Zyxel USG2200-VPN User Manual

Displayed below is the user manual for USG2200-VPN by Zyxel which is a product in the Hardware Firewalls category. This manual has pages.

Related Manuals

Zyxel P-871M Manual

Zyxel GS-105B Manual

Zyxel 793H Manual

Zyxel USG-20 Manual

Zyxel ES1100-8P Manual

Zyxel XGS4700-48F Manual

Zyxel NWA3550-N Manual

Default Login Details

User’s Guide

USG/ZyWALL Series

LAN Port IP Address https://192.168.1.1

User Name admin

Password 1234

Version 4.25 Edition 1, 3/2017

IMPORTANT!

READ CAREFULLY BEFORE USE.

KEEP THIS GUIDE FOR FUTURE REFERENCE.

This is a User’s Guide for a series of products. Not all products support all firmware features.

Screenshots and graphics in this book may differ slightly from your product due to differences in

your product firmware or your computer operating system. Every effort has been made to ensure

that the information in this manual is accurate.

Related Documentation

•Quick Start Guide

The Quick Start Guide shows how to connect the Zyxel Device and access the Web Configurator

wizards. (See the wizard real time help for information on configuring each screen.) It also contains a

connection diagram and package contents list.

•CLI Reference Guide

The CLI Reference Guide explains how to use the Command-Line Interface (CLI) to configure the

Zyxel Device.

Note: It is recommended you use the Web Configurator to configure the Zyxel Device.

• Web Configurator Online Help

Click the help icon in any screen for help in configuring that screen and supplementary information.

•More Information

Go to support.zyxel.com to find other information on Zyxel Device.

USG/ZyWALL User’s Guide

Part I: User’s Guide..........................................................................................23

Chapter 1

Introduction ........................................................................................................................................24

1.1 Overview ......................................................................................................................................... 24

1.2 Registration at myZyxel.com ......................................................................................................... 25

1.2.1 Grace Period ......................................................................................................................... 26

1.2.2 Applications ........................................................................................................................... 26

1.3 Management Overview ................................................................................................................ 29

1.4 Web Configurator ........................................................................................................................... 30

1.4.1 Web Configurator Access .................................................................................................... 31

1.4.2 Web Configurator Screens Overview ................................................................................. 33

1.4.3 Navigation Panel .................................................................................................................. 37

1.4.4 Tables and Lists ...................................................................................................................... 44

Chapter 2

Initial Setup Wizard.............................................................................................................................47

2.1 Initial Setup Wizard Screens .......................................................................................................... 47

2.1.1 Internet Access Setup - WAN Interface ............................................................................. 48

2.1.2 Internet Access: Ethernet .................................................................................................... 49

2.1.3 Internet Access: PPPoE ......................................................................................................... 50

2.1.4 Internet Access: PPTP ........................................................................................................... 52

2.1.5 Internet Access: L2TP ............................................................................................................ 53

2.1.6 Internet Access Setup - Second WAN Interface ............................................................... 54

2.1.7 Internet Access: Finish .......................................................................................................... 55

2.1.8 Date and Time Settings ........................................................................................................ 55

2.1.9 Register Device ..................................................................................................................... 56

2.1.10 Activate Service .................................................................................................................. 57

2.1.11 Wireless Settings: AP Controller ......................................................................................... 59

2.1.12 Wireless Settings: SSID & Security ...................................................................................... 59

Chapter 3

Hardware, Interfaces and Zones......................................................................................................61

3.1 Hardware Overview ....................................................................................................................... 61

3.1.1 Front Panels ............................................................................................................................ 61

3.1.2 Rear Panels ............................................................................................................................ 65

3.2 Mounting ......................................................................................................................................... 67

3.2.1 Rack-mounting ...................................................................................................................... 67

3.2.2 USG2200-VPN Rack Mounting ............................................................................................. 68

3.2.3 Wall-mounting ....................................................................................................................... 71

3.3 Default Zones, Interfaces, and Ports ............................................................................................ 72

3.4 Stopping the Zyxel Device ............................................................................................................ 74

USG/ZyWALL User’s Guide

Chapter 4

Easy Mode..........................................................................................................................................75

4.1 Overview ........................................................................................................................................ 75

4.1.1 Wizards and Links .................................................................................................................. 75

4.1.2 Easy Mode Settings ............................................................................................................... 76

4.1.3 Easy Mode Dashboard ......................................................................................................... 77

4.2 Initial Setup Wizard - Language and Overview ........................................................................ 80

4.2.1 Initial Setup Wizard - Internet ........................................................................................... 81

4.2.2 Initial Setup Wizard - Internet Access Errors ..................................................................... 82

4.2.3 Initial Setup Wizard - Date and Time ................................................................................ 83

4.2.4 Initial Setup Wizard - Register Device .............................................................................. 84

4.2.5 Initial Setup Wizard - Activate Services ............................................................................ 85

4.2.6 Initial Setup Wizard - Wi-Fi .................................................................................................. 87

4.2.7 Initial Setup Wizard - Congratulations .............................................................................. 88

4.3 Initial Setup Wizard - Security Service ....................................................................................... 89

4.4 Initial Setup Wizard - Port Forwarding ......................................................................................... 91

4.5 Initial Setup Wizard - Guest LAN ................................................................................................. 92

4.5.1 Connecting AP Scenarios .................................................................................................... 94

4.6 Initial Setup Wizard - VPN ............................................................................................................. 96

4.6.1 VPN Setup Wizard: Wizard Type ........................................................................................ 97

4.6.2 VPN Express Wizard - Scenario ........................................................................................... 97

4.6.3 VPN Express Wizard - Configuration .................................................................................. 99

4.6.4 VPN Express Wizard - Summary .......................................................................................... 99

4.6.5 VPN Express Wizard - Finish ............................................................................................... 100

4.6.6 VPN Advanced Wizard - Scenario .................................................................................. 101

4.6.7 VPN Advanced Wizard - Phase 1 Settings ..................................................................... 102

4.6.8 VPN Advanced Wizard - Phase 2 .................................................................................... 104

4.6.9 VPN Advanced Wizard - Summary ................................................................................. 105

4.6.10 VPN Advanced Wizard - Finish ...................................................................................... 106

4.7 VPN Settings for Configuration Provisioning Wizard: Wizard Type ......................................... 106

4.7.1 Configuration Provisioning Express Wizard - VPN Settings ............................................ 107

4.7.2 Configuration Provisioning VPN Express Wizard - Configuration ................................. 108

4.7.3 VPN Settings for Configuration Provisioning Express Wizard - Summary ..................... 109

4.7.4 VPN Settings for Configuration Provisioning Express Wizard - Finish .............................. 110

4.7.5 VPN Settings for Configuration Provisioning Advanced Wizard - Scenario ................ 111

4.7.6 VPN Settings for Configuration Provisioning Advanced Wizard - Phase 1 Settings .... 112

4.7.7 VPN Settings for Configuration Provisioning Advanced Wizard - Phase 2 ................. 113

4.7.8 VPN Settings for Configuration Provisioning Advanced Wizard - Summary ............... 114

4.7.9 VPN Settings for Configuration Provisioning Advanced Wizard- Finish ....................... 116

4.8 VPN Settings for L2TP VPN Settings Wizard ............................................................................... 117

4.8.1 L2TP VPN Settings 1 ............................................................................................................. 118

4.8.2 L2TP VPN Settings 2 ............................................................................................................ 119

4.8.3 VPN Settings for L2TP VPN Setting Wizard - Summary ................................................... 120

USG/ZyWALL User’s Guide

4.8.4 VPN Settings for L2TP VPN Setting Wizard Completed .................................................. 121

4.9 Port Forwarding ........................................................................................................................... 122

4.9.1 Port Forwarding > Add Client .......................................................................................... 123

4.9.2 Port Forwarding > Add Service ........................................................................................ 123

4.9.3 Port Forwarding > UPnP .................................................................................................... 123

4.10 Wi-Fi and Guest Network Wizard ........................................................................................... 125

4.10.1 Guest LAN (Wired Network) ........................................................................................... 126

4.10.2 Connecting AP Scenarios ................................................................................................ 127

4.11 Security Service Wizard .......................................................................................................... 128

4.11.1 Security Service Wizard 2 - Content Filter Categories ............................................... 130

4.11.2 Security Service Wizard 3 - Websites ........................................................................... 132

4.11.3 Security Service Wizard 4 - Exemptions ...................................................................... 133

4.11.4 Security Service Wizard 5 - IDP/AV .............................................................................. 134

4.12 MyZyxel Portal ......................................................................................................................... 135

4.13 One Security Portal ................................................................................................................. 136

Chapter 5

Quick Setup Wizards........................................................................................................................138

5.1 Quick Setup Overview ................................................................................................................. 138

5.2 WAN Interface Quick Setup ........................................................................................................ 139

5.2.1 Choose an Ethernet Interface ........................................................................................... 139

5.2.2 Select WAN Type ................................................................................................................. 140

5.2.3 Configure WAN IP Settings ................................................................................................. 140

5.2.4 ISP and WAN and ISP Connection Settings ...................................................................... 141

5.2.5 Quick Setup Interface Wizard: Summary ......................................................................... 144

5.3 VPN Setup Wizard ......................................................................................................................... 145

5.3.1 Welcome .............................................................................................................................. 145

5.3.2 VPN Setup Wizard: Wizard Type ........................................................................................ 146

5.3.3 VPN Express Wizard - Scenario .......................................................................................... 147

5.3.4 VPN Express Wizard - Configuration ................................................................................. 148

5.3.5 VPN Express Wizard - Summary ......................................................................................... 149

5.3.6 VPN Express Wizard - Finish ................................................................................................ 150

5.3.7 VPN Advanced Wizard - Scenario ................................................................................... 150

5.3.8 VPN Advanced Wizard - Phase 1 Settings ...................................................................... 152

5.3.9 VPN Advanced Wizard - Phase 2 ..................................................................................... 153

5.3.10 VPN Advanced Wizard - Summary ................................................................................ 154

5.3.11 VPN Advanced Wizard - Finish ....................................................................................... 154

5.4 VPN Settings for Configuration Provisioning Wizard: Wizard Type ........................................... 155

5.4.1 Configuration Provisioning Express Wizard - VPN Settings ............................................. 156

5.4.2 Configuration Provisioning VPN Express Wizard - Configuration .................................. 157

5.4.3 VPN Settings for Configuration Provisioning Express Wizard - Summary ...................... 158

5.4.4 VPN Settings for Configuration Provisioning Express Wizard - Finish .............................. 159

5.4.5 VPN Settings for Configuration Provisioning Advanced Wizard - Scenario ................. 160

USG/ZyWALL User’s Guide

5.4.6 VPN Settings for Configuration Provisioning Advanced Wizard - Phase 1 Settings .... 161

5.4.7 VPN Settings for Configuration Provisioning Advanced Wizard - Phase 2 .................. 162

5.4.8 VPN Settings for Configuration Provisioning Advanced Wizard - Summary ................ 163

5.4.9 VPN Settings for Configuration Provisioning Advanced Wizard- Finish ........................ 165

5.5 VPN Settings for L2TP VPN Settings Wizard ................................................................................. 166

5.5.1 L2TP VPN Settings ................................................................................................................ 167

5.5.2 L2TP VPN Settings ................................................................................................................ 168

5.5.3 VPN Settings for L2TP VPN Setting Wizard - Summary .................................................... 169

5.5.4 VPN Settings for L2TP VPN Setting Wizard Completed ................................................... 170

Chapter 6

Dashboard........................................................................................................................................171

6.1 Overview ....................................................................................................................................... 171

6.1.1 What You Can Do in this Chapter ..................................................................................... 171

6.2 Main Dashboard Screen .............................................................................................................. 171

6.2.1 Device Information Screen ................................................................................................173

6.2.2 System Status Screen .......................................................................................................... 174

6.2.3 VPN Status Screen ............................................................................................................... 175

6.2.4 DHCP Table Screen ............................................................................................................. 177

6.2.5 Number of Login Users Screen ........................................................................................... 178

6.2.6 System Resources Screen ................................................................................................... 178

6.2.7 CPU Usage Screen .............................................................................................................. 179

6.2.8 Memory Usage Screen ....................................................................................................... 180

6.2.9 Active Sessions Screen ....................................................................................................... 181

6.2.10 Extension Slot Screen ........................................................................................................ 182

6.2.11 Interface Status Summary Screen ................................................................................... 182

6.2.12 Secured Service Status Screen ........................................................................................ 184

6.2.13 Content Filter Statistics Screen ......................................................................................... 184

6.2.14 Top 5 Viruses Screen ......................................................................................................... 185

6.2.15 Top 5 Intrusions Screen ..................................................................................................... 186

6.2.16 Top 5 IPv4/IPv6 Security Policy Rules that Blocked Traffic Screen ............................... 186

6.2.17 The Latest Alert Logs Screen ............................................................................................187

Part II: Technical Reference.........................................................................188

Chapter 7

Monitor..............................................................................................................................................189

7.1 Overview ....................................................................................................................................... 189

7.1.1 What You Can Do in this Chapter ..................................................................................... 189

7.2 The Port Statistics Screen ............................................................................................................ 190

7.2.1 The Port Statistics Graph Screen ....................................................................................... 191

USG/ZyWALL User’s Guide

7.3 Interface Status Screen ................................................................................................................ 192

7.4 The Traffic Statistics Screen .......................................................................................................... 195

7.5 The Session Monitor Screen ........................................................................................................ 198

7.6 IGMP Statistics ............................................................................................................................... 199

7.7 The DDNS Status Screen ............................................................................................................... 200

7.8 IP/MAC Binding ............................................................................................................................. 201

7.9 The Login Users Screen ................................................................................................................ 201

7.10 The Dynamic Guest Screen ...................................................................................................... 202

7.11 Cellular Status Screen ................................................................................................................ 204

7.11.1 More Information .............................................................................................................. 206

7.12 The UPnP Port Status Screen ..................................................................................................... 207

7.13 USB Storage Screen .................................................................................................................... 208

7.14 Ethernet Neighbor Screen ........................................................................................................ 209

7.15 Wireless ........................................................................................................................................ 210

7.15.1 Wireless AP Information: AP List ....................................................................................... 210

7.15.2 AP List More Information ................................................................................................. 212

7.15.3 Config AP .......................................................................................................................... 214

7.15.4 Wireless AP Information: Radio List .................................................................................. 215

7.15.5 Radio List More Information .............................................................................................217

7.15.6 Wireless Station Info .......................................................................................................... 218

7.15.7 Detected Device ............................................................................................................. 219

7.16 The Printer Status Screen ........................................................................................................... 220

7.17 The IPSec Monitor Screen .......................................................................................................... 221

7.17.1 Regular Expressions in Searching IPSec SAs ................................................................... 222

7.18 The SSL Screen ............................................................................................................................. 222

7.19 The L2TP over IPSec Session Monitor Screen ............................................................................ 223

7.20 The App Patrol Screen ............................................................................................................... 223

7.21 The Content Filter Screen .......................................................................................................... 225

7.22 The IDP Screen ............................................................................................................................ 226

7.23 The Anti-Virus Screen .................................................................................................................. 228

7.24 The Anti-Spam Screens .............................................................................................................. 230

7.24.1 Anti-Spam Report .............................................................................................................. 230

7.24.2 The Anti-Spam Status Screen ........................................................................................... 232

7.25 The SSL Inspection Screens ........................................................................................................ 234

7.25.1 Certificate Cache List ....................................................................................................... 235

7.26 Log Screens ................................................................................................................................. 236

7.26.1 View Log ............................................................................................................................ 236

7.26.2 View AP Log ....................................................................................................................... 238

7.26.3 Dynamic Users Log ............................................................................................................ 240

Chapter 8

Licensing...........................................................................................................................................242

8.1 Registration Overview .................................................................................................................. 242

USG/ZyWALL User’s Guide

8.1.1 What you Need to Know ....................................................................................................242

8.1.2 Registration Screen ............................................................................................................. 242

8.1.3 Service Screen ..................................................................................................................... 243

8.2 Signature Update ......................................................................................................................... 245

8.2.1 What you Need to Know ....................................................................................................245

8.2.2 The Anti-Virus Update Screen ............................................................................................ 245

8.2.3 The IDP/AppPatrol Update Screen ................................................................................... 246

Chapter 9

Wireless .............................................................................................................................................249

9.1 Overview ....................................................................................................................................... 249

9.1.1 What You Can Do in this Chapter ..................................................................................... 249

9.2 Controller Screen ......................................................................................................................... 249

9.3 AP Management Screens ........................................................................................................... 250

9.3.1 Mgnt. AP List ....................................................................................................................... 250

9.3.2 AP Policy .............................................................................................................................. 254

9.3.3 AP Group ............................................................................................................................. 255

9.3.4 Firmware ............................................................................................................................... 259

9.4 MON Mode ................................................................................................................................... 261

9.4.1 Add/Edit Rogue/Friendly List .............................................................................................. 262

9.5 Auto Healing ................................................................................................................................. 263

9.6 RTLS Overview ............................................................................................................................... 264

9.6.1 What You Can Do in this Chapter ..................................................................................... 265

9.6.2 Before You Begin ................................................................................................................. 265

9.6.3 Configuring RTLS .................................................................................................................. 265

9.7 Technical Reference .................................................................................................................... 266

9.7.1 Dynamic Channel Selection .............................................................................................. 266

9.7.2 Load Balancing ................................................................................................................... 267

Chapter 10

Interfaces..........................................................................................................................................269

10.1 Interface Overview .................................................................................................................... 269

10.1.1 What You Can Do in this Chapter ................................................................................... 269

10.1.2 What You Need to Know ................................................................................................. 270

10.1.3 What You Need to Do First ...............................................................................................274

10.2 Port Role ....................................................................................................................................... 274

10.3 Port Group ................................................................................................................................... 275

10.4 Ethernet Summary Screen ......................................................................................................... 276

10.4.1 Ethernet Edit ...................................................................................................................... 278

10.4.2 Virtual Interfaces .............................................................................................................. 293

10.4.3 Virtual Interfaces Add/Edit ............................................................................................... 293

10.4.4 Object References ............................................................................................................ 294

10.4.5 Add/Edit DHCPv6 Request/Release Options ................................................................. 295

USG/ZyWALL User’s Guide

10.4.6 Add/Edit DHCP Extended Options ................................................................................. 295

10.5 PPP Interfaces ............................................................................................................................. 297

10.5.1 PPP Interface Summary .................................................................................................... 298

10.5.2 PPP Interface Add or Edit ................................................................................................ 299

10.6 Cellular Configuration Screen ................................................................................................... 304

10.6.1 Cellular Choose Slot ......................................................................................................... 307

10.6.2 Add / Edit Cellular Configuration .................................................................................... 307

10.7 Tunnel Interfaces ........................................................................................................................ 313

10.7.1 Configuring a Tunnel ........................................................................................................ 315

10.7.2 Tunnel Add or Edit Screen ................................................................................................ 316

