FCC ID: I88ATP100W ZyWALL ATP Firewall

 

Chapter 24 Web Authentication Make sure you select Enable Policy, Single Sign-On and choose required in Authentication. Do NOT select any as the source address unless you want all incoming connections to be authenticated!

ZyWALL ATP Series Users Guide 481 Chapter 24 Web Authentication See Table 184 on page 462 and Table 185 on page 465 for more information on configuring these screens. 24.4.4 Create a Security Policy Configure a Security Policy for SSO traffic source and destination direction in order to prevent the security policy from blocking this traffic. Go to Configuration > Security Policy > Policy Control and add a new policy if a default one does not cover the SSO web authentication traffic direction. Configure the fields as shown in the following screen. Configure the source and destination addresses according to the SSO web authentication traffic in your network. ZyWALL ATP Series Users Guide 482 Chapter 24 Web Authentication 24.4.5 Configure User Information Configure a User account of the ext-group-user type. Configure Group Identifier to be the same as Group Membership on the SSO agent. ZyWALL ATP Series Users Guide 483 Chapter 24 Web Authentication 24.4.6 Configure an Authentication Method Configure Active Directory (AD) for authentication with SSO. Choose group ad as the authentication server for SSO. ZyWALL ATP Series Users Guide 484 Chapter 24 Web Authentication 24.4.7 Configure Active Directory You must configure an Active Directory (AD) server in AAA Setup to be the same as AD configured on the SSO agent. The default AD server port is 389. If you change this, make sure you make the same changes on the SSO. Configure the Base DN exactly the same as on the Domain Controller and SSO. Bind DN is a user name and password that allows the Zyxel Device to join the domain with administrative privileges. It is a required field. ZyWALL ATP Series Users Guide 485 Chapter 24 Web Authentication 24.5 SSO Agent Configuration This section shows what you have to do on the SSO agent in order to work with the Zyxel Device. After you install the SSO agent, you will see an icon in the system tray (bottom right of the screen) Right-click the SSO icon and select Configure Zyxel SSO Agent. Configure the Agent Listening Port, AD server exactly as you have done on the Zyxel Device. Add the Zyxel Device IP address as the Gateway. Make sure the Zyxel Device and SSO agent are able to communicate with each other. ZyWALL ATP Series Users Guide 486 Chapter 24 Web Authentication Configure the Server Address, Port, Base DN, Bind DN, Login Name Attribute and Group Membership for the AD server settings exactly as you have done on the Zyxel Device. Group Membership is called Group Identifier on the Zyxel Device. LDAP/AD Server Configuration ZyWALL ATP Series Users Guide 487 Chapter 24 Web Authentication Configure the Gateway IP address, Gateway Port and PreShareKey exactly as you have done in the Zyxel Device Configuration > Web Authentication > SSO screen. If you want to use Generate Key to have the SSO create a random password, select Check to show PreShareKey as clear Text so as to see the password, then copy and paste it to the Zyxel Device. After all SSO agent configurations are done, right-click the SSO icon in the system tray and select Enable Zyxel SSO Agent. ZyWALL ATP Series Users Guide 488 CHAPTER 25 Security Policy 25.1 Overview A security policy is a template of security settings that can be applied to specific traffic at specific times. The policy can be applied:

to a specific direction of travel of packets (from / to) to a specific source and destination address objects to a specific type of traffic (services) to a specific user or group of users at a specific schedule The policy can be configured:

to allow or deny traffic that matches the criteria above send a log or alert for traffic that matches the criteria above to apply the actions configured in the profiles (application patrol, content filter, IDP, anti-malware, email security) to traffic that matches the criteria above Note: Security policies can be applied to both IPv4 and IPv6 traffic. The security policies can also limit the number of user sessions. The following example shows the Zyxel Devices default security policies behavior for a specific direction of travel of packets. WAN to LAN traffic and how stateful inspection works. A LAN user can initiate a Telnet session from within the LAN zone and the Zyxel Device allows the response. However, the Zyxel Device blocks incoming Telnet traffic initiated from the WAN zone and destined for the LAN zone. Figure 341 Default Directional Security Policy Example ZyWALL ATP Series Users Guide 489 Chapter 25 Security Policy 25.2 One Security OneSecurity is a website with guidance on configuration walkthroughs, troubleshooting, and other information. This is an example of a port forwarding configuration walkthrough. Figure 342 Example of a Port Forwarding Configuration Walkthrough. 1 3 2 4 This is an example of L2TP over IPSec VPN Troubleshooting troubleshooting. ZyWALL ATP Series Users Guide 490 Chapter 25 Security Policy Figure 343 Example of L2TP over IPSec Troubleshooting - 1 1 2 3 2 ZyWALL ATP Series Users Guide 491 Chapter 25 Security Policy Figure 344 Example of L2TP over IPSec Troubleshooting - 2 3 In the Zyxel Device, you will see icons that link to OneSecurity walkthroughs, troubleshooting and so on in certain screens. For example, at the time of writing, these are the OneSecurity icons you can see. Table 191 OneSecurity Icons SCREEN ONESECURITY ICON Click this icon to go to a series of screens that guide you how to configure the feature. Note that the walkthroughs do not perform the actual configuring, but just show you how to do it. Device HA > General Licensing > Registration Network > NAT Network > Routing > Policy Route Security Service > App Patrol Security Service > Content Filter Security Service > IDP Security Service > Anti-Malware Security Service > Email Security VPN > IPSec VPN VPN > SSL VPN VPN > L2TP VPN Click this icon to go to a series of screens that guide you how to fix problems with the feature. Device HA > General Network > NAT Network > Routing > Policy Route Security Service > App Patrol Security Service > Content Filter Security Service > IDP Security Service > Anti-Malware Security Service > Email Security VPN > IPSec VPN VPN > SSL VPN VPN > L2TP VPN ZyWALL ATP Series Users Guide 492 Chapter 25 Security Policy Table 191 OneSecurity Icons (continued) ONESECURITY ICON SCREEN Click this icon for more information on Application Patrol, which identifies traffic that passes through the Zyxel Device, so you can decide what to do with specific types of traffic. Traffic not recognized by application patrol is ignored. Security Service > Application Patrol Click this icon for more information on Content Filter, which controls access to specific web sites or web content. Security Service > Content Filter Click this icon for more information on IPSec and SSL VPN. Internet Protocol Security

(IPSec) VPN connects IPSec routers or remote users using IPSec client software. SSL VPN allows users to use a web browser for secure remote user login without need of a VPN router or VPN client software. VPN > IPSec VPN VPN > SSL VPN Click this icon to download VPN client software. VPN > IPSec VPN VPN > SSL VPN Click this icon for more information on the Wireless AP Controller which sets how the Zyxel Device allows APs to connect to the wireless network. Wireless > AP Management > Mgnt. AP List 25.3 What You Can Do in this Chapter Use the Security Policy Control screens (Section 25.4 on page 495) to enable or disable policies, asymmetrical routes, and manage and configure policies. Use the Anomaly Detection and Prevention (ADP) screens (Section 25.5 on page 501) to detect traffic with protocol anomalies and take appropriate action. Use the Session Control screens (see Section 25.5 on page 501) to limit the number of concurrent NAT/

security policies traffic sessions a client can use. 25.3.1 What You Need to Know Stateful Inspection The Zyxel Device uses stateful inspection in its security policies. The Zyxel Device restricts access by screening data packets against defined access rules. It also inspects sessions. For example, traffic from one zone is not allowed unless it is initiated by a computer in another zone first. Zones A zone is a group of interfaces. Group the Zyxel Devices interfaces into different zones based on your needs. You can configure security policies for data passing between zones or even between interfaces. ZyWALL ATP Series Users Guide 493 Chapter 25 Security Policy Default Directional Security Policy Behavior Security Policies can be grouped based on the direction of travel of packets to which they apply. Here is the The Zyxel Device has default Security Policy behavior for traffic going through the Zyxel Device in various directions. Table 192 Directional Security Policy Behavior FROM ZONE TO ZONE From any to Device From LAN1 to any (other than the Zyxel Device) From LAN2 to any (other than the Zyxel Device) From LAN1 to Device From LAN2 to Device From WAN to Device BEHAVIOR DHCP traffic from any interface to the Zyxel Device is allowed. Traffic from the LAN1 to any of the networks connected to the Zyxel Device is allowed. Traffic from the LAN2 to any of the networks connected to the Zyxel Device is allowed. Traffic from the LAN1 to the Zyxel Device itself is allowed. Traffic from the LAN2 to the Zyxel Device itself is allowed. The default services listed in To-Device Policies are allowed from the WAN to the Zyxel Device itself. All other WAN to Zyxel Device traffic is dropped. Traffic that does not match any Security policy is dropped. This includes traffic from the WAN to any of the networks behind the Zyxel Device. This also includes traffic to or from interfaces that are not assigned to a zone

(extra-zone traffic). From any to any To-Device Policies Policies with Device as the To Zone apply to traffic going to the Zyxel Device itself. By default:

