.

8550 TCP Ekahau T201 tag maintenance protocol and Ekahau RTLS Controller user interface.

8552 UDP Ekahau Location Protocol

8553 UDP Ekahau Maintenance Protocol

8554 UDP Ekahau T301 firmware update.

8560 TCP Ekahau Vision web interface

8562 UDP Ekahau T301W firmware update.

8569 UDP Ekahau TZSP Listener Port

Table 91 Configuration > Wireless > RTLS

LABEL DESCRIPTION

Enable Select this to use Wi-Fi to track the location of Ekahau Wi-Fi tags.

IP Address Specify the IP address of the Ekahau RTLS Controller.

Server Port Specify the server port number of the Ekahau RTLS Controller.

Chapter 8 Wireless

ZyWALL USG FLEX Series User’s Guide

214

8.7 Technical Reference

The following section contains additional technical information about wireless features.

8.7.1 Dynamic Channel Selection

When numerous APs broadcast within a given area, they introduce the possibility of heightened radio

interference, especially if some or all of them are broadcasting on the same radio channel. If the

interference becomes too great, then the network administrator must open his AP configuration options

and manually change the channel to one that no other AP is using (or at least a channel that has a

lower level of interference) in order to give the connected stations a minimum degree of interference.

Dynamic channel selection frees the network administrator from this task by letting the AP do it

automatically. The AP can scan the area around it looking for the channel with the least amount of

interference.

In the 2.4 GHz spectrum, each channel from 1 to 13 is broken up into discrete 22 MHz segments that are

spaced 5 MHz apart. Channel 1 is centered on 2.412 GHz while channel 13 is centered on 2.472 GHz.

Figure 171 An Example Three-Channel Deployment

Three channels are situated in such a way as to create almost no interference with one another if used

exclusively: 1, 6 and 11. When an AP broadcasts on any of these three channels, it should not interfere

with neighboring APs as long as they are also limited to same trio.

Figure 172 An Example Four-Channel Deployment

Apply Click Apply to save your changes back to the Zyxel Device.

Reset Click Reset to return the screen to its last-saved settings.

Table 91 Configuration > Wireless > RTLS (continued)

LABEL DESCRIPTION

Chapter 8 Wireless

ZyWALL USG FLEX Series User’s Guide

215

However, some regions require the use of other channels and often use a safety scheme with the

following four channels: 1, 4, 7 and 11. While they are situated sufficiently close to both each other and

the three so-called “safe” channels (1,6 and 11) that interference becomes inevitable, the severity of it is

dependent upon other factors: proximity to the affected AP, signal strength, activity, and so on.

Finally, there is an alternative four channel scheme for ETSI, consisting of channels 1, 5, 9, 13. This offers

significantly less overlap that the other one.

Figure 173 An Alternative Four-Channel Deployment

8.7.2 Load Balancing

Because there is a hard upper limit on an AP’s wireless bandwidth, load balancing can be crucial in

areas crowded with wireless users. Rather than let every user connect and subsequently dilute the

available bandwidth to the point where each connecting device receives a meager trickle, the load

balanced AP instead limits the incoming connections as a means to maintain bandwidth integrity.

There are two kinds of wireless load balancing available on the Zyxel Device:

Load balancing by station number limits the number of devices allowed to connect to your AP. If you

know exactly how many stations you want to let connect, choose this option.

For example, if your company’s graphic design team has their own AP and they have 10 computers,

you can load balance for 10. Later, if someone from the sales department visits the graphic design

team’s offices for a meeting and he tries to access the network, his computer’s connection is delayed,

giving it the opportunity to connect to a different, neighboring AP. If he still connects to the AP

regardless of the delay, then the AP may boot other people who are already connected in order to

associate with the new connection.

Load balancing by traffic level limits the number of connections to the AP based on maximum

bandwidth available. If you are uncertain as to the exact number of wireless connections you will have

then choose this option. By setting a maximum bandwidth cap, you allow any number of devices to

connect as long as their total bandwidth usage does not exceed the configured bandwidth cap

associated with this setting. Once the cap is hit, any new connections are rejected or delayed provided

that there are other APs in range.

Imagine a coffee shop in a crowded business district that offers free wireless connectivity to its

customers. The coffee shop owner can’t possibly know how many connections his AP will have at any

given moment. As such, he decides to put a limit on the bandwidth that is available to his customers but

not on the actual number of connections he allows. This means anyone can connect to his wireless

network as long as the AP has the bandwidth to spare. If too many people connect and the AP hits its

bandwidth cap then all new connections must basically wait for their turn or get shunted to the nearest

identical AP.

ZyWALL USG FLEX Series User’s Guide

216

CHAPTER 9

Interfaces

9.1 Interface Overview

Use the Interface screens to configure the Zyxel Device’s interfaces. You can also create interfaces on

top of other interfaces.

•Ports are the physical ports to which you connect cables.

•Interfaces are used within the system operationally. You use them in configuring various features. An

interface also describes a network that is directly connected to the Zyxel Device. For example, You

connect the LAN network to the LAN interface.

•Zones are groups of interfaces used to ease security policy configuration.

9.1.1 What You Can Do in this Chapter

• Use the Port Role screen (Section 9.2 on page 221) to create port groups and to assign physical ports

and port groups to Ethernet interfaces.

• Use the Port Configuration screen (Section 9.3 on page 222) to configure Zyxel Device port settings.

• Use the Ethernet screens (Section 9.4 on page 223) to configure the Ethernet interfaces. Ethernet

interfaces are the foundation for defining other interfaces and network policies. RIP and OSPF are also

configured in these interfaces.

• Use the PPP screens (Section 9.5 on page 246) for PPPoE, PPTP or L2TP Internet connections.

• Use the Cellular screens (Section 9.6 on page 253) to configure settings for interfaces for Internet

connections through an installed mobile broadband card.

• Use the Tunnel screens (Section 9.7 on page 262) to configure tunnel interfaces to be used in Generic

Routing Encapsulation (GRE), IPv6 in IPv4, and 6to4 tunnels.

• Use the VLAN screens (Section 9.8 on page 269) to divide the physical network into multiple logical

networks. VLAN interfaces receive and send tagged frames. The Zyxel Device automatically adds or

removes the tags as needed. Each VLAN can only be associated with one Ethernet interface.

• Use the Bridge screens (Section 9.9 on page 282) to combine two or more network segments into a

single network.

• Use the VTI screens (Section 9.10 on page 296) to encrypt or decrypt IPv4 traffic from or to the

interface according to the IP routing table.

• Use the Trunk screens (Section 9.11 on page 301) to configure load balancing.

9.1.2 What You Need to Know

Interface Characteristics

Interfaces generally have the following characteristics (although not all characteristics apply to each

type of interface).

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

217

• An interface is a logical entity through which (layer-3) packets pass.

• An interface is bound to a physical port or another interface.

• Many interfaces can share the same physical port.

• An interface belongs to at most one zone.

• Many interfaces can belong to the same zone.

• Layer-3 virtualization (IP alias, for example) is a kind of interface.

Types of Interfaces

You can create several types of interfaces in the Zyxel Device.

• Setting interfaces to the same port role forms a port group. Port groups creates a hardware

connection between physical ports at the layer-2 (data link, MAC address) level. Port groups are

created when you use the Interface > Port Roles or Interface > Port Groups screen to set multiple

physical ports to be part of the same interface.

•Ethernet interfaces are the foundation for defining other interfaces and network policies. RIP and

OSPF are also configured in these interfaces.

•Tunnel interfaces send IPv4 or IPv6 packets from one network to a specific network through the

Internet or a public network.

•VLAN interfaces receive and send tagged frames. The Zyxel Device automatically adds or removes

the tags as needed. Each VLAN can only be associated with one Ethernet interface.

•Bridge interfaces create a software connection between Ethernet or VLAN interfaces at the layer-2

(data link, MAC address) level. Unlike port groups, bridge interfaces can take advantage of some

security features in the Zyxel Device. You can also assign an IP address and subnet mask to the

bridge.

•PPP interfaces support Point-to-Point Protocols (PPP). ISP accounts are required for PPPoE/PPTP/L2TP

interfaces.

•Cellular interfaces are for mobile broadband WAN connections via a connected mobile broadband

device.

•Virtual interfaces provide additional routing information in the Zyxel Device. There are three types:

virtual Ethernet interfaces, virtual VLAN interfaces, and virtual bridge interfaces.

•Trunk interfaces manage load balancing between interfaces.

Port groups and trunks have a lot of characteristics that are specific to each type of interface. The other

types of interfaces--Ethernet, PPP, cellular, VLAN, bridge, and virtual--have a lot of similar characteristics.

These characteristics are listed in the following table and discussed in more detail below.

Table 92 Ethernet, PPP, Cellular, VLAN, Bridge, and Virtual Interface Characteristics

CHARACTERISTICS ETHERNET ETHERNET PPP CELLULAR VLAN BRIDGE VIRTUAL

Name* wan1, wan2 lan1, lan2,

dmz

pppxcellularx vlanxbrx**

Configurable Zone No No Yes Yes Yes Yes No

IP Address

Assignment

Static IP address Yes Yes Yes Yes Yes Yes Yes

DHCP client Yes No Yes Yes Yes Yes No

Routing metric Yes Yes Yes Yes Yes Yes Yes

Interface

Parameters

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

218

Note: - * The format of interface names other than the Ethernet and ppp interface names is

strict. Each name consists of 2-4 letters (interface type), followed by a number (x). For

most interfaces, x is limited by the maximum number of the type of interface. For VLAN

interfaces, x is defined by the number you enter in the VLAN name field. For example,

Ethernet interface names are wan1, wan2, lan1, lan2, dmz; VLAN interfaces are vlan0,

vlan1, vlan2,...; and so on.

** - The names of virtual interfaces are derived from the interfaces on which they are

created. For example, virtual interfaces created on Ethernet interface wan1 are called

wan1:1, wan1:2, and so on. Virtual interfaces created on VLAN interface vlan2 are

called vlan2:1, vlan2:2, and so on. You cannot specify the number after the colon(:) in

the Web Configurator; it is a sequential number. You can specify the number after the

colon if you use the CLI to set up a virtual interface.

Relationships Between Interfaces

In the Zyxel Device, interfaces are usually created on top of other interfaces. Only Ethernet interfaces

are created directly on top of the physical ports or port groups. The relationships between interfaces are

explained in the following table.

