ZyXEL Communications VPN Series Manual de usuario

1/810

www.zyxel.com

ZyWALL/USG/ATP /VPN Series

ATP200/ ATP500/ ATP800

USG20-VPN / USG20W-VPN / USG40 / USG40W /

USG60 / USG60W / USG110 / UGS210 / USG310/

USG1100 /USG1900 / USG2200-VPN

VPN50 / VPN100 /VPN300 /VPN1000

Security Firewalls

Firmware Version 4.60

Edition 1, 12/2020

Handbook

Default Login Details

LAN Port IP Address

https://192.168.1.1

User Name

admin

Password

1234

 
 
 
2/810 
 
 
 
www.zyxel.com 
copyright © 2018 ZyXEL Communications Corporation 
Table of Content 
How to Configure Site-to-site IPSec VPN with Amazon VPC ..................19 
Set Up the IPSec VPN Tunnel on the Amazon VPC............................20 
Set Up the IPSec VPN Tunnel on the ZyWALL/USG.............................24 
Test the IPSec VPN Tunnel ....................................................................30 
What Could Go Wrong? ......................................................................31 
How to Configure Site-to-site IPSec VPN with Microsoft (MS) Azure......32 
Set Up the IPSec VPN Tunnel on the ZyWALL/USG.............................33 
Set Up the IPSec VPN Tunnel on the MS Azure...................................38 
Test the IPSec VPN Tunnel ....................................................................45 
What Could Go Wrong?......................................................................48 
How to Configure GRE over IPSec VPN Tunnel.........................................49 
Set Up the ZyWALL/USG GRE over IPSec VPN Tunnel of Corporate 
Network (HQ) ........................................................................................50 
Set Up the ZyWALL/USG GRE over IPSec VPN Tunnel of Corporate 
Network (Branch) .................................................................................55 
Test the GRE over IPSec VPN Tunnel ....................................................59 
What Could Go Wrong? ......................................................................60 
How to Configure Site-to-site IPSec VPN Where the Peer has a Static IP 
Address........................................................................................................62 
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network 
(Branch).................................................................................................67 
Test the IPSec VPN Tunnel ....................................................................71 
What Could Go Wrong?......................................................................72 
How to Configure Site-to-site IPSec VPN Where the Peer has a Dynamic 
IP Address....................................................................................................74 
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network 
(HQ) .......................................................................................................74 
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network 
(Branch has a Dynamic IP Address) ...................................................78 
Test the IPSec VPN Tunnel ....................................................................82 

 
 
 
3/810 
 
 
 
www.zyxel.com 
What Could Go Wrong?......................................................................84 
How to Configure IPSec Site to Site VPN while one Site is behind a NAT 
router............................................................................................................86 
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network 
(HQ) .......................................................................................................86 
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network 
(Branch).................................................................................................90 
Set Up the NAT Router (Using ZyWALL USG device in this example)94 
Test the IPSec VPN Tunnel ....................................................................96 
What Could Go Wrong? ......................................................................97 
How to Configure Hub-and-Spoke IPSec VPN.........................................98 
Set Up the IPSec VPN Tunnel on the ZyWALL/USG by Using VPN 
Concentrator Hub_HQ-to-Branch_A ..................................................99 
Hub_HQ-to-Branch_B .........................................................................103 
Hub_HQ Concentrator....................................................................... 107 
Spoke_Branch_A ................................................................................108 
Spoke_Branch_B .................................................................................113 
Test the IPSec VPN Tunnel ..................................................................118 
What Could Go Wrong?....................................................................122 
Set Up the IPSec VPN Tunnel of ZyWALL/USG without Using VPN 
Concentrator Hub_HQ-to-Branch_A ................................................124 
Hub_HQ-to-Branch_B .........................................................................127 
Spoke_Branch_A ................................................................................130 
Spoke_Branch_B .................................................................................133 
Test the IPSec VPN Tunnel ..................................................................136 
What Could Go Wrong?....................................................................139 
How to Use Dual-WAN to Perform Fail-Over on VPN Using the VPN 
Concentrator.............................................................................................141 
Set Up the IPSec VPN Tunnel on the ZyWALL/USG Hub_HQ-to-
Branch_A.............................................................................................142 
Hub_HQ-to-Branch_B .........................................................................145 
Hub_HQ Concentrator....................................................................... 148 
Spoke_Branch_A ................................................................................149 
Spoke_Branch_B .................................................................................152 