The Security Policy allows only LAN, or WAN computers to access or manage the Zyxel Device. The Zyxel Device allows DHCP traffic from any interface to the Zyxel Device. The Zyxel Device drops most packets from the WAN zone to the Zyxel Device itself and generates a log except for AH, ESP, GRE, HTTPS, IKE, NATT. When you configure a Security Policy rule for packets destined for the Zyxel Device itself, make sure it does not conflict with your service control rule. The Zyxel Device checks the security policy before the service control rules for traffic destined for the Zyxel Device. A From Any To Device direction policy applies to traffic from an interface which is not in a zone. Global Security Policies Security Policies with from any and/or to any as the packet direction are called global Security Policies. The global Security Policies are the only Security Policies that apply to an interface that is not included in a zone. The from any policies apply to traffic coming from the interface and the to any policies apply to traffic going to the interface. Security Policy Rule Criteria The Zyxel Device checks the schedule, user name (users login name on the Zyxel Device), source IP address and object, destination IP address and object, IP protocol type of network traffic (service) and Security Service profile criteria against the Security Policies (in the order you list them). When the traffic matches a policy, the Zyxel Device takes the action specified in the policy. ZyWALL ATP Series Users Guide 494 Chapter 25 Security Policy User Specific Security Policies You can specify users or user groups in Security Policies. For example, to allow a specific user from any computer to access a zone by logging in to the Zyxel Device, you can set up a policy based on the user name only. If you also apply a schedule to the Security Policy, the user can only access the network at the scheduled time. A user-aware Security Policy is activated whenever the user logs in to the Zyxel Device and will be disabled after the user logs out of the Zyxel Device. Session Limits Accessing the Zyxel Device or network resources through the Zyxel Device requires a NAT session and corresponding Security Policy session. Peer to peer applications, such as file sharing applications, may use a large number of NAT sessions. A single client could use all of the available NAT sessions and prevent others from connecting to or through the Zyxel Device. The Zyxel Device lets you limit the number of concurrent NAT/Security Policy sessions a client can use. 25.4 The Security Policy Screen Asymmetrical Routes If an alternate gateway on the LAN has an IP address in the same subnet as the Zyxel Devices LAN IP address, return traffic may not go through the Zyxel Device. This is called an asymmetrical or triangle route. This causes the Zyxel Device to reset the connection, as the connection has not been acknowledged. You can have the Zyxel Device permit the use of asymmetrical route topology on the network (not reset the connection). However, allowing asymmetrical routes may let traffic from the WAN go directly to the LAN without passing through the Zyxel Device. A better solution is to use virtual interfaces to put the Zyxel Device and the backup gateway on separate subnets. Virtual interfaces allow you to partition your network into logical sections over the same interface. See the chapter about interfaces for more information. By putting LAN 1 and the alternate gateway (A in the figure) in different subnets, all returning network traffic must pass through the Zyxel Device to the LAN. The following steps and figure describe such a scenario. 1 A computer on the LAN1 initiates a connection by sending a SYN packet to a receiving server on the WAN. 2 3 4 The Zyxel Device reroutes the packet to gateway A, which is in Subnet 2. The reply from the WAN goes to the Zyxel Device. The Zyxel Device then sends it to the computer on the LAN1 in Subnet 1. ZyWALL ATP Series Users Guide 495 Chapter 25 Security Policy Figure 345 Using Virtual Interfaces to Avoid Asymmetrical Routes 25.4.1 Configuring the Security Policy Control Screen Click Configuration > Security Policy > Policy Control to open the Security Policy screen. Use this screen to enable or disable the Security Policy and asymmetrical routes, set a maximum number of sessions per host, and display the configured Security Policies. Specify from which zone packets come and to which zone packets travel to display only the policies specific to the selected direction. Note the following. Besides configuring the Security Policy, you also need to configure NAT rules to allow computers on the WAN to access LAN devices. The Zyxel Device applies NAT (Destination NAT) settings before applying the Security Policies. So for example, if you configure a NAT entry that sends WAN traffic to a LAN IP address, when you configure a corresponding Security Policy to allow the traffic, you need to set the LAN IP address as the destination. The ordering of your policies is very important as policies are applied in sequence. The following screen shows the Security Policy summary screen. ZyWALL ATP Series Users Guide 496 Chapter 25 Security Policy Figure 346 Configuration > Security Policy > Policy Control ZyWALL ATP Series Users Guide 497 Chapter 25 Security Policy The following table describes the labels in this screen. Table 193 Configuration > Security Policy > Policy Control LABEL Show Filter/Hide Filter General Settings Enable Policy Control IPv4 / IPv6 Configuration From / To DESCRIPTION Click Show Filter to display IPv4 and IPv6 (if enabled) security policy search filters. Enable or disable the Security Policy feature on the Zyxel Device. Select this to activate Security Policy on the Zyxel Device to perform access control. Use IPv4 / IPv6 search filters to find specific IPv4 and IPv6 (if enabled) security policies based on direction, application, user, source, destination and/or schedule. Select a zone to view all security policies from a particular zone and/or to a particular zone. any means all zones. Type an IPv4 or IPv6 IP address to view all security policies based on the IPv4 / IPv6 source address object used. IPv4 / IPv6 Source An IPv4 IP address is written as four integer blocks separated by periods. This is an example IPv4 address: 172.16.6.7. An 128-bit IPv6 address is written as eight 16-bit hexadecimal blocks separated by colons

(:). This is an example IPv6 address: 2001:0db8:1a2b:0015:0000:0000:1a2f:0000. IPv4 / IPv6 Destination Type an IPv4 or IPv6 IP address to view all security policies based on the IPv4 / IPv6 destination address object used. An IPv4 IP address is written as four integer blocks separated by periods. This is an example IPv4 address: 172.16.6.7. An 128-bit IPv6 address is written as eight 16-bit hexadecimal blocks separated by colons

(:). This is an example IPv6 address: 2001:0db8:1a2b:0015:0000:0000:1a2f:0000. Service User Schedule IPv4/IPv6 Policy Management Allow Asymmetrical Route Add Edit Remove Activate Inactivate View all security policies based the service object used. View all security policies based on user or user group object used. View all security policies based on the schedule object used. Use the following items to manage IPv4 and IPv6 policies. If an alternate gateway on the LAN has an IP address in the same subnet as the Zyxel Devices LAN IP address, return traffic may not go through the Zyxel Device. This is called an asymmetrical or triangle route. This causes the Zyxel Device to reset the connection, as the connection has not been acknowledged. Select this check box to have the Zyxel Device permit the use of asymmetrical route topology on the network (not reset the connection). Note: Allowing asymmetrical routes may let traffic from the WAN go directly to the LAN without passing through the Zyxel Device. A better solution is to use virtual interfaces to put the Zyxel Device and the backup gateway on separate subnets. Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. ZyWALL ATP Series Users Guide 498 Chapter 25 Security Policy Table 193 Configuration > Security Policy > Policy Control (continued) LABEL DESCRIPTION To change a policys position in the numbered list, select the policy and click Move to display a field to type a number for where you want to put that policy and press [ENTER] to move the policy to the number that you typed. The ordering of your policies is important as they are applied in order of their numbering. Use Clone to create a new entry by modifying an existing one. Select an existing entry. Click Clone, type a number where the new entry should go and then press [ENTER]. A configuration copy of the selected entry pops up. You must at least change the name as duplicate entry names are not allowed. The following read-only fields summarize the policies you have created that apply to traffic traveling in the selected packet direction. Priority IPv4 / IPv6 Source This displays the IPv4 / IPv6 source address object, including geographic address and FQDN This is the position of your Security Policy in the global policy list (including all through-Zyxel Device and to-Zyxel Device policies). The ordering of your policies is important as policies are applied in sequence. Default displays for the default Security Policy behavior that the Zyxel Device performs on traffic that does not match any other Security Policy. This icon is lit when the entry is active and dimmed when the entry is inactive. This is the name of the Security policy. This is the direction of travel of packets. Select from which zone the packets come and to which zone they go. Security Policies are grouped based on the direction of travel of packets to which they apply. For example, from LAN to LAN means packets traveling from a computer or subnet on the LAN to either another computer or subnet on the LAN. From any displays all the Security Policies for traffic going to the selected To Zone. To any displays all the Security Policies for traffic coming from the selected From Zone. From any to any displays all of the Security Policies. To ZyWALL policies are for traffic that is destined for the Zyxel Device and control which computers can manage the Zyxel Device.

(group) objects, to which this Security Policy applies. This displays the IPv4 / IPv6 destination address object, including geographic address and FQDN (group) objects, to which this Security Policy applies. This displays the service object to which this Security Policy applies. This is the user name or user group name to which this Security Policy applies. This field tells you the schedule object that the policy uses. none means the policy is active at all times if enabled. This field displays whether the Security Policy silently discards packets without notification

(deny), permits the passage of packets (allow) or drops packets with notification (reject) Select whether to have the Zyxel Device generate a log (log), log and alert (log alert) or not

(no) when the policy is matched to the criteria listed above. This field shows you which Security Service profiles (application patrol, content filter, IDP, anti-

malware, email security) apply to this Security policy. Click an applied Security Service profile icon to edit the profile directly. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Move Clone Status Name From / To IPv4 / IPv6 Destination Service User Schedule Action Log Profile Apply Reset ZyWALL ATP Series Users Guide 499 Chapter 25 Security Policy 25.4.2 The Security Policy Control Add/Edit Screen In the Security Policy Control screen, click the Edit or Add icon to display the Security Policy Edit or Add screen. Figure 347 Configuration > Security Policy > Policy Control > Add The following table describes the labels in this screen. DESCRIPTION Use to configure any new settings objects that you need to use in this screen. Table 194 Configuration > Security Policy > Policy Control > Add LABEL Create new Object Enable Name Description Select this check box to activate the Security policy. Type a name to identify the policy Enter a descriptive name of up to 60 printable ASCII characters for the Policy. Spaces are allowed. For through-Zyxel Device policies, select the direction of travel of packets to which the policy applies. any means all interfaces. Device means packets destined for the Zyxel Device itself. Select an IPv4 / IPv6 address or address group object, including geographic address and FQDN