Bandwidth

restrictions Yes Yes Yes Yes Yes Yes Yes

Packet size

(MTU) Yes Yes Yes Yes Yes Yes No

DHCP

DHCP server No Yes No No Yes Yes No

DHCP relay No Yes No No Yes Yes No

Connectivity Check Yes No Yes Yes Yes Yes No

Table 93 Relationships Between Different Types of Interfaces

INTERFACE REQUIRED PORT / INTERFACE

Ethernet interface physical port

VLAN interface Ethernet interface

bridge interface Ethernet interface*

VLAN interface*

PPP interface Ethernet interface*

VLAN interface*

bridge interface

WAN1, WAN2, OPT*

Table 92 Ethernet, PPP, Cellular, VLAN, Bridge, and Virtual Interface Characteristics (continued)

CHARACTERISTICS ETHERNET ETHERNET PPP CELLULAR VLAN BRIDGE VIRTUAL

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

219

Note: * You cannot set up a PPP interface, virtual Ethernet interface or virtual VLAN interface

if the underlying interface is a member of a bridge. You also cannot add an Ethernet

interface or VLAN interface to a bridge if the member interface has a virtual interface

or PPP interface on top of it.

IPv6 Overview

IPv6 (Internet Protocol version 6), is designed to enhance IP address size and features. The increase in

IPv6 address size to 128 bits (from the 32-bit IPv4 address) allows up to 3.4 x 1038 IP addresses.

IPv6 Addressing

An 128-bit IPv6 address is written as eight 16-bit hexadecimal blocks separated by colons (:). This is an

example IPv6 address 2001:0db8:1a2b:0015:0000:0000:1a2f:0000.

IPv6 addresses can be abbreviated in two ways:

• Leading zeros in a block can be omitted. So 2001:0db8:1a2b:0015:0000:0000:1a2f:0000 can be

written as 2001:db8:1a2b:15:0:0:1a2f:0.

• Any number of consecutive blocks of zeros can be replaced by a double colon. A double colon can

only appear once in an IPv6 address. So 2001:0db8:0000:0000:1a2f:0000:0000:0015 can be

written as 2001:0db8::1a2f:0000:0000:0015, 2001:0db8:0000:0000:1a2f::0015,

2001:db8::1a2f:0:0:15 or 2001:db8:0:0:1a2f::15.

Prefix and Prefix Length

Similar to an IPv4 subnet mask, IPv6 uses an address prefix to represent the network address. An IPv6

prefix length specifies how many most significant bits (start from the left) in the address compose the

network address. The prefix length is written as “/x” where x is a number. For example,

2001:db8:1a2b:15::1a2f:0/32

means that the first 32 bits (2001:db8) from the left is the network prefix.

virtual interface

(virtual Ethernet interface)

(virtual VLAN interface)

(virtual bridge interface)

Ethernet interface*

VLAN interface*

bridge interface

trunk Ethernet interface

Cellular interface

VLAN interface

bridge interface

PPP interface

Table 93 Relationships Between Different Types of Interfaces (continued)

INTERFACE REQUIRED PORT / INTERFACE

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

220

Link-local Address

A link-local address uniquely identifies a device on the local network (the LAN). It is similar to a “private IP

address” in IPv4. You can have the same link-local address on multiple interfaces on a device. A link-

local unicast address has a predefined prefix of fe80::/10. The link-local unicast address format is as

follows.

Subnet Masking

Both an IPv6 address and IPv6 subnet mask compose of 128-bit binary digits, which are divided into

eight 16-bit blocks and written in hexadecimal notation. Hexadecimal uses four bits for each character

(1 ~ 10, A ~ F). Each block’s 16 bits are then represented by four hexadecimal characters. For example,

FFFF:FFFF:FFFF:FFFF:FC00:0000:0000:0000.

Stateless Autoconfiguration

With stateless autoconfiguration in IPv6, addresses can be uniquely and automatically generated.

Unlike DHCPv6 (Dynamic Host Configuration Protocol version six) which is used in IPv6 stateful

autoconfiguration, the owner and status of addresses don’t need to be maintained by a DHCP server.

Every IPv6 device is able to generate its own and unique IP address automatically when IPv6 is initiated

on its interface. It combines the prefix and the interface ID (generated from its own Ethernet MAC

address) to form a complete IPv6 address.

When IPv6 is enabled on a device, its interface automatically generates a link-local address (beginning

with fe80).

When the Zyxel Device’s WAN interface is connected to an ISP with a router and the Zyxel Device is set

to automatically obtain an IPv6 network prefix from the router for the interface, it generates another

address which combines its interface ID and global and subnet information advertised from the router.

(In IPv6, all network interfaces can be associated with several addresses.) This is a routable global IP

address.

Prefix Delegation

Prefix delegation enables an IPv6 router (the Zyxel Device) to use the IPv6 prefix (network address)

received from the ISP (or a connected uplink router) for its LAN. The Zyxel Device uses the received IPv6

prefix (for example, 2001:db2::/48) to generate its LAN IP address. Through sending Router

Advertisements (RAs) regularly by multicast, the router passes the IPv6 prefix information to its LAN hosts.

The hosts then can use the prefix to generate their IPv6 addresses.

IPv6 Router Advertisement

An IPv6 router sends router advertisement messages periodically to advertise its presence and other

parameters to the hosts on the same network.

Table 94 Link-local Unicast Address Format

1111 1110 10 0Interface ID

10 bits 54 bits 64 bits

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

221

DHCPv6

The Dynamic Host Configuration Protocol for IPv6 (DHCPv6, RFC 3315) is a server-client protocol that

allows a DHCP server to assign and pass IPv6 network addresses, prefixes and other configuration

information to DHCP clients. DHCPv6 servers and clients exchange DHCP messages using UDP.

Each DHCP client and server has a unique DHCP Unique IDentifier (DUID), which is used for identification

when they are exchanging DHCPv6 messages. The DUID is generated from the MAC address, time,

vendor assigned ID and/or the vendor's private enterprise number registered with the IANA. It should not

change over time even after you reboot the device.

9.1.3 What You Need to Do First

For IPv6 settings, go to the Configuration > System > IPv6 screen to enable IPv6 support on the Zyxel

Device first.

9.2 Port Role

To access this screen, click Configuration > Network > Interface > Port Role. Use the Port Role screen to

set the Zyxel Device’s physical ports to ZONE interfaces. This creates a hardware connection between

the physical ports at the layer-2 (data link, MAC address) level. This provides wire-speed throughput but

no security.

Note the following if you are configuring from a computer connected to a lan1, lan2, ext-wlan, ext-lan

or dmz port and change the port's role:

• A port's IP address varies as its role changes, make sure your computer's IP address is on the same

subnet as the Zyxel Device's interface IP address.

• Use the appropriate interface IP address to access the Zyxel Device.

Figure 174 Configuration > Network > Interface > Port Role

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

222

The physical Ethernet ports are shown at the top and the Ethernet interfaces and zones are shown at the

bottom of the screen. Use the radio buttons to select for which interface (network) you want to use

each physical port. For example, select a port’s LAN radio button to use the port as part of the LAN

interface. The port will use the Zyxel Device’s LAN IP address and MAC address.

When you assign more than one physical port to a network, you create a port group. Port groups have

the following characteristics:

• There is a layer-2 Ethernet switch between physical ports in the port group. This provides wire-speed

throughput but no security.

• It can increase the bandwidth between the port group and other interfaces.

• The port group uses a single MAC address.

Click Apply to save your changes and apply them to the Zyxel Device.

Click Reset to change the port groups to their current configuration (last-saved values).

9.3 Port Configuration

Use this screen to configure port settings. Click Configuration > Network > Interface > Port Configuration

in the navigation panel to display the configuration screen.

Note: You cannot configure the speed and duplex mode of fiber ports.

Figure 175 Configuration > Network > Interface > Port Configuration

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

223

Each field is described in the following table.

9.4 Ethernet Summary Screen

This screen lists every Ethernet interface and virtual interface created on top of Ethernet interfaces. If you

enabled IPv6 on the Configuration > System > IPv6 screen, you can also configure Ethernet interfaces

used for your IPv6 networks on this screen. To access this screen, click Configuration > Network >

Interface > Ethernet.

Unlike other types of interfaces, you cannot create new Ethernet interfaces nor can you delete any of

them. If an Ethernet interface does not have any physical ports assigned to it, the Ethernet interface is

effectively removed from the Zyxel Device, but you can still configure it.

Ethernet interfaces are similar to other types of interfaces in many ways. They have an IP address, subnet

mask, and gateway used to make routing decisions. They restrict the amount of bandwidth and packet

size. They can provide DHCP services, and they can verify the gateway is available.

Use Ethernet interfaces to control which physical ports exchange routing information with other routers

and how much information is exchanged through each one. The more routing information is

exchanged, the more efficient the routers should be. However, the routers also generate more network

traffic, and some routing protocols require a significant amount of configuration and management. The

Zyxel Device supports the following routing protocols: RIP, OSPF and BGP. See Chapter 10 on page 324

for background information about these routing protocols.

Table 95 Configuration > Network > Interface > Port Configuration

LABEL DESCRIPTION

Edit Select an entry, and click this button to configure the speed and the duplex mode of the

Ethernet connection on this port.

Name This field displays the name of the port.

Interface This field displays the interface for the port.

Type This field displays the cable type that is used on the port.

Settings Select the speed and the duplex mode of the Ethernet connection on this port. Choices

are Auto Negotiate, 1000Mbps-Full Duplex, 100Mbps-Full Du plex, 100Mbps-Half Duplex,

10Mbps-Full Duplex, and 10Mbps-Half Duplex.

Selecting Auto Negotiate allows one port to negotiate with a peer port automatically to

obtain the connection speed (of up to 1000M) and duplex mode that both ends support.

When auto-negotiation is turned on, a port on the Zyxel Device negotiates with the peer

automatically to determine the connection speed and duplex mode. If the peer port does

not support auto-negotiation or turns off this feature, the Zyxel Device determines the

connection speed by detecting the signal on the cable and using half duplex mode. When

the Zyxel Device’s auto-negotiation is turned off, a port uses the pre-configured speed and

duplex mode when making a connection, thus requiring you to make sure that the settings

of the peer port are the same in order to connect.

Status This field displays the speed and the duplex mode of the Ethernet connection on the port.

Apply Click Apply to save your changes back to the Zyxel Device.

Reset Click Reset to return the screen to its last-saved settings.

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

224

Figure 176 Configuration > Network > Interface > Ethernet

Each field is described in the following table.

Table 96 Configuration > Network > Interface > Ethernet

LABEL DESCRIPTION

Configuration / IPv6

Configuration

Use the Configuration section for IPv4 network settings. Use the IPv6 Configuration section

for IPv6 network settings if you connect your Zyxel Device to an IPv6 network. Both sections

have similar fields as described below.