10.8 VLAN Interfaces ......................................................................................................................... 319

10.8.1 VLAN Summary Screen .....................................................................................................321

10.8.2 VLAN Add/Edit ................................................................................................................. 322

10.9 Bridge Interfaces ........................................................................................................................ 333

10.9.1 Bridge Summary ................................................................................................................ 334

10.9.2 Bridge Add/Edit ................................................................................................................ 336

10.10 LAG ............................................................................................................................................ 344

10.10.1 LAG Summary Screen .....................................................................................................345

10.10.2 LAG Add/Edit ................................................................................................................. 346

10.11 VTI ............................................................................................................................................... 352

10.11.1 Restrictions for IPSec Virtual Tunnel Interface .............................................................. 352

10.11.2 VTI Screen ........................................................................................................................ 352

10.11.3 VTI Add/Edit ..................................................................................................................... 353

10.12 Trunk Overview ......................................................................................................................... 355

10.12.1 What You Need to Know ............................................................................................... 356

10.13 The Trunk Summary Screen ...................................................................................................... 358

10.13.1 Configuring a User-Defined Trunk ................................................................................. 360

10.13.2 Configuring the System Default Trunk .......................................................................... 362

10.14 Interface Technical Reference ............................................................................................... 363

Chapter 11

Routing..............................................................................................................................................367

11.1 Policy and Static Routes Overview ........................................................................................... 367

11.1.1 What You Can Do in this Chapter ................................................................................... 367

11.1.2 What You Need to Know ................................................................................................ 368

11.2 Policy Route Screen ................................................................................................................... 369

11.2.1 Policy Route Edit Screen .................................................................................................. 371

11.3 IP Static Route Screen ................................................................................................................ 376

11.3.1 Static Route Add/Edit Screen .......................................................................................... 376

11.4 Policy Routing Technical Reference ........................................................................................378

11.5 Routing Protocols Overview ..................................................................................................... 378

11.5.1 What You Need to Know ................................................................................................. 379

11.6 The RIP Screen ............................................................................................................................. 379

USG/ZyWALL User’s Guide

11.7 The OSPF Screen ......................................................................................................................... 381

11.7.1 Configuring the OSPF Screen .......................................................................................... 384

11.7.2 OSPF Area Add/Edit Screen ........................................................................................... 385

11.7.3 Virtual Link Add/Edit Screen ...........................................................................................387

11.8 Routing Protocol Technical Reference .................................................................................... 388

Chapter 12

DDNS ...............................................................................................................................................389

12.1 DDNS Overview ........................................................................................................................... 389

12.1.1 What You Can Do in this Chapter ................................................................................... 389

12.1.2 What You Need to Know ................................................................................................. 389

12.2 The DDNS Screen ........................................................................................................................ 390

12.2.1 The Dynamic DNS Add/Edit Screen ................................................................................ 391

Chapter 13

NAT ....................................................................................................................................................395

13.1 NAT Overview ............................................................................................................................. 395

13.1.1 What You Can Do in this Chapter ................................................................................... 395

13.1.2 What You Need to Know ................................................................................................. 395

13.2 The NAT Screen ........................................................................................................................... 395

13.2.1 The NAT Add/Edit Screen .................................................................................................397

13.3 NAT Technical Reference .......................................................................................................... 400

Chapter 14

Redirect Service...............................................................................................................................402

14.1 Overview ..................................................................................................................................... 402

14.1.1 HTTP Redirect ..................................................................................................................... 402

14.1.2 SMTP Redirect .................................................................................................................... 402

14.1.3 What You Can Do in this Chapter ................................................................................... 403

14.1.4 What You Need to Know ................................................................................................. 403

14.2 The Redirect Service Screen ..................................................................................................... 405

14.2.1 The Redirect Service Edit Screen ..................................................................................... 406

Chapter 15

ALG....................................................................................................................................................408

15.1 ALG Overview ............................................................................................................................. 408

15.1.1 What You Need to Know ................................................................................................. 408

15.1.2 Before You Begin ............................................................................................................... 411

15.2 The ALG Screen .......................................................................................................................... 411

15.3 ALG Technical Reference ......................................................................................................... 414

Chapter 16

UPnP...................................................................................................................................................416

USG/ZyWALL User’s Guide

16.1 UPnP and NAT-PMP Overview ................................................................................................... 416

16.2 What You Need to Know ........................................................................................................... 416

16.2.1 NAT Traversal ..................................................................................................................... 416

16.2.2 Cautions with UPnP and NAT-PMP .................................................................................. 417

16.3 UPnP Screen ................................................................................................................................ 417

16.4 Technical Reference .................................................................................................................. 418

16.4.1 Turning on UPnP in Windows 7 Example ......................................................................... 418

16.4.2 Using UPnP in Windows XP Example ................................................................................ 420

16.4.3 Web Configurator Easy Access ....................................................................................... 422

Chapter 17

IP/MAC Binding................................................................................................................................425

17.1 IP/MAC Binding Overview ......................................................................................................... 425

17.1.1 What You Can Do in this Chapter ................................................................................... 425

17.1.2 What You Need to Know ................................................................................................. 425

17.2 IP/MAC Binding Summary ......................................................................................................... 426

17.2.1 IP/MAC Binding Edit .......................................................................................................... 426

17.2.2 Static DHCP Edit ................................................................................................................ 427

17.3 IP/MAC Binding Exempt List ....................................................................................................... 428

Chapter 18

Layer 2 Isolation...............................................................................................................................430

18.1 Overview ..................................................................................................................................... 430

18.1.1 What You Can Do in this Chapter ................................................................................... 430

18.2 Layer-2 Isolation General Screen ............................................................................................. 430

18.3 White List Screen ......................................................................................................................... 431

18.3.1 Add/Edit White List Rule ................................................................................................... 432

Chapter 19

DNS Inbound LB................................................................................................................................434

19.1 DNS Inbound Load Balancing Overview ................................................................................. 434

19.1.1 What You Can Do in this Chapter ................................................................................... 434

19.2 The DNS Inbound LB Screen ...................................................................................................... 435

19.2.1 The DNS Inbound LB Add/Edit Screen ............................................................................ 436

19.2.2 The DNS Inbound LB Add/Edit Member Screen ............................................................ 438

Chapter 20

Web Authentication ........................................................................................................................440

20.1 Web Auth Overview ................................................................................................................... 440

20.1.1 What You Can Do in this Chapter ................................................................................... 440

20.1.2 What You Need to Know ................................................................................................. 441

20.2 Web Authentication General Screen ...................................................................................... 441

20.2.1 User-aware Access Control Example ............................................................................. 446

USG/ZyWALL User’s Guide

20.2.2 Authentication Type Screen ............................................................................................ 451

20.2.3 Custom Web Portal / User Agreement File Screen ....................................................... 455

20.3 SSO Overview .............................................................................................................................. 457

20.4 SSO - Zyxel Device Configuration ............................................................................................. 458

20.4.1 Configuration Overview ................................................................................................... 458

20.4.2 Configure the Zyxel Device to Communicate with SSO .............................................. 459

20.4.3 Enable Web Authentication ............................................................................................ 460

20.4.4 Create a Security Policy ................................................................................................... 461

20.4.5 Configure User Information ..............................................................................................461

20.4.6 Configure an Authentication Method ........................................................................... 462

20.4.7 Configure Active Directory ..............................................................................................463

20.5 SSO Agent Configuration .......................................................................................................... 464

Chapter 21

Hotspot..............................................................................................................................................468

21.1 Overview ..................................................................................................................................... 468

21.2 Billing Overview ........................................................................................................................... 468

21.2.1 What You Need to Know ................................................................................................. 468

21.3 The General Screen ................................................................................................................... 469

21.4 The Billing Profile Screen ............................................................................................................. 471

21.4.1 The Account Generator Screen ...................................................................................... 472

21.4.2 The Account Redeem Screen ......................................................................................... 475

21.4.3 The Billing Profile Add/Edit Screen ................................................................................... 477

21.5 The Discount Screen ................................................................................................................... 478

21.5.1 The Discount Add/Edit Screen ......................................................................................... 480

21.6 The Payment Service General Screen ..................................................................................... 480

21.6.1 The Payment Service Desktop View / Mobile View Screen ......................................... 482

Chapter 22

Printer Manager ...............................................................................................................................486

22.1 Printer Manager Overview ........................................................................................................ 486

22.1.1 What You Can Do in this Chapter ................................................................................... 486

22.2 The General Setting Screen ....................................................................................................... 486

22.2.1 Add Printer Rule ................................................................................................................. 489

22.2.2 Edit Printer Rule .................................................................................................................. 489

22.2.3 Discover Printer ................................................................................................................. 490

22.2.4 Edit Printer Manager (Discover Printer) .......................................................................... 491

22.3 The Printout Configuration Screen ............................................................................................ 492

22.4 Printer Reports Overview ........................................................................................................... 493

22.4.1 Key Combinations ............................................................................................................. 493

22.4.2 Daily Account Summary .................................................................................................. 494

22.4.3 Monthly Account Summary ............................................................................................. 494

22.4.4 Account Report Notes ..................................................................................................... 495

USG/ZyWALL User’s Guide

22.4.5 System Status ..................................................................................................................... 495

Chapter 23

Free Time...........................................................................................................................................497

23.1 Free Time Overview .................................................................................................................... 497

23.1.1 What You Can Do in this Chapter ................................................................................... 497

23.2 The Free Time Screen ................................................................................................................. 497

Chapter 24

SMS....................................................................................................................................................501

24.1 SMS Overview ........................................................................................................................... 501

24.1.1 What You Can Do in this Chapter ................................................................................... 501

24.2 The SMS Screen ........................................................................................................................... 501

Chapter 25

IPnP....................................................................................................................................................503

25.1 IPnP Overview ............................................................................................................................. 503

25.1.1 What You Can Do in this Chapter ................................................................................... 503

25.2 IPnP Screen .................................................................................................................................. 504

Chapter 26

Walled Garden... .... ................... .................. .... .................. .................. .... ................... ......................505

26.1 Walled Garden Overview ......................................................................................................... 505

26.2 General Screen ........................................................................................................................... 505

26.3 URL Base Screen ......................................................................................................................... 506

26.3.1 Adding/Editing a Walled Garden URL ........................................................................... 507

26.4 Domain/IP Base Screen ............................................................................................................. 508

26.4.1 Adding/Editing a Walled Garden Domain or IP ........................................................... 508

26.4.2 Walled Garden Login Example ....................................................................................... 509

Chapter 27

Advertisement Screen................. .... .................. .... .... .................. .... .................. .... .... ......................511

27.1 Advertisement Overview ........................................................................................................... 511

27.1.1 Adding/Editing an Advertisement URL .......................................................................... 512

Chapter 28

Security Policy..................................................................................................................................513

28.1 Overview ..................................................................................................................................... 513

28.2 One Security ................................................................................................................................ 514

28.3 What You Can Do in this Chapter ............................................................................................ 517

28.3.1 What You Need to Know ................................................................................................. 518

28.4 The Security Policy Screen ......................................................................................................... 519

28.4.1 Configuring the Security Policy Control Screen ............................................................ 520

USG/ZyWALL User’s Guide

28.4.2 The Security Policy Control Add/Edit Screen ................................................................. 523

28.5 Anomaly Detection and Prevention Overview ...................................................................... 525

28.5.1 The Anomaly Detection and Prevention General Screen ........................................... 526

28.5.2 Creating New ADP Profiles ..............................................................................................527

28.5.3 Traffic Anomaly Profiles ................................................................................................... 528

28.5.4 Protocol Anomaly Profiles ................................................................................................ 531

28.6 The Session Control Screen ........................................................................................................ 534

28.6.1 The Session Control Add/Edit Screen .............................................................................. 535

28.7 Security Policy Example Applications ......................................................................................536

Chapter 29

Cloud CNM.....................................................................................................................................539

29.1 Cloud CNM Overview ................................................................................................................ 539

29.1.1 What You Can Do in this Chapter ................................................................................... 539

29.2 Cloud CNM SecuManager ........................................................................................................ 539

29.3 Cloud CNM SecuReporter ......................................................................................................... 542

Chapter 30

IPSec VPN .........................................................................................................................................545

30.1 Virtual Private Networks (VPN) Overview ................................................................................. 545

30.1.1 What You Can Do in this Chapter ................................................................................... 547

30.1.2 What You Need to Know ................................................................................................. 547

30.1.3 Before You Begin ............................................................................................................... 550

30.2 The VPN Connection Screen ..................................................................................................... 550

30.2.1 The VPN Connection Add/Edit Screen .......................................................................... 552

30.3 The VPN Gateway Screen ......................................................................................................... 559

30.3.1 The VPN Gateway Add/Edit Screen ............................................................................... 560

30.4 VPN Concentrator ..................................................................................................................... 567

30.4.1 VPN Concentrator Requirements and Suggestions ...................................................... 567

30.4.2 VPN Concentrator Screen ............................................................................................... 568

30.4.3 The VPN Concentrator Add/Edit Screen ........................................................................ 568

30.5 Zyxel Device IPSec VPN Client Configuration Provisioning .................................................... 569

30.6 IPSec VPN Background Information ......................................................................................... 571

Chapter 31

SSL VPN..............................................................................................................................................581

31.1 Overview ..................................................................................................................................... 581

31.1.1 What You Can Do in this Chapter ................................................................................... 581

31.1.2 What You Need to Know ................................................................................................. 581

31.2 The SSL Access Privilege Screen ................................................................................................ 582

31.2.1 The SSL Access Privilege Policy Add/Edit Screen ......................................................... 583

31.3 The SSL Global Setting Screen ................................................................................................... 586

31.3.1 How to Upload a Custom Logo ...................................................................................... 587

USG/ZyWALL User’s Guide

31.4 Zyxel Device SecuExtender ....................................................................................................... 588

31.4.1 Example: Configure Zyxel Device for SecuExtender ..................................................... 589

Chapter 32

SSL User Screens............................................................................................................... ................592

32.1 Overview ..................................................................................................................................... 592

32.1.1 What You Need to Know ................................................................................................. 592

32.2 Remote SSL User Login ............................................................................................................... 593

32.3 The SSL VPN User Screens ........................................................................................................... 596

32.4 Bookmarking the Zyxel Device .................................................................................................. 597

32.5 Logging Out of the SSL VPN User Screens ................................................................................ 598

32.6 SSL User Application Screen ...................................................................................................... 598

32.7 SSL User File Sharing .................................................................................................................... 599

32.7.1 The Main File Sharing Screen ........................................................................................... 599

32.7.2 Opening a File or Folder ................................................................................................... 600

32.7.3 Downloading a File ........................................................................................................... 601

32.7.4 Saving a File ....................................................................................................................... 601

32.7.5 Creating a New Folder ..................................................................................................... 602

32.7.6 Renaming a File or Folder ................................................................................................ 602

32.7.7 Deleting a File or Folder .................................................................................................... 603

32.7.8 Uploading a File ................................................................................................................ 603

Chapter 33

Zyxel Device SecuExtender (Windows).........................................................................................605

33.1 The Zyxel Device SecuExtender Icon ....................................................................................... 605

33.2 Status ............................................................................................................................................ 605

33.3 View Log ...................................................................................................................................... 606

33.4 Suspend and Resume the Connection ................................................................................... 607

33.5 Stop the Connection ................................................................................................................. 607

33.6 Uninstalling the Zyxel Device SecuExtender ............................................................................ 607

Chapter 34

L2TP VPN...................... .................. .... .................. ................... ... ................... .....................................609

34.1 Overview ..................................................................................................................................... 609

34.1.1 What You Can Do in this Chapter ................................................................................... 609

34.1.2 What You Need to Know ................................................................................................. 609

34.2 L2TP VPN Screen ......................................................................................................................... 610

34.2.1 Example: L2TP and Zyxel Device Behind a NAT Router ................................................ 612

Chapter 35

BWM (Bandwidth Management) .................................................................................................614

35.1 Overview ..................................................................................................................................... 614

35.1.1 What You Can Do in this Chapter ................................................................................... 614

USG/ZyWALL User’s Guide

35.1.2 What You Need to Know ................................................................................................ 614

35.2 The Bandwidth Management Screen ...................................................................................... 618

35.2.1 The Bandwidth Management Add/Edit Screen ............................................................ 621

Chapter 36

Application Patrol ............................................................................................................................629

36.1 Overview ..................................................................................................................................... 629

36.1.1 What You Can Do in this Chapter ................................................................................... 629

36.1.2 What You Need to Know ................................................................................................ 629

36.2 Application Patrol Profile ........................................................................................................... 630

36.2.1 The Application Patrol Profile Add/Edit Screen ............................................................. 632

36.2.2 The Application Patrol Profile Rule Add Application Screen ....................................... 633

Chapter 37

Content Filtering...............................................................................................................................635

37.1 Overview ..................................................................................................................................... 635

37.1.1 What You Can Do in this Chapter ................................................................................... 635

37.1.2 What You Need to Know ................................................................................................. 635

37.1.3 Before You Begin ............................................................................................................... 637

37.2 Content Filter Profile Screen ...................................................................................................... 637

37.3 Content Filter Profile Add or Edit Screen .................................................................................. 639

37.3.1 Content Filter Add Profile Category Service .................................................................. 639

37.3.2 Content Filter Add Filter Profile Custom Service ........................................................... 647

37.4 Content Filter Trusted Web Sites Screen ................................................................................. 650

37.5 Content Filter Forbidden Web Sites Screen ............................................................................ 651

37.6 Content Filter Technical Reference ......................................................................................... 652

Chapter 38

IDP .....................................................................................................................................................654

38.1 Overview ..................................................................................................................................... 654

38.1.1 What You Can Do in this Chapter ................................................................................... 654

38.1.2 What You Need To Know ................................................................................................. 654

38.1.3 Before You Begin ............................................................................................................... 654

38.2 The IDP Profile Screen ................................................................................................................. 655

38.2.1 Base Profiles ....................................................................................................................... 656

38.2.2 Adding / Editing Profiles .................................................................................................. 657

38.2.3 Profile > Group View Screen ............................................................................................ 658

38.2.4 Add Profile > Query View ................................................................................................ 661

38.2.5 Query Example .................................................................................................................. 665

38.3 IDP Custom Signatures .............................................................................................................. 666

38.3.1 Add / Edit Custom Signatures ......................................................................................... 669

38.3.2 Custom Signature Example ............................................................................................. 673

38.3.3 Applying Custom Signatures ............................................................................................ 675

USG/ZyWALL User’s Guide

38.3.4 Verifying Custom Signatures ............................................................................................ 675

38.4 IDP Technical Reference ........................................................................................................... 676

Chapter 39

Anti-Virus...........................................................................................................................................679

39.1 Overview ..................................................................................................................................... 679

39.1.1 What You Can Do in this Chapter ................................................................................... 679

39.1.2 What You Need to Know ................................................................................................. 680

39.2 Anti-Virus Profile Screen ............................................................................................................. 681