(group) objects, to apply the policy to traffic coming from it. Select any to apply the policy to all traffic coming from IPv4 / IPv6 addresses. Select an IPv4 / IPv6 address or address group, including geographic address and FQDN (group) objects, to apply the policy to traffic going to it. Select any to apply the policy to all traffic going to IPv4 / IPv6 addresses. Select a service or service group from the drop-down list box. From To Source Destination Service ZyWALL ATP Series Users Guide 500 Chapter 25 Security Policy Table 194 Configuration > Security Policy > Policy Control > Add (continued) LABEL User DESCRIPTION This field is not available when you are configuring a to-Zyxel Device policy. Select a user name or user group to which to apply the policy. The Security Policy is activated only when the specified user logs into the system and the policy will be disabled when the user logs out. Otherwise, select any and there is no need for user logging. Note: If you specified a source IP address (group) instead of any in the field below, the users IP address should be within the IP address range. Select a schedule that defines when the policy applies. Otherwise, select none and the policy is always effective. Use the drop-down list box to select what the Security Policy is to do with packets that match this policy. Select deny to silently discard the packets without sending a TCP reset packet or an ICMP destination-unreachable message to the sender. Select reject to discard the packets and send a TCP reset packet or an ICMP destination-

unreachable message to the sender. Select allow to permit the passage of the packets. Select whether to have the Zyxel Device generate a log (log), log and alert (log alert) or not (no) when the policy is matched to the criteria listed above.. Use this section to apply anti- x profiles (created in the Configuration > Security Service screens) to traffic that matches the criteria above. You must have created a profile first; otherwise none displays. Use Log to generate a log (log), log and alert (log alert) or not (no) for all traffic that matches criteria in the profile. Select an Application Patrol profile from the list box; none displays if no profiles have been created in the Configuration > Security Service > App Patrol screen. Select a Content Filter profile from the list box; none displays if no profiles have been created in the Configuration > Security Service > Content Filter screen. Select an SSL Inspection profile from the list box; none displays if no profiles have been created in the Configuration > Security Service > SSL Inspection screen. Click OK to save your customized settings and exit this screen. Click Cancel to exit this screen without saving. Schedule Action Log matched traffic Profile Application Patrol Content Filter SSL Inspection OK Cancel 25.5 Anomaly Detection and Prevention Overview Anomaly Detection and Prevention (ADP) protects against anomalies based on violations of protocol standards (RFCs Requests for Comments) and abnormal flows such as port scans. This section introduces ADP, anomaly profiles and applying an ADP profile to a traffic direction. Traffic Anomalies Traffic anomaly policies look for abnormal behavior or events such as port scanning, sweeping or network flooding. They operate at OSI layer-2 and layer-3. Traffic anomaly policies may be updated when you upload new firmware. ZyWALL ATP Series Users Guide 501 Chapter 25 Security Policy Protocol Anomalies Protocol anomalies are packets that do not comply with the relevant RFC (Request For Comments). Protocol anomaly detection includes:

TCP Decoder UDP Decoder ICMP Decoder Protocol anomaly policies may be updated when you upload new firmware. Note: First, create an ADP profile in the In the Configuration > Security Policy > ADP > Profile screen. Then, apply the profile to traffic originating from a specific zone in the Configuration >

Security Policy > ADP > General screen. 25.5.1 The Anomaly Detection and Prevention General Screen Click Configuration > Security Policy > ADP > General to display the next screen. Figure 348 Configuration > Security Policy > ADP > General The following table describes the labels in this screen. Table 195 Configuration > Security Policy > ADP > General LABEL General Settings Enable Anomaly Detection and Prevention DESCRIPTION Add Edit Remove Activate Inactivate Move

#

Select this to enable traffic anomaly and protocol anomaly detection and prevention. Select an entry and click Add to append a new row beneath the one selected. ADP policies are applied in order (Priority) shown in this screen Select an entry and click this to be able to modify it. Select an entry and click this to delete it. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. To change an entrys position in the numbered list, select it and click Move to display a field to type a number for where you want to put that entry and press [ENTER] to move the entry to the number that you typed. This is the entrys index number in the list. ZyWALL ATP Series Users Guide 502 Chapter 25 Security Policy Table 195 Configuration > Security Policy > ADP > General LABEL Priority Status From DESCRIPTION This is the rank in the list of anomaly profile policies. The list is applied in order of priority. The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. This is the direction of travel of packets to which an anomaly profile is bound. Traffic direction is defined by the zone the traffic is coming from. Use the From field to specify the zone from which the traffic is coming. Select ZyWALL to specify traffic coming from the Zyxel Device itself. From LAN means packets traveling from a computer on one LAN subnet to a computer on another subnet via the Zyxel Devices LAN1 zone interfaces. The Zyxel Device does not check packets traveling from a LAN computer to another LAN computer on the same subnet. From WAN means packets that come in from the WAN zone and the Zyxel Device routes back out through the WAN zone. Anomaly Profile Note: Depending on your network topology and traffic load, applying every packet direction to an anomaly profile may affect the Zyxel Devices performance. An anomaly profile is a set of anomaly policies with configured activation, log and action settings. This field shows which anomaly profile is bound to which traffic direction. Select an ADP profile to apply to the entrys traffic direction. Configure the ADP profiles in the ADP profile screens. 25.5.2 Creating New ADP Profiles Create new ADP profiles in the Configuration > Security Policy > ADP > Profile screens. When creating ADP profiles. you may find that certain policies are triggering too many false positives or false negatives. A false positive is when valid traffic is flagged as an attack. A false negative is when invalid traffic is wrongly allowed to pass through the Zyxel Device. As each network is different, false positives and false negatives are common on initial ADP deployment. To counter this, you could create a monitor profile that creates logs, but all actions are disabled. Observe the logs over time and try to eliminate the causes of the false alarms. When youre satisfied that they have been reduced to an acceptable level, you could then create an in-line profile whereby you configure appropriate actions to be taken when a packet matches a policy. ADP profiles consist of traffic anomaly profiles and protocol anomaly profiles. To create a new profile, select a base profile and then click OK to go to the profile details screen. Type a new profile name, enable or disable individual policies and then edit the default log options and actions. Click Configuration > Security Policy > ADP > Profile to view the following screen. ZyWALL ATP Series Users Guide 503 Chapter 25 Security Policy Figure 349 Configuration > Security Policy > ADP > Profile The following table describes the labels in this screen. Table 196 Configuration > Security Policy > ADP > Profile LABEL Profile Management Add Edit Remove References Clone DESCRIPTION Create ADP profiles here and then apply them in the Configuration > Security Policy

> ADP > Profile screen. Click Add and first choose a none or all Base Profile. none base profile sets all ADP entries to have Log set to no and Action set to all base profile sets all ADP entries to have Log set to log and Action set to block none by default. by default. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. Select an entry and click References to open a screen that shows which settings use the entry. Click Refresh to update information on this screen. Use Clone to create a new entry by modifying an existing one. Select an existing entry. Click Clone. A configuration copy of the selected entry pops up. You must at least change the name as duplicate entry names are not allowed.

#

Name Description Base Profile Reference This is the entrys index number in the list. This is the name of the profile you created. This is the description of the profile you created. This is the name of the base profile used to create this profile. This is the number of object references used to create this profile. 25.5.3 Traffic Anomaly Profiles Traffic anomaly detection looks for abnormal behavior such as scan or flooding attempts. In the Configuration > Security Policy > ADP > Profile screen, click the Edit or Add icon and choose a base profile. Traffic Anomaly is the first tab in the profile. ZyWALL ATP Series Users Guide 504 Chapter 25 Security Policy Figure 350 Configuration > Security Policy > ADP > Profile > Add-Traffic-Anomaly The following table describes the labels in this screen. Table 197 Configuration > Security Policy > ADP > Profile > Add-Traffic-Anomaly LABELS Name DESCRIPTION A name is automatically generated that you can edit. The name must be the same in the Traffic Anomaly and Protocol Anomaly screens for the same ADP profile. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. These are valid, unique profile names:

MyProfile mYProfile Mymy12_3-4 These are invalid profile names:

Description 1mYProfile My Profile MyProfile?

Whatalongprofilename123456789012 In addition to the name, type additional information to help you identify this ADP profile. ZyWALL ATP Series Users Guide 505 Chapter 25 Security Policy Table 197 Configuration > Security Policy > ADP > Profile > Add-Traffic-Anomaly (continued) LABELS Scan/Flood Detection DESCRIPTION Scan detection, such as port scanning, tries to find attacks where an attacker scans device(s) to determine what types of network protocols or services a device supports. Sensitivity Block Period Edit (Flood Detection only) Activate Inactivate Log Action

#

Status Name Log Action Threshold (pkt/sec) OK Cancel Save Flood detection tries to find attacks that saturate a network with useless data, use up all available bandwidth, and so aim to make communications in the network impossible.

(Scan detection only.) Select a sensitivity level so as to reduce false positives in your network. If you choose low sensitivity, then scan thresholds and sample times are set low, so you will have fewer logs and false positives; however some traffic anomaly attacks may not be detected. If you choose high sensitivity, then scan thresholds and sample times are set high, so most traffic anomaly attacks will be detected; however you will have more logs and false positives. Specify for how many seconds the Zyxel Device blocks all packets from being sent to the victim (destination) of a detected anomaly attack. Flood Detection applies blocking to the destination IP address and Scan Detection applies blocking to the source IP address. Select an entry and click this to be able to modify it. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. To edit an items log option, select it and use the Log icon. Select whether to have the Zyxel Device generate a log (log), log and alert (log alert) or neither (no) when traffic matches this anomaly policy. To edit what action the Zyxel Device takes when a packet matches a policy, select the policy and use the Action icon. none: The Zyxel Device takes no action when a packet matches the policy. block: The Zyxel Device silently drops packets that matches the policy. Neither sender nor receiver are notified. This is the entrys index number in the list. The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. This is the name of the anomaly policy. Click the Name column heading to sort in ascending or descending order according to the protocol anomaly policy name. These are the log options. To edit this, select an item and use the Log icon. This is the action the Zyxel Device should take when a packet matches a policy. To edit this, select an item and use the Action icon.