Edit Double-click an entry or select it and click Edit to open a screen where you can modify the

entry’s settings.

Remove To remove a virtual interface, select it and click Remove. The Zyxel Device confirms you

want to remove it before doing so.

Activate To turn on an interface, select it and click Activate.

Inactivate To turn off an interface, select it and click Inactivate.

Create Virtual

Interface

To open the screen where you can create a virtual Ethernet interface, select an Ethernet

interface and click Create Virtual Interface.

References Select an entry and click References to open a screen that shows which settings use the

entry. See Section 9.4.4 on page 243 for an example.

#This field is a sequential value, and it is not associated with any interface.

Status This icon is lit when the entry is active and dimmed when the entry is inactive.

Name This field displays the name of the interface.

Description This field displays the description of the interface.

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

225

9.4.1 Ethernet Edit

The Ethernet Edit screen lets you configure IP address assignment, interface parameters, RIP settings,

OSPF settings, DHCP settings, connectivity check, and MAC address settings. To access this screen, click

an Edit icon on the Ethernet Summary screen. (See Section 9.4 on page 223.)

The OPT interface’s Edit > Configuration screen is shown here as an example. The screens for other

interfaces are similar and contain a subset to the OPT interface screen’s fields.

Note: If you create IP address objects based on an interface’s IP address, subnet, or gateway,

the Zyxel Device automatically updates every rule or setting that uses the object

whenever the interface’s IP address settings change. For example, if you change the

VLAN's IP address, the Zyxel Device automatically updates the corresponding

interface-based, LAN subnet address object.

With RIP, you can use Ethernet interfaces to do the following things.

• Enable and disable RIP in the underlying physical port or port group.

• Select which direction(s) routing information is exchanged - The Zyxel Device can receive routing

information, send routing information, or do both.

• Select which version of RIP to support in each direction - The Zyxel Device supports RIP-1, RIP-2, and

both versions.

• Select the broadcasting method used by RIP-2 packets - The Zyxel Device can use subnet

broadcasting or multicasting.

With OSPF, you can use Ethernet interfaces to do the following things.

• Enable and disable OSPF in the underlying physical port or port group.

• Select the area to which the interface belongs.

• Override the default link cost and authentication method for the selected area.

• Select in which direction(s) routing information is exchanged - The Zyxel Device can receive routing

information, send routing information, or do both.

Set the priority used to identify the DR or BDR if one does not exist.

IP Address This field displays the current IP address of the interface. If the IP address is 0.0.0.0 (on the

IPv4 network) or :: (on the IPv6 network), the interface does not have an IP address yet.

On the IPv4 network, this screen also shows whether the IP address is a static IP address

(STATIC) or dynamically assigned (DHCP). IP addresses are always static in virtual interfaces.

On the IPv6 network, this screen also shows whether the IP address is a static IP address

(STATIC), link-local IP address (LINK LOCAL), dynamically assigned (DHCP), or an IPv6

StateLess Address AutoConfiguration IP address (SLAAC). See Section 9.1.2 on page 216 for

more information about IPv6.

Mask This field displays the interface’s subnet mask in dot decimal notation.

Apply Click Apply to save your changes back to the Zyxel Device.

Reset Click Reset to return the screen to its last-saved settings.

Table 96 Configuration > Network > Interface > Ethernet (continued)

LABEL DESCRIPTION

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

226

9.4.1.1 IGMP Proxy

Internet Group Management Protocol (IGMP) proxy is used for multicast routing. IGMP proxy enables the

Zyxel Device to issue IGMP host messages on behalf of hosts that the Zyxel Device discovered on its

IGMP-enabled interfaces. The Zyxel Device acts as a proxy for its hosts. Refer to the following figure.

• DS: Downstream traffic

• US: Upstream traffic

•R: Router

• MS: Multicast Server

• Enable IGMP Upstream (US) on the Zyxel Device interface that connects to a router (R) running IGMP

that is closer to the multicast server (MS).

• Enable IGMP Downstream on the Zyxel Device interface which connects to the multicast hosts.

Figure 177 IGMP Proxy

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

227

Figure 178 Configuration > Network > Interface > Ethernet > Edit (External Type)

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

228

Configuration > Netwo rk > Interface > Ethernet > Edit (External Type

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

229

Figure 179 Configuration > Network > Interface > Ethernet > Edit (Internal Type)

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

230

Configuration > Netwo rk > Interface > Ethernet > Edit (Internal Type)

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

231

Figure 180 Configuration > Network > Interface > Ethernet > Edit (OPT)

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

232

Configuration > Netwo rk > Interface > Ethernet > Edit (OPT)

These screen’s fields are described in the table below.

Table 97 Configuration > Network > Interface > Ethernet > Edit

LABEL DESCRIPTION

IPv4/IPv6 View / IPv4

View / IPv6 View

Use this button to display both IPv4 and IPv6, IPv4-only, or IPv6-only configuration fields.

Show Advanced

Settings / Hide

Advanced Settings

Click this button to display a greater or lesser number of configuration fields.

Create New Object Click this button to create a DHCPv6 lease or DHCPv6 request object that you may use for

the DHCPv6 settings in this screen.

General Settings

Enable Interface Select this to enable this interface. Clear this to disable this interface.

General IPv6 Setting

Enable IPv6 Select this to enable IPv6 on this interface. Otherwise, clear this to disable it.

Interface Properties

Interface Type This field is configurable for the OPT interface only. Select to which type of network you will

connect this interface. When you select internal or external the rest of the screen’s options

automatically adjust to correspond. The Zyxel Device automatically adds default route and

SNAT settings for traffic it routes from internal interfaces to external interfaces; for example

LAN to WAN traffic.

internal is for connecting to a local network. Other corresponding configuration options:

DHCP server and DHCP relay. The Zyxel Device automatically adds default SNAT settings for

traffic flowing from this interface to an external interface.

external is for connecting to an external network (like the Internet). The Zyxel Device

automatically adds this interface to the default WAN trunk.

For general, the rest of the screen’s options do not automatically adjust and you must

manually configure a policy route to add routing and SNAT settings for the interface.

Interface Name Specify a name for the interface. It can use alphanumeric characters, hyphens, and

underscores, and it can be up to 11 characters long.

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

233

Port This is the name of the Ethernet interface’s physical port.

Zone Select the zone to which this interface is to belong. You use zones to apply security settings

such as security policy, IDP, remote management, anti-malware, and application patrol.

Make sure to select the correct zone as otherwise traffic may be blocked by a security

policy.

MAC Address This field is read-only. This is the MAC address that the Ethernet interface uses.

Description Enter a description of this interface. You can use alphanumeric and ()+/:=?!*#@$_%-

characters, and it can be up to 60 characters long. Spaces are allowed, but the string

can’t start with a space.

IP Address

Assignment

These IP address fields configure an IPv4 IP address on the interface itself. If you change this

IP address on the interface, you may also need to change a related address object for the

network connected to the interface. For example, if you use this screen to change the IP

address of your LAN interface, you should also change the corresponding LAN subnet

address object.

Get

Automatically This option appears when Interface Type is external or general. Select this to make the

interface a DHCP client and automatically get the IP address, subnet mask, and gateway

address from a DHCP server.

You should not select this if the interface is assigned to a VRRP group. See Chapter 40 on

page 765.

DHCP Option 60 DHCP Option 60 is used by the Zyxel Device for identification to the DHCP server using the

VCI (Vendor Class Identifier) on the DHCP server. The Zyxel Device adds it in the initial DHCP

discovery message that a DHCP client broadcasts in search of an IP address. The DHCP

server can assign different IP addresses or options to clients with the specific VCI or reject

the request from clients without the specific VCI.

Type a string using up to 64 of these characters [a-zA-Z0-9!\"#$%&\'()*+,-./

:;<=>?@\[\\\]^_`{|}~] to identify this Zyxel Device to the DHCP server. For example, Zyxel-

TW.

Use Fixed IP

Address This option appears when Interface Type is external or general. Select this if you want to

specify the IP address, subnet mask, and gateway manually.

IP Address Enter the IP address for this interface.

Subnet Mask Enter the subnet mask of this interface in dot decimal notation. The subnet mask indicates

what part of the IP address is the same for all computers on the network.

Gateway This option appears when Interface Type is external or general. Enter the IP address of the

gateway. The Zyxel Device sends packets to the gateway when it does not know how to

route the packet to its destination. The gateway should be on the same network as the

interface.

Metric This option appears when Interface Type is external or general. Enter the priority of the

gateway (if any) on this interface. The Zyxel Device decides which gateway to use based

on this priority. The lower the number, the higher the priority. If two or more gateways have

the same priority, the Zyxel Device uses the one that was configured first.

Enable IGMP Support Select this to allow the Zyxel Device to act as an IGMP proxy for hosts connected on the

IGMP downstream interface.

IGMP Upstream Enable IGMP Upstream on the interface which connects to a router running IGMP that is

closer to the multicast server.

IGMP

Downstream Enable IGMP Downstream on the interface which connects to the multicast hosts.

IPv6 Address

Assignment

These IP address fields configure an IPv6 IP address on the interface itself.

Enable Stateless

Address Auto-

configuration

(SLAAC)

Select this to enable IPv6 stateless auto-configuration on this interface. The interface will

generate an IPv6 IP address itself from a prefix obtained from an IPv6 router on the network.

Table 97 Configuration > Network > Interface > Ethernet > Edit (continued)

LABEL DESCRIPTION

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

234

Link-Local

Address This displays the IPv6 link-local address and the network prefix that the Zyxel Device

generates itself for the interface.

IPv6 Address/

Prefix Length Enter the IPv6 address and the prefix length for this interface if you want to use a static IP

address. This field is optional.

The prefix length indicates what the left-most part of the IP address is the same for all

computers on the network, that is, the network address.

Gateway Enter the IPv6 address of the default outgoing gateway using colon (:) hexadecimal

notation.

Metric Enter the priority of the gateway (if any) on this interface. The Zyxel Device decides which

gateway to use based on this priority. The lower the number, the higher the priority. If two or

more gateways have the same priority, the Zyxel Device uses the one that was configured

first.

Address from

DHCPv6 Prefix

Delegation

Use this table to have the Zyxel Device obtain an IPv6 prefix from the ISP or a connected

uplink router for an internal network, such as the LAN or DMZ. You have to also enter a suffix

address which is appended to the delegated prefix to form an address for this interface.

See Prefix Delegation on page 220 for more information.

To use prefix delegation, you must:

• Create at least one DHCPv6 request object before configuring this table.

• The external interface must be a DHCPv6 client. You must configure the DHCPv6

request options using a DHCPv6 request object with the type of prefix-delegation.