 
 
 
4/810 
 
 
 
www.zyxel.com 
Test the IPSec VPN Tunnel ..................................................................156 
What Could Go Wrong?....................................................................159 
How to Configure IPSec VPN with ZyWALL IPSec VPN Client................160 
Set Up the ZyWALL/USG IPSec VPN Tunnel .......................................161 
Set Up the ZyWALL IPSec VPN Client.................................................165 
Test the IPSec VPN Tunnel ..................................................................168 
What Can Go Wrong? .......................................................................170 
How to Configure Site-to-site IPSec VPN with FortiGate .......................172 
Set Up the IPSec VPN Tunnel on the ZyWALL/USG........................... 173 
Set Up the IPSec VPN Tunnel on the FortiGate ................................176 
Test the IPSec VPN Tunnel ..................................................................181 
What Could Go Wrong?....................................................................182 
How to Configure Site-to-site IPSec VPN with WatchGuard .................184 
Set Up the IPSec VPN Tunnel on the ZyWALL/USG........................... 185 
Set Up the IPSec VPN Tunnel on the WatchGuard..........................188 
Test the IPSec VPN Tunnel ..................................................................194 
What Could Go Wrong?....................................................................195 
How to Configure Site-to-site IPSec VPN with Cisco .............................197 
Set Up the IPSec VPN Tunnel on the ZyWALL/USG........................... 198 
Set Up the IPSec VPN Tunnel on the Cisco....................................... 203 
Test the IPSec VPN Tunnel ..................................................................208 
What Could Go Wrong?....................................................................210 
How to Configure Site-to-site IPSec VPN with a SonicWALL router ......211 
Set Up the IPSec VPN Tunnel on the ZyWALL/USG........................... 212 
Set Up the IPSec VPN Tunnel on the SonicWALL..............................219 
Test the IPSec VPN Tunnel ..................................................................223 
What Could Go Wrong?....................................................................225 
How to Configure IPSec VPN Failover.....................................................228 
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network 
(HQ) .....................................................................................................229 
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network 
(Branch)............................................................................................... 232 
Set up the WAN Trunk (ZyWALL/USG_HQ)........................................237 

 
 
 
5/810 
 
 
 
www.zyxel.com 
Set up the Failover Command Line (ZyWALL/USG HQ)..................238 
Test the IPSec VPN Tunnel ..................................................................239 
What Could Go Wrong?....................................................................241 
How to Configure L2TP over IPSec VPN while the ZyWALL/USG is behind 
a NAT router...............................................................................................243 
Set Up the L2TP VPN Tunnel on the ZyWALL/USG_HQ......................244 
Set Up the NAT Router (Using ZyWALL USG device in this example)
..............................................................................................................248 
Test the L2TP over IPSec VPN Tunnel ..................................................251 
What Could Go Wrong? ....................................................................254 
How to Configure L2TP VPN with Android 5.0 Mobile Devices .............256 
Set Up the L2TP VPN Tunnel on the ZyWALL/USG .............................257 
Set Up the L2TP VPN Tunnel on the Android Device........................ 261 
Test the L2TP over IPSec VPN Tunnel.................................................264 
What Could Go Wrong?....................................................................266 
How to Configure L2TP VPN with iOS 8.4 Mobile Devices .....................268 
Set Up the L2TP VPN Tunnel on the ZyWALL/USG .............................268 
Set Up the L2TP VPN Tunnel on the iOS Device ................................274 
Test the L2TP over IPSec VPN Tunnel.................................................275 
What Could Go Wrong?....................................................................278 
How to Import ZyWALL/USG Certificate for L2TP over IPsec in Windows 10
....................................................................................................................280 
Set Up the L2TP VPN Tunnel on the ZyWALL/USG .............................280 
Export a Certificate from ZyWALL/USG and Import it to Windows 10 
Operating System...............................................................................285 
Set Up the L2TP VPN Tunnel on the Windows 10...............................290 
Test the L2TP over IPSec VPN Tunnel.................................................294 
What Could Go Wrong?....................................................................296 
How to Import ZyWALL/USG Certificate for L2TP over IPsec in IOS mobile 
phone.........................................................................................................298 
Set Up the L2TP VPN Tunnel on the ZyWALL/USG .............................298 
Export a Certificate from ZyWALL/USG and Import it to iOS Mobile 
Phone ..................................................................................................303 