(Flood detection only.) Select a suitable threshold level (the number of packets per second that match the flood detection criteria) for your network. If you choose a low threshold, most traffic anomaly attacks will be detected, but you may have more logs and false positives. If you choose a high threshold, some traffic anomaly attacks may not be detected, but you will have fewer logs and false positives. Click OK to save your settings to the Zyxel Device, complete the profile and return to the profile summary page. Click Cancel to return to the profile summary page without saving any changes. Click Save to save the configuration to the Zyxel Device but remain in the same page. You may then go to the another profile screen (tab) in order to complete the profile. Click OK in the final profile screen to complete the profile. ZyWALL ATP Series Users Guide 506 Chapter 25 Security Policy 25.5.4 Protocol Anomaly Profiles Protocol anomalies are packets that do not comply with the relevant RFC (Request For Comments). Protocol anomaly detection includes:

TCP Decoder UDP Decoder ICMP Decoder IP Decoder Teardrop When an IP packet is larger than the Maximum Transmission Unit (MTU) configured in the Zyxel Device, it is fragmented using the TCP or ICMP protocol. A Teardrop attack falsifies the offset which defines the size of the fragment and the original packet. A series of IP fragments with overlapping offset fields can cause some systems to crash, hang, or reboot when fragment reassembling is attempted at the destination. IP Spoofing IP Spoofing is used to gain unauthorized access to network devices by modifying packet headers so that it appears that the packets originate from a host within a trusted network. In an IP Spoof from the WAN, the source address appears to be in the same subnet as a Zyxel Device LAN interface. In an IP Spoof from a LAN interface, the source address appears to be in a different subnet from that Zyxel Device LAN interface. ZyWALL ATP Series Users Guide 507 Chapter 25 Security Policy Figure 351 Configuration > Security Policy > ADP > Profile > Add-Protocol-Anomaly ZyWALL ATP Series Users Guide 508 Chapter 25 Security Policy The following table describes the labels in this screen. Table 198 Configuration > Security Policy > ADP > Profile > Add-Protocol-Anomaly LABEL Name DESCRIPTION A name is automatically generated that you can edit. The name must be the same in the Traffic Anomaly and Protocol Anomaly screens for the same ADP profile. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. These are valid, unique profile names:

Description TCP Decoder/UDP Decoder/ICMP Decoder/IP Decoder Activate Inactivate Log Action

#

Status Name MyProfile mYProfile Mymy12_3-4 These are invalid profile names:

1mYProfile My Profile MyProfile?

Whatalongprofilename123456789012 In addition to the name, type additional information to help you identify this ADP profile. Perform the following actions for each type of encoder. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. To edit an items log option, select it and use the Log icon. Select whether to have the Zyxel Device generate a log (log), log and alert (log alert) or neither (no) when traffic matches this anomaly policy. To edit what action the Zyxel Device takes when a packet matches a policy, select the policy and use the Action icon. original setting: Select this action to return each rule in a service group to its previously saved configuration. none: Select this action to have the Zyxel Device take no action when a packet matches a policy. drop: Select this action to have the Zyxel Device silently drop a packet that matches a policy. Neither sender nor receiver are notified. reject-sender: Select this action to have the Zyxel Device send a reset to the sender when a packet matches the policy. If it is a TCP attack packet, the Zyxel Device will send a packet with a RST flag. If it is an ICMP or UDP attack packet, the Zyxel Device will send an ICMP unreachable packet. reject-receiver: Select this action to have the Zyxel Device send a reset to the receiver when a packet matches the policy. If it is a TCP attack packet, the Zyxel Device will send a packet with an a RST flag. If it is an ICMP or UDP attack packet, the Zyxel Device will do nothing. reject-both: Select this action to have the Zyxel Device send a reset to both the sender and receiver when a packet matches the policy. If it is a TCP attack packet, the Zyxel Device will send a packet with a RST flag to the receiver and sender. If it is an ICMP or UDP attack packet, the Zyxel Device will send an ICMP unreachable packet. This is the entrys index number in the list. The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. This is the name of the anomaly policy. Click the Name column heading to sort in ascending or descending order according to the protocol anomaly policy name. ZyWALL ATP Series Users Guide 509 Chapter 25 Security Policy Table 198 Configuration > Security Policy > ADP > Profile > Add-Protocol-Anomaly LABEL Log Action DESCRIPTION These are the log options. To edit this, select an item and use the Log icon. This is the action the Zyxel Device should take when a packet matches a policy. To edit this, select an item and use the Action icon. Click OK to save your settings to the Zyxel Device, complete the profile and return to the profile summary page. Click Cancel to return to the profile summary page without saving any changes. Click Save to save the configuration to the Zyxel Device but remain in the same page. You may then go to the another profile screen (tab) in order to complete the profile. Click OK in the final profile screen to complete the profile. OK Cancel Save 25.6 The Session Control Screen Click Configuration > Security Policy > Session Control to display the Security Policy Session Control screen. Use this screen to limit the number of concurrent NAT/Security Policy sessions a client can use. You can apply a default limit for all users and individual limits for specific users, addresses, or both. The individual limit takes priority if you apply both. Figure 352 Configuration > Security Policy > Session Control ZyWALL ATP Series Users Guide 510 Chapter 25 Security Policy The following table describes the labels in this screen. DESCRIPTION Table 199 Configuration > Security Policy > Session Control LABEL General Settings UDP Session Time Out Session Limit Settings Enable Session limit IPv4 / IPv6 Configuration Set how many seconds the Zyxel Device will allow a UDP session to remain idle (without UDP traffic) before closing it. Select this check box to control the number of concurrent sessions hosts can have. This table lists the rules for limiting the number of concurrent sessions hosts can have. Default Session per Host Add Edit Remove Activate Inactivate Move This field is configurable only when you enable session limit. Use this field to set a common limit to the number of concurrent NAT/Security Policy sessions each client computer can have. If only a few clients use peer to peer applications, you can raise this number to improve their performance. With heavy peer to peer application use, lower this number to ensure no single client uses too many of the available NAT sessions. Create rules below to apply other limits for specific users or addresses. Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. To change a rules position in the numbered list, select the rule and click Move to display a field to type a number for where you want to put that rule and press [ENTER] to move the rule to the number that you typed.

#

Status

#

User IPv4 / IPv6 Address Description Limit Apply Reset The ordering of your rules is important as they are applied in order of their numbering. This field is a sequential value showing the number of the profile. The profile order is not important. This icon is lit when the entry is active and dimmed when the entry is inactive. This is the index number of a session limit rule. It is not associated with a specific rule. This is the user name or user group name to which this session limit rule applies. This is the IPv4 / IPv6 address object, including geographic address (group) objects to which this session limit rule applies. This is the information configured to help you identify the rule. This is how many concurrent sessions this user or address is allowed to have. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. 25.6.1 The Session Control Add/Edit Screen Click Configuration > Security Policy > Session Control and the Add or Edit icon to display the Add or Edit screen. Use this screen to configure rules that define a session limit for specific users or addresses. ZyWALL ATP Series Users Guide 511 Chapter 25 Security Policy Figure 353 Configuration > Security Policy > Session Control > Edit The following table describes the labels in this screen. Table 200 Configuration > Security Policy > Session Control > Add / Edit LABEL Create new Object Enable Rule Description DESCRIPTION Use to configure new settings for User or Address objects that you need to use in this screen.Click on the down arrow to see the menu. Select this check box to turn on this session limit rule. Enter information to help you identify this rule. Use up to 60 printable ASCII characters. Spaces are allowed. Select a user name or user group to which to apply the rule. The rule is activated only when the specified user logs into the system and the rule will be disabled when the user logs out. Otherwise, select any and there is no need for user logging. User Note: If you specified an IP address (or address group) instead of any in the field below, the users IP address should be within the IP address range. Select the IPv4 source address or address group, including geographic address (group) object, to which this rule applies. Select any to apply the rule to all IPv4 source addresses. Select the IPv6 source address or address group, including geographic address (group) object, to which this rule applies. Select any to apply the rule to all IPv6 source addresses. Use this field to set a limit to the number of concurrent NAT/Security Policy sessions this rules users or addresses can have. For this rules users and addresses, this setting overrides the Default Session per Host setting in the general Security Policy Session Control screen. Click OK to save your customized settings and exit this screen. Click Cancel to exit this screen without saving. Address IPv6 Address Session Limit per Host OK Cancel 25.7 Security Policy Example Applications Suppose you decide to block LAN users from using IRC (Internet Relay Chat) through the Internet. To do this, you would configure a LAN to WAN Security Policy that blocks IRC traffic from any source IP address from going to any destination address. You do not need to specify a schedule since you need the Security Policy to always be in effect. The following figure shows the results of this policy. ZyWALL ATP Series Users Guide 512 Chapter 25 Security Policy Figure 354 Blocking All LAN to WAN IRC Traffic Example Your Security Policy would have the following settings. Table 201 Blocking All LAN to WAN IRC Traffic Example

#

1 2 DESTINATION Any Any SOURCE Any Any USER Any Any SCHEDULE Any Any SERVICE IRC Any ACTION Deny Allow The first row blocks LAN access to the IRC service on the WAN. The second row is the Security Policys default policy that allows all LAN1 to WAN traffic. The Zyxel Device applies the security policies in order. So for this example, when the Zyxel Device receives traffic from the LAN, it checks it against the first policy. If the traffic matches (if it is IRC traffic) the security policy takes the action in the policy (drop) and stops checking the subsequent security policies. Any traffic that does not match the first security policy will match the second security policy and the Zyxel Device forwards it. Now suppose you need to let the CEO use IRC. You configure a LAN1 to WAN security policy that allows IRC traffic from the IP address of the CEOs computer. You can also configure a LAN to WAN policy that allows IRC traffic from any computer through which the CEO logs into the Zyxel Device with his/her user name. In order to make sure that the CEOs computer always uses the same IP address, make sure it either:

Has a static IP address, or You configure a static DHCP entry for it so the Zyxel Device always assigns it the same IP address. Now you configure a LAN1 to WAN security policy that allows IRC traffic from the IP address of the CEOs computer (172.16.1.7 for example) to go to any destination address. You do not need to specify a schedule since you want the security policy to always be in effect. The following figure shows the results of your two custom policies. ZyWALL ATP Series Users Guide 513 Chapter 25 Security Policy Figure 355 Limited LAN to WAN IRC Traffic Example Your security policy would have the following configuration. Table 202 Limited LAN1 to WAN IRC Traffic Example 1

#

1 2 3 DESTINATION Any Any Any SOURCE 172.16.1.7 Any Any USER Any Any Any SCHEDULE Any Any Any SERVICE IRC IRC Any ACTION Allow Deny Allow The first row allows the LAN1 computer at IP address 172.16.1.7 to access the IRC service on the WAN. The second row blocks LAN1 access to the IRC service on the WAN. The third row is the default policy of allowing all traffic from the LAN1 to go to the WAN. Alternatively, you configure a LAN1 to WAN policy with the CEOs user name (say CEO) to allow IRC traffic from any source IP address to go to any destination address. Your Security Policy would have the following settings. Table 203 Limited LAN1 to WAN IRC Traffic Example 2