• Assign the prefix delegation to an internal interface and enable router advertisement

on that interface.

Add Click this to create an entry.

Edit Select an entry and click this to change the settings.

Remove Select an entry and click this to delete it from this table.

References Select an entry and click References to check which settings use the entry.

# This field is a sequential value, and it is not associated with any entry.

Delegated

Prefix Select the DHCPv6 request object to use from the drop-down list.

Suffix

Address Enter the ending part of the IPv6 address, a slash (/), and the prefix length. The Zyxel Device

will append it to the delegated prefix.

For example, you got a delegated prefix of 2003:1234:5678/48. You want to configure an IP

address of 2003:1234:5678:1111::1/128 for this interface, then enter ::1111:0:0:0:1/128 in this

field.

Address This field displays the combined IPv6 IP address for this interface.

Note: This field displays the combined address after you click OK and reopen this

screen.

DHCPv6 Setting

DHCPv6 Select N/A to not use DHCPv6.

Select Client to set this interface to act as a DHCPv6 client.

Select Server to set this interface to act as a DHCPv6 server which assigns IP addresses and

provides subnet mask, gateway, and DNS server information to clients.

Select Relay to set this interface to route DHCPv6 requests to the DHCPv6 relay server you

specify. The DHCPv6 server(s) may be on another network.

DUID This field displays the DHCP Unique IDentifier (DUID) of the interface, which is unique and

used for identification purposes when the interface is exchanging DHCPv6 messages with

others. See DHCPv6 on page 221 for more information.

Table 97 Configuration > Network > Interface > Ethernet > Edit (continued)

LABEL DESCRIPTION

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

235

DUID as MAC Select this if you want the DUID is generated from the interface’s default MAC address.

Customized DUID If you want to use a customized DUID, enter it here for the interface.

Enable Rapid

Commit Select this to shorten the DHCPv6 message exchange process from four to two steps. This

function helps reduce heavy network traffic load.

Note: Make sure you also enable this option in the DHCPv6 clients to make rapid

commit work.

Information

Refresh Time Enter the number of seconds a DHCPv6 client should wait before refreshing information

retrieved from DHCPv6.

Request Address This field is available if you set this interface to DHCPv6 Client. Select this to get an IPv6 IP

address for this interface from the DHCP server. Clear this to not get any IP address

information through DHCPv6.

DHCPv6 Request

Options /

DHCPv6 Lease

Options

If this interface is a DHCPv6 client, use this section to configure DHCPv6 request settings that

determine what additional information to get from the DHCPv6 server. If the interface is a

DHCPv6 server, use this section to configure DHCPv6 lease settings that determine what

additional information to offer to the DHCPv6 clients.

Add Click this to create an entry in this table. See Section 9.4.5 on page 244 for more

information.

Remove Select an entry and click this to delete it from this table.

References Select an entry and click References to open a screen that shows which settings use the

entry. See Section 9.4.4 on page 243 for an example.

# This field is a sequential value, and it is not associated with any entry.

Name This field displays the name of the DHCPv6 request or lease object.

Type This field displays the type of the object.

Value This field displays the IPv6 prefix that the Zyxel Device obtained from an uplink router (Server

is selected) or will advertise to its clients (Client is selected).

Interface When Relay is selected, select this check box and an interface from the drop-down list if

you want to use it as the relay server.

Relay Server When Relay is selected, select this check box and enter the IP address of a DHCPv6 server

as the relay server.

IPv6 Router

Setting

Enable Router

Advertisement Select this to enable this interface to send router advertisement messages periodically. See

IPv6 Router Advertisement on page 220 for more information.

Advertised Hosts

Get Network

Configuration

From DHCPv6

Select this to have the Zyxel Device indicate to hosts to obtain network settings (such as

prefix and DNS settings) through DHCPv6.

Clear this to have the Zyxel Device indicate to hosts that DHCPv6 is not available and they

should use the prefix in the router advertisement message.

Advertised Hosts

Get Other

Configuration

From DHCPv6

Select this to have the Zyxel Device indicate to hosts to obtain DNS information through

DHCPv6.

Clear this to have the Zyxel Device indicate to hosts that DNS information is not available in

this network.

Router

Preference Select the router preference (Low, Medium or High) for the interface. The interface sends

this preference in the router advertisements to tell hosts what preference they should use for

the Zyxel Device. This helps hosts to choose their default router especially when there are

multiple IPv6 router on the network.

Note: Make sure the hosts also support router preference to make this function

work.

Table 97 Configuration > Network > Interface > Ethernet > Edit (continued)

LABEL DESCRIPTION

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

236

MTU The Maximum Transmission Unit. Type the maximum size of each IPv6 data packet, in bytes,

that can move through this interface. If a larger packet arrives, the Zyxel Device discards

the packet and sends an error message to the sender to inform this.

Hop Limit Enter the maximum number of network segments that a packet can cross before reaching

the destination. When forwarding an IPv6 packet, IPv6 routers are required to decrease the

Hop Limit by 1 and to discard the IPv6 packet when the Hop Limit is 0.

Advertised Prefix

Table Configure this table only if you want the Zyxel Device to advertise a fixed prefix to the

network.

Add Click this to create an IPv6 prefix address.

Edit Select an entry in this table and click this to modify it.

Remove Select an entry in this table and click this to delete it.

# This field is a sequential value, and it is not associated with any entry.

IPv6

Address/

Prefix Length

Enter the IPv6 network prefix address and the prefix length.

The prefix length indicates what the left-most part of the IP address is the same for all

computers on the network, that is, the network address.

Advertised Prefix

from DHCPv6

Prefix Delegation

This table is available when the Interface Type is internal. Use this table to configure the

network prefix if you want to use a delegated prefix as the beginning part of the network

prefix.

Add Click this to create an entry in this table.

Edit Select an entry in this table and click this to modify it.

Remove Select an entry in this table and click this to delete it.

# This field is a sequential value, and it is not associated with any entry.

Delegated

Prefix Select the DHCPv6 request object to use for generating the network prefix for the network.

Suffix

Address Enter the ending part of the IPv6 network address plus a slash (/) and the prefix length. The

Zyxel Device will append it to the selected delegated prefix. The combined address is the

network prefix for the network.

For example, you got a delegated prefix of 2003:1234:5678/48. You want to divide it into

2003:1234:5678:1111/64 for this interface and 2003:1234:5678:2222/64 for another interface.

You can use ::1111/64 and ::2222/64 for the suffix address respectively. But if you do not

want to divide the delegated prefix into subnetworks, enter ::0/48 here, which keeps the

same prefix length (/48) as the delegated prefix.

Address This is the final network prefix combined by the delegated prefix and the suffix.

Note: This field displays the combined address after you click OK and reopen this

screen.

Interface Parameters

Egress Bandwidth Enter the maximum amount of traffic, in kilobits per second, the Zyxel Device can send

through the interface to the network. Allowed values are 0 - 1048576.

Ingress

Bandwidth This is reserved for future use.

Enter the maximum amount of traffic, in kilobits per second, the Zyxel Device can receive

from the network through the interface. Allowed values are 0 - 1048576.

MTU Maximum Transmission Unit. Type the maximum size of each data packet, in bytes, that can

move through this interface. If a larger packet arrives, the Zyxel Device divides it into smaller

fragments. Allowed values are 576 - 1500. Usually, this value is 1500.

Table 97 Configuration > Network > Interface > Ethernet > Edit (continued)

LABEL DESCRIPTION

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

237

Connectivity Check These fields appear when Interface Properties is External or General.

The interface can regularly check the connection to the gateway you specified to make

sure it is still available. You specify how often the interface checks the connection, how

long to wait for a response before the attempt is a failure, and how many consecutive

failures are required before the Zyxel Device stops routing to the gateway. The Zyxel Device

resumes routing to the gateway the first time the gateway passes the connectivity check.

Enable

Connectivity

Check

Select this to turn on the connection check.

Check Method Select the method that the gateway allows.

Select icmp to have the Zyxel Device regularly ping the gateway you specify to make sure

it is still available.

Select tcp to have the Zyxel Device regularly perform a TCP handshake with the gateway

you specify to make sure it is still available.

Check Period Enter the number of seconds between connection check attempts.

Check Timeout Enter the number of seconds to wait for a response before the attempt is a failure.

Check Fail

Tolerance Enter the number of consecutive failures before the Zyxel Device stops routing through the

gateway.

Check Default

Gateway Select this to use the default gateway for the connectivity check.

Check this

address Select this to specify a domain name or IP address for the connectivity check. Enter that

domain name or IP address on the field next to it.

Check Port This field only displays when you set the Check Method to tcp. Specify the port number to

use for a TCP connectivity check.

Check these

addresses Type one or two domain names or IP addresses for the connectivity check.

Probe Succeeds

When This field applies when you specify two domain names or IP addresses for the connectivity

check.

Select any one if you want the check to pass if at least one of the domain names or IP

addresses responds.

Select all if you want the check to pass only if both domain names or IP addresses respond.

DHCP Setting This section appears when Interface Type is internal or general.

DHCP Select what type of DHCP service the Zyxel Device provides to the network. Choices are:

None - the Zyxel Device does not provide any DHCP services. There is already a DHCP

server on the network.

DHCP Relay - the Zyxel Device routes DHCP requests to one or more DHCP servers you

specify. The DHCP server(s) may be on another network.

DHCP Server - the Zyxel Device assigns IP addresses and provides subnet mask, gateway,

and DNS server information to the network. The Zyxel Device is the DHCP server for the

network.

These fields appear if the Zyxel Device is a DHCP Relay.

Relay Server 1 Enter the IP address of a DHCP server for the network.

Relay Server 2 This field is optional. Enter the IP address of another DHCP server for the network.

These fields appear if the Zyxel Device is a DHCP Server.

Table 97 Configuration > Network > Interface > Ethernet > Edit (continued)

LABEL DESCRIPTION

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

238

IP Pool Start

Address Enter the IP address from which the Zyxel Device begins allocating IP addresses. If you want

to assign a static IP address to a specific computer, use the Static DHCP Table.

If this field is blank, the Pool Size must also be blank. In this case, the Zyxel Device can assign

every IP address allowed by the interface’s IP address and subnet mask, except for the first

address (network address), last address (broadcast address) and the interface’s IP address.

Pool Size Enter the number of IP addresses to allocate. This number must be at least one and is limited

by the interface’s Subnet Mask. For example, if the Subnet Mask is 255.255.255.0 and IP Pool

Start Address is 10.10.10.10, the Zyxel Device can allocate 10.10.10.10 to 10.10.10.254, or 245

IP addresses.