 
 
 
6/810 
 
 
 
www.zyxel.com 
Set Up the L2TP VPN Tunnel on the iOS Mobile Device ...................303 
Test the L2TP over IPSec VPN Tunnel.................................................306 
What Could Go Wrong?....................................................................308 
How to Configure 2 factor for VPN connection? ...................................309 
Set up the ZyWALL/USG IPSec VPN Tunnel....................................... 310 
Set up the ZyWALL IPSec VPN Client ................................................ 315 
Set up notification for 2 factor authentication................................ 319 
Set up authentication for 2 factor VPN connection.......................320 
Test the Result .....................................................................................321 
What could went wrong.................................................................... 324 
How to Import ZyWALL/USG Certificate for L2TP over IPsec in Android 
mobile phone............................................................................................324 
Set Up the L2TP VPN Tunnel on the ZyWALL/USG .............................325 
Export a Certificate from ZyWALL/USG and Import it to Android 
Mobile Phone......................................................................................329 
Set Up the L2TP VPN Tunnel on the Android Mobile Device ...........330 
Test the L2TP over IPSec VPN Tunnel.................................................334 
What Could Go Wrong?....................................................................336 
How to Configure the L2TP VPN with Apple MAC OS X 10.11 Operating 
System........................................................................................................338 
Set Up the L2TP VPN Tunnel on the ZyWALL/USG .............................338 
Set Up the L2TP VPN Tunnel on the Apple MAC OS X 10.11 El 
Capitan Operating System ...............................................................343 
Test the L2TP over IPSec VPN Tunnel.................................................346 
What Could Go Wrong?....................................................................348 
How to configure if I want user can only see SSL VPN Login button in 
web portal login page .............................................................................350 
Set Up the DNS Service ....................................................................... 351 
Set Up the ZyWALL/USG SSL VPN Setting............................................351 
Set Up the ZyWALL/USG System Setting .............................................352 
Test the SSL VPN ..................................................................................353 
How to Deploy SSL VPN with Apple Mac OS X 10.10 Operating System
....................................................................................................................357 

 
 
 
7/810 
 
 
 
www.zyxel.com 
Set Up the SSL VPN Tunnel on the ZyWALL/USG ............................... 358 
Set Up the SSL VPN Tunnel on the Apple MAC OS X 10.10 Operating 
System.................................................................................................. 361 
Test the SSL VPN Tunnel ......................................................................365 
What Could Go Wrong?....................................................................368 
How To Configure SSL VPN for Remote Access Mobile Devices..........370 
Set Up the SSL VPN Tunnel on the ZyWALL/USG ............................... 371 
Test the SSL VPN Tunnel ......................................................................374 
What Could Go Wrong?....................................................................376 
How to Configure an SSL VPN Tunnel (with SecuExtender version 4.0.0.1) 
on the Windows 10 Operating System....................................................377 
Set up the SSL VPN Tunnel with Windows 10 ....................................377 
What Can Go Wrong?....................................................................... 381 
How to redirect multiple LAN interface traffic to the VPN tunnel .........383 
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network 
(HQ) .....................................................................................................384 
Set Up the ZyWALL/USG IPSec VPN Tunnel of Corporate Network 
(Branch)............................................................................................... 387 
Set up the Policy Route (ZyWALL/USG_HQ).....................................391 
Set up the Policy Route (ZyWALL/USG_Branch) ..............................392 
Test the IPSec VPN Tunnel ..................................................................394 
What Could Go Wrong?....................................................................395 
How to Create VTI and Configure VPN Failover with VTI ......................397 
VTI Deployment Flow.......................................................................... 397 
Set Up the ZyWALL/USG VTI of Corporate Network (HQ) ............... 398 
Set Up the ZyWALL/USG VTI of Corporate Network (Branch) ........403 
Test the IPSec VPN Tunnel..................................................................409 
What Can Go Wrong?....................................................................... 411 
How to configure the USG when using a Cloud Based SIP system ......413 
Set Up the SIP ALG ..............................................................................414 
Test result ............................................................................................. 414 
What could go wrong?......................................................................415 

 
 
