ZyXEL Communications ZyXEL ZyWALL 35 Manual

ZyWALL 35

Security Appliance

Support Notes

Version 4.03

Sep. 2007

ZyWALL35 Support Notes

INDEX

Application Notes....................................................................................................12

Seamless Incorporation into your network..........................................................12

Using Transparent (Bridge Mode) Firewall ............................................12

Internet Connection...................................................................................17

DHCP server/client/relay + flexible port role configuration..................19

Using NAT/Multi-NAT ..............................................................................23

Optimize network performance & availability....................................................33

Using Dual WAN / Load Balancing and policy route .............................33

Using Dual WAN.................................................................................34

WAN backup (Active/Passive mode)...........................................34

Load Balancing (Active/Active Mode)........................................43

Using Policy Route..............................................................................52

Using Bandwidth Management ................................................................53

Secure Connections across the Internet...............................................................67

Site-to-Site VPN (Intranet) Scenario........................................................67

Configure ZyWALLs with Static WAN IPAddress.............................67

Configure ZyWALL with Dynamic WAN IPAddress.........................68

Configure ZyWALL behind NAT Router ............................................70

Mapping multiple Network policy to same gateway policy................72

Using DDNS for VPN Redundancy ....................................................77

Using Certificate for Device Authentication........................................78

Using Self-signed Certificates .....................................................78

Online Enroll Certificates............................................................82

Offline Enroll Certificates............................................................91

Using Pre-Shared Key for Device Authentication.............................124

Using VPN routing between branches...............................................125

NAT over IPSec on ZyNOS...............................................................135

Never lost your VPN connection (IPSec High Availability)..............144

How to configure the VPN HA..................................................145

Access control and security VPN connection (Security policy

enforcement IPSec)............................................................................147

How to configure access control rule over VPN .......................148

How to configure Security policy (AV/IDP/AS) over VPN......152

How to configure Web filtering rule over VPN – Content Filter154

ZyWALLvs 3rd Party VPN Gateway....................................................155

SonicWALL with ZyWALL VPN Tunneling.............................155

NetScreen with ZyWALL VPN Tunneling................................164

ZyWALL35 Support Notes

Check Point with ZyWALL VPN Tunneling ............................178

FortiNet with ZyWALL VPN Tunneling ...................................213

Remote Access VPN Scenario.................................................................227

Using xAuth for User Authentication................................................228

ZyXEL VPN Client to ZyWALL Tunneling......................................230

Flexible Wireless Connection and Security...........................................239

Deploy the ZyWALL WLAN security policy....................................240

Threat Management...........................................................................................244

To protect computer networks against virus intrusions and attacks

from Internet............................................................................................245

To Control IM/P2PApplications Usage to Increase Employee

Productivity..............................................................................................251

To filter non-work related and unproductive web surfing to mitigate

spyware and phishing threats .................................................................256

To eliminate spam mails to block unwanted messages everyday.........266

Threat Reports....................................................................................................271

Centralized Management...................................................................................276

Using Vantage CNM for Management...................................................276

FAQ ...........................................................................................................................281

A. Product FAQ .................................................................................................281

A01. What is the ZyWALLInternet Access Sharing Router?.............281

A02. Will the ZyWALL work with my Internet connection?...............281

A03. What do I need to use the ZyWALL?............................................281

A04. What is PPPoE? ..............................................................................281

A05. Does the ZyWALLsupport PPPoE?..............................................282

A06. How do I know I am using PPPoE? ..............................................282

A07. Why does my Internet Service Provider use PPPoE?..................282

A08. How can I configure the ZyWALL?..............................................282

A09. What can we do with ZyWALL?...................................................282

A10. Does ZyWALLsupport dynamic IP addressing?.........................282

A11. What is the difference between the internal IP and the real IP

from my ISP?............................................................................................282

A12. How does e-mail work through the ZyWALL?............................283

A13. Is it possible to access a server running behind NAT from the

outside Internet? If possible, how?.........................................................283

A14. What DHCPcapability does the ZyWALL support?...................283

A15. What are the capability of wireless feature of ZyWALL.............283

A16. What is the coverage range of Wireless in ZyWALL?.................283

ZyWALL35 Support Notes

A17. How do I used the reset button, more over what field of

parameter will be reset by reset button?................................................283

A18. What network interface does the new ZyWALL series support?284

A19. How does the ZyWALLsupport TFTP?.......................................284

A20. Can the ZyWALL support TFTPover WAN?..............................284

A21. How can I upload data to outside Internet over the one-way

cable?.........................................................................................................284

A22. My ZyWALLcan not get an IP address from the ISPto connect

to the Internet, what can I do?................................................................284