If this field is blank, the IP Pool Start Address must also be blank. In this case, the Zyxel Device

can assign every IP address allowed by the interface’s IP address and subnet mask, except

for the first address (network address), last address (broadcast address) and the interface’s

IP address.

First DNS Server,

Second DNS

Server, Third DNS

Server

Specify the IP addresses up to three DNS servers for the DHCP clients to use. Use one of the

following ways to specify these IP addresses.

Custom Defined - enter a static IP address.

From ISP - select the DNS server that another interface received from its DHCP server.

Zyxel Device - the DHCP clients use the IP address of this interface and the Zyxel Device

works as a DNS relay.

First WINS Server,

Second WINS

Server

Type the IP address of the WINS (Windows Internet Naming Service) server that you want to

send to the DHCP clients. The WINS server keeps a mapping table of the computer names

on your network and the IP addresses that they are currently using.

Default Router If you set this interface to DHCP Server, you can select to use either the interface’s IP

address or another IP address as the default router. This default router will become the

DHCP clients’ default gateway.

To use another IP address as the default router, select Custom Defined and enter the IP

address.

Lease time Specify how long each computer can use the information (especially the IP address)

before it has to request the information again. Choices are:

infinite - select this if IP addresses never expire.

days, hours, and minutes - select this to enter how long IP addresses are valid.

Extended

Options This table is available if you selected DHCP server.

Configure this table if you want to send more information to DHCP clients through DHCP

packets.

Add Click this to create an entry in this table. See Section 9.4.6 on page 245.

Edit Select an entry in this table and click this to modify it.

Remove Select an entry in this table and click this to delete it.

# This field is a sequential value, and it is not associated with any entry.

Name This is the name of the DHCP option.

Code This is the code number of the DHCP option.

Type This is the type of the set value for the DHCP option.

Value This is the value set for the DHCP option.

Table 97 Configuration > Network > Interface > Ethernet > Edit (continued)

LABEL DESCRIPTION

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

239

PXE Server PXE (Preboot eXecution Environment) allows a client computer to use the network to boot

up and install an operating system via a PXE-capable Network Interface Card (NIC).

PXE is available for computers on internal interfaces to allow them to boot up using boot

software on a PXE server. The Zyxel Device acts as an intermediary between the PXE server

and the computers that need boot software.

The PXE server must have a public IPv4 address. You must enable DHCP Server on the Zyxel

Device so that it can receive information from the PXE server.

PXE Boot Loader

File A boot loader is a computer program that loads the operating system for the computer.

Type the exact file name of the boot loader software file, including filename extension, that

is on the PXE server. If the wrong filename is typed, then the client computers cannot boot.

Enable IP/MAC

Binding Select this option to have this interface enforce links between specific IP addresses and

specific MAC addresses. This stops anyone else from manually using a bound IP address on

another device connected to this interface. Use this to make use only the intended users

get to use specific IP addresses.

Enable Logs for

IP/MAC Binding

Violation

Select this option to have the Zyxel Device generate a log if a device connected to this

interface attempts to use an IP address that is bound to another device’s MAC address.

Static DHCP

Table Configure a list of static IP addresses the Zyxel Device assigns to computers connected to

the interface. Otherwise, the Zyxel Device assigns an IP address dynamically using the

interface’s IP Pool Start Address and Pool Size.

Add Click this to create a new entry.

Edit Select an entry and click this to be able to modify it.

Remove Select an entry and click this to delete it.

#This field is a sequential value, and it is not associated with a specific entry.

IP Address Enter the IP address to assign to a device with this entry’s MAC address.

MAC Enter the MAC address to which to assign this entry’s IP address.

Description Enter a description to help identify this static DHCP entry. You can use alphanumeric and

()+/:=?!*#@$_%- characters, and it can be up to 60 characters long.

RIP Setting See Section 10.6 on page 325 for more information about RIP.

Enable RIP Select this to enable RIP in this interface.

Direction This field is effective when RIP is enabled. Select the RIP direction from the drop-down list

box.

BiDir - This interface sends and receives routing information.

In-Only - This interface receives routing information.

Out-Only - This interface sends routing information.

Send Version This field is effective when RIP is enabled. Select the RIP version(s) used for sending RIP

packets. Choices are 1, 2, and 1 and 2.

Receive Version This field is effective when RIP is enabled. Select the RIP version(s) used for receiving RIP

packets. Choices are 1, 2, and 1 and 2.

V2-Broadcast This field is effective when RIP is enabled. Select this to send RIP-2 packets using subnet

broadcasting; otherwise, the Zyxel Device uses multicasting.

OSPF Setting See Section 10.7 on page 327 for more information about OSPF.

Area Select the area in which this interface belongs. Select None to disable OSPF in this interface.

Priority Enter the priority (between 0 and 255) of this interface when the area is looking for a

Designated Router (DR) or Backup Designated Router (BDR). The highest-priority interface

identifies the DR, and the second-highest-priority interface identifies the BDR. Set the priority

to zero if the interface can not be the DR or BDR.

Link Cost Enter the cost (between 1 and 65,535) to route packets through this interface.

Table 97 Configuration > Network > Interface > Ethernet > Edit (continued)

LABEL DESCRIPTION

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

240

Passive Interface Select this to stop forwarding OSPF routing information from the selected interface. As a

result, this interface only receives routing information.

Authentication Select an authentication method, or disable authentication. To exchange OSPF routing

information with peer border routers, you must use the same authentication method that

they use. Choices are:

Same-as-Area - use the default authentication method in the area

None - disable authentication

Text - authenticate OSPF routing information using a plain-text password

MD5 - authenticate OSPF routing information using MD5 encryption

Text

Authentication

Key

This field is available if the Authentication is Text. Type the password for text authentication.

The key can consist of alphanumeric characters and the underscore, and it can be up to

16 characters long.

MD5

Authentication ID This field is available if the Authentication is MD5. Type the ID for MD5 authentication. The ID

can be between 1 and 255.

MD5

Authentication

Key

This field is available if the Authentication is MD5. Type the password for MD5 authentication.

The password can consist of alphanumeric characters and the underscore, and it can be

up to 16 characters long.

MAC Address Setting This section appears when Interface Properties is External or General. Have the interface

use either the factory assigned default MAC address, a manually specified MAC address,

or clone the MAC address of another device or computer.

Use Default MAC

Address Select this option to have the interface use the factory assigned default MAC address. By

default, the Zyxel Device uses the factory assigned MAC address to identify itself.

Overwrite

Default MAC

Address

Select this option to have the interface use a different MAC address. Either enter the MAC

address in the fields or click Clone by host and enter the IP address of the device or

computer whose MAC you are cloning. Once it is successfully configured, the address will

be copied to the configuration file. It will not change unless you change the setting or

upload a different configuration file.

Proxy ARP Proxy ARP is available for external or general interfaces on the Zyxel Device. See Section

9.4.2 on page 241 for more information on Proxy ARP.

Enable Proxy ARP Select this to allow the Zyxel Device to answer external interface ARP requests on behalf of

a device on its internal interface. Interfaces supported are:

•Ethernet

•VLAN

• Bridge

See Section 9.4.2 on page 241 for more information.

Add Click Add to create an IPv4 Address, an IPv4 CIDR (for example, 192.168.1.1/24) or an IPv4

Range (for example, 192.168.1.2-192.168.1.100) as the target IP address. The Zyxel Device

answers external ARP requests only if they match one of these inputted target IP addresses.

For example, if the IPv4 Address is 192.168.1.5, then the Zyxel Device will answer ARP

requests coming from the WAN only if it contains 192.168.1.5 as the target IP address.

Select an existing entry and click Remove to delete that entry.

Related Setting

Table 97 Configuration > Network > Interface > Ethernet > Edit (continued)

LABEL DESCRIPTION

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

241

9.4.2 Proxy ARP

An Address Resolution Protocol (ARP) is a protocol for mapping an IP address to a MAC address. An ARP

broadcast is sent to all devices on the same Ethernet network to request the MAC address of a target IP

address.

In the following figure, a host in a WAN subnet (A) broadcasts an ARP request to all devices within its

network in order to find the MAC address of a target IP address (172.16.x.x). However, the target IP

address may be in another subnet (B) that has the same network IP address (172.16.x.x). A router, such

as the Zyxel Device, does not forward broadcasts, so the request will not reach its destination.

Enable Proxy ARP (RFC 1027) to allow the Zyxel Device to answer external interface ARP requests on

behalf of a device on its internal interface. Interfaces supported are:

• Ethernet

• VLAN

•Bridge

The Zyxel Device sends its external MAC address to the WAN sender as the destination for the target IP

address. From then on the sender will send packets containing that target IP address directly to the

external interface of the Zyxel Device. The Zyxel Device then forwards the packet to the correct target IP

address in its LAN.

Figure 181 Proxy ARP

Configure

PPPoE/PPTP Click PPPoE/PPTP if this interface’s Internet connection uses PPPoE or PPTP or L2TP.

Configure VLAN Click VLAN if you want to configure a VLAN interface for this Ethernet interface.

Configure WAN

TRUNK Click WAN TRUNK to go to a screen where you can set this interface to be part of a WAN

trunk for load balancing.

Configure Policy

Route Click Policy Route to go to the policy route summary screen where you can manually

associate traffic with this interface.

You must manually configure a policy route to add routing and SNAT settings for an

interface with the Interface Type set to general. You can also configure a policy route to

override the default routing and SNAT behavior for an interface with an Interface Type of

internal or external.

OK Click OK to save your changes back to the Zyxel Device.

Cancel Click Cancel to exit this screen without saving.

Table 97 Configuration > Network > Interface > Ethernet > Edit (continued)

LABEL DESCRIPTION

172.16.x.x 172.16.x.x

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

242

To allow the Zyxel Device to answer external interface ARP requests on behalf of a device on a

supported interface, select the interface, click Add or Edit, then click Add in the Proxy ARP section of the

screen.

Figure 182 Interface > Edit > Add Proxy ARP

The following table describes labels that can appear in this screen.

9.4.3 Virtual Interfaces

Use virtual interfaces to tell the Zyxel Device where to route packets. Virtual interfaces can also be used

in VPN gateways (see Chapter 19 on page 397) and VRRP groups (see Chapter 40 on page 765).

Virtual interfaces can be created on top of Ethernet interfaces, VLAN interfaces, or bridge interfaces.

Virtual VLAN interfaces recognize and use the same VLAN ID. Otherwise, there is no difference between

each type of virtual interface. Network policies (for example, security policies) that apply to the

underlying interface automatically apply to the virtual interface as well.