39.2.1 Anti-Virus Profile Add or Edit ............................................................................................. 683

39.3 Anti-Virus Black List ...................................................................................................................... 685

39.3.1 Anti-Virus Black List or White List Add/Edit ...................................................................... 685

39.3.2 Anti-Virus White List ............................................................................................................ 686

39.4 AV Signature Searching ............................................................................................................. 687

39.5 Anti-Virus Technical Reference ................................................................................................. 688

Chapter 40

Anti-Spam.........................................................................................................................................690

40.1 Overview ..................................................................................................................................... 690

40.1.1 What You Can Do in this Chapter ................................................................................... 690

40.1.2 What You Need to Know ................................................................................................. 690

40.2 Before You Begin ........................................................................................................................ 691

40.3 The Anti-Spam Profile Screen .................................................................................................... 692

40.3.1 The Anti-Spam Profile Add or Edit Screen ...................................................................... 693

40.4 The Mail Scan Screen ................................................................................................................. 695

40.5 The Anti-Spam Black List Screen ............................................................................................... 697

40.5.1 The Anti-Spam Black or White List Add/Edit Screen ...................................................... 699

40.5.2 Regular Expressions in Black or White List Entries ........................................................... 700

40.6 The Anti-Spam White List Screen ............................................................................................... 700

40.7 The DNSBL Screen ....................................................................................................................... 702

40.8 Anti-Spam Technical Reference ............................................................................................... 704

Chapter 41

SSL Inspection...................................................................................................................................708

41.1 SSL Inspection Overview ............................................................................................................ 708

41.1.1 What You Can Do in this Chapter ................................................................................... 708

41.1.2 What You Need To Know ................................................................................................. 709

41.1.3 Before You Begin ............................................................................................................... 709

41.2 The SSL Inspection Profile Screen .............................................................................................. 709

41.2.1 Add / Edit SSL Inspection Profiles .................................................................................... 710

41.3 Exclude List Screen .................................................................................................................... 713

41.4 Certificate Update Screen ....................................................................................................... 714

41.5 Install a CA Certificate in a Browser ......................................................................................... 715

USG/ZyWALL User’s Guide

Chapter 42

Device HA.........................................................................................................................................718

42.1 Overview ..................................................................................................................................... 718

42.1.1 What You Can Do in These Screens ................................................................................ 718

42.2 Device HA General .................................................................................................................... 719

42.2.1 Before You Begin ............................................................................................................... 719

42.3 Device HA Pro ............................................................................................................................. 721

42.3.1 Deploying Device HA Pro ................................................................................................ 721

42.3.2 Configuring Device HA Pro .............................................................................................. 722

42.4 The Active-Passive Mode Screen ............................................................................................. 724

42.4.1 Configuring Active-Passive Mode Device HA ............................................................... 725

42.5 Active-Passive Mode Edit Monitored Interface ...................................................................... 728

42.6 Device HA Technical Reference .............................................................................................. 730

Chapter 43

Object...............................................................................................................................................733

43.1 Zones Overview .......................................................................................................................... 733

43.1.1 What You Need to Know ................................................................................................. 733

43.1.2 The Zone Screen ................................................................................................................ 734

43.2 User/Group Overview ................................................................................................................ 736

43.2.1 What You Need To Know ................................................................................................. 736

43.2.2 User/Group User Summary Screen .................................................................................. 738

43.2.3 User/Group Group Summary Screen .............................................................................. 741

43.2.4 User/Group Setting Screen ............................................................................................. 743

43.2.5 User/Group MAC Address Summary Screen ................................................................ 747

43.2.6 User /Group Technical Reference .................................................................................. 748

43.3 AP Profile Overview .................................................................................................................... 749

43.3.1 Radio Screen ..................................................................................................................... 750

43.3.2 SSID Screen ....................................................................................................................... 756

43.4 MON Profile ................................................................................................................................ 764

43.4.1 Overview ............................................................................................................................ 764

43.4.2 MON Profile ........................................................................................................................ 764

43.4.3 Technical Reference ........................................................................................................ 767

43.5 Application .................................................................................................................................. 768

43.5.1 Add Application Rule ....................................................................................................... 770

43.5.2 Application Group Screen .............................................................................................. 773

43.6 Address/Geo IP Overview ......................................................................................................... 775

43.6.1 What You Need To Know ................................................................................................. 775

43.6.2 Address Summary Screen ................................................................................................ 775

43.6.3 Address Group Summary Screen .................................................................................... 779

43.6.4 Geo IP Summary Screen .................................................................................................. 781

43.7 Service Overview ........................................................................................................................ 783

43.7.1 What You Need to Know ................................................................................................. 783

USG/ZyWALL User’s Guide

43.7.2 The Service Summary Screen .......................................................................................... 784

43.7.3 The Service Group Summary Screen ............................................................................. 786

43.8 Schedule Overview ................................................................................................................... 787

43.8.1 What You Need to Know ................................................................................................. 788

43.8.2 The Schedule Screen ........................................................................................................ 788

43.8.3 The Schedule Group Screen ............................................................................................ 791

43.9 AAA Server Overview ............................................................................................................... 793

43.9.1 Directory Service (AD/LDAP) ........................................................................................... 793

43.9.2 RADIUS Server .................................................................................................................... 794

43.9.3 ASAS .................................................................................................................................... 794

43.9.4 What You Need To Know ................................................................................................. 794

43.9.5 Active Directory or LDAP Server Summary ..................................................................... 796

43.9.6 RADIUS Server Summary ...................................................................................................799

43.10 Auth. Method Overview ........................................................................................................ 801

43.10.1 Before You Begin ............................................................................................................. 801

43.10.2 Example: Selecting a VPN Authentication Method ................................................... 801

43.10.3 Authentication Method Objects ................................................................................... 802

43.11 Certificate Overview ............................................................................................................... 804

43.11.1 What You Need to Know ............................................................................................... 804

43.11.2 Verifying a Certificate .................................................................................................... 806

43.11.3 The My Certificates Screen ............................................................................................ 807

43.11.4 The Trusted Certificates Screen .................................................................................... 814

43.11.5 Certificates Technical Reference ................................................................................. 819

43.12 ISP Account Overview ............................................................................................................ 819

43.12.1 ISP Account Summary ....................................................................................................819

43.13 SSL Application Overview ....................................................................................................... 822

43.13.1 What You Need to Know ............................................................................................... 822

43.13.2 The SSL Application Screen ............................................................................................ 824

43.14 DHCPv6 Overview .................................................................................................................... 827

43.14.1 The DHCPv6 Request Screen ......................................................................................... 827

43.14.2 The DHCPv6 Lease Screen ............................................................................................. 829

Chapter 44

System...............................................................................................................................................831

44.1 Overview ..................................................................................................................................... 831

44.1.1 What You Can Do in this Chapter ................................................................................... 831

44.2 Host Name ................................................................................................................................... 832

44.3 USB Storage ................................................................................................................................. 832

44.4 Date and Time ............................................................................................................................ 833

44.4.1 Pre-defined NTP Time Servers List ..................................................................................... 836

44.4.2 Time Server Synchronization ............................................................................................ 836

44.5 Console Port Speed ................................................................................................................... 837

44.6 DNS Overview ............................................................................................................................. 838

USG/ZyWALL User’s Guide

44.6.1 DNS Server Address Assignment ...................................................................................... 838

44.6.2 Configuring the DNS Screen ............................................................................................ 838

44.6.3 (IPv6) Address Record ...................................................................................................... 841

44.6.4 PTR Record ......................................................................................................................... 842

44.6.5 Adding an (IPv6) Address/PTR Record .......................................................................... 842

44.6.6 CNAME Record ................................................................................................................. 842

44.6.7 Adding a CNAME Record ................................................................................................ 843

44.6.8 Domain Zone Forwarder ................................................................................................. 843

44.6.9 Adding a Domain Zone Forwarder ................................................................................. 844

44.6.10 MX Record ...................................................................................................................... 844

44.6.11 Adding a MX Record ...................................................................................................... 845

44.6.12 Security Option Control .................................................................................................. 845

44.6.13 Editing a Security Option Control .................................................................................. 845

44.6.14 Adding a DNS Service Control Rule .............................................................................. 846

44.7 WWW Overview .......................................................................................................................... 847

44.7.1 Service Access Limitations ............................................................................................... 847

44.7.2 System Timeout .................................................................................................................. 848

44.7.3 HTTPS ................................................................................................................................... 848

44.7.4 Configuring WWW Service Control ................................................................................. 849

44.7.5 Service Control Rules ........................................................................................................ 852

44.7.6 Customizing the WWW Login Page ................................................................................ 853

44.7.7 HTTPS Example ................................................................................................................... 858

44.8 SSH ............................................................................................................................................. 865

44.8.1 How SSH Works .................................................................................................................. 866

44.8.2 SSH Implementation on the Zyxel Device ...................................................................... 867

44.8.3 Requirements for Using SSH ..............................................................................................867

44.8.4 Configuring SSH ................................................................................................................. 867

44.8.5 Secure Telnet Using SSH Examples .................................................................................. 868

44.9 Telnet ........................................................................................................................................... 870

44.9.1 Configuring Telnet ............................................................................................................. 870

44.10 FTP .............................................................................................................................................. 871

44.10.1 Configuring FTP ................................................................................................................ 871

44.11 SNMP ......................................................................................................................................... 872

44.11.1 SNMPv3 and Security ...................................................................................................... 873

44.11.2 Supported MIBs ............................................................................................................... 874

44.11.3 SNMP Traps ....................................................................................................................... 874

44.11.4 Configuring SNMP ........................................................................................................... 874

44.11.5 Add SNMPv3 User ............................................................................................................ 876

44.12 Authentication Server .............................................................................................................. 877

44.12.1 Add/Edit Trusted RADIUS Client .................................................................................... 879

44.13 Language Screen ..................................................................................................................... 879

44.14 IPv6 Screen ................................................................................................................................ 880

44.15 Zyxel One Network (ZON) Utility ............................................................................................. 880

USG/ZyWALL User’s Guide

44.15.1 Zyxel One Network (ZON) System Screen .................................................................... 882

Chapter 45

Log and Report.................. .... .................. ................... ... ................... .................. .... ..........................883

45.1 Overview ..................................................................................................................................... 883

45.1.1 What You Can Do In this Chapter .................................................................................. 883

45.2 Email Daily Report ....................................................................................................................... 883

45.3 Log Setting Screens ................................................................................................................... 885

45.3.1 Log Setting Summary ........................................................................................................ 886

45.3.2 Edit System Log Settings .................................................................................................. 887

45.3.3 Edit Log on USB Storage Setting ..................................................................................... 892

45.3.4 Edit Remote Server Log Settings ..................................................................................... 894

45.3.5 Log Category Settings Screen ......................................................................................... 897

Chapter 46

File Manager ....................................................................................................................................902

46.1 Overview ..................................................................................................................................... 902

46.1.1 What You Can Do in this Chapter ................................................................................... 902

46.1.2 What you Need to Know .................................................................................................. 902

46.2 The Configuration File Screen ................................................................................................... 904

46.3 Firmware Management .......................................................................................................... 908

46.3.1 Cloud Helper ..................................................................................................................... 908

46.3.2 The Firmware Management Screen ............................................................................... 910

46.3.3 Firmware Upgrade via USB Stick ...................................................................................... 912

46.4 The Shell Script Screen .............................................................................................................. 913

Chapter 47

Diagnostics ......................................................................................................................................915

47.1 Overview ..................................................................................................................................... 915

47.1.1 What You Can Do in this Chapter ................................................................................... 915

47.2 The Diagnostic Screen ............................................................................................................... 915

47.2.1 The Diagnostics Files Screen ............................................................................................916

47.3 The Packet Capture Screen ...................................................................................................... 917

47.3.1 The Packet Capture Files Screen .................................................................................... 919

47.4 The System Log Screen .............................................................................................................. 920

47.5 The Network Tool Screen ........................................................................................................... 921

47.6 The Wireless Frame Capture Screen ........................................................................................922

47.6.1 The Wireless Frame Capture Files Screen ...................................................................... 924

Chapter 48

Packet Flow Explore .......................................................................................................................925

48.1 Overview ..................................................................................................................................... 925

48.1.1 What You Can Do in this Chapter ................................................................................... 925

USG/ZyWALL User’s Guide

48.2 The Routing Status Screen ......................................................................................................... 925

48.3 The SNAT Status Screen .............................................................................................................. 930

Chapter 49

Shutdown..........................................................................................................................................933

49.1 Overview ..................................................................................................................................... 933

49.1.1 What You Need To Know ................................................................................................. 933

49.2 The Shutdown Screen ................................................................................................................ 933

Chapter 50

Troubleshooting................................................................................................................................934

50.1 Resetting the Zyxel Device ........................................................................................................ 946

50.2 Getting More Troubleshooting Help .........................................................................................946

Appendix A Customer Support ..................................................................................................... 947

Appendix B Legal Information....................................................................................................... 953

Appendix C Product Features ....................................................................................................... 969

Index .................................................................................................................................................980

PART I

User’s Guide

USG/ZyWALL User’s Guide

CHAPTER 1

Introduction

1.1 Overview

Zyxel Device refers to all USG, VPN and ZyWALL models in this series as outlined below.

Besides performance variance, the following are the key feature differences between the models:

• UTM (Unified Threat Management) features include the following:

• ZyWALL models need a license for UTM functionality.

• USG models need a UTM license after one year

• The following UTM features work without a UTM license:

• Configuration > Content Filter > Trusted Web Sites

• Configuration > IDP > Custom Signatures

• Configuration > Anti-Virus > Black/White List

• Configuration > Anti-Spam > Black/White List

• ZyWALL models do not support SSL Inspection

• USG40 / USG40W / USG60 / USG60W support UTM but not SSL Inspection

• USG20-VPN and USG20W-VPN support UTM consisting of Content Filter and Anti-Spam

• USG2200-VPN supports UTM consisting of Content Filter, Anti-Spam and SSL Inspection

Table 1 Zyxel Device Models

USG MODELS VPN MODELS ZYWALL MODELS

USG40 USG20-VPN ZyWALL 110

USG40W USG20W-VPN ZyWALL 310

USG60 USG2200-VPN ZyWALL 1100

USG60W

USG110

USG210

USG310

USG1100

USG1900

• Application Patrol (AP) • Intrusion Detection & Prevention (IDP)

• Anomaly Detection & Prevention (ADP) • Content Filtering (CF)

• Anti-Virus (AV) • Anti-Spam (AS)

• Secure Socket Layer (SSL) encrypted traffic

Inspection

•

Chapter 1 Introduction

USG/ZyWALL User’s Guide

• The following models support Hotspot Management:

Note: At the time of writing, if the Zyxel Device is registered and with firmware version 4.25, the Zyxel

Device will get a free 30-day Hotspot Management trial license.

• USG20W-VPN / USG40W / USG60W have built-in Wi-Fi functionality

• The following models support Device HA (High Availability):

• The following models support Link Aggregation Group (LAG):

• USG20-VPN and USG20W-VPN do not support the AP controller function.

• The following models have Easy Mode wizards. Initial setup wizards for these models have a different

style to the other models.

• Some interface names vary by model - see Table 17 on page 72 for default port / interface name

mapping. See Table 18 on page 73 and Table 19 on page 74 for default interface / zone mapping.

See the product’s datasheet for detailed information on a specific model.

1.2 Registration at myZyxel.com

myZyxelZyxel.com is Zyxel’s online services center where you can register your Zyxel Device and

manage subscription services available for your Zyxel Device (see Configuration > Licensing >

Registration > Service for services available for your Zyxel Device).

• For Zyxel Devices that already have firmware version 4.25 or later, you have to register your Zyxel

Device and activate the corresponding service at myZyxel.com (through your Zyxel Device).

• For Zyxel Devices upgrading to firmware version 4.25, you may skip registering your Zyxel Device and

activating the corresponding service at myZyxel.com (through your Zyxel Device). However, it is highly

recommended to at least register your Zyxel Device. At the time of writing, the Firmware Upgrade

license providing Cloud Helper new firmware notifications, is free when you register your Zyxel Device.

• ZyWALL 110 • ZyWALL 310 • ZyWALL 1100

• USG110 • USG210 • USG310

• USG1100 • USG1900 • USG2200-VPN

• ZyWALL 110 • ZyWALL 310 • ZyWALL 1100

• USG110 • USG210 • USG310

• USG1100 • USG1900 • USG2200-VPN

• ZyWALL 310 • USG310 • ZyWALL 1100

• USG1100 • USG1900 • USG2200-VPN

• USG20-VPN • USG20W-VPN

• USG40 • USG40W

• USG60 • USG60W

Chapter 1 Introduction

USG/ZyWALL User’s Guide

Note: You need to create a myZyxel.com account at portal.myzyxel.com before you can

You may need your Zyxel Device’s serial number and LAN MAC address to register it at

myZyxel.com. See the label at the back of the Zyxel Device’s for details.

Figure 1 myZyxel Login

1.2.1 Grace Period

SecuReporter and UTM licenses have a 15-day grace period after a license expires. Services will

continue to work in this period during which you will receive notifications to renew your license(s). New

license(s) are valid for 1 year from the date of purchase.

1.2.2 Applications

These are some Zyxel Device application scenarios.

Security Router

Security includes a Stateful Packet Inspection (SPI) firewall, and UTM (Unified Threat Management). All

models need a license to use UTM (Unified Threat Management) features.

Chapter 1 Introduction

USG/ZyWALL User’s Guide

Figure 2 Applications: Security Router Applications: Security Router

IPv6 Routing

The Zyxel Device supports IPv6 Ethernet, PPP, VLAN, and bridge routing. You may also create IPv6 policy

routes and IPv6 objects. The Zyxel Device can also route IPv6 packets through IPv4 networks using

different tunneling methods.

Figure 3 Applications: IPv6 Routing

VPN Connectivity

Set up VPN tunnels with other companies, branch offices, telecommuters, and business travelers to

provide secure access to your network. You can also purchase the Zyxel Device OTPv2 One-Time

Password System for strong two-factor authentication for Web Configurator, Web access, SSL VPN, and

Zyxel IPSec VPN client user logins. AS is an Authentication Server in the below figure.

Chapter 1 Introduction

USG/ZyWALL User’s Guide

Figure 4 Applications: VPN Connectivity

SSL VPN Network Access

SSL VPN lets remote users use their web browsers for a very easy-to-use VPN solution. A user just browses

to the Zyxel Device’s web address and enters his user name and password to securely connect to the

Zyxel Device’s network. Here full tunnel mode creates a virtual connection for a remote user and gives

him a private IP address in the same subnet as the local network so he can access network resources in

the same way as if he were part of the internal network.

Figure 5 SSL VPN With Full Tunnel Mode

User-Aware Access Control

Set up security policies to restrict access to sensitive information and shared resources based on the user

who is trying to access it. In the following figure user A can access both the Internet and an internal file

server. User B has a lower level of access and can only access the Internet. User C is not even logged in,

so and cannot access either the Internet or the file server.