#

1 2 3 DESTINATION Any Any Any SOURCE Any Any Any USER CEO Any Any SCHEDULE Any Any Any SERVICE IRC IRC Any ACTION Allow Deny Allow The first row allows any LAN1 computer to access the IRC service on the WAN by logging into the Zyxel Device with the CEOs user name. The second row blocks LAN1 access to the IRC service on the WAN. The third row is the default policy of allowing allows all traffic from the LAN1 to go to the WAN. The policy for the CEO must come before the policy that blocks all LAN1 to WAN IRC traffic. If the policy that blocks all LAN1 to WAN IRC traffic came first, the CEOs IRC traffic would match that policy and the Zyxel Device would drop it and not check any other security policies. ZyWALL ATP Series Users Guide 514 CHAPTER 26 Application Patrol 26.1 Overview Application patrol provides a convenient way to manage the use of various applications on the network. It manages general protocols (for example, HTTP and FTP) and instant messenger (IM), peer-to-

peer (P2P), Voice over IP (VoIP), and streaming (RSTP) applications. You can even control the use of a particular applications individual features (like text messaging, voice, video conferencing, and file transfers). 26.1.1 What You Can Do in this Chapter Use the App Patrol summary screen (see Section 26.2 on page 516) to manage the application patrol profiles. You can also view license registration and signature information. Use the App Patrol Add/Edit screens (see Section 26.2.2 on page 520 & Section 26.2.3 on page 521) to set actions for application categories and for specific applications within the category. 26.1.2 What You Need to Know If you want to use a service, make sure both the Security Policy and application patrol allow the services packets to go through the Zyxel Device. Note: The Zyxel Device checks secure policies before it checks application patrol rules for traffic going through the Zyxel Device. Application patrol examines every TCP and UDP connection passing through the Zyxel Device and identifies what application is using the connection. Then, you can specify whether or not the Zyxel Device continues to route the connection. Traffic not recognized by the application patrol signatures is ignored. Application Profiles & Policies An application patrol profile is a group of categories of application patrol signatures. For each profile, you can specify the default action the Zyxel Device takes once a packet matches a signature (forward, drop, or reject a services connections and/or create a log alert). Use policies to link profiles to traffic flows based on criteria such as source zone, destination zone, source address, destination address, schedule, user. Classification of Applications There are two ways the Zyxel Device can identify the application. The first is called auto. The Zyxel Device looks at the IP payload (OSI level-7 inspection) and attempts to match it with known patterns for specific applications. Usually, this occurs at the beginning of a connection, when the payload is more consistent across connections, and the Zyxel Device examines several packets to make sure the match ZyWALL ATP Series Users Guide 515 Chapter 26 Application Patrol is correct. Before confirmation, packets are forwarded by App Patrol with no action taken. The number of packets inspected before confirmation varies by signature. Note: The Zyxel Device allows the first eight packets to go through the security policy, regardless of the application patrol policy for the application. The Zyxel Device examines these first eight packets to identify the application. The second approach is called service ports. The Zyxel Device uses only OSI level-4 information, such as ports, to identify what application is using the connection. This approach is available in case the Zyxel Device identifies a lot of false positives for a particular application. Custom Ports for SIP and the SIP ALG Configuring application patrol to use custom port numbers for SIP traffic also configures the SIP ALG to use the same port numbers for SIP traffic. Likewise, configuring the SIP ALG to use custom port numbers for SIP traffic also configures application patrol to use the same port numbers for SIP traffic. 26.2 Application Patrol Profile Use the application patrol screens to customize action and log settings for a group of application patrol signatures. You then link a profile to a policy. Use this screen to create an application patrol profile, and view signature information. It also lists the registration status and details about the signature set the Zyxel Device is using. Note: You must register for the AppPatrol signature service (at least the trial) before you can use it. A profile is an application object(s) or application group(s) that has customized action and log settings. Click Configuration > Security Service > App Patrol to open the following screen. Click the Application Patrol icon for more information on the Zyxel Devices security features. Figure 356 Configuration > Security Service > App Patrol ZyWALL ATP Series Users Guide 516 Chapter 26 Application Patrol The following table describes the labels in this screen. Table 204 Configuration > Security Service > App Patrol LABEL Add DESCRIPTION Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. Select an entry and click Remove to delete the selected entry. Select an entry and click References to open a screen that shows which settings use the entry. Click Refresh to update information on this screen. This field is a sequential value showing the number of the profile. The profile order is not important. This displays the name of the profile created. This displays the description of the App Patrol Profile. This field displays the scan options from the App Patrol profile. This displays the number of times an object reference is used in a profile. Click this icon to apply the entry to a security policy. Go to the Configuration > Security Policy > Policy Control screen to check the result. The following fields display information on the current signature set that the Zyxel Device is using. This field displays the App Patrol signature set version number. This number gets larger as the set is enhanced. This field displays the number of IDP signatures in this set. This number usually gets larger as the set is enhanced. Older signatures and rules may be removed if they are no longer applicable or have been supplanted by newer ones. This field displays the date and time the set was released. Click this link to go to the screen you can use to download signatures from the update server. Edit Remove References

#

Name Description Scan Option Reference Action Signature Information Current Version Signature Number Released Date Update Signatures 26.2.1 Apply to a Security Policy Click the icon in the Action field of an existing application patrol file to apply the profile to a security policy. Go to the Configuration > Security Policy > Policy Control screen to check the result. ZyWALL ATP Series Users Guide 517 Chapter 26 Application Patrol Figure 357 Configuration > Security Service > App Patrol > Action The following table describes the labels in this screen. DESCRIPTION Click Show Filter to display IPv4 and IPv6 (if enabled) security policy search filters. Table 205 Configuration > Security Service > App Patrol > Action LABEL Show Filter/Hide Filter IPv4 / IPv6 Configuration From / To Use IPv4 / IPv6 search filters to find specific IPv4 and IPv6 (if enabled) security policies based on direction, application, user, source, destination and/or schedule. Select a zone to view all security policies from a particular zone and/or to a particular zone. any means all zones. ZyWALL ATP Series Users Guide 518 Chapter 26 Application Patrol Table 205 Configuration > Security Service > App Patrol > Action LABEL DESCRIPTION Type an IPv4 or IPv6 IP address to view all security policies based on the IPv4 / IPv6 source address object used. IPv4 / IPv6 Source An IPv4 IP address is written as four integer blocks separated by periods. This is an example IPv4 address: 172.16.6.7. An 128-bit IPv6 address is written as eight 16-bit hexadecimal blocks separated by colons

(:). This is an example IPv6 address: 2001:0db8:1a2b:0015:0000:0000:1a2f:0000. IPv4 / IPv6 Destination Type an IPv4 or IPv6 IP address to view all security policies based on the IPv4 / IPv6 destination address object used. Service User Schedule Priority Status Name From / To An IPv4 IP address is written as four integer blocks separated by periods. This is an example IPv4 address: 172.16.6.7. An 128-bit IPv6 address is written as eight 16-bit hexadecimal blocks separated by colons

(:). This is an example IPv6 address: 2001:0db8:1a2b:0015:0000:0000:1a2f:0000. View all security policies based the service object used. View all security policies based on user or user group object used. View all security policies based on the schedule object used. This is the position of your Security Policy in the global policy list (including all through-Zyxel Device and to-Zyxel Device policies). The ordering of your policies is important as policies are applied in sequence. Default displays for the default Security Policy behavior that the Zyxel Device performs on traffic that does not match any other Security Policy. This icon is lit when the entry is active and dimmed when the entry is inactive. This is the name of the Security policy. This is the direction of travel of packets. Select from which zone the packets come and to which zone they go. Security Policies are grouped based on the direction of travel of packets to which they apply. For example, from LAN to LAN means packets traveling from a computer or subnet on the LAN to either another computer or subnet on the LAN. From any displays all the Security Policies for traffic going to the selected To Zone. To any displays all the Security Policies for traffic coming from the selected From Zone. From any to any displays all of the Security Policies. To ZyWALL policies are for traffic that is destined for the Zyxel Device and control which computers can manage the Zyxel Device. IPv4 / IPv6 Source This displays the IPv4 / IPv6 source address object, including geographic address and FQDN IPv4 / IPv6 Destination Service User Schedule Action Log Profile OK Cancel

(group) objects, to which this Security Policy applies. This displays the IPv4 / IPv6 destination address object, including geographic address and FQDN (group) objects, to which this Security Policy applies. This displays the service object to which this Security Policy applies. This is the user name or user group name to which this Security Policy applies. This field tells you the schedule object that the policy uses. none means the policy is active at all times if enabled. This field displays whether the Security Policy silently discards packets without notification

(deny), permits the passage of packets (allow) or drops packets with notification (reject) Select whether to have the Zyxel Device generate a log (log), log and alert (log alert) or not

(no) when the policy is matched to the criteria listed above. This field shows you which Security Service profiles (application patrol, content filter, IDP, anti-

malware, email security) apply to this Security policy. Click an applied Security Service profile icon to edit the profile directly. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving. ZyWALL ATP Series Users Guide 519 Chapter 26 Application Patrol 26.2.2 The Application Patrol Profile Add/Edit Screen - My Application Use this screen to configure profile settings. Click Configuration > Security Service > App Patrol > Add/

Edit, then click My Application to open the following screen. Figure 358 Configuration > Security Service > App Patrol > Add/Edit > My Application The following table describes the labels in this screen. Table 206 Configuration > Security Service > App Patrol > Add/Edit > My Application LABEL General Settings DESCRIPTION Name Type the name of the profile. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. These are valid, unique profile names:

MyProfile mYProfile Mymy12_3-4 These are invalid profile names:

1mYProfile My Profile MyProfile?