A23. What is BOOTP/DHCP?................................................................285

A24. What is DDNS?................................................................................285

A25. When do I need DDNS service?.....................................................286

A26. What DDNS servers does the ZyWALLsupport?........................286

A27. What is DDNS wildcard? ...............................................................286

A28. Does the ZyWALLsupport DDNS wildcard?...............................286

A29. Can the ZyWALLNAT handle IPSec packets sent by the VPN

gateway behind ZyWALL? .....................................................................286

A30. How do I setup my ZyWALLfor routing IPSec packets over

NAT? .........................................................................................................286

A31. What is STP(Spanning Tree Protocol) /RSTP (Rapid STP)?.....287

A32. What is the flow ZyWALL handles inbound and outgoing

traffic?.......................................................................................................287

A33. What is “UTM”?.............................................................................287

A34. What are the differences between ZyWALLUTM models and

previous ZyWALL models?.....................................................................287

A35. What are the key new features of ZyWALLUTM?.....................288

B. Firmware Upgrade FAQ................................................................................288

B01. Which ZyWALLmodels are eligible to be upgraded to run

ZyNOS v4.01?...........................................................................................288

B02. Why it’s conditional to upgrade to ZyNOS v4.01 for ZyWALL

70?..............................................................................................................289

B03. What is ZyNOS v3.65 for ZyWALL 70?........................................289

B04. What happens if I wrongfully upgrade firmware of a ZyWALL

70 with only 32MB of RAM to ZyNOS v4.01 directly?........................289

B05. What happened if I upgrade a ZyWALL 70 running ZyNOS

v3.62/3.63/3.64 to v4.01 directly?............................................................290

B06. I am a 32MB ZyWALL70 owner, how can I upgrade to ZyNOS

v4.01 having AV+IDP and AS features?.................................................290

ZyWALL35 Support Notes

B07. If I were a 32MB ZyWALL 70 owner and a Content Filtering

service subscriber, will my current license status be retained after

joining your ZyWALL 70 trade-in promotion?.....................................290

B08. What’s the firmware upgrade path for my current ZyWALL 5

and ZyWALL 35?.....................................................................................290

B09. After a successful firmware upgrade to ZyNOS v4.01, what’s the

default setting of AV+IDP, AS and CF? .................................................290

B10. What happens to my original system configurations after a

successful firmware upgrade to ZyNOS v4.01?....................................291

B11. What’s the downgrade procedure of ZyWALL 70 running

ZyNOS v4.01?...........................................................................................291

B12. Can I downgrade a ZyWALL5 or ZyWALL 35 running ZyNOS

v4.01 back to ZyNOS v3.64 (or below)?.................................................291

C. Turbo Card FAQ............................................................................................291

C01. Can I insert the ZyWALLTurbo Card & wireless card

simultaneously into ZyWALL5, ZyWALL 35 or ZyWALL70?..........291

C02. Except ZyWALLTurbo Card is a must when use AV+IDP service,

what exactly I can get benefit from it?...................................................292

C03. Do I must have a ZyWALLTurbo Card inserted if I upgraded to

ZyNOS v4.01? If not, when must I insert a ZyWALLTurbo Card into

my ZyWALL device?...............................................................................292

D. Firewall FAQ.................................................................................................292

D01. What is a network firewall?...........................................................292

D02. What makes ZyWALL secure? .....................................................292

D03. What are the basic types of firewalls?...........................................293

D04. What kind of firewall is the ZyWALL?........................................293

D05. Why do you need a firewall when your router has packet

filtering and NAT built-in?.....................................................................294

D06. What is Denials of Service (DoS)attack?.......................................294

D07. What is Ping of Death attack? .......................................................294

D08. What is Teardrop attack?..............................................................294

D09. What is SYN Flood attack?............................................................295

D10. What is LAND attack? ...................................................................295

D11. What is Brute-force attack?...........................................................295

D12. What is IP Spoofing attack?...........................................................295

D13. What are the default ACL firewall rules in ZyWALL?..............295

D14. In ZyWALL, is DMZ behind NAT or not? ..................................296

D15. Can I use both public and private IP addresses on DMZ?..........296

ZyWALL 35 Support Notes

D16. Why does traffic redirect/static/policy route be blocked by

ZyWALL?.................................................................................................296

D17. How can I protect against IP spoofing attacks?...........................298

E. Security Service licenses FAQ ......................................................................299

E01. What is iCard?.................................................................................299

E02. Where can I buy the iCard and how much does it cost?.............299

E03. How many kinds of iCard does ZyXEL provide? ........................299

E04. Is each type of iCard device specific?............................................299

E05. What are the available security service licenses which require

additional purchase and license activation in ZyNOS v4.01?..............299

E06. What kind of iCard should I buy?.................................................300

E07. If I violate the mappings described above, for example, using a

silver iCard for ZyWALL35 or ZyWALL70, what will happen?.......300

E08. Can I try the Content Filtering service for free? How long is the

free trial period of Content Filtering service?.......................................300

E09. Does ZyXELprovide customers free trial forAV+IDP service?