O T P PIN

Web Mail File Share

Web-based Application

https://

Application Server

Non-Web

LAN (192.168.1.X)

Chapter 1 Introduction

USG/ZyWALL User’s Guide

Figure 6 Applications: User-Aware Access Control

Load Balancing

Set up multiple connections to the Internet on the same port, or different ports, including cellular

interfaces. In either case, you can balance the traffic loads between them.

Figure 7 Applications: Multiple WAN Interfaces

1.3 Management Overview

You can manage the Zyxel Device in the following ways.

Web Configurator

The Web Configurator allows easy Zyxel Device setup and management using an Internet browser. This

User’s Guide provides information about the Web Configurator.

Chapter 1 Introduction

USG/ZyWALL User’s Guide

Figure 8 Managing the Zyxel Device: Web Configurator

Command-Line Interface (CLI)

The CLI allows you to use text-based commands to configure the Zyxel Device. Access it using remote

management (for example, SSH or Telnet) or via the physical or Web Configurator console port. See the

Command Reference Guide for CLI details. The default settings for the console port are:

FTP

Use File Transfer Protocol for firmware upgrades and configuration backup/restore.

SNMP

The device can be monitored and/or managed by an SNMP manager. See Section 44.11 on page 872.

Cloud CNM

Use the Cloud CNM screens (see Section 29.1 on page 539) to enable and configure management of

the Zyxel Device by a Central Network Management system and collect logs from the Zyxel Device in

order to monitor network activities and alert on potential threats, both internal and external.

1.4 Web Configurator

In order to use the Web Configurator, you must:

Table 2 Console Port Default Settings

SETTING VALUE

Speed 115200 bps

Data Bits 8

Parity None

Stop Bit 1

Flow Control Off

Chapter 1 Introduction

USG/ZyWALL User’s Guide

• Use one of the following web browser versions or later:

• Internet Explorer 10.x, 11.x

• Chrome latest version (45 or above)

• Firefox latest version (45 or above)

• Safari latest version (9.0 or above)

• Allow pop-up windows (blocked by default in Windows XP Service Pack 2)

• Enable JavaScripts, Java permissions, and cookies

The recommended screen resolution is 1024 x 768 pixels.

Note: Most screen shots in this guide come from the USG110 and USG60W. Screen shots for

other models may vary a little.

1.4.1 Web Configurator Access

1Make sure your Zyxel Device hardware is properly connected. See the Quick Start Guide.

2In your browser go to http://192.168.1.1. By default, the Zyxel Device automatically routes this request to

its HTTPS server, and it is recommended to keep this setting. The Login screen appears.

3Type the user name (default: “admin”) and password (default: “1234”).

If you have a OTP (One-Time Password) token generate a number and enter it in the One-Time

Password field. The number is only good for one login. You must use the token to generate a new

number the next time you log in.

4Click Login. After you log in for the first time using the default user name and password, you must

change the default admin password in the Update Admin Info screen. Type a new password of up to 63

printable characters without spaces, then click Apply.

Chapter 1 Introduction

USG/ZyWALL User’s Guide

5The Network Risk Warning screen displays any unregistered or disabled security services. Select how

often to display the screen and click OK.

If you select Never and you later want to bring this screen back, use these commands (note the space

before the underscore).

See the Command Line Interface (CLI) Reference Guide (RG) for details on all supported commands.

Router> enable

Router#

Router# configure terminal

Router(config)#

Router(config)# service-register _setremind

after-10-days

after-180-days

after-30-days

every-time

never

Router(config)# service-register _setremind every-time

Router(config)#

Chapter 1 Introduction

USG/ZyWALL User’s Guide

6Follow the directions in the Update Admin Info screen. If you change the default password, the Login

screen appears after you click Apply. If you click Ignore, the Installation Setup Wizard opens if the

ZyWALL is using its default configuration; otherwise the dashboard appears.

1.4.2 Web Configurator Screens Overview

The Web Configurator screen is divided into these parts (as illustrated on page 33):

•A - title bar

•B - navigation panel

Chapter 1 Introduction

USG/ZyWALL User’s Guide

•C - main window

Title Bar

Figure 9 Title Bar

The title bar icons in the upper right corner provide the following functions.

About

Click About to display basic information about the Zyxel Device.

Figure 10 About

Table 3 Title Bar: Web Configurator Icons

LABEL DESCRIPTION

Logout Click this to log out of the Web Configurator.

Help Click this to open the help page for the current screen.

About Click this to display basic information about the Zyxel Device.

Site Map Click this to see an overview of links to the Web Configurator screens.

Object

Reference

Click this to check which configuration items reference an object.

Console Click this to open a Java-based console window from which you can run command line

interface (CLI) commands. You will be prompted to enter your user name and password. See

the Command Reference Guide for information about the commands.

CLI Click this to open a popup window that displays the CLI commands sent by the Web

Configurator to the Zyxel Device.

Easy Mode Click this to switch from Expert Mode to Easy Mode, which offers wizards to configure the Zyxel

Device.

Table 4 About

LABEL DESCRIPTION

Current Version This shows the firmware version of the Zyxel Device.

Released Date This shows the date (yyyy-mm-dd) and time (hh:mm:ss) when the firmware was released.

OK Click this to close the screen.

Chapter 1 Introduction

USG/ZyWALL User’s Guide

Site Map

Click Site MAP to see an overview of links to the Web Configurator screens. Click a screen’s link to go to

that screen.

Figure 11 Site Map

Object Reference

Click Object Reference to open the Object Reference screen. Select the type of object and the

individual object and click Refresh to show which configuration settings reference the object.

Figure 12 Object Reference

Chapter 1 Introduction

USG/ZyWALL User’s Guide

The fields vary with the type of object. This table describes labels that can appear in this screen.

Console

Click Console to open a Java-based console window from which you can run CLI commands. You will

be prompted to enter your user name and password. See the Command Reference Guide for

information about the commands.

Figure 13 Console Window

CLI Messages

Click CLI to look at the CLI commands sent by the Web Configurator. Open the pop-up window and

then click some menus in the Web Configurator to display the corresponding commands.

Table 5 Object References

LABEL DESCRIPTION

Object Type Select the object type to display the services available.

Object

Name

This identifies the object for which the configuration settings that use it are displayed. Click the

object’s name to display the object’s configuration screen in the main window.

# This field is a sequential value, and it is not associated with any entry.

Service This is the type of setting that references the selected object. Click a service’s name to display the

service’s configuration screen in the main window.

Priority If it is applicable, this field lists the referencing configuration item’s position in its list, otherwise N/A

displays.

Name This field identifies the configuration item that references the object.

Description If the referencing configuration item has a description configured, it displays here.

Refresh Click this to update the information in this screen.

Cancel Click Cancel to close the screen.

Chapter 1 Introduction

USG/ZyWALL User’s Guide

Figure 14 CLI Messages

1.4.3 Navigation Panel

Use the navigation panel menu items to open status and configuration screens. Click the arrow in the

middle of the right edge of the navigation panel to hide the panel or drag to resize it. The following

sections introduce the Zyxel Device’s navigation panel menus and their screens.

Figure 15 Navigation Panel

Dashboard

The dashboard displays general device information, system status, system resource usage, licensed

service status, and interface status in widgets that you can re-arrange to suit your needs. See the Web

Help for details on the dashboard.

Chapter 1 Introduction

USG/ZyWALL User’s Guide

Monitor Menu

The monitor menu screens display status and statistics information.

Table 6 Monitor Menu Screens Summary

FOLDER OR LINK TAB FUNCTION

System Status

Port Statistics Port Statistics Displays packet statistics for each physical port.

Interface Status Interface

Summary

Displays general interface information and packet statistics.

Traffic Statistics Traffic

Statistics

Collect and display traffic statistics.

Session Monitor Session

Monitor

Displays the status of all current sessions.

IGMP Statistics IGMP

Statistics

Collect and display IGMP statistics.

DDNS Status DDNS Status Displays the status of the Zyxel Device’s DDNS domain names.

IP/MAC Binding IP/MAC

Binding

Lists the devices that have received an IP address from Zyxel Device

interfaces using IP/MAC binding.

Dynamic Guest Dynamic

Guest

List the dynamic guest accounts in the Zyxel Device’s local database.

Cellular Status Cellular

Status

Displays details about the Zyxel Device’s mobile broadband connection

status.

UPnP Port Status Port Statistics Displays details about UPnP connections going through the Zyxel Device.

USB Storage Storage

Information

Displays details about USB device connected to the Zyxel Device.

Ethernet

Neighbor Ethernet

Neighbor

View and manage the Zyxel Device’s neighboring devices via Smart

Connect (Layer Link Discovery Protocol (LLDP)). Use the Zyxel One Network

(ZON) utility to view and manage the Zyxel Device’s neighboring devices via

the Zyxel Discovery Protocol (ZDP).

Wireless

AP Information AP List Lists APs managed by the Zyxel Device.

Radio List Lists wireless details of APs managed by the Zyxel Device.

Station Info Station List Lists wireless clients associated with the APs managed by the Zyxel Device.

Detected

Device Detected

Device

Display information about suspected rogue APs.

Printer Status Printer Status Display information about the connected statement printers.

VPN Monitor

IPSec IPSec Displays and manages the active IPSec SAs.

SSL SSL Lists users currently logged into the VPN SSL client portal. You can also log out

individual users and delete related session information.

L2TP over IPSec L2TP over

IPSec

Displays details about current L2TP sessions.

UTM Statistics

App Patrol AppPatrol

Statistics

Displays application patrol statistics.

Content Filter Report Collect and display content filter statistics

Chapter 1 Introduction

USG/ZyWALL User’s Guide

Configuration Menu

Use the configuration menu screens to configure the Zyxel Device’s features.

IDP IDP Collect and display statistics on the intrusions that the Zyxel Device has

detected.

Anti-Virus Anti-Virus Collect and display statistics on the viruses that the Zyxel Device has

detected.

Anti-Spam Report Collect and display spam statistics.

Status Displays how many mail sessions the ZyWALL is currently checking and DNSBL

(Domain Name Service-based spam Black List) statistics.

SSL Inspection Report Collect and display SSL Inspection statistics.

Certificate

Cache List

Displays traffic to destination servers using certificates.

Log View Log Lists log entries.

View AP Log Lists AP log entries.

Dynamic

Users Log

Display the Zyxel Device’s dynamic guest account log messages.

Table 7 Configuration Menu Screens Summary

FOLDER OR LINK TAB FUNCTION

Quick Setup Quickly configure WAN interfaces or VPN connections.

Licensing

Registration Registration Register the device and activate trial services.

Service View the licensed service status and upgrade licensed services.

Signature

Update Anti-Virus Update anti-virus signatures immediately or by a schedule.

IDP/AppPatrol Update IDP signatures immediately or by a schedule.

Wireless

Controller Configuration Configure manual or automatic controller registration.

Management Mgnt AP List Edit or remove entries in the lists of APs managed by the Zyxel Device.

AP Policy Configure the AP controller’s IP address on the managed APs and

determine the action the managed APs take if the current AP

controller fails.

AP Group Create groups of APs, define their radio, VLAN, port and load

balancing settings.

Firmware Update the firmware on APs connected to your Zyxel Device.

MON Profile Rogue/Friendly AP

List

Configure how the Zyxel Device monitors rogue APs.

Load Balancing Load Balancing Configure load balancing for traffic moving to and from wireless

clients.

DCS DCS Configure dynamic wireless channel selection.

Auto Healing Auto Healing Enable auto healing to extend the wireless service coverage area of

the managed APs when one of the APs fails.

RTLS Real Time Location

System

Use the managed APs as part of an Ekahau RTLS to track the location

of Ekahau Wi-Fi tags.

Network

Table 6 Monitor Menu Screens Summary (continued)

FOLDER OR LINK TAB FUNCTION

Chapter 1 Introduction

USG/ZyWALL User’s Guide

Interface Port Role Use this screen to set the Zyxel Device’s flexible ports such as LAN, OPT,

WLAN, or DMZ.

Ethernet Manage Ethernet interfaces and virtual Ethernet interfaces.

PPP Create and manage PPPoE and PPTP interfaces.

Cellular Configure a cellular Internet connection for an installed mobile

broadband card.

Tunnel Configure tunneling between IPv4 and IPv6 networks.

VLAN Create and manage VLAN interfaces and virtual VLAN interfaces.

Bridge Create and manage bridges and virtual bridge interfaces.

VTI Configure IP address assignment and interface parameters for VTI

(Virtual Tunnel Interface).

Trunk Create and manage trunks (groups of interfaces) for load balancing.

Routing Policy Route Create and manage routing policies.

Static Route Create and manage IP static routing information.

RIP Configure device-level RIP settings.

OSPF Configure device-level OSPF settings, including areas and virtual links.

DDNS DDNS Define and manage the Zyxel Device’s DDNS domain names.

NAT NAT Set up and manage port forwarding rules.

Redirect

Service Redirect Service Set up and manage HTTP and SMTP redirection rules.

ALG ALG Configure SIP, H.323, and FTP pass-through settings.

UPnP UPnP Configure interfaces that allow UPnP and NAT-PMP connections.

IP/MAC Binding Summary Configure IP to MAC address bindings for devices connected to each

supported interface.

Exempt List Configure ranges of IP addresses to which the Zyxel Device does not

apply IP/MAC binding.

Layer 2 Isolation General Enable layer-2 isolation on the Zyxel Device and the internal

interface(s).

White List Enable and configure the white list.

DNS Inbound LB DNS Load Balancing Configure DNS Load Balancing.

Web

Authentication

Web Authentication Define a web portal and exempt services from authentication.

SSO Configure the Zyxel Device to work with a Single Sign On agent.

Hotspot

Billing General Configure the general billing settings, such as the accounting

method.

Billing Profile Configure the billing profiles for the web-based account generator

and each button on the connected statement printer.

Discount Configure discount price plans.

Payment Service Enable online payment service and configure the service pages.

Printer

Manager General Setting Configure the printer list, enable printer management and customize

the account printout.

Printer Manager Detect the connected statement printers, change their IP addresses

and/or add them to the managed printer list.

Free Time Free Time Allow users to get a free account for Internet surfing during the

specified time period.

Table 7 Configuration Menu Screens Summary (continued)

FOLDER OR LINK TAB FUNCTION

Chapter 1 Introduction

USG/ZyWALL User’s Guide

SMS SMS Enable the SMS service to send dynamic guest account information in

text messages.

IPnP IPnP Enable IPnP on the Zyxel Device and the internal interface(s).

Walled Garden Walled Garden Create walled garden links that display in the login screen.

Advertisement Advertisement Enable and set advertisement links.

Security Policy

Policy Control Policy Create and manage level-3 traffic rules and apply UTM profiles.

ADP General Display and manage ADP bindings.

Profile Create and manage ADP profiles.

Session Control Session Control Limit the number of concurrent client NAT/security policy sessions.

Cloud CNM SecuManager Enable and configure management of the Zyxel Device by a Central

Network Management system.

SecuReporter Enable SecuReporter logging and access the SecuReporter security

analytics portal that collects and analyzes logs from your Zyxel Device

in order to identify anomalies, alert on potential internal / external

threats, and report on network usage.

VPN

IPSec VPN VPN Connection Configure IPSec tunnels.

VPN Gateway Configure IKE tunnels.

Concentrator Combine IPSec VPN connections into a single secure network

Configuration

Provisioning

Set who can retrieve VPN rule settings from the Zyxel Device using the

Zyxel Device IPSec VPN Client.

SSL VPN Access Privilege Configure SSL VPN access rights for users and groups.

Global Setting Configure the Zyxel Device’s SSL VPN settings that apply to all

connections.

L2TP VPN L2TP VPN Configure L2TP over IPSec tunnels.

BWM BWM Enable and configure bandwidth management rules.

App Patrol General Enable or disable traffic management by application and see

registration and signature information.

UTM Profile

AppPatrol Profile Manage different types of traffic in this screen. Create App Patrol

template(s) of settings to apply to a traffic flow using a security policy.

Content Filter Profile Create and manage the detailed filtering rules for content filtering

profiles and then apply to a traffic flow using a security policy.

Trusted Web Sites Create a list of allowed web sites that bypass content filtering policies.

Forbidden Web Sites Create a list of web sites to block regardless of content filtering

policies.

IDP Profile Create IDP template(s) of settings to apply to a traffic flow using a

security policy.

Custom Signatures Create, import, or export custom signatures.

Anti-Virus Profile Create anti-virus template(s) of settings to apply to a traffic flow using

a security policy.

Black/White List Set up a black list to identify files with virus file patterns and a white list

to identify files that should not be checked for AV.

Signature Search for signatures by signature name or attributes and configure

how the Zyxel Device uses them.

Table 7 Configuration Menu Screens Summary (continued)

FOLDER OR LINK TAB FUNCTION

Chapter 1 Introduction

USG/ZyWALL User’s Guide

Anti-Spam Profile Turn anti-spam on or off and manage anti-spam policies. Create anti-

spam template(s) of settings to apply to a traffic flow using a security

policy.

Mail Scan Configure e-mail scanning details.

Black/White List Set up a black list to identify spam and a white list to identify

legitimate e-mail.

DNSBL Have the ZyWALL check e-mail against DNS Black Lists.

SSL Inspection Profile Decrypt HTTPS traffic for UTM inspection. Create SSL Inspection

template(s) of settings to apply to a traffic flow using a security policy.

Exclude List Configure services to be excluded from SSL Inspection.

Certificate Update Use this screen to update the latest certificates of servers using SSL

connections to the Zyxel Device network.

Device HA General Configure Device HA global settings, and see the status of each

interface monitored by Device HA.

Device HA Pro Configure Device HA Pro global, monitored interfaces and

synchronization settings.

Device HA Configure active-passive mode Device HA.

Object

Zone Zone Configure zone template(s) used to define various policies.

User/Group User Create and manage users.

Group Create and manage groups of users.

Setting Manage default settings for all users, general settings for user sessions,

and rules to force user authentication.

MAC Address Configure the MAC addresses of wireless clients for MAC

authentication using the local user database.

AP Profile Radio Create template(s) of radio settings to apply to policies as an object.

SSID Create template(s) of wireless settings to apply to radio profiles or

policies as an object.

MON Profile MON Profile Create and manage rogue AP monitoring files that can be

associated with different APs.

Application Application Create template(s) of services to apply to policies as an object.

Application Group Create and manage groups of applications to apply to policies as a

single object.

Address/Geo IP Address Create and manage host, range, and network (subnet) addresses.

Address Group Create and manage groups of addresses to apply to policies as a

single objects.

Geo IP Update the database of country-to-IP address mappings and

manually configure country-to-IP address mappings for geographic

address objects that can be used in security policies.

Service Service Create and manage TCP and UDP services.

Service Group Create and manage groups of services to apply to policies as a single

object.

Schedule Schedule Create one-time and recurring schedules.

Schedule Group Create and manage groups of schedules to apply to policies as a

single object.