Whatalongprofilename123456789012 Type a description for the profile rule to help identify the purpose of rule. You may use 1-31 alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. This field is optional. This field displays the total number of the selected category(ies) in the Query Result screen. This field displays the total number of the selected applications in the Query Result screen. Select an entry and click Remove to delete the selected entry. Description Total Category(s) Total Application(s) Remove ZyWALL ATP Series Users Guide 520 Chapter 26 Application Patrol Table 206 Configuration > Security Service > App Patrol > Add/Edit (continued)> My Application LABEL Log DESCRIPTION Select whether to have the Zyxel Device generate a log (log), log and alert (log alert) or neither (no) by default when traffic matches a signature in this category. Select the default action for all signatures in this category. forward - the Zyxel Device routes packets that matches these signatures. drop - the Zyxel Device silently drops packets that matches these signatures without notification. reject - the Zyxel Device drops packets that matches these signatures and sends notification. This field is a sequential value showing the number of the profile. The profile order is not important. This field displays the application name of the policy. This field displays the category type of the application. This field displays the tag information of the application. Select the default action for all signatures in this category. forward - the Zyxel Device routes packets that matches these signatures. drop - the Zyxel Device silently drops packets that matches these signatures without notification. reject - the Zyxel Device drops packets that matches these signatures and sends notification. Select whether to have the Zyxel Device generate a log (log), log and alert (log alert) or neither (no) by default when traffic matches a signature in this category. A profile consists of separate category editing screens. If you want to configure just one category for a profile, click OK to save your settings to the Zyxel Device, complete the profile and return to the profile summary page. Click Cancel to return to the profile summary page without saving any changes. If you want to configure more than one category for a profile, click Save to save your settings to the Zyxel Device without leaving this page. Action

#

Application Category Tag Action Log Save & Exit Cancel Save 26.2.3 The Application Patrol Profile Add/Edit Screen - Query Result Click Configuration > Security Service > App Patrol > Add, then click Query Result to search for certain applications within a specific category, and the selected applications will be added to My Application screen. You can also click an existing profile, click Edit (or double-click it), then click Query Result to open the following screen. ZyWALL ATP Series Users Guide 521 Chapter 26 Application Patrol Figure 359 Configuration > Security Service > App Patrol > Add/Edit > Query Result The following table describes the labels in this screen. Table 207 Configuration > Security Service > App Patrol > Add/Edit > Query Result LABEL General Settings DESCRIPTION Name Type the name of the profile. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. These are valid, unique profile names:

MyProfile mYProfile Mymy12_3-4 These are invalid profile names:

1mYProfile My Profile MyProfile?

Whatalongprofilename123456789012 Type a description for the profile rule to help identify the purpose of rule. You may use 1-31 alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. This field is optional. Enter a name to search for relevant applications. Select a category(ies) below to search for relevant applications. Add or delete a tag(s) to display or not display an application(s). This field is a sequential value showing the number of the profile. The profile order is not important. This field displays the application name of the policy. This field displays the category type of the application. Description Search Application(s) By Name Search Application(s) By Category Filter by Tags

#

Application Category ZyWALL ATP Series Users Guide 522 Chapter 26 Application Patrol Table 207 Configuration > Security Service > App Patrol > Add/Edit (continued)> Query Result LABEL Tag Action DESCRIPTION This field displays the tag information of the policy. Select the default action for all signatures in this category. forward - the Zyxel Device routes packets that matches these signatures. drop - the Zyxel Device silently drops packets that matches these signatures without notification. reject - the Zyxel Device drops packets that matches these signatures and sends notification. Select whether to have the Zyxel Device generate a log (log), log and alert (log alert) or neither (no) by default when traffic matches a signature in this category. Select an application(s) to show in the My Application profile screen. Log Add to My Application Reset Cancel Click this button to reset the fields to default settings. Click Cancel to return to the profile summary page without saving any changes. ZyWALL ATP Series Users Guide 523 CHAPTER 27 Content Filter 27.1 Overview Use the content filtering feature to control access to specific web sites or web content. 27.1.1 What You Can Do in this Chapter Use the Filter Profile screens (Section 27.2 on page 526) to set up content filtering profiles. Use the Trusted Web Sites screens (Section 27.3 on page 539) to create a common list of good

(allowed) web site addresses. Use the Forbidden Web Sites screens (Section 27.4 on page 540) to create a common list of bad

(blocked) web site addresses. 27.1.2 What You Need to Know Content Filtering Content filtering allows you to block certain web features, such as cookies, and/or block access to specific web sites. It can also block access to specific categories of web site content. You can create different content filter policies for different addresses, schedules, users or groups and content filter profiles. For example, you can configure one policy that blocks John Does access to arts and entertainment web pages during the workday and another policy that lets him access them after work. Content Filtering Policies A content filtering policy allows you to do the following. Use schedule objects to define when to apply a content filter profile. Use address and/or user/group objects to define to whose web access to apply the content filter profile. Apply a content filter profile that you have custom-tailored. Content Filtering Profiles A content filtering profile conveniently stores your custom settings for the following features. Category-based Blocking The Zyxel Device can block access to particular categories of web site content, such as pornography or racial intolerance. ZyWALL ATP Series Users Guide 524 Chapter 27 Content Filter Restrict Web Features The Zyxel Device can disable web proxies and block web features such as ActiveX controls, Java applets and cookies. Customize Web Site Access You can specify URLs to which the Zyxel Device blocks access. You can alternatively block access to all URLs except ones that you specify. You can also have the Zyxel Device block access to URLs that contain particular keywords. Content Filtering Configuration Guidelines When the Zyxel Device receives an HTTP request, the content filter searches for a policy that matches the source address and time (schedule). The content filter checks the policies in order (based on the policy numbers). When a matching policy is found, the content filter allows or blocks the request depending on the settings of the filtering profile specified by the policy. Some requests may not match any policy. The Zyxel Device allows the request if the default policy is not set to block. The Zyxel Device blocks the request if the default policy is set to block. External Web Filtering Service When you register for and enable the external web filtering service, your Zyxel Device accesses an external database that has millions of web sites categorized based on content. You can have the Zyxel Device block, block and/or log access to web sites based on these categories. HTTPS Domain Filter HTTPS Domain Filter works with the Content Filter category feature to identify HTTPS traffic and take appropriate action. SSL Inspection identifies HTTPS traffic for all Security Service traffic and has higher priority than HTTPS Domain Filter. HTTPS Domain Filter only identifies keywords in the domain name of an URL and matches it to a category. For example, if the keyword is 'picture' and the URL is http://

www.google.com/picture/index.htm, then HTTPS Domain Filter cannot identify 'picture' because that keyword in not in the domain name 'www.google.com'. However, SSL Inspection can identify 'picture' in the URL http://www.google.com/picture/index.htm. Keyword Blocking URL Checking The Zyxel Device checks the URLs domain name (or IP address) and file path separately when performing keyword blocking. The URLs domain name or IP address is the characters that come before the first slash in the URL. For example, with the URL www.zyxel.com.tw/news/pressroom.php, the domain name is www.zyxel.com.tw. The file path is the characters that come after the first slash in the URL. For example, with the URL www.zyxel.com.tw/news/pressroom.php, the file path is news/pressroom.php. Since the Zyxel Device checks the URLs domain name (or IP address) and file path separately, it will not find items that go across the two. For example, with the URL www.zyxel.com.tw/news/pressroom.php, the Zyxel Device would find tw in the domain name (www.zyxel.com.tw). It would also find news in the file path (news/pressroom.php) but it would not find tw/news. ZyWALL ATP Series Users Guide 525 Chapter 27 Content Filter Finding Out More See Section 27.5 on page 541 for content filtering background/technical information. 27.1.3 Before You Begin You must configure an address object, a schedule object and a filtering profile before you can set up a content security policy. You must have Content Filtering license in order to use the function.subscribe to use the external database content filtering (see the Licensing > Registration screens). 27.2 Content Filter Profile Screen Click Configuration > Security Service> Content Filter > Profile to open the Content Filter Profile screen. Use this screen to enable content filtering, view and order your list of content filter policies, create a denial of access message or specify a redirect URL and check your external web filtering service registration status. Click the Content Filter icon for more information on the Zyxel Devices security features. Figure 360 Configuration > Security Service > Content Filter > Profile ZyWALL ATP Series Users Guide 526 Chapter 27 Content Filter The following table describes the labels in this screen. Table 208 Configuration > Security Service > Content Filter > Profile LABEL General Settings Enable HTTPS Domain Filter for HTTPS traffic DESCRIPTION Select this check box to have the Zyxel Device block HTTPS web pages using the cloud category service. Drop connection when HTTPS connection with SSL V3 or previous version Content Filter Category Service Timeout Denied Access Message Redirect URL Profile Management Add Edit Remove References

#

Name Description Reference Action Apply Reset In an HTTPS connection, the Zyxel Device can extract the Server Name Indication

(SNI) from a client request, check if it matches a category in the cloud content filter and then take appropriate action. The keyword match is for the domain name only. Select this check box to have the Zyxel Device block HTTPS web pages using SSL V3 or a previous version. Specify the allowable time period in seconds for accessing the external web filtering services server. Enter a message to be displayed when content filter blocks access to a web page. Use up to 127 characters (0-9a-zA-Z;/?:@&=+$\.-_!~*'()%,). For example, Access to this web page is not allowed. Please contact the network administrator. It is also possible to leave this field blank if you have a URL specified in the Redirect URL field. In this case if the content filter blocks access to a web page, the Zyxel Device just opens the web page you specified without showing a denied access message. Enter the URL of the web page to which you want to send users when their web access is blocked by content filter. The web page you specify here opens in a new frame below the denied access message. Use http:// or https:// followed by up to 262 characters (0-9a-zA-Z;/?:@&=+$\.-