How long is it?..........................................................................................300

E10. Does ZyXELprovide customers free trial forAnti-Spam service?

How long is it?..........................................................................................301

F. Security Service Activation and UpdateFAQ.................................................301

F01. Why do I have to register?..............................................................301

F02. In addition to registration, what can I do with myZyXEL.com?301

F03. Is there anything changed on myZyXEL.com because of the

launch of ZyNOS v4.00? Which ZyWALL models can be registered

via myZyXEL.com?.................................................................................302

F04. What’s the difference between new registration flow and

previous registration? What’s the advantage of new registration flow

over the previous registration flow?.......................................................302

F05. If I were new to myZyXEL.com, what are the required fields

when I register my ZyWALLdevice on myZyXEL.com?....................302

F06. When using the new registration flow of myZyXEL.com for

ZyNOS v4.0, do I have to create a new account if I were already a

registered user on myZyXEL.com?........................................................303

F07. What is mySecurityZone?...............................................................303

F08. What is Update Server?..................................................................303

F09. Who maintains mySecurityZone & Update Server?....................303

F10. What’s the URL for these service portals?....................................304

G. Anti-Virus FAQ..............................................................................................304

ZyWALL 35 Support Notes

G01. Why should I need a gatewayAnti-Virus solution while I already

deployed the Anti-Virus software on each desktop/laptop?.................304

G02. Why does ZyWALLbundle Anti-Virus and IDP feature

together?...................................................................................................304

G03. Can I subscribe to the Anti-Virus service alone or IDP service

alone? ........................................................................................................304

G04. What are the hardware requirements to run AV+IDPsecurity

service?......................................................................................................305

G05. Now I know that the ZyWALLTurbo Card is a must when use

AV+IDP service; but what exactly I can benefit from the ZyWALL

Turbo Card?.............................................................................................305

G06. How do I keep signatures ofAV+IDP service updated?..............305

G07. How often does ZyXELrelease signatures ofAV+IDPsecurity

service?......................................................................................................305

G08. Will the traffic coming in through the VPN tunnel also be

scanned by Anti-Virus, IDPand Anti-Spam feature in ZyWALL

ZyNOS v4.0?.............................................................................................305

H. IDP FAQ........................................................................................................306

H01. Why does ZyWALLbundle Anti-Virus and IDP feature

together?...................................................................................................306

H02. Can I subscribe to the Anti-Virus service alone or IDP service

alone? ........................................................................................................306

H03. What are the hardware requirements to run AV+IDPsecurity

service?......................................................................................................306

H04. Now I know that the ZyWALLTurbo Card is a must when use

AV+IDP service; but what exactly I can benefit from the ZyWALL

Turbo Card?.............................................................................................306

H05. Could I duplicate the IDP feature’s policy settings from one

ZyWALL device to another?...................................................................306

H06. How do I keep signatures ofAV+IDP service updated?..............307

H07. How often does ZyXELrelease signatures ofAV+IDPsecurity

service?......................................................................................................307

H08. Will the traffic coming in through the VPN tunnel also be

scanned by Anti-Virus, IDPand Anti-Spam feature in ZyWALL

ZyNOS v4.0?.............................................................................................307

I. Anti-Spam FAQ..............................................................................................307

I01. What’s the difference between gatewayAnti-Spam and

client-basedAnti-Spam filter such as Microsoft Outlook’s?................307

ZyWALL 35 Support Notes

I02. A customer already has her/his own exchange server including the

Anti-Spam software from other vendors; is there any good reason for

her/him to use ZyXEL’sAnti-Spam service in addition to the current

solution?....................................................................................................308

I03. What happens when an email with large attachment in size, e.g.