Table 7 Configuration Menu Screens Summary (continued)

FOLDER OR LINK TAB FUNCTION

Chapter 1 Introduction

USG/ZyWALL User’s Guide

AAA Server Active Directory Configure the Active Directory settings.

LDAP Configure the LDAP settings.

RADIUS Configure the RADIUS settings.

Auth. Method Authentication

Method

Create and manage ways of authenticating users.

Certificate My Certificates Create and manage the Zyxel Device’s certificates.

Trusted Certificates Import and manage certificates from trusted sources.

ISP Account ISP Account Create and manage ISP account information for PPPoE/PPTP

interfaces.

SSL Application SSL Application Create SSL web application or file sharing objects to apply to policies.

DHCPv6 Request Configure IPv6 DHCP request type and interface information.

Lease Configure IPv6 DHCP lease type and interface information.

System

Host Name Host Name Configure the system and domain name for the Zyxel Device.

USB Storage Settings Configure the settings for the connected USB devices.

Date/Time Date/Time Configure the current date, time, and time zone in the Zyxel Device.

Console Speed Console Speed Set the console speed.

DNS DNS Configure the DNS server and address records for the Zyxel Device.

WWW Service Control Configure HTTP, HTTPS, and general authentication.

SSH SSH Configure SSH server and SSH service settings.

TELNET TELNET Configure telnet server settings for the Zyxel Device.

FTP FTP Configure FTP server settings.

SNMP SNMP Configure SNMP communities and services.

Auth. Server Auth. Server Configure the Zyxel Device to act as a RADIUS server.

Language Language Select the Web Configurator language.

IPv6 IPv6 Enable IPv6 globally on the Zyxel Device here.

ZON ZON Use the Zyxel One Network (ZON) utility to view and manage the Zyxel

Device’s neighboring devices via the Zyxel Discovery Protocol (ZDP).

Log & Report

Email Daily

Report Email Daily Report Configure where and how to send daily reports and what reports to

send.

Log Settings Log Settings Configure the system log, e-mail logs, and remote syslog servers.

Table 7 Configuration Menu Screens Summary (continued)

FOLDER OR LINK TAB FUNCTION

Chapter 1 Introduction

USG/ZyWALL User’s Guide

Maintenance Menu

Use the maintenance menu screens to manage configuration and firmware files, run diagnostics, and

reboot or shut down the Zyxel Device.

1.4.4 Tables and Lists

Web Configurator tables and lists are flexible with several options for how to display their entries.

Click a column heading to sort the table’s entries according to that column’s criteria.

Figure 16 Sorting Table Entries by a Column’s Criteria

Click the down arrow next to a column heading for more options about how to display the entries. The

options available vary depending on the type of fields in the column. Here are some examples of what

you can do:

• Sort in ascending or descending (reverse) alphabetical order

• Select which columns to display

•Group entries by field

•Show entries in groups

• Filter by mathematical operators (<, >, or =) or searching for text

Table 8 Maintenance Menu Screens Summary

FOLDER

OR LINK TAB FUNCTION

File

Manager

Configuration File Manage and upload configuration files for the Zyxel Device.

Firmware

Management

View the current firmware version and upload firmware. Reboot with your

choice of firmware.

Shell Script Manage and run shell script files for the Zyxel Device.

Diagnostics Diagnostics Collect diagnostic information.

Packet Capture Capture packets for analysis.

System Log Connect a USB device to the Zyxel Device and archive the Zyxel Device system

logs to it here.

Network Tool Identify problems with the connections. You can use Ping or Traceroute to help

you identify problems.

Wireless Frame

Capture

Capture wireless frames from APs for analysis.

Packet

Flow

Explore

Routing Status Check how the Zyxel Device determines where to route a packet.

SNAT Status View a clear picture on how the Zyxel Device converts a packet’s source IP

address and check the related settings.

Shutdown Shutdown Turn off the Zyxel Device.

Chapter 1 Introduction

USG/ZyWALL User’s Guide

Figure 17 Common Table Column Options

Select a column heading cell’s right border and drag to re-size the column.

Figure 18 Resizing a Table Column

Select a column heading and drag and drop it to change the column order. A green check mark

displays next to the column’s title when you drag the column to a valid new location.

Figure 19 Moving Columns

Use the icons and fields at the bottom of the table to navigate to different pages of entries and control

how many entries display at a time.

Figure 20 Navigating Pages of Table Entries

The tables have icons for working with table entries. You can often use the [Shift] or [Ctrl] key to select

multiple entries to remove, activate, or deactivate.

Chapter 1 Introduction

USG/ZyWALL User’s Guide

Figure 21 Common Table Icons

Here are descriptions for the most common table icons.

Working with Lists

When a list of available entries displays next to a list of selected entries, you can often just double-click

an entry to move it from one list to the other. In some lists you can also use the [Shift] or [Ctrl] key to

select multiple entries, and then use the arrow button to move them to the other list.

Figure 22 Working with Lists

Table 9 Common Table Icons

LABEL DESCRIPTION

Add Click this to create a new entry. For features where the entry’s position in the numbered list is

important (features where the Zyxel Device applies the table’s entries in order like the security policy

for example), you can select an entry and click Add to create a new entry after the selected entry.

Edit Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s

settings. In some tables you can just click a table entry and edit it directly in the table. For those types

of tables small red triangles display for table entries with changes that you have not yet applied.

Remove To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it

before doing so.

Activate To turn on an entry, select it and click Activate.

Inactivate To turn off an entry, select it and click Inactivate.

Connect To connect an entry, select it and click Connect.

Disconnect To disconnect an entry, select it and click Disconnect.

Object

References

Select an entry and click Object References to check which settings use the entry.

Move To change an entry’s position in a numbered list, select it and click Move to display a field to type a

number for where you want to put that entry and press [ENTER] to move the entry to the number that

you typed. For example, if you type 6, the entry you are moving becomes number 6 and the previous

entry 6 (if there is one) gets pushed up (or down) one.

USG/ZyWALL User’s Guide

CHAPTER 2

Initial Setup Wizard

2.1 Initial Setup Wizard Screens

When you log into the Web Configurator for the first time or when you reset the Zyxel Device to its

default configuration, the Initial Setup Wizard screen displays. This wizard helps you configure Internet

connection settings and activate subscription services.

The following models have Easy Mode wizards. Initial setup wizards for these models have a different

style to the other models.

• USG20-VPN

• USG20W-VPN

•USG40

• USG40W

•USG60

• USG60W

Note: For Zyxel Devices that already have firmware version 4.25, you have to register your

Zyxel Device and activate the corresponding service at myZyxel.com (through your

Zyxel Device).

This chapter provides information on configuring the Web Configurator's Initial Setup Wizard. See the

feature-specific chapters in this User’s Guide for background information.

Chapter 2 Initial Setup Wizard

USG/ZyWALL User’s Guide

Figure 23 Initial Setup Wizard

• Click the double arrow in the upper right corner to display or hide the help.

• Click Logout to exit the Initial Setup Wizard or click Next to continue the wizard.

2.1.1 Internet Access Setup - WAN Interface

Use this screen to set how many WAN interfaces to configure and the first WAN interface’s type of

encapsulation and method of IP address assignment.

The screens vary depending on the encapsulation type. Refer to information provided by your ISP to

know what to enter in each field. Leave a field blank if you don’t have that information.

Note: Enter the Internet access information exactly as your ISP gave it to you.

Chapter 2 Initial Setup Wizard

USG/ZyWALL User’s Guide

Figure 24 Internet Access

•I have two ISPs: Select this option to configure two Internet connections. Leave it cleared to configure

just one. This option appears when you are configuring the first WAN interface.

•Encapsulation: Choose the Ethernet option when the WAN port is used as a regular Ethernet. Choose

PPPoE, PPTP or L2TP for a dial-up connection according to the information from your ISP.

•WAN Interface: This is the interface you are configuring for Internet access.

•Zone: This is the security zone to which this interface and Internet connection belong.

•IP Address Assignment: Select Auto if your ISP did not assign you a fixed IP address.

Select Static if the ISP assigned a fixed IP address.

2.1.2 Internet Access: Ethernet

This screen is read-only if you set the previous screen’s IP Address Assignment field to Auto. If you set the

previous screen’s IP Address Assignment field to Static, use this screen to configure your IP address

settings.

Note: Enter the Internet access information exactly as given to you by your ISP or network

administrator.

Chapter 2 Initial Setup Wizard

USG/ZyWALL User’s Guide

Figure 25 Internet Access: Ethernet Encapsulation

•Encapsulation: This displays the type of Internet connection you are configuring.

•First WAN Interface: This is the number of the interface that will connect with your ISP.

•Zone: This is the security zone to which this interface and Internet connection will belong.

•IP Address: Enter your (static) public IP address. Auto displays if you selected Auto as the IP Address

Assignment in the previous screen.

The following fields display if you selected static IP address assignment.

•IP Subnet Mask: Enter the subnet mask for this WAN connection's IP address.

•Gateway IP Address: Enter the IP address of the router through which this WAN connection will send

traffic (the default gateway).

•First / Second DNS Server: These fields display if you selected static IP address assignment. The Domain

Name System (DNS) maps a domain name to an IP address and vice versa. Enter a DNS server's IP

address(es). The DNS server is extremely important because without it, you must know the IP address

of a computer before you can access it. The Zyxel Device uses these (in the order you specify here) to

resolve domain names for VPN, DDNS and the time server. Leave the field as 0.0.0.0 if you do not want

to configure DNS servers.

2.1.3 Internet Access: PPPoE

Note: Enter the Internet access information exactly as given to you by your ISP.

Chapter 2 Initial Setup Wizard

USG/ZyWALL User’s Guide

Figure 26 Internet Access: PPPoE Encapsulation

2.1.3.1 ISP Parameters

• Type the PPPoE Service Name from your service provider. PPPoE uses a service name to identify and

reach the PPPoE server. You can use alphanumeric and -_@$./ characters, and it can be up to 64

characters long.

•Authentication Type - Select an authentication protocol for outgoing connection requests. Options

are:

•CHAP/PAP - Your Zyxel Device accepts either CHAP or PAP when requested by the remote node.

•CHAP - Your Zyxel Device accepts CHAP only.

•PAP - Your Zyxel Device accepts PAP only.

•MSCHAP - Your Zyxel Device accepts MSCHAP only.

•MSCHAP-V2 - Your Zyxel Device accepts MSCHAP-V2 only.

• Type the User Name given to you by your ISP. You can use alphanumeric and -_@$./ characters, and

it can be up to 31 characters long.

•Type the Password associated with the user name. Use up to 64 ASCII characters except the [] and ?.

This field can be blank.

•Select Nailed-Up if you do not want the connection to time out. Otherwise, type the Idle Timeout in

seconds that elapses before the router automatically disconnects from the PPPoE server.

2.1.3.2 WAN IP Address Assignments

•WAN Interface: This is the name of the interface that will connect with your ISP.

•Zone: This is the security zone to which this interface and Internet connection will belong.

•IP Address: Enter your (static) public IP address. Auto displays if you selected Auto as the IP Address

Assignment in the previous screen.

•First / Second DNS Server: These fields display if you selected static IP address assignment. The Domain

Name System (DNS) maps a domain name to an IP address and vice versa. Enter a DNS server's IP

address(es). The DNS server is extremely important because without it, you must know the IP address

of a computer before you can access it. The Zyxel Device uses these (in the order you specify here) to

resolve domain names for VPN, DDNS and the time server. Leave the field as 0.0.0.0 if you do not want

to configure DNS servers. If you do not configure a DNS server, you must know the IP address of a

machine in order to access it.

Chapter 2 Initial Setup Wizard

USG/ZyWALL User’s Guide

2.1.4 Internet Access: PPTP

Note: Enter the Internet access information exactly as given to you by your ISP.

Figure 27 Internet Access: PPTP Encapsulation

2.1.4.1 ISP Parameters

•Authentication Type - Select an authentication protocol for outgoing calls. Options are:

•CHAP/PAP - Your Zyxel Device accepts either CHAP or PAP when requested by the remote node.

•CHAP - Your Zyxel Device accepts CHAP only.

•PAP - Your Zyxel Device accepts PAP only.

•MSCHAP - Your Zyxel Device accepts MSCHAP only.

•MSCHAP-V2 - Your Zyxel Device accepts MSCHAP-V2 only.

• Type the User Name given to you by your ISP. You can use alphanumeric and -_@$./ characters, and

it can be up to 31 characters long.

•Type the Password associated with the user name. Use up to 64 ASCII characters except the [] and ?.

This field can be blank. Re-type your password in the next field to confirm it.

•Select Nailed-Up if you do not want the connection to time out. Otherwise, type the Idle Timeout in

seconds that elapses before the router automatically disconnects from the PPTP server.

2.1.4.2 PPTP Configuration

•Base Interface: This identifies the Ethernet interface you configure to connect with a modem or router.

•Type a Base IP Address (static) assigned to you by your ISP.

• Type the IP Subnet Mask assigned to you by your ISP (if given).

•Server IP: Type the IP address of the PPTP server.

Chapter 2 Initial Setup Wizard

USG/ZyWALL User’s Guide

•Type a Connection ID or connection name. It must follow the “c:id” and “n:name” format. For

example, C:12 or N:My ISP. This field is optional and depends on the requirements of your broadband

modem or router. You can use alphanumeric and -_: characters, and it can be up to 31 characters

long.

2.1.4.3 WAN IP Address Assignments

•First WAN Interface: This is the connection type on the interface you are configuring to connect with

your ISP.

•Zone This is the security zone to which this interface and Internet connection will belong.

•IP Address: Enter your (static) public IP address. Auto displays if you selected Auto as the IP Address

Assignment in the previous screen.

•First / Second DNS Server: These fields display if you selected static IP address assignment. The Domain

Name System (DNS) maps a domain name to an IP address and vice versa. Enter a DNS server's IP

address(es). The DNS server is extremely important because without it, you must know the IP address

of a computer before you can access it. The Zyxel Device uses these (in the order you specify here) to

resolve domain names for VPN, DDNS and the time server. Leave the field as 0.0.0.0 if you do not want

to configure DNS servers.

2.1.5 Internet Access: L2TP

Note: Enter the Internet access information exactly as given to you by your ISP or network

administrator.

Figure 28 Internet Access: L2TP Encapsulation

2.1.5.1 ISP Parameters

•Authentication Type - Select an authentication protocol for outgoing connection requests. Options

are:

•CHAP/PAP - Your Zyxel Device accepts either CHAP or PAP when requested by the remote node.

•CHAP - Your Zyxel Device accepts CHAP only.

Chapter 2 Initial Setup Wizard

USG/ZyWALL User’s Guide

•PAP - Your Zyxel Device accepts PAP only.

•MSCHAP - Your Zyxel Device accepts MSCHAP only.

•MSCHAP-V2 - Your Zyxel Device accepts MSCHAP-V2 only.

• Type the User Name given to you by your ISP. You can use alphanumeric and -_@$./ characters, and

it can be up to 31 characters long.

•Type the Password associated with the user name. Use up to 64 ASCII characters except the [] and ?.

This field can be blank.

•Select Nailed-Up if you do not want the connection to time out. Otherwise, type the Idle Timeout in

seconds that elapses before the router automatically disconnects from the PPPoE server.

2.1.5.2 L2TP Configuration

•Base Interface: This identifies the Ethernet interface you configure to connect with a modem or router.

•IP Subnet Mask: Enter the subnet mask for this WAN connection's IP address.

•Gateway IP Address: Enter the IP address of the router through which this WAN connection will send

traffic (the default gateway).

•Server IP: Type the IP address of the L2TP server.

2.1.5.3 WAN IP Address Assignments

•WAN Interface: This is the name of the interface that will connect with your ISP.

•Zone: This is the security zone to which this interface and Internet connection will belong.

•IP Address: Enter your (static) public IP address. Auto displays if you selected Auto as the IP Address

Assignment in the previous screen.

2.1.6 Internet Access Setup - Second WAN Interface

If you selected I have two ISPs, after you configure the First WAN Interface, you can configure the

Second WAN Interface. The screens for configuring the second WAN interface are similar to the first (see

Section 2.1.1 on page 48).

Figure 29 Internet Access: Step 3: Second WAN Interface

Chapter 2 Initial Setup Wizard

USG/ZyWALL User’s Guide

2.1.7 Internet Access: Finish

You have set up your Zyxel Device to access the Internet. A screen displays with your settings. Click

Connection Test to check that you can access the Internet. If you cannot, click Back and confirm that

you entered the settings correctly. If you have, check that you got the correct settings from your ISP or

network administrator.

Figure 30 Internet Access: Finish

2.1.8 Date and Time Settings

It’s important to have correct date and time values in the logs. The Zyxel Device can automatically

update the time and date by detecting your time zone and whether Daylight Savings is in effect in that

time zone.

If your Zyxel Device cannot get the correct date and time, it may not able to connect to a time server.

Check that the Zyxel Device has Internet access, then click Sync. Now.

Chapter 2 Initial Setup Wizard

USG/ZyWALL User’s Guide

Figure 31 Date and Time Settings

2.1.9 Register Device

Click the Register button in this screen to register your device at portal.myzyxel.com.

Note: The Zyxel Device must be connected to the Internet in order to register.

Figure 32 myZyxel Login

Chapter 2 Initial Setup Wizard

USG/ZyWALL User’s Guide

Figure 33 Register Device

Figure 34 Registered Device

You may need the Zyxel Device’s serial number and LAN MAC address to register it at myZyxel.com if

you have not already done so. Refer to the label at the back of the Zyxel Device’s for details. Use the

Configuration > Licensing > Registration screen to update your Zyxel Device registration status.

2.1.10 Activate Service

After you register your Zyxel Device, you can register for the services supported by your model. Examples

of services are:

• Content Filter (to block websites by category, such as Gambling)

• IDP (to recognize and drop traffic with Intrusion, Detection & Protection attack patterns)

Chapter 2 Initial Setup Wizard

USG/ZyWALL User’s Guide

• Anti-Virus (to detect virus patterns in files)

• Anti-Spam (to mark or discard unsolicited commercial or junk e-mail suspect of being sent by

spammers).

Click Refresh and wait a few moments for the registration information to update in this screen. If the

page does not refresh, make sure the Internet connection is working and click Refresh again. To check

your Internet connection, try to access the Internet from a computer connected to a LAN port on the

Zyxel Device. If you cannot, then check your Internet access settings on the Zyxel Device

Figure 35 Activate Service

Figure 36 Activated Service

Chapter 2 Initial Setup Wizard

USG/ZyWALL User’s Guide

2.1.11 Wireless Settings: AP Controller

The Zyxel Device can act as an AP Controller that can manage APs in the same network as the Zyxel

Device. Select Yes if you want your Zyxel Device to manage APs in your network; otherwise select No.

• USG20-VPN and USG20W-VPN do not support the AP controller function.

Figure 37 Wireless Settings: AP Controller

2.1.12 Wireless Settings: SSID & Security

Configure SSID and wireless security in this screen.