_!~*'()%). For example, http://192.168.1.17/blocked access. Click Add to create a new content filter rule. Click Edit to make changes to a content filter rule. Click Remove the delete a content filter rule. Select an entry and click References to open a screen that shows which settings use the entry. Click Refresh to update information on this screen. This column lists the index numbers of the content filter profile. This column lists the names of the content filter profile rule. This column lists the description of the content filter profile rule. This displays the number of times an Object Reference is used in a rule. Click this icon to apply the content filter profile with a security policy. Go to the Configuration > Security Policy > Policy Control screen to check the result. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. 27.2.1 Apply to a Security Policy Click the icon in the Action field to apply the entry to a security policy. Go to the Configuration > Security Policy > Policy Control screen to check the result. ZyWALL ATP Series Users Guide 527 Chapter 27 Content Filter Figure 361 Configuration > Security Service > Content Filter > Action The following table describes the labels in this screen. DESCRIPTION Click Show Filter to display IPv4 and IPv6 (if enabled) security policy search filters. Table 209 Configuration > Security Service > Content Filter > Action LABEL Show Filter/Hide Filter IPv4 / IPv6 Configuration From / To Use IPv4 / IPv6 search filters to find specific IPv4 and IPv6 (if enabled) security policies based on direction, application, user, source, destination and/or schedule. Select a zone to view all security policies from a particular zone and/or to a particular zone. any means all zones. ZyWALL ATP Series Users Guide 528 Chapter 27 Content Filter Table 209 Configuration > Security Service > Content Filter > Action LABEL DESCRIPTION Type an IPv4 or IPv6 IP address to view all security policies based on the IPv4 / IPv6 source address object used. IPv4 / IPv6 Source An IPv4 IP address is written as four integer blocks separated by periods. This is an example IPv4 address: 172.16.6.7. An 128-bit IPv6 address is written as eight 16-bit hexadecimal blocks separated by colons

(:). This is an example IPv6 address: 2001:0db8:1a2b:0015:0000:0000:1a2f:0000. IPv4 / IPv6 Destination Type an IPv4 or IPv6 IP address to view all security policies based on the IPv4 / IPv6 destination address object used. Service User Schedule Priority Status Name From / To An IPv4 IP address is written as four integer blocks separated by periods. This is an example IPv4 address: 172.16.6.7. An 128-bit IPv6 address is written as eight 16-bit hexadecimal blocks separated by colons

(:). This is an example IPv6 address: 2001:0db8:1a2b:0015:0000:0000:1a2f:0000. View all security policies based the service object used. View all security policies based on user or user group object used. View all security policies based on the schedule object used. This is the position of your Security Policy in the global policy list (including all through-Zyxel Device and to-Zyxel Device policies). The ordering of your policies is important as policies are applied in sequence. Default displays for the default Security Policy behavior that the Zyxel Device performs on traffic that does not match any other Security Policy. This icon is lit when the entry is active and dimmed when the entry is inactive. This is the name of the Security policy. This is the direction of travel of packets. Select from which zone the packets come and to which zone they go. Security Policies are grouped based on the direction of travel of packets to which they apply. For example, from LAN to LAN means packets traveling from a computer or subnet on the LAN to either another computer or subnet on the LAN. From any displays all the Security Policies for traffic going to the selected To Zone. To any displays all the Security Policies for traffic coming from the selected From Zone. From any to any displays all of the Security Policies. To ZyWALL policies are for traffic that is destined for the Zyxel Device and control which computers can manage the Zyxel Device. IPv4 / IPv6 Source This displays the IPv4 / IPv6 source address object, including geographic address and FQDN IPv4 / IPv6 Destination Service User Schedule Action Log Profile OK Cancel

(group) objects, to which this Security Policy applies. This displays the IPv4 / IPv6 destination address object, including geographic address and FQDN (group) objects, to which this Security Policy applies. This displays the service object to which this Security Policy applies. This is the user name or user group name to which this Security Policy applies. This field tells you the schedule object that the policy uses. none means the policy is active at all times if enabled. This field displays whether the Security Policy silently discards packets without notification

(deny), permits the passage of packets (allow) or drops packets with notification (reject) Select whether to have the Zyxel Device generate a log (log), log and alert (log alert) or not

(no) when the policy is matched to the criteria listed above. This field shows you which Security Service profiles (application patrol, content filter, IDP, anti-

malware, email security) apply to this Security policy. Click an applied Security Service profile icon to edit the profile directly. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving. ZyWALL ATP Series Users Guide 529 Chapter 27 Content Filter 27.2.2 Content Filter Add Profile Category Service Click Configuration > Security Service > Content Filter > Profile > Add or Edit to open the Add Filter Profile screen. Figure 362 Content Filter > Profile > Add Filter Profile > Category Service ZyWALL ATP Series Users Guide 530 Chapter 27 Content Filter The following table describes the labels in this screen. Table 210 Configuration > Security Service > Content Filter > Profile > Add > Category Service LABEL Name DESCRIPTION Enter a descriptive name for this content filtering profile name. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Enter a description for the content filtering profile rule to help identify the purpose of rule. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Description Enable SafeSearch Enable Content Filter Category Service Log all web pages Action for Managed Web Pages Action for Unrated Web Pages This field is optional. SafeSearch is a search engine that can automatically filter sexually explicit videos and images from the search result without overloading the Zyxel Device. It does this by adding a parameter in the search URL:

https://www.google.com.tw/?gws_rd=ssl#q=porn&safe=active. Supported search engines at the time of writing are:

Yahoo, Google, MSN Live Bing, Yandex Enable external database content filtering to have the Zyxel Device check an external database to find to which category a requested web page belongs. The Zyxel Device then blocks or forwards access to the web page depending on the configuration of the rest of this page. Select this to record attempts to access web pages when:

They match the other categories that you select below. They are not categorized. The external content filtering database is unavailable. Select Pass to allow users to access web pages that match the other categories that you select below. Select Block to prevent users from accessing web pages that match the other categories that you select below. When external database content filtering blocks access to a web page, it displays the denied access message that you configured in the Content Filter General screen along with the category of the blocked web page. Select Log to record attempts to access web pages that match the other categories that you select below. Select Pass to allow users to access web pages that the external web filtering service has not categorized. Select Block to prevent users from accessing web pages that the external web filtering service has not categorized. When the external database content filtering blocks access to a web page, it displays the denied access message that you configured in the Content Filter General screen along with the category of the blocked web page. Select Warn to display a warning message before allowing users to access web pages that the external web filtering service has not categorized. Select Log to record attempts to access web pages that are not categorized. ZyWALL ATP Series Users Guide 531 Chapter 27 Content Filter Table 210 Configuration > Security Service > Content Filter > Profile > Add > Category Service LABEL Action When Category Server Is Unavailable Select Categories Select All Categories Clear All Categories Managed Categories Test Web Site Category URL to test If you think the category is incorrect Test Against Content Filter Category Server OK Cancel DESCRIPTION Select Pass to allow users to access any requested web page if the external content filtering database is unavailable. Select Block to block access to any requested web page if the external content filtering database is unavailable. Select Warn to display a warning message before allowing users to access any requested web page if the external content filtering database is unavailable. The following are possible causes for the external content filtering server not being available:

There is no response from the external content filtering server within the time period specified in the Content Filter Server Unavailable Timeout field. The Zyxel Device is not able to resolve the domain name of the external content filtering database. There is an error response from the external content filtering database. This can be caused by an expired content filtering registration (External content filterings license key is invalid). Select Log to record attempts to access web pages that occur when the external content filtering database is unavailable. Select this check box to restrict access to all site categories listed below. Select this check box to clear the selected categories below. These are categories of web pages based on their content. Select categories in this section to control access to specific types of Internet content. You must have the Category Service content filtering license to filter these categories. See the next table for category details. You can check which category a web page belongs to. Enter a web site URL in the text box. When the content filter is active, you should see the web pages category. The query fails if the content filter is not active. Content Filtering can query a category by full URL string (for example, http://

www.google.com/picture/index.htm), but HTTPS Domain Filter can only query a category by domain name ('www.google.com'), so the category may be different in the query result. URL to test displays both results in the test. Click this link to see the category recorded in the Zyxel Devices content filtering database for the web page you specified (if the database has an entry for it). Click this button to see the category recorded in the external content filter servers database for the web page you specified. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. The following table describes the managed categories. Table 211 Managed Category Descriptions CATEGORY Advertisements & Pop-Ups DESCRIPTION Sites that provide advertising graphics or other ad content files such as banners and pop-ups. For example, pagead2.googlesyndication.com, ad.yieldmanager.com. ZyWALL ATP Series Users Guide 532 Chapter 27 Content Filter Table 211 Managed Category Descriptions (continued) Alcohol & Tobacco Arts Business Transportation Chat Forums & Newsgroups Computers & Technology Criminal Activity Dating & Personals Download Sites Education Entertainment Finance Gambling Games Government Sites that promote or sell alcohol- or tobacco-related products or services. For example, www.drinks.com.tw, www.p9.com.tw, beer.ttl.com.tw. Sites with artistic content or relating to artistic institutions such as theaters, museums, galleries, dance companies, photography, and digital graphic resources. For example, www.npm.gov.tw, www.nmh.gov.tw. Sites that provide business related information such as corporate Web sites. Information, services, or products that help businesses of all sizes to do their day-to-

day commercial activities. For example, www.kinkos.com, www.proctorgamble.com, www.bbb.org. Sites that provide information about motor vehicles such as cars, motorcycles, boats, trucks, RVs and the like. Includes manufacturer sites, dealerships, review sites, pricing,, online purchase sites, enthusiasts clubs, etc. For example, www.toyota.com.tw, www.ford.com.tw, www.sym.com.tw. Sites that enable web-based exchange of real time messages through chat services or chat rooms. For example, me.sohu.com, blufiles.storage.live.com. Sites for sharing information in the form of newsgroups, forums, bulletin boards. For example, ck101.com, my.xuite.net, ptt.cc. Sites that contain information about computers, software, hardware, IT, peripheral and computer services, such as product reviews, discussions, and IT news. For example, www.informationsecurity.com.tw, blog.ithome.com.tw. Sites that offer advice on how to commit illegal or criminal activities, or to avoid detection. These can include how to commit murder, build bombs, pick locks, etc. Also includes sites with information about illegal manipulation of electronic devices, hacking, fraud and illegal distribution of software. For example, www.hackbase.com, jia.hackbase.com, ad.adver.com.tw. Sites that promote networking for interpersonal relationships such as dating and marriage. Includes sites for match-making, online dating, spousal introduction. For example, www.i-part.com.tw, www.imatchi.com. Sites that contain downloadable software, whether shareware, freeware, or for a charge. Includes peer-to-peer sites. For example, www.hotdl.com, toget.pchome.com.tw, www.azroo.com. Sites sponsored by educational institutions and schools of all types including distance education. Includes general educational and reference materials such as dictionaries, encyclopedias, online courses, teaching aids and discussion guides. For example, www.tfam.museum, www.lksf.org, www.1980.org.tw. Sites related to television, movies, music and video (including video on demand), such as program guides, celebrity sites, and entertainment news. For example, www.ctitv.com.tw, www.hboasia.com, www.startv.com.tw. Sites related to banking, finance, payment or investment, including banks, brokerages, online stock trading, stock quotes, fund management, insurance companies, credit unions, credit card companies, and so on. For example, www.concords.com.tw, www.polaris.com.tw, www.bochk.com. Sites that offer or are related to online gambling, lottery, casinos and betting agencies involving chance. For example, www.taiwanlottery.com.tw, www.i-