5MB, is downloaded which has virus in it?...........................................308

I04. What happens if the virus is in the last part of the email message

and the email receiver already got a part of the contaminated file in

her/his laptop or desktop?.......................................................................308

I05. Will the traffic coming in through the VPN tunnel also be

scanned by Anti-Virus, IDPand Anti-Spam feature in ZyWALL

ZyNOS v4.0?.............................................................................................308

I06. In ZyWALL’sAnti-Spam feature, what’s your recommendation to

handle identified spam emails?...............................................................309

I07. What’s the specification of Anti-Spam feature in ZyNOS v4.01?309

I08. How do I keep signatures ofAnti-Spam service update? .............309

J. Content Filter FAQ.........................................................................................310

J01. What's the operation between ZyXELappliance and BlueCoat

data center? ..............................................................................................310

J02. How many entries can the cache of Web Site Auto Categorization

keep at most?............................................................................................310

J03. Can I specify the time out value of the query response from

BlueCoat data center? .............................................................................310

J04. Can I decide whether to forward or drop the HTTP response if

the query to BlueCoat data center is timed out?...................................310

J05. How to register for BlueCoat service? ...........................................310

J06. Why can't I make registration successfully?.................................310

J07. What services can I get with Trial Registration?..........................311

J08. What types of content filter does ZyWALL provide?...................311

J09. What are the primary features of ZyXELContent Filtering?.....311

J10. Who needs ZyXELContent Filtering? Is ZyXELContent

Filtering for small companies or for large corporations?....................311

J11. Can I have different policies in effect for different times of the

day or week?.............................................................................................312

J12. How many policies can I create? ....................................................312

J13. Can I create my own categories?....................................................312

J14. Can I override (block or allow) certain URLs regardless of the

rating?.......................................................................................................312

ZyWALL 35 Support Notes

J15. How many URL keywords does ZyWALL support?....................312

J16. How do I keep database of Content Filtering service updated?..312

J17. What is BlueCoat Filter list?...........................................................312

J18. How many ratings does the BlueCoat database contain? ............312

J19. How often does BlueCoat update the database?...........................313

J20. How do I locate sites to block?........................................................313

J21. Do humans review the ratings? ......................................................313

J22. How can I do if I find a WEB site is mis-categorized?.................314

J23. How many and what categories do you provide? .........................314

J24. How does the ZyXELcontent filtering handle dynamically

generated sites?........................................................................................315

J25. Does BlueCoat have more than one data center? Is the BlueCoat

Web Filter geographically load balanced? ............................................316

J26. Who can generate and view reports on BlueCoat WEB site?......316

J27. How can I get Content Filtering report?.......................................316

J28. Can I change the password for BlueCoat service? .......................316

J29. Which User Name & Password should I input for Content

Filtering report?.......................................................................................316

J30. My device can't get connected to Http://myZyXEL.com, so I can't

get into Registration page. What should I check? ................................317

K. IPSec FAQ.....................................................................................................317

K01. How many VPN tunnels are supported on ZyWALL?................317

K02. How to count my VPN tunnels on ZyWALL?..............................318

K03. What is VPN?..................................................................................318

K04. Why do I need VPN? ......................................................................319

K05. What are most common VPN protocols?......................................319

K06. What is PPTP?................................................................................319

K07. What is L2TP? ................................................................................319

K08. What is IPSec? ................................................................................320

K09. What is SA?.....................................................................................320

K10. What is Pre-Shared Key?...............................................................320

K11. What is Phase 1 ID for?..................................................................321

K12. What are Local ID and Peer ID?...................................................321

K13. Is my ZyWALLready for IPSec VPN?.........................................322

K14. How do I configure ZyWALL VPN?.............................................322

K15. What VPN protocols are supported by ZyWALL?......................322

K16. What types of encryption does ZyWALLVPN support?............322

K17. What types of authentication does ZyWALLVPN support?......322

ZyWALL 35 Support Notes

K18. I am planning my ZyWALL-to-ZyWALLVPN configuration.

What do I need to know?.........................................................................323

K19. Does ZyWALLsupport dynamic secure gateway IP?.................323

K20. What VPN gateway that has been tested with ZyWALL

successfully?..............................................................................................323

K21. What VPN software that has been tested with ZyWALL

successfully?..............................................................................................324

K22. Will ZyXEL support Secure Remote Management?...................324

K23. Does ZyWALLVPN support NetBIOS broadcast?.....................324

K24. Is the host behind NAT allowed to use IPSec?.............................324

K25. How do I configure ZyWALL with NAT for internal servers?...325

K26. I am planning my ZyWALLbehind a NAT router. What do I

need to know?...........................................................................................325

K27. Where can I configure Phase 1 ID in ZyWALL?.........................325

K28. How can I keep a tunnel alive?......................................................326

K29. Single, Range, Subnet, which types of IPaddress does ZyWALL

support in VPN/IPSec?............................................................................326

K30. Does ZyWALLsupport IPSec pass-through? ..............................326

K31. Can ZyWALL behave as a NAT router supporting IPSec pass

through and an IPSec gateway simultaneously?...................................327