Figure 38 Wireless Settings: SSID & Security

Chapter 2 Initial Setup Wizard

USG/ZyWALL User’s Guide

SSID Setting

•SSID - Enter a descriptive name of up to 32 printable characters for the wireless LAN.

•Security Mode - Select Pre-Shared Key to add security on this wireless network. Otherwise, select None

to allow any wireless client to associate this network without authentication.

•Pre-Shared Key - Enter a pre-shared key of between 8 and 63 case-sensitive ASCII characters

(including spaces and symbols) or 64 hexadecimal characters.

•Hidden SSID - Select this option if you want to hide the SSID in the outgoing beacon frame. A wireless

client then cannot obtain the SSID through scanning using a site survey tool.

•Enable Intra-BSS Traffic Blocking - Select this option if you want to prevent crossover traffic from within

the same SSID. Wireless clients can still access the wired network but cannot communicate with each

other.

For Built-in Wireless AP Only

•Bridged to: Zyxel Devices with W in the model name have a built-in AP. Select an interface to bridge

with the built-in AP wireless network. Devices connected to this interface will then be in the same

broadcast domain as devices in the AP wireless network.

USG/ZyWALL User’s Guide

CHAPTER 3

Hardware, Interfaces and

Zones

3.1 Hardware Overview

This table is an overview of the different housings in the series.

3.1.1 Front Panels

The LED indicators are located on the front panel.

Figure 39 ZyWALL 110 / USG110 / USG210 Front Panel

Figure 40 ZyWALL 310 / ZyWALL 1100 / USG310 / USG1100 / USG1900 Front Panel

Figure 41 USG40 Front Panel

Table 10 Housing Comparison

MODELS WITH SAME HARDWARE MODELS WITH SAME HARDWARE

• ZyWALL 110

• USG110

• USG210

• ZyWALL 310

• ZyWALL 1100

•USG310

• USG1100

• USG1900

•USG40

• USG40W (with two antennas)

•USG60

• USG60W (with four antennas)

• USG20-VPN

• USG20W-VPN (with three antennas)

• USG2200-VPN

•

Chapter 3 Hardware, Interfaces and Zones

USG/ZyWALL User’s Guide

Figure 42 USG40W Front Panel

Figure 43 USG20-VPN Front Panel

Figure 44 USG20W-VPN / VPN20W Front Panel

Figure 45 USG60 Front Panel

Figure 46 USG60W Front Panel

Figure 47 USG2200-VPN Front Panel

Chapter 3 Hardware, Interfaces and Zones

USG/ZyWALL User’s Guide

The following table describes the LEDs.

The following table describes the USG2200-VPN and VPN3000 LEDs.

Table 11 LED Descriptions

LED COLOR STATUS DESCRIPTION

PWR Off The Zyxel Device is turned off.

Green On The Zyxel Device is turned on.

Red On There is a hardware component failure. Shut down the device, wait for a few

minutes and then restart the device. If the LED turns red again, then please

contact your vendor.

SYS Green Off The Zyxel Device is not ready or has failed.

On The Zyxel Device is ready and running.

Blinking The Zyxel Device is booting.

Red On The Zyxel Device encountered an error or has failed.

USB Green Off No device is connected to the Zyxel Device’s USB port or the connected device

is not supported by the Zyxel Device.

On A mobile broadband USB card or USB storage device is connected to the USB

port.

Orange On Connected to a mobile broadband network through the connected mobile

broadband USB card.

P1, P2... Green Off There is no traffic on this port.

Blinking The Zyxel Device is sending or receiving packets on this port.

Orange Off There is no connection on this port.

On This port has a successful link.

Table 12 USG2200-VPN LED Descriptions

LED COLOR STATUS DESCRIPTION

PWR1, 2 Off The Zyxel Device is turned off.

Green On The Zyxel Device is turned on.

Red On There is a hardware component failure. Shut down the device, wait for a few

minutes and then restart the device. If the LED turns red again, then please

contact your vendor.

SYS Green Off The Zyxel Device is not ready or has failed.

On The Zyxel Device is ready and running.

Blinking The Zyxel Device is booting.

Red On The Zyxel Device encountered an error or has failed.

P1-P4

(SFP) Link

Green Off There is no connection on this port.

On This port has a successful 100Mbps link.

Orange Off There is no connection on this port.

On This port has a successful 1000Mbps link.

P1-P4

(SFP) ACT

Green Off There is no traffic on this port.

On The Zyxel Device is sending or receiving packets on this port.

Chapter 3 Hardware, Interfaces and Zones

USG/ZyWALL User’s Guide

The following table describes the ports on the front panel.

The following table describes the ports on the USG2200-VPN front panel.

P5-P16

(WAN/

LAN))

Green Off There is no connection on this port.

On This port has a successful 10/100Mbps link.

Blinking The Zyxel Device is sending or receiving packets on this port.

Orange Off There is no connection on this port.

On This port has a successful 1000Mbps link.

Blinking The Zyxel Device is sending or receiving packets on this port.

P17-P18

(SFP+)

Link

Blue Off There is no connection on this port.

On This port has a successful 10Gbps link.

P17-P18

(SFP+)

ACT

Green Off There is no traffic on this port.

Blinking The Zyxel Device is sending or receiving packets on this port.

P17-P18

(10GE)

Link

Blue Off There is no connection on this port.

On This port has a successful 10Gbps link.

P17-P18

(10GE)

ACT

Green Off There is no traffic on this port.

Blinking The Zyxel Device is sending or receiving packets on this port.

Table 13 Front Panel Ports

LABEL DESCRIPTION

RESET Press the button in for about 5 seconds (or until the SYS LED starts to blink), then release it to

return the Zyxel Device to the factory defaults (password is 1234, LAN IP address 192.168.1.1

etc.)

CONSOLE You can use the console port to manage the Zyxel Device using CLI commands. You will be

prompted to enter your user name and password. See the Command Reference Guide for

more information about the CLI.

When configuring using the console port, you need a computer equipped with

communications software configured to the following parameters:

• Speed 115200 bps

• Data Bits 8

•Parity None

•Stop Bit 1

• Flow Control Off

USB Connect a storage device for system logs (see Maintenance > Diagnostics > System Log) and

storage (see Configuration > System > USB Storage).

P1 ~ P6 These are 1G RJ-45 Ethernet ports.

Table 14 USG2200-VPN Front Panel Ports

LABEL DESCRIPTION

RESET Press the button in for about 5 seconds (or until the SYS LED starts to blink), then release it to

return the Zyxel Device to the factory defaults (password is 1234, LAN IP address 192.168.1.1

etc.)

BUZZER RESET The buzzer alarms when a power module fails. Use this to mute the buzzer alarm.

Table 12 USG2200-VPN LED Descriptions (continued)

LED COLOR STATUS DESCRIPTION

Chapter 3 Hardware, Interfaces and Zones

USG/ZyWALL User’s Guide

3.1.2 Rear Panels

The connection ports are located on the rear panel.

Figure 48 ZyWALL 110 / USG110 / USG210 Rear Panel

Figure 49 ZyWALL 310 / ZyWALL 1100 / USG310 / USG1100 / USG1900 Rear Panel

Figure 50 USG40 / USG40W Rear Panel

CONSOLE You can use the console port to manage the Zyxel Device using CLI commands. You will be

prompted to enter your user name and password. See the Command Reference Guide for

more information about the CLI.

When configuring using the console port, you need a computer equipped with

communications software configured to the following parameters:

• Speed 115200 bps

• Data Bits 8

•Parity None

•Stop Bit 1

• Flow Control Off

USB Connect a storage device for system logs (see Maintenance > Diagnostics > System Log) and

storage (see Configuration > System > USB Storage).

P1 ~ P4 These are SFP (1G) ports. These are compatible 1G transceiver modules (at the time of writing):

• SFP-1000T

•SFP-SX-D

• SFP-LX-10-D

• SFP-BX1310-10-D

• SFP-BX1490-10-D

• SFP-LHX1310-40-D

•SFP-ZX-80-D

P5 ~ P16 These are 1G RJ-45 Ethernet ports.

P17 ~ P18 These are 10G combo (SFP+ & RJ-45) ports. These are compatible 10G transceiver modules (at

the time of writing:)

• SFP10G-SR

• SFP10G-LR

Table 14 USG2200-VPN Front Panel Ports (continued)

LABEL DESCRIPTION

Chapter 3 Hardware, Interfaces and Zones

USG/ZyWALL User’s Guide

Figure 51 USG20-VPN / USG20W-VPN Rear Panel

Figure 52 USG60 / USG60W Rear Panel

Figure 53 USG2200-VPN Rear Panel

The following table describes the items on the rear panel.

Note: Use an 8-wire Ethernet cable to run your Gigabit Ethernet connection at 1000 Mbps.

Using a 4-wire Ethernet cable limits your connection to 100 Mbps. Note that the

connection speed also depends on what the Ethernet device at the other end can

support.

Table 15 Rear Panel Items

LABEL DESCRIPTION

Console You can use the console port to manage the Zyxel Device using CLI commands. You will be

prompted to enter your user name and password. See the Command Reference Guide for

more information about the CLI.

When configuring using the console port, you need a computer equipped with

communications software configured to the following parameters:

• Speed 115200 bps

• Data Bits 8

•Parity None

•Stop Bit 1

• Flow Control Off

Power Use the included power cord to connect the power socket to a power outlet. Turn the power

switch on if your Zyxel Device has a power switch.

Lock Attach a lock-and-cable from the Kensington lock (the small, metal-reinforced, oval hole) to a

permanent object, such as a pole, to secure the Zyxel Device in place.

Fan The fans are for cooling the Zyxel Device. Make sure they are not obstructed to allow maximum

ventilation.

Chapter 3 Hardware, Interfaces and Zones

USG/ZyWALL User’s Guide

3.2 Mounting

Some models can be mounted in a rack, and some can be mounted on a wall.

3.2.1 Rack-mounting

See Table 16 on page 67 for the Zyxel Device models that can be rack mounted. Use the following steps

to mount the Zyxel Device on an EIA standard size, 19-inch rack or in a wiring closet with other

equipment using a rack-mounting kit. Make sure the rack will safely support the combined weight of all

the equipment it contains and that the position of the ZyWALL does not make the rack unstable or top-

heavy. Take all necessary precautions to anchor the rack securely before installing the unit.

Note: Leave 10 cm of clearance at the sides and 20 cm in the rear.

Use a #2 Phillips screwdriver to install the screws.

Note: Failure to use the proper screws may damage the unit.

1Align one bracket with the holes on one side of the Zyxel Device and secure it with the included bracket

screws (smaller than the rack-mounting screws).

2Attach the other bracket in a similar fashion.

3After attaching both mounting brackets, position the Zyxel Device in the rack and match up the bracket

holes with the rack holes. Secure the Zyxel Device to the rack with the rack-mounting screws.

Table 16 Mounting Method

RACK-MOUNTING WALL-MOUNTING

•ZyWALL 110 •USG40

•ZyWALL 310 •USG40W

•ZyWALL 1100 •USG60

•USG110 •USG60W

• USG210 • USG20-VPN

•USG310 •USG20W-VPN

• USG1100 •

• USG1900 •

• USG2200-VPN •

Chapter 3 Hardware, Interfaces and Zones

USG/ZyWALL User’s Guide

3.2.2 USG2200-VPN Rack Mounting

3.2.2.1 Installation Requirements

• Two front mounting brackets (short) and two rear mounting brackets (long).

• Two railings (inner and outer)

• Front Brackets & M3 Screws

• Rack M6 Screws and Nuts

Chapter 3 Hardware, Interfaces and Zones

USG/ZyWALL User’s Guide

Note: Failure to use the proper screws may damage the unit.

3.2.2.2 Procedure

1Connect the front brackets to the USG2200-VPN using the M3 bracket screws.

2To separate the inner and outer railings, press tab B (white) and slide out the outer railing.

Chapter 3 Hardware, Interfaces and Zones

USG/ZyWALL User’s Guide

3Connect the inner railing to the USG2200-VPN as shown. Align the holes on the inner rail with the screws

on the side of the USG2200-VPN and slide until it clicks in place. Do the same for the other inner rail on

the other side of the USG2200-VPN. (Use tab C to remove the inner rail from the USG2200-VPN.)

4Connect the front of an outer railing to the front of the rack using the M6 rack screws. Similarly, connect

the rear of an outer railing to the back of the rack using the rack screws. Repeat for the second outer rail

on the other side of the rack.

5Carefully lift the USG2200-VPN with the inner rails attached and slide it onto the outer rails of the rack.

Use the blue tab (A in step 2 above) to slide the USG2200-VPN along the inner rail. Secure the USG2200-

VPN in the rack using the front bracket screws.

Precautions

• Make sure the rack will safely support the combined weight of all the equipment it contains.

• Make sure the position of the USG2200-VPN does not make the rack unstable or top-heavy. Take all

necessary precautions to anchor the rack securely before installing the unit.

Chapter 3 Hardware, Interfaces and Zones

USG/ZyWALL User’s Guide

3.2.3 Wall-mounting

See Table 16 on page 67 for the Zyxel Device models that can be wall-mounted. Do the following to

attach your Zyxel Device to a wall.

1Drill two holes 3 mm ~ 4 mm (0.12" ~ 0.16") wide, 20 mm ~ 30 mm (0.79” ~ 1.18”) deep and 150 mm apart,

into a wall. Place two screw anchors in the holes.

2Screw two screws with 6 mm ~ 8 mm (0.24" ~ 0.31") wide heads into the screw anchors. Do not screw the

screws all the way in to the wall; leave a small gap between the head of the screw and the wall.

The gap must be big enough for the screw heads to slide into the screw slots and the connection cables

to run down the back of the Zyxel Device.

Note: Make sure the screws are securely fixed to the wall and strong enough to hold the

weight of the Zyxel Device with the connection cables.

3Use the holes on the bottom of the Zyxel Device to hang the Zyxel Device on the screws.

Wall-mount the Zyxel Device horizontally. The Zyxel Device's side

panels with ventilation slots should not be facing up or down as this

position is less safe.

Chapter 3 Hardware, Interfaces and Zones

USG/ZyWALL User’s Guide

Figure 54 Wall Mounting

3.3 Default Zones, Interfaces, and Ports

The default configurations for zones, interfaces, and ports are as follows. References to interfaces may

be generic rather than the specific name used in your model. For example, this guide may use “the

WAN interface” rather than “wan1” or “wan2”, “ge2” or” ge3”.

An OPT (optional) Ethernet port can be configured as an additional WAN port, LAN, WLAN, or DMZ port.

The following table shows the default physical port and interface mapping for each model at the time

of writing.

Screw Specifications

Table 17 Default Physical Port - Interface Mapping

PORT / INTERFACE P1 P2 P3 P4 P5 P6 P7 P8

• USG40 wan1 lan1 lan1 lan1 opt

• USG40W wan1 lan1 lan1 lan1 opt

• USG20-VPN sfp wan lan1 lan1 lan1 lan1

• USG20W-VPN sfp wan lan1 lan1 lan1 lan1

• USG60 wan1 wan2 lan1 lan1 lan1 lan1

• USG60W wan1 wan2 lan1 lan1 lan1 lan1

Chapter 3 Hardware, Interfaces and Zones

USG/ZyWALL User’s Guide

The following table shows the default interface and zone mapping for each model at the time of

writing.

•ZyWALL 110

• USG110

• USG210

wan1 wan2 opt lan1 lan1 lan1 dmz

•ZyWALL 310

• ZyWALL 1100

• USG310

• USG1100

• USG1900

• USG2200-VPN

ge1 ge2 ge3 ge4 ge5 ge6 ge7 ge8

Table 18 Default Zone - Interface Mapping

ZONE / INTERFACE WAN LAN1 LAN2 DMZ OPT NO

DEFAULT

ZONE

•USG40 WAN1

WAN1_PPP

LAN1 LAN2 DMZ OPT

OPT_PPP

• USG40W WAN1

WAN1_PPP

LAN1 LAN2 DMZ OPT

OPT_PPP

• USG20-VPN

• USG20W-VPN

WAN

WAN_PPP

OPT

OPT_PPP

LAN1 LAN2 DMZ

•USG60 WAN1

WAN1_PPP

WAN2

WAN2_PPP

LAN1 LAN2 DMZ

• USG60W WAN1

WAN1_PPP

WAN2

WAN2_PPP

LAN1 LAN2 DMZ

•ZyWALL 110

• USG110

• USG210

WAN1

WAN1_PPP

WAN2

WAN2_PPP

LAN1 LAN2 DMZ OPT

OPT_PPP

•ZyWALL 310

• ZyWALL 1100

• USG310

• USG1100

• USG1900

GE1

GE1_PPP

GE2

GE2_PPP

GE3 GE4 GE5 GE3_PPP

GE4_PPP

GE5_PPP

GE6_PPP

GE7_PPP

GE8_PPP

Table 17 Default Physical Port - Interface Mapping (continued)

PORT / INTERFACE P1 P2 P3 P4 P5 P6 P7 P8

Chapter 3 Hardware, Interfaces and Zones

USG/ZyWALL User’s Guide

3.4 Stopping the Zyxel Device

Always use Maintenance > Shutdown > Shutdown or the shutdown command before you turn off the

Zyxel Device or remove the power. Not doing so can cause the firmware to become corrupt.

Table 19 Default Zone - Interface Mapping USG2200-VPN

ZONE / INTERFACE WAN LAN1 LAN2 DMZ 10G NO

DEFAULT

ZONE

• USG2200-VPN GE5, GE5_PPP

GE6, GE6_PPP

GE7 GE8 GE9, GE10 TE17, TE17_PPP

TE18, TE18_PPP

GE1, GE1_PPP

GE2, GE2_PPP

GE3, GE3_PPP

GE4, GE4_PPP

GE7_PPP

GE8_PPP

GE9_PPP

GE10_PPP

GE11,

GE11_PPP

GE12,

GE12_PPP

GE13,

GE13_PPP

GE14,

GE14_PPP

GE15,

GE15_PPP

GE16,

GE16_PPP

USG/ZyWALL User’s Guide

CHAPTER 4

Easy Mode

4.1 Overview

Welcome to the Easy Mode screens. This mode contains wizards that help you configure the Zyxel

Device, links to portals and the advanced menus in Expert Mode.

The following models have Easy Mode wizards.

Use the Easy Mode screens if you have a relatively simple network environment with one WAN (WAN1)

and one LAN (LAN1) connections. If your Zyxel Device has two WAN ports, use WAN1 as the WAN

connection. If you use WAN2 as the WAN connection or want to use both WAN ports, then please use

the Expert Mode screens.

If you prefer to start directly with the advanced screens, then simply click Expert Mode and select

the Expert Mode option.

Figure 55 Switch Modes

4.1.1 Wizards and Links

In the wizards, click the question mark on the right to display or hide the help. Click Next > to continue

to the following screen, < Back to return to the previous screen and Exit or X (top right) to close the

wizard screen without saving any changes.