 
8/810 
 
 
 
www.zyxel.com 
How to block HTTPS websites by Domain Filter without applying SSL 
Inspection..................................................................................................415 
Set Up the Content Filter on the ZyWALL/USG................................. 416 
Set Up the Security Policy on the ZyWALL/USG ...............................419 
Set Up the System Policy on the ZyWALL/USG................................. 419 
Test the Result .....................................................................................419 
How to Configure Content Filter 2.0 with Geo IP Blocking....................422 
Set Up the Address Objet with Geo IP on the ZyWALL/USG........... 423 
Set Up the Security Policy on the ZyWALL/USG ...............................423 
Test the Result .....................................................................................424 
What Could Go Wrong?....................................................................425 
How to Configure Content Filter 2.0 with HTTPs Domain Filter...............426 
Application Scenario .........................................................................426 
Set Up the Content Filter on the ZyWALL/USG..................................427 
Set Up the Security Policy on the ZyWALL/USG ...............................429 
Set Up the System Policy on the ZyWALL/USG................................. 430 
Test the Result .....................................................................................431 
What Could Wrong? ..........................................................................431 
How to block the client accessing to certain country using Geo IP and 
Content Filter .............................................................................................432 
Check Geo IP License Status on the ZyWALL/USG...........................433 
Set Up the Address Objet with Geo IP on the ZyWALL/USG........... 434 
Set Up the Security Policy on the ZyWALL/USG ...............................435 
Test the Result .....................................................................................436 
How to Restrict Web Portal access from the Internet ............................439 
Set Up the ZyWALL/USG System Setting .............................................439 
Test the Web Access .......................................................................... 440 
How to Setup and Configure Daily Report .............................................443 
Set Up the ZyWALL/USG Email Daily Report Setting...........................444 
Test the Daily Log Report ................................................................... 445 
What Could Go Wrong?....................................................................447 
How to Setup and Configure Email Logs ................................................448 

 
 
 
9/810 
 
 
 
www.zyxel.com 
Set Up the ZyWALL/USG Email Logs Setting .......................................449 
Test the Email Log ............................................................................... 450 
What Could Go Wrong?....................................................................451 
How to Setup and send logs to a Syslog Server ....................................452 
Set Up the Syslog Server (Use Papertrail syslog in this example) ....... 452 
Set Up the ZyWALL/USG Remote Server Setting ................................ 455 
Test the Remote Server.......................................................................456 
What Could Go Wrong?....................................................................457 
How to Setup and send logs to a Vantage Reports Server...................458 
Set Up the VRPT Server........................................................................ 459 
Set Up the ZyWALL/USG Remote Server Setting ................................ 462 
Test the Remote Server.......................................................................463 
What Could Go Wrong?....................................................................463 
How to Setup and send logs to the USB storage....................................464 
Set Up the USB System Settings...........................................................465 
Set Up the USB Log Storage................................................................466 
Check the USG Log Files....................................................................467 
How to Activate a Free Access Hotspot.................................................467 
Set up the Free Access Hotspot........................................................ 469 
Test the User Agreement and Advertisement Webpage............... 470 
What could Go Wrong?.....................................................................472 
Set up Enable the Free Time Feature ...............................................472 
Test Free Time Feature........................................................................ 478 
What Can Go Wrong?....................................................................... 481 
How to Setup IPv6 Interfaces for Pure IPv6 Routing ...............................483 
Setting Up the IPv6 Interface.............................................................484 
Set up the Prefix Delegation and Router Advertisement ...............486 
Test .......................................................................................................490 
What Can Go Wrong?....................................................................... 491 
Test .......................................................................................................493 
How to Perform and Use the Packet Capture Feature on the 
ZyWALL/USG ..............................................................................................493 
Set Up the Packet Capture Feature ..................................................494 

 
 
 
10/810 
 
 
 