K32. Will the traffic coming in through the VPN tunnel also be

scanned by Anti-Virus, IDPand Anti-Spam feature in ZyWALL

ZyNOS v4.0?.............................................................................................327

L. PKI FAQ........................................................................................................327

L01. Basic Cryptography concept..........................................................327

L02. What is PKI?....................................................................................328

L03. What are the security services PKI provides?..............................328

L04. What are the main elements of a PKI?..........................................328

L05. What is a CertificationAuthority? ................................................329

L06. What is a digital certificate?...........................................................329

L07. What are public and private keys, and what is their relationship?329

L08. What are Certificate Policies (CPs)?.............................................329

L09. How does a PKI ensure data confidentiality?...............................330

L10. What is a digital signature?............................................................330

L11. How does a digital signature work?...............................................330

L12. Does ZyXELprovide CAservice?..................................................331

L13. What if customers don't have access to CAservice, but would

like to use PKI function?.........................................................................332

Otros manuales para ZyXEL ZyWALL 35

Tabla de contenidos

Otros manuales de Cortafuegos de ZyXEL Communications

ZyXEL Communications

ZyXEL Communications ZyWALL USG Series Manual de usuario

ZyXEL Communications

ZyXEL Communications ZyWALL 110 Series Manual de usuario

ZyXEL Communications

ZyXEL Communications ZyWALL 110 Series Manual de usuario

ZyXEL Communications

ZyXEL Communications ZyWall Manual de usuario

ZyXEL Communications

ZyXEL Communications ZyWALL 1050 Manual

ZyXEL Communications

ZyXEL Communications ZyWALL/USG Series Manual de usuario

ZyXEL Communications

ZyXEL Communications ZyWALL SEM-DUAL Manual de usuario

ZyXEL Communications

ZyXEL Communications USG Series Manual de usuario

ZyXEL Communications

ZyXEL Communications ZyWALL 1100 Series Manual de usuario

ZyXEL Communications

ZyXEL Communications ZyWALL 110 Series Manual de usuario

ZyXEL Communications

ZyXEL Communications ADSL 2+ Security Gateway Manual de usuario

ZyXEL Communications

ZyXEL Communications USG40 Manual de usuario

ZyXEL Communications

ZyXEL Communications ZyXEL ZyWALL 35 Manual de usuario

ZyXEL Communications

ZyXEL Communications ADSL 2+ Security Gateway Manual de usuario

ZyXEL Communications

ZyXEL Communications ZyXEL ZyWALL IDP 10 Manual

ZyXEL Communications

ZyXEL Communications ZyWALL 1050 Manual de usuario

ZyXEL Communications

ZyXEL Communications ADSL 2+ Security Gateway Manual de instrucciones

ZyXEL Communications

ZyXEL Communications ZyXEL ZyWALL IDP 10 Manual de usuario

ZyXEL Communications

ZyXEL Communications ZYWALL OTPV2 - Manual

ZyXEL Communications

ZyXEL Communications ZYWALL 2 WG Manual de usuario

ZyXEL Communications

ZyXEL Communications ZyWALL 110 Series Manual de usuario

ZyXEL Communications

ZyXEL Communications ZyWALL 1050 Manual de instrucciones

ZyXEL Communications

ZyXEL Communications ZyXEL ZyWALL 35 Manual de usuario

ZyXEL Communications

ZyXEL Communications ADSL 2+ Security Gateway Manual de usuario

Manuales populares de Cortafuegos de otras marcas

Cisco

Cisco S190 Manual de usuario

Fortinet

Fortinet FortiGate Voice Series Manual de usuario

ADTRAN

ADTRAN NetVanta 2300 Manual de usuario

SecureLogix

SecureLogix ETM System Manual de usuario

NETGEAR

NETGEAR ProSafe FVX538 Manual de usuario

Lanner

Lanner FW-8877 Manual de usuario

Huawei

Huawei USG6000 Series Manual de instalación y operación

H3C

H3C SecPath F5000-AI-15 Manual de usuario

Nexcom

Nexcom DNA 1150 Manual de usuario

Fortinet

Fortinet FortiGate-60 series Manual de usuario

Cisco

Cisco 3110 Manual

Draytek

Draytek Vigor2860 Series Manual de usuario

Lanner electronics

Lanner electronics FW-7650 Series Manual de usuario

Swisscom

Swisscom Internet Backup Manual de usuario

SonicWALL

SonicWALL NSa 5700 Manual de usuario

DPtech

DPtech FW1000 SERIES Manual de usuario

FEITIAN

FEITIAN MultiPass FIDO Manual de usuario

EBLOCKER

EBLOCKER PRO Manual de usuario