The following are the Easy Mode wizards and links.

• USG20-VPN • USG20W-VPN

• USG40 • USG40W

• USG60 • USG60W

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

Figure 56 Easy Mode Wizards and Links

•Initial Setup Wizard for Internet access - you should have your Internet access account information at

hand

•VPN Wizard for a site-to-site tunnel between Zyxel Device networks, a tunnel from a remote client

using the Zyxel client VPN software to the Zyxel Device network, or a tunnel from a remote client using

other VPN software to the Zyxel Device network

•Port Forwarding Wizard to set up a server, such as a NAS in your network that you or other people can

access from outside the network

•Wi-Fi and Guest Wizard to set up a wireless name and security for normal and guest (Internet only)

wireless access to the Zyxel Device

•Security Service Wizard to configure subscriptions for content filtering, IDP, and anti-virus services.

There are also links to:

•MyZyxel Portal where you can subscribe for security services such as content filtering, IDP, and anti-

virus

•One Security Portal where you can get configuration walkthroughs, troubleshooting help and other

help on security services and VPN

•Expert Mode which contains all the advanced menus.

4.1.2 Easy Mode Settings

Click to display the Easy Mode Settings menu.

Figure 57 Easy Mode Settings

•Create Recovery Point - a recovery point is a point to which all the Zyxel Device’s configuration can

be reset to after you click Create Recovery Point. Choose this when you have some configurations

done and everything is working correctly.

•Restore Last Recovery Point - choose this if you have problems with recent configurations done on the

Zyxel Device and you want to return to a previous configuration point where everything was working

correctly. You will lose all configurations done after the restore point.

•Restart - reboot the Zyxel Device after upgrading new firmware. It may also be useful when

troubleshooting. Changes in the Web configurator are saved automatically and do not change

when you reboot. If you made changes in the CLI, however, you have to use the write command to

save the configuration before you reboot.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

•Shutdown - use this to safely turn off the Zyxel Device in preparation for disconnecting the power.

Shutdown writes all cached data to the local storage and stops the system processes. It does not turn

off the power. Wait for the device to shut down before you manually turn off or remove the power.

4.1.3 Easy Mode Dashboard

Cloud Helper

Click the Cloud Helper icon to check if there is new firmware available at myZyxel.com.

If there is new firmware available at myZyxel.com, then the icon displays a red N . Click the icon

with the red N to display a What’s New pop-up screen. You need a Firmware Upgrade license to

upgrade the firmware. If you do not have a license, Upgrade Now is grayed out. If you have a license,

click Upgrade Now to directly upgrade firmware. The Zyxel Device will reboot automatically.

Figure 58 Cloud Helper - What’s New

The Easy Mode dashboard is shown next.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

Figure 59 Easy Mode Dashboard

The Easy Mode dashboard contains the following.

•System information, such as firmware version, the length of time the Zyxel Device has been on, date

and time.

•Internet information such as Internet connection type, WAN IP address and a button to test the

connection.

•VPN tunnel information and a button to monitor and create VPN tunnels.

•Security information such as if the firewall is enabled and if supported security services are licensed.

You will be prompted to create a secure policy when a service is licensed and you turn it on in order

for the service to be used.

• Network Client

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

Click the settings icon to manage clients. Click + to add a new network client. In the pop-up

screen, you can add a new client by entering its interface (LAN1 or Guest), IP Address, MAC Address

and Name.

This is the information you see under Network Client:

•LAN information on wired and wireless connections to the Zyxel Device

•Guest Network information on guest wired and wireless connections to the Zyxel Device

•Wi-Fi button to change Wi-Fi channel

•Guest button turn the guest wireless network off or on.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

4.2 Initial Setup Wizard - Language and Overview

Figure 60 Initial Setup Wizard Language

Choose the language for the Easy Mode and Expert Mode screens.

• The initial wizard helps you set up basic options as shown in the screen. At the end, you will have the

choice of finishing the wizard or continuing the wizard to configure the optional features as listed. If

you choose to finish the wizard, you can configure the optional features later using their own

separate links in the Easy Mode main screen.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

4.2.1 Initial Setup Wizard - Internet

Figure 61 Initial Setup Wizard Connect to Internet

This screen displays the Internet settings if the Zyxel Device can detect them automatically.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

If the Zyxel Device cannot detect the Internet settings automatically, then you have to enter them

manually.

• Choose DHCP if you were not given a specific IP address for the Zyxel Device. This allows the Zyxel

Device to be able to get one automatically.

• Choose Ethernet Fixed IP if you were given a specific IP address for the Zyxel Device.

• Choose PPPoE if you were given a PPPoE user name and password.

Note: Enter the Internet access information exactly as your ISP gave you.

4.2.2 Initial Setup Wizard - Internet Access Errors

These are some things you can do if you see Internet access error messages.

WAN 1 Down

Check that your cable connection from the WAN1 interface on the Zyxel Device is connected to the

device you’re using for Internet access such as a broadband router and that the router is turned on. The

LED of the WAN1 interface on the Zyxel Device should be orange.

PPPoE Error

Your Zyxel Device was not able to obtain an IP address. Check that your Internet access information

uses PPPoE as the WAN connection type. Re-enter your PPPoE user name and password exactly as

given. If it fails again, check with your Internet service provider for correct WAN settings and user

credentials.

DHCP Error

Your Zyxel Device was not able to obtain an IP address. Check that your Internet access information

uses DHCP as the WAN connection type. If it fails again, check with your Internet service provider for

correct WAN settings and user credentials.

Ethernet Fixed IP Error

Your Zyxel Device was not able to use the IP address entered. Check that you were given an IP address,

subnet mask and gateway address as part of your Internet access information. Re-enter your IP address,

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

subnet mask and gateway address exactly as given. If it fails again, check with your Internet service

provider for correct IP address, subnet mask and gateway address and other WAN settings.

4.2.3 Initial Setup Wizard - Date and Time

Figure 62 Initial Setup Wizard Date and Time

It’s important to have correct date and time values in the logs. The Zyxel Device can automatically

update the time and date by detecting your time zone and whether Daylight Savings is in effect in that

time zone.

If your Zyxel Device cannot get the correct date and time, it may not able to connect to a time server.

Check that the Zyxel Device has Internet access, then click Synch Now.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

4.2.4 Initial Setup Wizard - Register Device

Figure 63 Initial Setup Wizard Non-Registered Device

Figure 64 Initial Setup Wizard Registered Device

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

• For Zyxel Devices that already have firmware version 4.25 or later, you have to register your Zyxel

Device and activate the corresponding service at myZyxel.com (through your Zyxel Device).

• For Zyxel Devices upgrading to firmware version 4.25, you may skip registering your Zyxel Device and

activating the corresponding service at myZyxel.com. However, it is highly recommended to at least

Click the Register button in this screen to register your device at portal.myzyxel.com. You need to create

a myZyxel.com account at portal.myzyxel.com before you can register your device and activate the

services at myZyxel.com.

When registering the Zyxel Device at myZyxel.com, if you are prompted for the Zyxel Device’s serial

number and LAN MAC address, see the label at the back of the Zyxel Device’s.

Note: The Zyxel Device must be connected to the Internet in order to register.

4.2.5 Initial Setup Wizard - Activate Services

Figure 65 Initial Setup Wizard Non-Activated Services

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

Figure 66 Initial Setup Wizard Activated Services

After you register your Zyxel Device, you can activate the services supported by your model if you have

service licenses. Examples of services are:

• Content Filter (to block websites by category, such as Gambling)

• IDP (to recognize and drop traffic with Intrusion, Detection & Protection attack patterns)

• Anti-Virus (to detect virus patterns in files)

• Anti-Spam (to mark or discard unsolicited commercial or junk e-mail suspect of being sent by

spammers).

Click Refresh and wait a few moments for the service information to update in this screen. If the page

does not refresh, make sure the Internet connection is working and click Refresh again. To check your

Internet connection, try to access the Internet from a computer connected to a LAN port on the Zyxel

Device. If you cannot, then check your Internet access settings on the Zyxel Device.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

4.2.6 Initial Setup Wizard - Wi-Fi

Figure 67 Initial Setup Wizard Wi-Fi

Select Enable Wi-Fi Network if you want wireless devices to be able to wirelessly access the Zyxel Device

and all resources connected to the Zyxel Device. Configure a descriptive name of from 1 to 32 alpha-

numeric characters, hyphens or underscores (a-z A-Z 0-9 -_) for the wireless network name (Wi-Fi). Set a

Password of between 8 and 63 printable ASCII characters (including spaces and symbols) or 64

hexadecimal characters (0-9 a-f) that wireless users will have to enter for access to the Zyxel Device

wireless network.

Note: You must change the Password to continue.

Select Enable Guest Wi-Fi Network if you want wireless devices to only be able to wirelessly access the

Internet via the Zyxel Device for up to 4 hours. Configure a descriptive name of from 1 to 32 alpha-

numeric characters, hyphens or underscores (a-z A-Z 0-9 -_) for the wireless network name (Wi-Fi). Set a

Password of between 8 and 63 printable ASCII characters (including spaces and symbols) or 64

hexadecimal characters (0-9 a-f) that wireless users will have to enter for access to the Zyxel Device

Guest wireless network.

The Guest Wi-Fi Network allows Internet access only for up to 4 hours by default. Log in again if the time

has elapsed. You can change the default time for Guest Wi-Fi access in the Wi-Fi and Guest Wizard.

The Zyxel Device uses WPA2-PSK with AES encryption so wireless clients must be able to support AES

encryption to wirelessly connect to the Zyxel Device using WPA2-PSK.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

4.2.7 Initial Setup Wizard - Congratulations

Figure 68 Initial Setup Wizard Congratulations

This screen shows if your Internet access is successfully configured. You can save changes and exit the

Initial Wizard here by clearing Security Service, Port Forwarding, Guest LAN and VPN service selections

and clicking Finish. Alternatively, select desired security services to continue configuring them as part of

the Initial Wizard (Finish becomes Continue). If you want to configure these services later you can

access them from the tabs in the dashboard.

Select from the following to continue configuring in this screen:

•Security Service (Content Filter, IDP, Anti Virus) to configure subscriptions for these services

•Port Forwarding to set up a server in your network that people outside the network can access

•Guest LAN (Wired Network) to set up a guest network where users can access the Internet only from a

wired connection to the OPT port for a limited time

•VPN for a site-to-site tunnel between Zyxel Device networks, a tunnel from a remote client using the

Zyxel client VPN software to the Zyxel Device network, or a tunnel from a remote client using other

VPN software to the Zyxel Device network.

A restore point is a recovery point where you can reset the Zyxel Device’s configuration to if you have

problems later.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

4.3 Initial Setup Wizard - Security Service

Figure 69 Initial Setup Wizard Security Service

Configure licensed (non-grayed-out) services in this screen. After you buy a license for a service, you

must activate it at myZyxel.com. Make sure the Zyxel Device Internet connection is working correctly.

Select Enable Content Filter to block websites by category, such as Chat websites. Note that if you select

Chat, the Content Filter blocks chat websites and not chat apps. Therefore, the Skype app can still be

used although the Skype website would be blocked. Select the categories you want to block.

•Chat: Sites that enable web-based exchange of real time messages through chat services or chat

rooms. For example, me.sohu.com, blufiles.storage.live.com.

•Dating & Personals: Sites that promote networking for interpersonal relationships such as dating and

marriage. Includes sites for match-making, online dating, spousal introduction. For example, www.i-

part.com.tw, www.imatchi.com.

•Gambling: Sites that offer or are related to online gambling, lottery, casinos and betting agencies

involving chance. For example, www.taiwanlottery.com.tw, www.i-win.com.tw, www.hkjc.com.

•Games: Sites relating to computer or other games, information about game producers, or how to

obtain cheat codes. Game-related publication sites. For example, www.gamer.com.tw,

www.wowtaiwan.com.tw, tw.lineage.gamania.com.

•Hacking: Sites that promote or give advice about how to gain unauthorized access to proprietary

computer systems, for the purpose of stealing information, perpetrating fraud, creating viruses, or

committing other illegal activity related to theft of digital information. For example,

www.hackbase.com, www.chinahacker.com.

•Illegal Software: Sites that illegally distribute software or copyrighted materials such as movies or

music, software cracks, illicit serial numbers, illegal license key generators. For example,

www.zhaokey.com.cn, www.tiansha.net.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

•Instant Messaging: Sites that enable logging in to instant messaging services such as ICQ, AOL Instant

Messenger, IRC, MSN, Jabber, Yahoo Messenger, and the like. For example, www.meebo.com,

www.aim.com, www. ebuddy.com.

•Job Search: Sites containing job listings, career information, assistance with job searches (such as

resume writing, interviewing tips, etc.), employment agencies or head hunters. For example,

www.104.com.tw, www.1111.com.tw, www.yes123.com.tw.

•Pornography/Sexually Explicit: Sites that contain explicit sexual content. Includes adult products such

as sex toys, CD-ROMs, and videos, adult services such as videoconferencing, escort services, and strip

clubs, erotic stories and textual descriptions of sexual acts. For example, www.dvd888.com,

www.18center.com, blog.sina.com.tw.

•Social Networking: Sites that enable social networking for online communities of various topics, for

friendship, dating, or professional reasons. For example, www.facebook.com, www.flickr.com,

www.groups.google.com.

•Streaming Media & Downloads: Sites that deliver streaming content, such as Internet radio, Internet TV

or MP3 and live or archived media download sites. Includes fan sites, or official sites run by musicians,

bands, or record labels. For example, www.youtube.com, pfp.sina.com.cn, my.xunlei.com.

•Tasteless: Sites with offensive or tasteless content such as bathroom humor or profanity. For example,

comedycentral.com, dilbert.com.

•Violence: Sites that contain images or text depicting or advocating physical assault against humans,

animals, or institutions. Sites of a particularly gruesome nature such as shocking depictions of blood or

wounds, or cruel animal treatment. For example, crimescene.com, deathnet.com,

michiganmilitia.com.

Select Enable IDP to drop traffic with recognized Intrusion, Detection & Protection attack patterns.

Select Enable Anti-Virus to detect virus patterns in files.

Use the Security Service Wizard if you need more detailed settings. Grayed-out services are not licensed

yet. Please go to portal.myzyxel.com to register and manage your services.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

4.4 Initial Setup Wizard - Port Forwarding

Figure 70 Initial Setup Wizard Port Forwarding

NAT port forwarding allows the Zyxel Device to direct incoming traffic from the Internet to the correct

virtual server in your network. For example, if you have a NAS server in your network that you or other

people need access to from outside your network, select the IP address of the NAS from Client. Then,

select the service(s) that your NAS provides (for example FTP, HTTP, HTTPS) from the Available box and

use the right arrow to move each service to the Member box.

Even though the NAS is in your local network receiving the protection of the Zyxel Device, you can still

access that NAS using these services from anywhere outside your network.

Run the main Port Forwarding Wizard if you cannot see service you need in the list. In that wizard you

can define other services.

A client or device in your network acting as a server for forwarded services (for example, the NAS) needs

to have a static address. If the client selected does not have a static IP address, the IP address may

change when the client reboots, so the Zyxel Device may not be able to find it. If this happens, check

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

for the new IP address of the client. Then add the new IP address by clicking Add here and entering it in

the pop-up screen.

4.5 Initial Setup Wizard - Guest LAN

Figure 71 Initial Setup Wizard Guest LAN

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

Select Enable Guest Network (for wired client s) to convert the OPT or P6 port (depending on your model)

to be a guest port and isolate it from the LAN/DMZ ports. Devices connected to the guest port are

allowed Internet access only and do not have access to networks connected to the other ports.

When the OPT or P6 port is not a guest port, then guest devices connected to that port can

communicate with all networks, including devices connected to the LAN/DMZ ports. If that is not your

intention, make sure Enable Guest Network (for wired clients) is selected and that guest devices are only

connected to the OPT or P6 port on the Zyxel Device.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

4.5.1 Connecting AP Scenarios

If you connect an AP to a LAN port, then users can use the AP’s SSID to wirelessly access all wired

resources connected to the LAN ports and Internet access.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

If you connect an AP to the Guest port, then users can use the AP’s SSID to wirelessly access all wired

resources connected to the Guest port (only) and Internet access. You must select both Enable Guest

Wi-Fi Network and Guest LAN (Wired Network).

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

4.6 Initial Setup Wizard - VPN

Figure 72 Initial Setup Wizard VPN

A VPN is a secure, private connection between two end points. An end point could be a VPN gateway

like the Zyxel Device itself or a computer with VPN software installed. Select a VPN wizard type and click

Launch to begin that wizard and end the Initial Setup Wizard with changes saved. Click Exit to leave the

wizard with changes unsaved.

•Select IPSec VPN Settings to create a secure, private connection between two Zyxel Devices. Two

networks (sites) behind the Zyxel Devices can then communicate securely with each other.

Make sure that the settings on both Zyxel Devices are correct and reciprocal. What is a local setting

for one should be the equivalent remote setting on the other. Make sure the pre-shared key,

negotiation mode, encryption, authentication settings, DH key group and so on are the same on both

Zyxel Devices.

Make sure that both Zyxel Devices are able to communicate with each other. Try pinging one

gateway from a computer behind the other.

Make sure that there is not a firewall blocking VPN traffic in front of one of the Zyxel Devices.

•Select IPSec VPN Settings for Configuration Provisioning to create a secure, private connection

between a Zyxel Device and a computer with Zyxel client VPN software installed. See the client VPN

software’s help to see how to configure it. The computer with client VPN software installed and the

Zyxel Device can then communicate securely with each other.

Make sure the client VPN software is installed and configured correctly on the computer. See the

client VPN software’s help if anything is unclear.

Make sure the VPN settings such as the pre-shared key (or certificate), negotiation mode, encryption,

authentication settings, DH key group on the computer and the Zyxel Device are correct. Make sure

that the client is able to communicate with the Zyxel Device. Try pinging the Zyxel Device from the

client.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

•Select VPN Settings for L2TP VPN Settings to create a secure, private connection between the Zyxel

Device and a computer with L2TP VPN software installed. Many computer operating systems come

with L2TP installed. See your computer’s help to see how to configure it. The L2TP computer and the

Zyxel Device will then communicate securely with each other.

Make sure that the computer with L2TP is able to communicate with the Zyxel Device. Try pinging the

Zyxel Device from the computer. Make sure that L2TP traffic is allowed through the WAN on the Zyxel

Device.

4.6.1 VPN Setup Wizard: Wizard Type

Choose Express to create a VPN rule with the default phase 1 and phase 2 settings to connect to

another ZLD-based Zyxel Device using a pre-shared key.

Choose Advanced to change the default settings and/or use certificates instead of a pre-shared key to

create a VPN rule to connect to another IPSec device.