Like other interfaces, virtual interfaces have an IP address, subnet mask, and gateway used to make

routing decisions. However, you have to manually specify the IP address and subnet mask; virtual

interfaces cannot be DHCP clients. The virtual interface uses the same MTU and bandwidth settings that

the underlying interface uses. Unlike other interfaces, virtual interfaces do not provide DHCP services,

and they do not verify that the gateway is available.

This screen lets you configure IP address assignment and interface parameters for virtual interfaces. To

access this screen, click the Create Virtual Interface icon on the Ethernet, VLAN, or bridge interface

summary screen.

Table 98 Interface > Edit > Add Proxy ARP

LABEL DESCRIPTION

Interface Name This identifies the interface for which the configuration settings that use it are displayed.

Address Type Choose IPv4 Address, or IPv4 CIDR (for example, 192.168.1.1/24) or an IPv4 Range (for

example, 192.168.1.2-192.168.1.100) and then enter the target IP address information. The

Zyxel Device answers external ARP requests only if they match one of these inputted target IP

addresses. For example, if the IPv4 Address is 192.168.1.5, then the Zyxel Device will answer

ARP requests coming from the WAN only if it contains 192.168.1.5 as the target IP address.

OK Click OK to save your changes back to the Zyxel Device.

Cancel Click Cancel to exit this screen without saving.

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

243

Figure 183 Configuration > Network > Interface > Create Virtual Interface

Each field is described in the table below.

9.4.4 References

When a configuration screen includes an References icon, select a configuration object and click

References to open the References screen. This screen displays which configuration settings reference

the selected object. The fields shown vary with the type of object.

Table 99 Configuration > Network > Interface > Create Virtual Interface

LABEL DESCRIPTION

Interface Properties

Interface Name This field is read-only. It displays the name of the virtual interface, which is automatically

derived from the underlying Ethernet interface, VLAN interface, or bridge interface.

Description Enter a description of this interface. It is not used elsewhere. You can use alphanumeric and

()+/:=?!*#@$_%- characters, and it can be up to 60 characters long.

IP Address

Assignment

IP Address Enter the IP address for this interface.

Subnet Mask Enter the subnet mask of this interface in dot decimal notation. The subnet mask indicates

what part of the IP address is the same for all computers on the network.

Gateway Enter the IP address of the gateway. The Zyxel Device sends packets to the gateway when

it does not know how to route the packet to its destination. The gateway should be on the

same network as the interface.

Metric Enter the priority of the gateway (if any) on this interface. The Zyxel Device decides which

gateway to use based on this priority. The lower the number, the higher the priority. If two or

more gateways have the same priority, the Zyxel Device uses the one that was configured

first.

OK Click OK to save your changes back to the Zyxel Device.

Cancel Click Cancel to exit this screen without saving.

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

244

Figure 184 References

The following table describes labels that can appear in this screen.

9.4.5 Add/Edit DHCPv6 Request/Release Options

When you configure an interface as a DHCPv6 server or client, you can additionally add DHCPv6

request or lease options which have the Zyxel Device to add more information in the DHCPv6 packets.

To open the screen, click Configuration > Network > Interface > Ethernet > Edit, select DHCPv6 Server or

DHCPv6 Client in the DHCPv6 Setting section, and then click Add in the DHCPv6 Request Options or

DHCPv6 Lease Options table.

Figure 185 Configuration > Network > Interface > Ethernet > Edit > Add DHCPv6 Request/Lease Options

Select a DHCPv6 request or lease object in the Select one object field and click OK to save it. Click

Cancel to exit without saving the setting.

Table 100 References

LABEL DESCRIPTION

Name This identifies the object for which the configuration settings that use it are displayed. Click the

object’s name to display the object’s configuration screen in the main window.

#This field is a sequential value, and it is not associated with any entry.

Service This is the type of setting that references the selected object. Click a service’s name to display

the service’s configuration screen in the main window.

Priority If it is applicable, this field lists the referencing configuration item’s position in its list, otherwise

N/A displays.

Name This field identifies the configuration item that references the object.

Description If the referencing configuration item has a description configured, it displays here.

Refresh Click this to update the information in this screen.

Cancel Click Cancel to close the screen.

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

245

9.4.6 Add/Edit DHCP Extended Options

When you configure an interface as a DHCPv4 server, you can additionally add DHCP extended

options which have the Zyxel Device to add more information in the DHCP packets. The available fields

vary depending on the DHCP option you select in this screen. To open the screen, click Configuration >

Network > Interface > Ethernet > Edit, select DHCP Server in the DHCP Setting section, and then click Add

or Edit in the Extended Options table.

Figure 186 Configuration > Network > Interface > Ethernet > Edit > Add/Edit Extended Options

The following table describes labels that can appear in this screen.

Table 101 Configuration > Network > Interface > Ethernet > Edit > Add/Edit Extended Options

LABEL DESCRIPTION

Option Select which DHCP option that you want to add in the DHCP packets sent through the

interface. See the next table for more information.

Name This field displays the name of the selected DHCP option. If you selected User Defined in the

Option field, enter a descriptive name to identify the DHCP option. You can enter up to 16

characters (“a-z”, “A-Z, “0-9”, “-”, and “_”) with no spaces allowed. The first character must be

alphabetical (a-z, A-Z).

Code This field displays the code number of the selected DHCP option. If you selected User Defined

in the Option field, enter a number for the option. This field is mandatory.

Type This is the type of the selected DHCP option. If you selected User Defined in the Option field,

select an appropriate type for the value that you will enter in the next field. Only advanced

users should configure User Defined. Misconfiguration could result in interface lockout.

Value Enter the value for the selected DHCP option. For example, if you selected TFTP Server Name

(66) and the type is TEXT, enter the DNS domain name of a TFTP server here. This field is

mandatory.

First IP Address,

Second IP

Address, Third IP

Address

If you selected Time Server (4), NTP Server (41), SIP Server (120), CAPWAP AC (138), or TFTP

Server (150), you have to enter at least one IP address of the corresponding servers in these

fields. The servers should be listed in order of your preference.

First Enterprise ID,

Second Enterprise

If you selected VIVC (124) or VIVS (125), you have to enter at least one vendor’s 32-bit

enterprise number in these fields. An enterprise number is a unique number that identifies a

company.

First Class, Second

Class

If you selected VIVC (124) , enter the details of the hardware configuration of the host on which

the client is running, or of industry consortium compliance.

First Information,

Second

Information

If you selected VIVS (125), enter additional information for the corresponding enterprise

number in these fields.

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

246

The following table lists the available DHCP extended options (defined in RFCs) on the Zyxel Device. See

RFCs for more information.

9.5 PPP Interfaces

Use PPPoE/PPTP/L2TP interfaces to connect to your ISP. This way, you do not have to install or manage

PPPoE/PPTP/L2TP software on each computer on the network.

OK Click this to close this screen and update the settings to the previous Edit screen.

Cancel Click Cancel to close the screen.

Table 102 DHCP Extended Options

OPTION NAME CODE DESCRIPTION

Time Offset 2This option specifies the offset of the client's subnet in seconds from Coordinated

Universal Time (UTC).

Time Server 4This option specifies a list of Time servers available to the client.

NTP Server 42 This option specifies a list of the NTP servers available to the client by IP address.

TFTP Server Name 66 This option is used to identify a TFTP server when the “sname” field in the DHCP

header has been used for DHCP options. The minimum length of the value is 1.

Bootfile 67 This option is used to identify a bootfile when the “file” field in the DHCP header

has been used for DHCP options. The minimum length of the value is 1.

SIP Server 120 This option carries either an IPv4 address or a DNS domain name to be used by

the SIP client to locate a SIP server.

VIVC 124 Vendor-Identifying Vendor Class option

A DHCP client may use this option to unambiguously identify the vendor that

manufactured the hardware on which the client is running, the software in use, or

an industry consortium to which the vendor belongs.

VIVS 125 Vendor-Identifying Vendor-Specific option

DHCP clients and servers may use this option to exchange vendor-specific

information.

CAPWAP AC 138 CAPWAP Access Controller addresses option

The Control And Provisioning of Wireless Access Points Protocol allows a Wireless

Termination Point (WTP) to use DHCP to discover the Access Controllers to which it

is to connect. This option carries a list of IPv4 addresses indicating one or more

CAPWAP ACs available to the WTP.

TFTP Server 150 The option contains one or more IPv4 addresses that the client may use. The

current use of this option is for downloading configuration from a VoIP server via

TFTP; however, the option may be used for purposes other than contacting a VoIP

configuration server.

Table 101 Configuration > Network > Interface > Ethernet > Edit > Add/Edit Extended Options

LABEL DESCRIPTION

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

247

Figure 187 Example: PPPoE/PPTP/L2TP Interfaces

PPPoE/PPTP/L2TP interfaces are similar to other interfaces in some ways. They have an IP address, subnet

mask, and gateway used to make routing decisions; they restrict bandwidth and packet size; and they

can verify the gateway is available. There are two main differences between PPPoE/PPTP/L2TP

interfaces and other interfaces.

• You must also configure an ISP account object for the PPPoE/PPTP/L2TP interface to use.

Each ISP account specifies the protocol (PPPoE or PPTP or L2TP), as well as your ISP account

information. If you change ISPs later, you only have to create a new ISP account, not a new PPPoE/

PPTP/L2TP interface. You should not have to change any network policies.

• You do not set up the subnet mask or gateway.

PPPoE/PPTP/L2TP interfaces are interfaces between the Zyxel Device and only one computer.

Therefore, the subnet mask is always 255.255.255.255. In addition, the Zyxel Device always treats the

ISP as a gateway.

9.5.1 PPP Interface Summary

This screen lists every PPPoE/PPTP/L2TP interface. To access this screen, click Configuration > Network >

Interface > PPP.

Figure 188 Configuration > Network > Interface > PPP

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

248

Each field is described in the table below.

9.5.2 PPP Interface Add or Edit

Note: You have to set up an ISP account before you create a PPPoE/PPTP/L2TP interface.

This screen lets you configure a PPPoE or PPTP or L2TP interface. If you enabled IPv6 on the Configuration

> System > IPv6 screen, you can also configure PPP interfaces used for your IPv6 networks on this screen.

To access this screen, click the Add icon or an Edit icon on the PPP Interface screen.

Table 103 Configuration > Network > Interface > PPP

LABEL DESCRIPTION

User Configuration /

System Default

The Zyxel Device comes with the (non-removable) System Default PPP interfaces pre-

configured. You can create (and delete) User Configuration PPP interfaces. System Default

PPP interfaces vary by model.

Add Click this to create a new user-configured PPP interface.