www.zyxel.com 
Check the Capture Files ....................................................................497 
How to Automatically Reboot the ZyWALL/USG by Schedule .............498 
Set Up the Shell Script.......................................................................... 499 
Set Up the Schedule Run .................................................................... 500 
Check the Reboot Status ..................................................................502 
How To Schedule YouTube Access.........................................................504 
Set Up the Schedule on the ZyWALL/USG ........................................504 
Create the Application Objects on the ZyWALL/USG ..................... 505 
Set Up SSL Inspection on the ZyWALL/USG........................................505 
Set Up the Security Policy on the ZyWALL/USG.................................506 
Export Certificate from ZyWALL/USG and Import it to Windows 7 
Operation System...............................................................................507 
Test the Result...................................................................................... 512 
What Could Go Wrong?....................................................................512 
How to continuously run a ZySH script....................................................514 
Set Up the Shell Script.......................................................................... 514 
Set Up the Schedule Run .................................................................... 516 
Check the Result ................................................................................ 516 
How To Register Your Device and Services at myZyXEL.com ..............517 
Account Creation ..............................................................................518 
Device Registration ............................................................................ 520 
Service Registration (In the Case of Standard License) .................521 
Device Management (In the Case of Registering Bundled Licenses)
..............................................................................................................522 
Refresh Service....................................................................................523 
What Could Go Wrong?....................................................................523 
How To Exempt Specific Users From Security Control ...........................525 
Set Up the Security Policy on the ZyWALL/USG for Employees .......526 
Set Up the Security Policy on the ZyWALL/USG for Executives........528 
Test the Result...................................................................................... 530 
What Could Go Wrong?....................................................................531 
How To Detect and Prevent TCP Port Scanning with ADP .....................532 
Set Up the ADP Profile on the ZyWALL/USG ......................................533 

Este manual sirve para los siguientes modelos

Tabla de contenidos

Otros manuales de Hardware de red de ZyXEL Communications

ZyXEL Communications

ZyXEL Communications Prestige 2602HW Series Manual de usuario

ZyXEL Communications

ZyXEL Communications FMT3211 Manual de usuario

ZyXEL Communications

ZyXEL Communications NSA-2400 Manual de usuario

ZyXEL Communications

ZyXEL Communications NSA-2400 Manual de usuario

ZyXEL Communications

ZyXEL Communications PK5000Z Manual de usuario

ZyXEL Communications

ZyXEL Communications Internet Security Gateway ZyWALL 100 Manual de usuario

ZyXEL Communications

ZyXEL Communications ATP Series Manual de usuario

ZyXEL Communications

ZyXEL Communications PM7516-R0 Manual de usuario

ZyXEL Communications

ZyXEL Communications ONU-6040BBF-22 - V1.00 Manual de usuario

ZyXEL Communications

ZyXEL Communications NSA-2401 Manual de usuario

ZyXEL Communications

ZyXEL Communications Prestige 971M Manual de usuario

ZyXEL Communications

ZyXEL Communications RS-1612 Manual de usuario

ZyXEL Communications

ZyXEL Communications PLA450 Series Manual de usuario

ZyXEL Communications

ZyXEL Communications VMG4005-B50B Guía de instalación

ZyXEL Communications

ZyXEL Communications WAP6405 Manual de usuario

ZyXEL Communications

ZyXEL Communications IES-708 Manual de usuario

ZyXEL Communications

ZyXEL Communications ZyAir G-100 Manual de usuario

ZyXEL Communications

ZyXEL Communications WAP6804 Manual de usuario

ZyXEL Communications

ZyXEL Communications ZYWALL OTPV2 - Manual de usuario

ZyXEL Communications

ZyXEL Communications NSA-220 Plus Manual de usuario

ZyXEL Communications

ZyXEL Communications NSA-210 Manual

ZyXEL Communications

ZyXEL Communications OLT2406 Manual de usuario

ZyXEL Communications

ZyXEL Communications NSA-2400 Guía de referencia

ZyXEL Communications

ZyXEL Communications Multi-service Access Platform MSAP2000 Manual de usuario

Manuales populares de Hardware de red de otras marcas

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Manual de usuario

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Manual de usuario

Yudor

Yudor YDS-16 Manual de usuario

D-Link

D-Link ShareCenter DNS-320L Manual de usuario

Samsung

Samsung ES1642dc Instrucciones de uso

Honeywell Home

Honeywell Home LTEM-PV Instrucciones de montaje

evertz

evertz 7700 Series Manual de usuario

D-Link

D-Link ShareCenter DNS-343 Manual de usuario

Asante

Asante AsanteBridge 1012 Manual de usuario

FireBrick

FireBrick FB2700 Manual de usuario

Audiovox Electronics

Audiovox Electronics ARWH2T Manual de usuario

ADC

ADC DSX-1 Manual

NetComm

NetComm NF2 Manual de usuario

Alcatel-Lucent

Alcatel-Lucent 5620 Manual de usuario

Dell EMC

Dell EMC XC6420 Series Manual de usuario

Lanner

Lanner NCA-1020A Manual de usuario

Allied Telesis

Allied Telesis AT-TN121-A Manual de usuario

Arista

Arista CCA-ETM-Q12 Manual de usuario