Figure 73 VPN Setup Wizard: Wizard Type

4.6.2 VPN Express Wizard - Scenario

Click the Express radio button as shown in the previous figure to display the following screen.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

Figure 74 VPN Express Wizard: Scenario

Rule Name: Type the name used to identify this VPN connection (and VPN gateway). You may use 1-31

alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a number.

This value is case-sensitive.

Select the scenario that best describes your intended VPN connection. The figure on the left of the

screen changes to match the scenario you select.

•Site-to-site - choose this if the remote IPSec router has a static IP address or a domain name. This Zyxel

Device can initiate the VPN tunnel. The remote IPSec router can also initiate the VPN tunnel if this Zyxel

Device has a static IP address or a domain name.

SITE-TO-SITE SITE-TO-SITE WITH

DYNAMIC PEER REMOTE ACCESS

(SERVER ROLE) REMOTE ACCESS (CLIENT

ROLE)

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

•Site-to-site with Dynamic Peer - choose this if the remote IPSec router has a dynamic IP address. You

don’t specify the remote IPSec router’s address, but you specify the remote policy (the addresses of

the devices behind the remote IPSec router). This Zyxel Device must have a static IP address or a

domain name. Only the remote IPSec router can initiate the VPN tunnel.

•Remote Access (Server Role) - choose this to allow incoming connections from IPSec VPN clients. The

clients have dynamic IP addresses and are also known as dial-in users. You don’t specify the

addresses of the client IPSec routers or the remote policy. This creates a dynamic IPSec VPN rule that

can let multiple clients connect. Only the clients can initiate the VPN tunnel.

•Remote Access (Client Role) - choose this to connect to an IPSec server. This Zyxel Device is the client

(dial-in user). Client role Zyxel Devices initiate IPSec VPN connections to a server role Zyxel Device. This

Zyxel Device can have a dynamic IP address. The IPSec server doesn’t configure this Zyxel Device’s IP

address or the addresses of the devices behind it. Only this Zyxel Device can initiate the VPN tunnel.

4.6.3 VPN Express Wizard - Configuration

Figure 75 VPN Express Wizard: Configuration

•Secure Gateway: Any displays in this field if it is not configurable for the chosen scenario. Otherwise,

enter the WAN IP address or domain name of the remote IPSec device (secure gateway) to identify

the remote IPSec router by its IP address or a domain name. Use 0.0.0.0 if the remote IPSec router has

a dynamic WAN IP address.

•Pre-Shared Key: Type the password. Both ends of the VPN tunnel must use the same password. Use 8

to 31 case-sensitive ASCII characters or 8 to 31 pairs of hexadecimal (“0-9”, “A-F”) characters.

Proceed a hexadecimal key with “0x”. You will receive a PYLD_MALFORMED (payload malformed)

packet if the same pre-shared key is not used on both ends.

•Local Policy (IP/Mask): Type the IP address of a computer on your network that can use the tunnel.

You can also specify a subnet. This must match the remote IP address configured on the remote IPSec

device.

•Remote Policy (IP/Mask): Any displays in this field if it is not configurable for the chosen scenario.

Otherwise, type the IP address of a computer behind the remote IPSec device. You can also specify

a subnet. This must match the local IP address configured on the remote IPSec device.

4.6.4 VPN Express Wizard - Summary

This screen provides a read-only summary of the VPN tunnel’s configuration and commands that you

can copy and paste into another ZLD-based Zyxel Device’s command line interface to configure it.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

100

Figure 76 VPN Express Wizard: Summary

•Rule Name: Identifies the VPN gateway policy.

•Secure Gateway: IP address or domain name of the remote IPSec device. If this field displays Any,

only the remote IPSec device can initiate the VPN connection.

•Pre-Shared Key: VPN tunnel password. It identifies a communicating party during a phase 1 IKE

negotiation.

•Local Policy: IP address and subnet mask of the computers on the network behind your Zyxel Device

that can use the tunnel.

•Remote Policy: IP address and subnet mask of the computers on the network behind the remote

IPSec device that can use the tunnel. If this field displays Any, only the remote IPSec device can

initiate the VPN connection.

• Copy and paste the Configuration for Secure Gateway commands into another ZLD-based Zyxel

Device’s command line interface to configure it to serve as the other end of this VPN tunnel. You can

also use a text editor to save these commands as a shell script file with a “.zysh” filename extension.

Use the file manager to run the script in order to configure the VPN connection. See the commands

reference guide for details on the commands displayed in this list.

4.6.5 VPN Express Wizard - Finish

Now the rule is configured on the Zyxel Device. The Phase 1 rule settings appear in the VPN > IPSec VPN

> VPN Gateway screen and the Phase 2 rule settings appear in the VPN > IPSec VPN > VPN Connection

screen.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

101

Figure 77 VPN Express Wizard: Finish

Click Close to exit the wizard.

4.6.6 VPN Advanced Wizard - Scenario

Click the Advanced radio button as shown in Figure 73 on page 97 to display the following screen.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

102

Figure 78 VPN Advanced Wizard: Scenario

Rule Name: Type the name used to identify this VPN connection (and VPN gateway). You may use 1-31

alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a number.

This value is case-sensitive.

Select the scenario that best describes your intended VPN connection. The figure on the left of the

screen changes to match the scenario you select.

•Site-to-site - The remote IPSec device has a static IP address or a domain name. This Zyxel Device can

initiate the VPN tunnel.

•Site-to-site with Dynamic Peer - The remote IPSec device has a dynamic IP address. Only the remote

IPSec device can initiate the VPN tunnel.

•Remote Access (Server Role) - Allow incoming connections from IPSec VPN clients. The clients have

dynamic IP addresses and are also known as dial-in users. Only the clients can initiate the VPN tunnel.

•Remote Access (Client Role) - Connect to an IPSec server. This Zyxel Device is the client (dial-in user)

and can initiate the VPN tunnel.

4.6.7 VPN Advanced Wizard - Phase 1 Settings

There are two phases to every IKE (Internet Key Exchange) negotiation – phase 1 (Authentication) and

phase 2 (Key Exchange). A phase 1 exchange establishes an IKE SA (Security Association).

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

103

Figure 79 VPN Advanced Wizard: Phase 1 Settings

•Secure Gateway: Any displays in this field if it is not configurable for the chosen scenario. Otherwise,

enter the WAN IP address or domain name of the remote IPSec device (secure gateway) to identify

the remote IPSec device by its IP address or a domain name. Use 0.0.0.0 if the remote IPSec device

has a dynamic WAN IP address.

•My Address (interface): Select an interface from the drop-down list box to use on your Zyxel Device.

•Negotiation Mode: This displays Main or Aggressive:

•Main encrypts the ZyWALL/USG’s and remote IPSec router’s identities but takes more time to

establish the IKE SA

•Aggressive is faster but does not encrypt the identities.

The ZyWALL/USG and the remote IPSec router must use the same negotiation mode. Multiple SAs

connecting through a secure gateway must have the same negotiation mode.

•Encryption Algorithm: 3DES and AES use encryption. The longer the key, the higher the security (this

may affect throughput). Both sender and receiver must use the same secret key, which can be used

to encrypt and decrypt the message or to generate and verify a message authentication code. The

DES encryption algorithm uses a 56-bit key. Triple DES (3DES) is a variation on DES that uses a 168-bit

key. As a result, 3DES is more secure than DES. It also requires more processing power, resulting in

increased latency and decreased throughput. AES128 uses a 128-bit key and is faster than 3DES.

AES192 uses a 192-bit key, and AES256 uses a 256-bit key.

•Authentication Algorithm: MD5 gives minimal security and SHA512 gives the highest security. MD5

(Message Digest 5) and SHA (Secure Hash Algorithm) are hash algorithms used to authenticate

packet data. The stronger the algorithm the slower it is.

•Key Group: DH5 is more secure than DH1 or DH2 (although it may affect throughput). DH1 (default)

refers to Diffie-Hellman Group 1 a 768 bit random number. DH2 refers to Diffie-Hellman Group 2 a 1024

bit (1Kb) random number. DH5 refers to Diffie-Hellman Group 5 a 1536 bit random number.

•SA Life Time: Set how often the Zyxel Device renegotiates the IKE SA. A short SA life time increases

security, but renegotiation temporarily disconnects the VPN tunnel.

•NAT Traversal: Select this if the VPN tunnel must pass through NAT (there is a NAT router between the

IPSec devices).

Note: The remote IPSec device must also have NAT traversal enabled. See the help in the

main IPSec VPN screens for more information.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

104

•Dead Peer Detection (DPD) has the Zyxel Device make sure the remote IPSec device is there before

transmitting data through the IKE SA. If there has been no traffic for at least 15 seconds, the Zyxel

Device sends a message to the remote IPSec device. If it responds, the Zyxel Device transmits the

data. If it does not respond, the Zyxel Device shuts down the IKE SA.

•Authentication Method: Select Pre-Shared Key to use a password or Certificate to use one of the Zyxel

Device’s certificates.

4.6.8 VPN Advanced Wizard - Phase 2

Phase 2 in an IKE uses the SA that was established in phase 1 to negotiate SAs for IPSec.

Figure 80 VPN Advanced Wizard: Phase 2 Settings

•Active Protocol: ESP is compatible with NAT, AH is not.

•Encapsulation: Tunnel is compatible with NAT, Transport is not.

•Encryption Algorithm: 3DES and AES use encryption. The longer the AES key, the higher the security

(this may affect throughput). Null uses no encryption.

•Authentication Algorithm: MD5 gives minimal security and SHA512 gives the highest security. MD5

(Message Digest 5) and SHA (Secure Hash Algorithm) are hash algorithms used to authenticate

packet data. The stronger the algorithm the slower it is.

•SA Life Time: Set how often the Zyxel Device renegotiates the IKE SA. A short SA life time increases

security, but renegotiation temporarily disconnects the VPN tunnel.

•Perfect Forward Secrecy (PFS): Disabling PFS allows faster IPSec setup, but is less secure. Select DH1,

DH2 or DH5 to enable PFS. DH5 is more secure than DH1 or DH2 (although it may affect throughput).

DH1 refers to Diffie-Hellman Group 1 a 768 bit random number. DH2 refers to Diffie-Hellman Group 2 a

1024 bit (1Kb) random number. DH5 refers to Diffie-Hellman Group 5 a 1536 bit random number (more

secure, yet slower).

•Local Policy (IP/Mask): Type the IP address of a computer on your network. You can also specify a

subnet. This must match the remote IP address configured on the remote IPSec device.

•Remote Policy (IP/Mask): Type the IP address of a computer behind the remote IPSec device. You

can also specify a subnet. This must match the local IP address configured on the remote IPSec

device.

•Nailed-Up: This displays for the site-to-site and remote access client role scenarios. Select this to have

the Zyxel Device automatically renegotiate the IPSec SA when the SA life time expires.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

105

4.6.9 VPN Advanced Wizard - Summary

This is a read-only summary of the VPN tunnel settings.

Figure 81 VPN Advanced Wizard: Summary

•Rule Name: Identifies the VPN connection (and the VPN gateway).

•Secure Gateway: IP address or domain name of the remote IPSec device.

•Pre-Shared Key: VPN tunnel password.

•Certificate: The certificate the Zyxel Device uses to identify itself when setting up the VPN tunnel.

•Local Policy: IP address and subnet mask of the computers on the network behind your Zyxel Device

that can use the tunnel.

•Remote Policy: IP address and subnet mask of the computers on the network behind the remote

IPSec device that can use the tunnel.

• Copy and paste the Configuration for Remote Gateway commands into another ZLD-based Zyxel

Device’s command line interface.

• Click Save to save the VPN rule.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

106

4.6.10 VPN Advanced Wizard - Finish

Now the rule is configured on the Zyxel Device. The Phase 1 rule settings appear in the VPN > IPSec VPN

> VPN Gateway screen and the Phase 2 rule settings appear in the VPN > IPSec VPN > VPN Connection

screen.

Figure 82 VPN Wizard: Finish

Click Close to exit the wizard.

4.7 VPN Settings for Configuration Provisioning Wizard:

Wizard Type

Use VPN Settings for Configuration Provisioning to set up a VPN rule that can be retrieved with the Zyxel

Device IPSec VPN Client.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

107

VPN rules for the Zyxel Device IPSec VPN Client have certain restrictions. They must not contain the

following settings:

•AH active protocol

•NULL encryption

•SHA512 authentication

• A subnet or range remote policy

Choose Express to create a VPN rule with the default phase 1 and phase 2 settings and to use a pre-

shared key.

Choose Advanced to change the default settings and/or use certificates instead of a pre-shared key in

the VPN rule.

Figure 83 VPN Settings for Configuration Provisioning Express Wizard: Wizard Type

4.7.1 Configuration Provisioning Express Wizard - VPN Settings

Click the Express radio button as shown in the previous screen to display the following screen.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

108

Figure 84 VPN for Configuration Provisioning Express Wizard: Settings Scenario

Rule Name: Type the name used to identify this VPN connection (and VPN gateway). You may use 1-31

alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a number.

This value is case-sensitive.

Application Scenario: Only the Remote Access (Server Role) is allowed in this wizard. It allows incoming

connections from the Zyxel Device IPSec VPN Client.

4.7.2 Configuration Provisioning VPN Express Wizard - Configuration

Click Next to continue the wizard.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

109

Figure 85 VPN for Configuration Provisioning Express Wizard: Configuration

•Secure Gateway: Any displays in this field because it is not configurable in this wizard. It allows

incoming connections from the Zyxel Device IPSec VPN Client.

•Pre-Shared Key: Type the password. Both ends of the VPN tunnel must use the same password. Use 8

to 31 case-sensitive ASCII characters or 8 to 31 pairs of hexadecimal (“0-9”, “A-F”) characters.

Proceed a hexadecimal key with “0x”. You will receive a PYLD_MALFORMED (payload malformed)

packet if the same pre-shared key is not used on both ends.

•Local Policy (IP/Mask): Type the IP address of a computer on your network. You can also specify a

subnet. This must match the remote IP address configured on the remote IPSec device.

•Remote Policy (IP/Mask): Any displays in this field because it is not configurable in this wizard.

4.7.3 VPN Settings for Configuration Provisioning Express Wizard - Summary

This screen has a read-only summary of the VPN tunnel’s configuration and commands you can copy

and paste into another ZLD-based Zyxel Device’s command line interface to configure it.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

110

Figure 86 VPN for Configuration Provisioning Express Wizard: Summary

•Rule Name: Identifies the VPN gateway policy.

•Secure Gateway: Any displays in this field because it is not configurable in this wizard. It allows

incoming connections from the Zyxel Device IPSec VPN Client.

•Pre-Shared Key: VPN tunnel password. It identifies a communicating party during a phase 1 IKE

negotiation.

•Local Policy: (Static) IP address and subnet mask of the computers on the network behind your Zyxel

Device that can be accessed using the tunnel.

•Remote Policy: Any displays in this field because it is not configurable in this wizard.

• The Configuration for Secure Gateway displays the configuration that the Zyxel Device IPSec VPN

Client will get from the Zyxel Device.

• Click Save to save the VPN rule.

4.7.4 VPN Settings for Configuration Provisioning Express Wizard - Finish

Now the rule is configured on the Zyxel Device. The Phase 1 rule settings appear in the VPN > IPSec VPN

> VPN Gateway screen and the Phase 2 rule settings appear in the VPN > IPSec VPN > VPN Connection

screen. Enter the IP address of the Zyxel Device in the Zyxel Device IPSec VPN Client to get all these VPN

settings automatically from the Zyxel Device.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

111

Figure 87 VPN for Configuration Provisioning Express Wizard: Finish

Click Close to exit the wizard.

4.7.5 VPN Settings for Configuration Provisioning Advanced Wizard -

Scenario

Click the Advanced radio button as shown in the screen shown in Figure 83 on page 107 to display the

following screen.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

112

Figure 88 VPN for Configuration Provisioning Advanced Wizard: Scenario Settings

Rule Name: Type the name used to identify this VPN connection (and VPN gateway). You may use 1-31

alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a number.

This value is case-sensitive.

Application Scenario: Only the Remote Access (Server Role) is allowed in this wizard. It allows incoming

connections from the Zyxel Device IPSec VPN Client.

Click Next to continue the wizard.

4.7.6 VPN Settings for Configuration Provisioning Advanced Wizard - Phase

1 Settings

There are two phases to every IKE (Internet Key Exchange) negotiation – phase 1 (Authentication) and

phase 2 (Key Exchange). A phase 1 exchange establishes an IKE SA (Security Association).

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

113

Figure 89 VPN for Configuration Provisioning Advanced Wizard: Phase 1 Settings

•Secure Gateway: Any displays in this field because it is not configurable in this wizard. It allows

incoming connections from the Zyxel Device IPSec VPN Client.

•My Address (interface): Select an interface from the drop-down list box to use on your Zyxel Device.

•Negotiation Mode: This displays Main or Aggressive:

•Main encrypts the ZyWALL/USG’s and remote IPSec router’s identities but takes more time to

establish the IKE SA

•Aggressive is faster but does not encrypt the identities.

The ZyWALL/USG and the remote IPSec router must use the same negotiation mode. Multiple SAs

connecting through a secure gateway must have the same negotiation mode.

•Encryption Algorithm: 3DES and AES use encryption. The longer the key, the higher the security (this

may affect throughput). Both sender and receiver must know the same secret key, which can be

used to encrypt and decrypt the message or to generate and verify a message authentication code.

The DES encryption algorithm uses a 56-bit key. Triple DES (3DES) is a variation on DES that uses a 168-

bit key. As a result, 3DES is more secure than DES. It also requires more processing power, resulting in

increased latency and decreased throughput. AES128 uses a 128-bit key and is faster than 3DES.

AES192 uses a 192-bit key and AES256 uses a 256-bit key.

•Authentication Algorithm: MD5 (Message Digest 5) and SHA (Secure Hash Algorithm) are hash

algorithms used to authenticate packet data. MD5 gives minimal security. SHA1 gives higher security

and SHA256 gives the highest security. The stronger the algorithm, the slower it is.

•Key Group: DH5 is more secure than DH1 or DH2 (although it may affect throughput). DH1 (default)

refers to Diffie-Hellman Group 1 a 768 bit random number. DH2 refers to Diffie-Hellman Group 2 a 1024

bit (1Kb) random number. DH5 refers to Diffie-Hellman Group 5 a 1536 bit random number.

•SA Life Time: Set how often the Zyxel Device renegotiates the IKE SA. A short SA life time increases

security, but renegotiation temporarily disconnects the VPN tunnel.

•Authentication Method: Select Pre-Shared Key to use a password or Certificate to use one of the Zyxel

Device’s certificates.

4.7.7 VPN Settings for Configuration Provisioning Advanced Wizard - Phase

Phase 2 in an IKE uses the SA that was established in phase 1 to negotiate SAs for IPSec.

Chapter 4 Easy Mode

USG/ZyWALL User’s Guide

114

Figure 90 VPN for Configuration Provisioning Advanced Wizard: Phase 2 Settings

•Active Protocol: ESP is compatible with NAT. AH is not available in this wizard.