Edit Double-click an entry or select it and click Edit to open a screen where you can modify the

entry’s settings.

Remove To remove a user-configured PPP interface, select it and click Remove. The Zyxel Device

confirms you want to remove it before doing so.

Activate To turn on an entry, select it and click Activate.

Inactivate To turn off an entry, select it and click Inactivate.

Connect To connect an interface, select it and click Connect. You might use this in testing the

interface or to manually establish the connection for a Dial-on-Demand PPPoE/PPTP

interface.

Disconnect To disconnect an interface, select it and click Disconnect. You might use this in testing the

interface.

References Select an entry and click References to open a screen that shows which settings use the

entry. See Section 9.4.4 on page 243 for an example.

#This field is a sequential value, and it is not associated with any interface.

Status The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is

inactive.

The connect icon is lit when the interface is connected and dimmed when it is

disconnected.

Name This field displays the name of the interface.

Description This field displays the description of the interface.

Base Interface This field displays the interface on the top of which the PPPoE/PPTP/L2TP interface is.

Account Profile This field displays the ISP account used by this PPPoE/PPTP interface.

Apply Click Apply to save your changes back to the Zyxel Device.

Reset Click Reset to return the screen to its last-saved settings.

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

249

Figure 189 Configuration > Network > Interface > PPP > Add

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

250

Each field is explained in the following table.

Table 104 Configuration > Network > Interface > PPP > Add

LABEL DESCRIPTION

IPv4/IPv6 View / IPv4

View / IPv6 View

Use this button to display both IPv4 and IPv6, IPv4-only, or IPv6-only configuration fields.

Show Advanced

Settings / Hide

Advanced Settings

Click this button to display a greater or lesser number of configuration fields.

Create New Object Click this button to create an ISP Account or a DHCPv6 request object that you may use for

the ISP or DHCPv6 settings in this screen.

General Settings

Enable Interface Select this to enable this interface. Clear this to disable this interface.

General IPv6 Setting

Enable IPv6 Select this to enable IPv6 on this interface. Otherwise, clear this to disable it.

Interface Properties

Interface Name Specify a name for the interface. It can use alphanumeric characters, hyphens, and

underscores, and it can be up to 11 characters long.

Base Interface Select the interface upon which this PPP interface is built.

Note: Multiple PPP interfaces can use the same base interface.

Zone Select the zone to which this PPP interface belongs. The zone determines the security

settings the Zyxel Device uses for the interface.

Description Enter a description of this interface. You can use alphanumeric and ()+/:=?!*#@$_%-

characters, and it can be up to 60 characters long. Spaces are allowed, but the string

can’t start with a space.

Connectivity

Nailed-Up Select this if the PPPoE/PPTP/L2TP connection should always be up. Clear this to have the

Zyxel Device establish the PPPoE/PPTP/L2TP connection only when there is traffic. You might

use this option if a lot of traffic needs to go through the interface or it does not cost extra to

keep the connection up all the time.

Dial-on-Demand Select this to have the Zyxel Device establish the PPPoE/PPTP/L2TP connection only when

there is traffic. You might use this option if there is little traffic through the interface or if it

costs money to keep the connection available.

ISP Setting

Account Profile Select the ISP account that this PPPoE/PPTP/L2TP interface uses. The drop-down box lists ISP

accounts by name. Use Create new Object if you need to configure a new ISP account

(see Chapter 39 on page 758 for details).

Protocol This field is read-only. It displays the protocol specified in the ISP account.

User Name This field is read-only. It displays the user name for the ISP account.

Service Name This field is read-only. It displays the PPPoE service name specified in the ISP account. This

field is blank if the ISP account uses PPTP.

IP Address

Assignment

Click Show Advanced Settings to display more settings. Click Hide Advanced Settings to

display fewer settings.

Get

Automatically Select this if this interface is a DHCP client. In this case, the DHCP server configures the IP

address automatically. The subnet mask and gateway are always defined automatically in

PPPoE/PPTP/L2TP interfaces.

Use Fixed IP

Address Select this if you want to specify the IP address manually.

IP Address This field is enabled if you select Use Fixed IP Address.

Enter the IP address for this interface.

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

251

Gateway This field is enabled if you select Use Fixed IP Address.

Enter the IP address of the gateway. The Zyxel Device sends packets to the gateway when

it does not know how to route the packet to its destination. The gateway should be on the

same network as the interface.

Metric Enter the priority of the gateway (the ISP) on this interface. The Zyxel Device decides which

gateway to use based on this priority. The lower the number, the higher the priority. If two or

more gateways have the same priority, the Zyxel Device uses the one that was configured

first.

IPv6 Address

Assignment

These IP address fields configure an IPv6 IP address on the interface itself.

Enable Stateless

Address Auto-

configuration

(SLAAC)

Select this to enable IPv6 stateless auto-configuration on this interface. The interface will

generate an IPv6 IP address itself from a prefix obtained from an IPv6 router on the network.

Metric Enter the priority of the gateway (if any) on this interface. The Zyxel Device decides which

gateway to use based on this priority. The lower the number, the higher the priority. If two or

more gateways have the same priority, the Zyxel Device uses the one that was configured

first.

Address from

DHCPv6 Prefix

Delegation

Use this table to have the Zyxel Device obtain an IPv6 prefix from the ISP or a connected

uplink router for an internal network, such as the LAN or DMZ. You have to also enter a suffix

address which is appended to the delegated prefix to form an address for this interface.

See Prefix Delegation on page 220 for more information.

To use prefix delegation, you must:

• Create at least one DHCPv6 request object before configuring this table.

• The external interface must be a DHCPv6 client. You must configure the DHCPv6

request options using a DHCPv6 request object with the type of prefix-delegation.

• Assign the prefix delegation to an internal interface and enable router advertisement

on that interface.

Add Click this to create an entry.

Edit Select an entry and click this to change the settings.

Remove Select an entry and click this to delete it from this table.

References Select an entry and click References to open a screen that shows which settings use the

entry.

# This field is a sequential value, and it is not associated with any entry.

Delegated

Prefix Select the DHCPv6 request object to use from the drop-down list.

Suffix

Address Enter the ending part of the IPv6 address, a slash (/), and the prefix length. The Zyxel Device

will append it to the delegated prefix.

For example, you got a delegated prefix of 2003:1234:5678/48. You want to configure an IP

address of 2003:1234:5678:1111::1/128 for this interface, then enter ::1111:0:0:0:1/128 in this

field.

Address This field displays the combined IPv6 IP address for this interface.

Note: This field displays the combined address after you click OK and reopen this

screen.

DHCPv6 Setting

DHCPv6 Select Client to obtain an IP address and DNS information from the service provider for the

interface. Otherwise, select N/A to disable the function.

DUID This field displays the DHCP Unique IDentifier (DUID) of the interface, which is unique and

used for identification purposes when the interface is exchanging DHCPv6 messages with

others. See DHCPv6 on page 221 for more information.

Table 104 Configuration > Network > Interface > PPP > Add (continued)

LABEL DESCRIPTION

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

252

DUID as MAC Select this if you want the DUID is generated from the interface’s default MAC address.

Customized DUID If you want to use a customized DUID, enter it here for the interface.

Enable Rapid

Commit Select this to shorten the DHCPv6 message exchange process from four to two steps. This

function helps reduce heavy network traffic load.

Note: Make sure you also enable this option in the DHCPv6 clients to make rapid

commit work.

Request Address Select this to get an IPv6 IP address for this interface from the DHCP server. Clear this to not

get any IP address information through DHCPv6.

DHCPv6 Request

Options Use this section to configure DHCPv6 request settings that determine what additional

information to get from the DHCPv6 server.

Add Click this to create an entry in this table. See Section 9.4.6 on page 245 for more

information.

Remove Select an entry and click this to delete it from this table.

References Select an entry and click References to open a screen that shows which settings use the

entry. See Section 9.4.4 on page 243 for an example.

Name This field displays the name of the DHCPv6 request object.

Type This field displays the type of the object.

Value This field displays the IPv6 prefix that the Zyxel Device will advertise to its clients.

Interface Parameters

Egress Bandwidth Enter the maximum amount of traffic, in kilobits per second, the Zyxel Device can send

through the interface to the network. Allowed values are 0 - 1048576.

Ingress

Bandwidth This is reserved for future use.

Enter the maximum amount of traffic, in kilobits per second, the Zyxel Device can receive

from the network through the interface. Allowed values are 0 - 1048576.

MTU Maximum Transmission Unit. Type the maximum size of each data packet, in bytes, that can

move through this interface. If a larger packet arrives, the Zyxel Device divides it into smaller

fragments. Allowed values are 576 - 1492. Usually, this value is 1492.

Connectivity Check The interface can regularly check the connection to the gateway you specified to make

sure it is still available. You specify how often the interface checks the connection, how

long to wait for a response before the attempt is a failure, and how many consecutive

failures are required before the Zyxel Device stops routing to the gateway. The Zyxel Device

resumes routing to the gateway the first time the gateway passes the connectivity check.

Enable

Connectivity

Check

Select this to turn on the connection check.

Check Method Select the method that the gateway allows.

Select icmp to have the Zyxel Device regularly ping the gateway you specify to make sure

it is still available.

Select tcp to have the Zyxel Device regularly perform a TCP handshake with the gateway

you specify to make sure it is still available.

Check Period Enter the number of seconds between connection check attempts.

Check Timeout Enter the number of seconds to wait for a response before the attempt is a failure.

Check Fail

Tolerance Enter the number of consecutive failures before the Zyxel Device stops routing through the

gateway.

Check Default

Gateway Select this to use the default gateway for the connectivity check.

Table 104 Configuration > Network > Interface > PPP > Add (continued)

LABEL DESCRIPTION

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

253

9.6 Cellular Configuration Screen

Mobile broadband is a digital, packet-switched wireless technology. Bandwidth usage is optimized as

multiple users share the same channel and bandwidth is only allocated to users when they send data. It

allows fast transfer of voice and non-voice data and provides broadband Internet access to mobile

devices.

Note: The actual data rate you obtain varies depending on the mobile broadband device

you use, the signal strength to the service provider’s base station, and so on.

You can configure how the Zyxel Device’s mobile broadband device connects to a network (refer to

Section 9.6.1 on page 256):

• You can set the mobile broadband device to connect only to the home network, which is the

network to which you are originally subscribed.

• You can set the mobile broadband device to connect to other networks if the signal strength of the

home network is too low or it is unavailable.

3G (Third Generation) is a digital, packet-switched wireless technology. Bandwidth usage is optimized as

multiple users share the same channel and bandwidth is only allocated to users when they send data. It

allows fast transfer of voice and non-voice data and provides broadband Internet access to mobile

devices.

4G is the fourth generation of the mobile telecommunications technology and a successor of 3G. Both

the WiMAX and Long Term Evolution (LTE) standards are the 4G candidate systems. 4G only supports all-

IP-based packet-switched telephony services and is required to offer Gigabit speed access.

Note: The actual data rate you obtain varies depending on your mobile environment. The

environmental factors may include the number of mobile devices which are currently

connected to the mobile network, the signal strength to the mobile network, and so on.

Check this

address Select this to specify a domain name or IP address for the connectivity check. Enter that

domain name or IP address in the field next to it.

Check Port This field only displays when you set the Check Method to tcp. Specify the port number to

use for a TCP connectivity check.

Related Setting

Configure WAN

TRUNK Click WAN TRUNK to go to a screen where you can configure the interface as part of a

WAN trunk for load balancing.

Policy Route Click Policy Route to go to the screen where you can manually configure a policy route to

associate traffic with this interface.

OK Click OK to save your changes back to the Zyxel Device.

Cancel Click Cancel to exit this screen without saving.

Table 104 Configuration > Network > Interface > PPP > Add (continued)

LABEL DESCRIPTION

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

254

See the following table for a comparison between 2G, 2.5G, 2.75G, 3G and 4G wireless technologies.

To change your mobile broadband WAN settings, click Configuration > Network > Interface > Cellular.

Note: Install (or connect) a compatible mobile broadband USB device to use a cellular

connection.

Note: The WAN IP addresses of a Zyxel Device with multiple WAN interfaces must be on

different subnets.

Table 105 2G, 2.5G, 2.75G, 3G, 3.5G and 4G Wireless Technologies

NAME TYPE MOBILE PHONE AND DATA STANDARDS DATA

SPEED

GSM-BASED CDMA-BASED

2G Circuit-

switched

GSM (Global System for Mobile

Communications), Personal Handy-

phone System (PHS), etc.

Interim Standard 95 (IS-95), the first CDMA-based

digital cellular standard pioneered by Qualcomm.

The brand name for IS-95 is cdmaOne. IS-95 is also

known as TIA-EIA-95.

Slow

Fast

2.5G Packet-

switched

GPRS (General Packet Radio Services),

High-Speed Circuit-Switched Data

(HSCSD), etc.

CDMA2000 is a hybrid 2.5G / 3G protocol of mobile

telecommunications standards that use CDMA, a

multiple access scheme for digital radio.

CDMA2000 1xRTT (1 times Radio Transmission

Technology) is the core CDMA2000 wireless air

interface standard. It is also known as 1x, 1xRTT, or IS-

2000 and considered to be a 2.5G or 2.75G

technology.

2.75G Packet-

switched

Enhanced Data rates for GSM Evolution

(EDGE), Enhanced GPRS (EGPRS), etc.

3G Packet-

switched

UMTS (Universal Mobile

Telecommunications System), a third-

generation (3G) wireless standard

defined in ITU specification, is sometimes

marketed as 3GSM. The UMTS uses GSM

infrastructures and W-CDMA (Wideband

Code Division Multiple Access) as the air

interface. The International

Telecommunication Union (ITU) is an

international organization within which

governments and the private sector

coordinate global telecom networks

and services.

CDMA2000 EV-DO (Evolution-Data Optimized,

originally 1x Evolution-Data Only), also referred to as

EV-DO, EVDO, or just EV, is an evolution of

CDMA2000 1xRTT and enables high-speed wireless

connectivity. It is also denoted as IS-856 or High

Data Rate (HDR).

3.5G Packet-

switched

HSDPA (High-Speed Downlink Packet

Access) is a mobile telephony protocol,

used for UMTS-based 3G networks and

allows for higher data transfer speeds.

4G/LTE Packet-

switched

The LTE (Long Term Evolution) standard is

based on the GSM and UMTS network

technologies.

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

255

Figure 190 Configuration > Network > Interface > Cellular

The following table describes the labels in this screen.

Table 106 Configuration > Network > Interface > Cellular

LABEL DESCRIPTION

Add Click this to create a new cellular interface.

Edit Double-click an entry or select it and click Edit to open a screen where you can modify the

entry’s settings.

Remove To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove

it before doing so.

Activate To turn on an entry, select it and click Activate.

Inactivate To turn off an entry, select it and click Inactivate.

Connect To connect an interface, select it and click Connect. You might use this in testing the interface

or to manually establish the connection.

Disconnect To disconnect an interface, select it and click Disconnect. You might use this in testing the

interface.

References Select an entry and click References to open a screen that shows which settings use the entry.

See Section 9.4.4 on page 243 for an example.

#This field is a sequential value, and it is not associated with any interface.

Status The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is

inactive.

The connect icon is lit when the interface is connected and dimmed when it is disconnected.

Name This field displays the name of the interface.

Description This field displays the description of the interface.

Extension Slot This field displays where the entry’s cellular card is located.

Connected

Device

This field displays the name of the cellular card.

ISP Settings This field displays the profile of ISP settings that this cellular interface is set to use.

Mobile

Broadband

Dongle Support

You should have registered your Zyxel Device at myZyxel. myZyxel hosts a list of supported

mobile broadband dongle devices. You should have an Internet connection to access this

website.

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

256

9.6.1 Cellular Choose Slot

To change your mobile broadband settings, click Configuration > Network > Interface > Cellular > Add

(or Edit). In the pop-up window that displays, select the slot that contains the mobile broadband device,

then the Add Cellular configuration screen displays.

9.6.2 Add / Edit Cellular Configuration

This screen displays after you select the slot that contains the mobile broadband device in the previous

pop-up window.

Latest Version This displays the latest supported mobile broadband dongle list version number.

Current

Version This displays the currently supported (by the Zyxel Device) mobile broadband dongle list

version number.

Update Now If the latest version number is greater than the current version number, then click this button to

download the latest list of supported mobile broadband dongle devices to the Zyxel Device.

Apply Click Apply to save your changes back to the Zyxel Device.

Reset Click Reset to return the screen to its last-saved settings.

Table 106 Configuration > Network > Interface > Cellular (continued)

LABEL DESCRIPTION

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

257

Figure 191 Configuration > Network > Interface > Cellular > Add / Edit

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

258

The following table describes the labels in this screen.

Table 107 Configuration > Network > Interface > Cellular > Add / Edit

LABEL DESCRIPTION

Show Advanced

Settings / Hide

Advanced Settings

Click this button to display a greater or lesser number of configuration fields.

General Settings

Enable Interface Select this option to turn on this interface.

Interface Properties

Interface Name Select a name for the interface.

Zone Select the zone to which you want the cellular interface to belong. The zone determines

the security settings the Zyxel Device uses for the interface.

Extension Slot This is the USB slot that you are configuring for use with a mobile broadband card.

Connected

Device This displays the manufacturer and model name of your mobile broadband card if you

inserted one in the Zyxel Device. Otherwise, it displays none.

Description Enter a description of this interface. You can use alphanumeric and ()+/:=?!*#@$_%-

characters, and it can be up to 60 characters long. Spaces are allowed, but the string

can’t start with a space.

Connectivity

Nailed-Up Select this if the connection should always be up. Clear this to have the Zyxel Device to

establish the connection only when there is traffic. You might not nail up the connection if

there is little traffic through the interface or if it costs money to keep the connection

available.

Idle timeout This value specifies the time in seconds (0~360) that elapses before the Zyxel Device

automatically disconnects from the ISP’s server. Zero disables the idle timeout.

ISP Settings

Profile Selection Select Device to use one of the mobile broadband device’s profiles of device settings.

Then select the profile (use Profile 1 unless your ISP instructed you to do otherwise).

Select Custom to configure your device settings yourself.

APN This field is read-only if you selected Device in the profile selection. Select Custom in the

profile selection to be able to manually input the APN (Access Point Name) provided by

your service provider. This field applies with a GSM or HSDPA mobile broadband card. Enter

the APN from your service provider. Connections with different APNs may provide different

services (such as Internet access or MMS (Multi-Media Messaging Service)) and charge

method.

You can enter up to 63 ASCII printable characters. Spaces are allowed.

Dial String Enter the dial string if your ISP provides a string, which would include the APN, to initialize the

mobile broadband card.

You can enter up to 63 ASCII printable characters. Spaces are allowed.

This field is available only when you insert a GSM mobile broadband card.

Authentication

Type The Zyxel Device supports PAP (Password Authentication Protocol) and CHAP (Challenge

Handshake Authentication Protocol). CHAP is more secure than PAP; however, PAP is

readily available on more platforms.

Use the drop-down list box to select an authentication protocol for outgoing calls. Options

are:

None: No authentication for outgoing calls.

CHAP - Your Zyxel Device accepts CHAP requests only.

PAP - Your Zyxel Device accepts PAP requests only.

Chapter 9 Interfaces

ZyWALL USG FLEX Series User’s Guide

259

User Name This field displays when you select an authentication type other than None. This field is read-

only if you selected Device in the profile selection. If this field is configurable, enter the user

name for this mobile broadband card exactly as the service provider gave it to you.

You can use 1 ~ 64 alphanumeric and #:%-_@$./ characters. The first character must be

alphanumeric or -_@$./. Spaces are not allowed.

Password This field displays when you select an authentication type other than None. This field is read-

only if you selected Device in the profile selection and the password is included in the

mobile broadband card’s profile. If this field is configurable, enter the password for this SIM

card exactly as the service provider gave it to you.

You can use 0 ~ 63 alphanumeric and `~!@#$%^&*()_-+={}|;:'<,>./ characters.

Spaces are not allowed.

Retype to

Confirm This field displays when you select an authentication type other than None. This field is read-

only if you selected Device in the profile selection and the password is included in the

mobile broadband card’s profile. If this field is configurable, re-enter the password for this

SIM card exactly as the service provider gave it to you.

SIM Card Setting

PIN Code This field displays with a GSM or HSDPA mobile broadband card. A PIN (Personal

Identification Number) code is a key to a mobile broadband card. Without the PIN code,

you cannot use the mobile broadband card.

Enter the 4-digit PIN code (0000 for example) provided by your ISP. If you enter the PIN

code incorrectly, the mobile broadband card may be blocked by your ISP and you cannot

use the account to access the Internet.

If your ISP disabled PIN code authentication, enter an arbitrary number.

Retype to

Confirm Type the PIN code again to confirm it.

Interface Parameters

Egress Bandwidth Enter the maximum amount of traffic, in kilobits per second, the Zyxel Device can send

through the interface to the network. Allowed values are 0 - 1048576. This setting is used in

WAN load balancing and bandwidth management.