win.com.tw, www.hkjc.com. Sites relating to computer or other games, information about game producers, or how to obtain cheat codes. Game-related publication sites. For example, www.gamer.com.tw, www.wowtaiwan.com.tw, tw.lineage.gamania.com. Sites run by governmental organizations, departments, or agencies, including police departments, fire departments, customs bureaus, emergency services, civil defense, counter-terrorism organizations, military and hospitals. For example, www.ey.gov.tw, www.whitehouse.gov, www.npa.gov.tw. ZyWALL ATP Series Users Guide 533 Chapter 27 Content Filter Table 211 Managed Category Descriptions (continued) Hate & Intolerance Health & Medicine Illegal Drugs Job Search Streaming Media &

Downloads News Non-profits & NGOs Nudity Personal Sites Politics Pornography/Sexually Explicit Real Estate Religion Restaurants & Dining Search Engines & Portals Shopping Sites that promote a supremacist political agenda, encouraging oppression of people or groups of people based on their race, religion, gender, age, disability, sexual orientation or nationality. For example, www.racist-jokes.com, aryan-

nations.org, whitepower.com. Sites containing information pertaining to health, healthcare services, fitness and well-being, including information about medical equipment, hospitals, drugstores, nursing, medicine, procedures, prescription medications, etc. For example, www.lksf.org, www.ohayo.com.tw. Sites with information on the purchase, manufacture, and use of illegal or recreational drugs and their paraphernalia, and misuse of prescription drugs and other compounds For example, www.cannabis.net, www.amphetamines.com. Sites containing job listings, career information, assistance with job searches (such as resume writing, interviewing tips, etc.), employment agencies or head hunters. For example, www.104.com.tw, www.1111.com.tw, www.yes123.com.tw. Sites that deliver streaming content, such as Internet radio, Internet TV or MP3 and live or archived media download sites. Includes fan sites, or official sites run by musicians, bands, or record labels. For example, www.youtube.com, pfp.sina.com.cn, my.xunlei.com. Sites covering news and current events such as newspapers, newswire services, personalized news services, broadcasting sites, and magazines. For example, www.tvbs.com.tw?Awww.ebc.net.tw?Awww.iset.com.tw. Sites devoted to clubs, communities, unions, and non-profit organizations. Many of these groups exist for educational or charitable purposes. For example, www.tzuchi.org.tw, web.redcross.org.tw, www.lksf.org. Sites that contain full or partial nudity that are not necessarily overtly sexual in intent. Includes sites that advertise or sell lingerie, intimate apparel, or swim wear. For example, www.easyshop.com.tw, www.faster-swim.com.tw, image.baidu.com. Sites about or hosted by personal individuals, including those hosted on commercial sites. For example, blog.yam.com, www.wretch.cc, blog.xuite.net. Sites that promote political parties or political advocacy, or provide information about political parties, interest groups, elections, legislation or lobbying. Also includes sites that offer legal information and advice. For example, www.kmt.org.tw, www.dpp.org.tw, cpc.people.com.cn. Sites that contain explicit sexual content. Includes adult products such as sex toys, CD-ROMs, and videos, adult services such as videoconferencing, escort services, and strip clubs, erotic stories and textual descriptions of sexual acts. For example, www.dvd888.com, www.18center.com, blog.sina.com.tw. Sites relating to commercial or residential real estate services, including renting, purchasing, selling or financing homes, offices, etc. For example, www.sinyi.com.tw, www.yungching.com.tw, house.focus.cn. Sites that deal with faith, human spirituality or religious beliefs, including sites of churches, synagogues, mosques and other houses of worship. For example, www.fgs.org.tw, www.twtaoism.net, www.fhl.net. Sites that list, review, promote or advertise food, dining or catering services. Includes sites for recipes, cooking instruction and tips, food products, and wine advisors. For example, www.jogoya.com.tw, www.dintaifung.com.tw, www2.pizzahut.com.tw. Sites enabling the searching of the Web, newsgroups, images, directories, and other online content. Includes portal and directory sites such as white/yellow pages. For example, tw.yahoo.com, www.pchome.com.tw, www.google.com.tw. Sites for online shopping, catalogs, online ordering, auctions, classified ads. Excludes shopping for products and services exclusively covered by another category such as health & medicine. For example, shopping.pchome.com.tw, buy.yahoo.com.tw, www.tkec.com.tw. ZyWALL ATP Series Users Guide 534 Chapter 27 Content Filter Table 211 Managed Category Descriptions (continued) Social Networking Sports Translators Travel Violence Weapons Web-based Email General Leisure & Recreation Cults Fashion & Beauty Greeting cards Hacking Illegal Software Image Sharing Information Security Instant Messaging Sites that enable social networking for online communities of various topics, for friendship, dating, or professional reasons. For example, www.facebook.com, www.flickr.com, www.groups.google.com. Sites relating to sports teams, fan clubs, scores and sports news. Relates to all sports, whether professional or recreational. For example, www.yankees.com, www.nba.com, mlb.mlb.com. Sites that translate Web pages or phrases from one language to another. These sites may be used to attempt to bypass a filtering system. For example, translate.google.com.tw, www.smartlinkcorp.com, translation.paralink.com. Sites that provide travel and tourism information or online booking of travel services such as airlines, accommodations, car rentals. Includes regional or city information sites. For example, www.startravel.com.tw, taipei.grand.hyatt.com.tw, www.car-plus.com.tw. Sites that contain images or text depicting or advocating physical assault against humans, animals, or institutions. Sites of a particularly gruesome nature such as shocking depictions of blood or wounds, or cruel animal treatment. For example, crimescene.com, deathnet.com, michiganmilitia.com. Sites that depict, sell, review or describe guns and weapons, including for sport. For example, www.ak-47.net, warfare.ru. Sites that enable users to send and receive email through a web-accessible email account. For example, mail.163.com, mail.google.com, mail.yahoo.com.tw. Sites that do not clearly fall into other categories, for example, blank Web pages. For example, bs.serving-sys.com, simg.sinajs.cn, i0.itc.cn. Sites relating to recreational activities and hobbies including zoos, public recreation centers, pools, amusement parks, and hobbies such as gardening, literature, arts & crafts, home improvement, home d?cor, family, etc. For example, tpbg.tfri.gov.tw, tw.fashion.yahoo.com, www.relaxtimes.com.tw. Sites relating to non-traditional religious practice typically known as "cults," that is, considered to be false, unorthodox, extremist, or coercive, with members often living under the direction of a charismatic leader. For example, www.churchofsatan.com, www.ccya.org.tw. Sites concerning fashion, jewelry, glamour, beauty, modeling, cosmetics or related products or services. Includes product reviews, comparisons, and general consumer information. For example, women.sohu.com, baodian.women.sohu.com. Sites that allow people to send and receive greeting cards and postcards. For example, www.e-card.com.tw, card.ivy.net.tw. Sites that promote or give advice about how to gain unauthorized access to proprietary computer systems, for the purpose of stealing information, perpetrating fraud, creating viruses, or committing other illegal activity related to theft of digital information. For example, www.hackbase.com, www.chinahacker.com. Sites that illegally distribute software or copyrighted materials such as movies or music, software cracks, illicit serial numbers, illegal license key generators. For example, www.zhaokey.com.cn, www.tiansha.net. Sites that host digital photographs and images, online photo albums and digital photo exchanges. For example, photo.pchome.com.tw, photo.xuite.net, photobucket.com. Sites that provide legitimate information about data protection, including newly discovered vulnerabilities and how to block them. For example, www.informationsecurity.com.tw, www.itis.tw. Sites that enable logging in to instant messaging services such as ICQ, AOL Instant Messenger, IRC, MSN, Jabber, Yahoo Messenger, and the like. For example, www.meebo.com, www.aim.com, www. ebuddy.com. ZyWALL ATP Series Users Guide 535 Chapter 27 Content Filter Table 211 Managed Category Descriptions (continued) Peer-to-Peer Private IP Addresses School Cheating Sex Education Tasteless Child Abuse Images Unknown Sites that enable direct exchange of files between users without dependence on a central server. For example, www.eyny.com. Sites that are private IP addresses as defined in RFC 1918, that is, hosts that do not require access to hosts in other enterprises (or require just limited access) and whose IP address may be ambiguous between enterprises but are well defined within a certain enterprise. For example, 172.21.20.123, 192.168.35.62. Sites that promote unethical practices such as cheating or plagiarism by providing test answers, written essays, research papers, or term papers. For example, www.zydk788.com, www.huafengksw.com. Sites relating to sex education, including subjects such as respect for partner, abortion, gay and lesbian lifestyle, contraceptives, sexually transmitted diseases, and pregnancy. For example, apps.rockyou.com, www.howmama.com.tw, www.mombaby.com.tw. Sites with offensive or tasteless content such as bathroom humor or profanity. For example, comedycentral.com, dilbert.com. Sites that portray or discuss children in sexual or other abusive acts. For example, a.uuzhijia.info. Unknown For example, www.669.com.tw, www.appleballoon.com.tw, www.uimco.com.tw. 27.2.3 Content Filter Add Filter Profile Custom Service Click Configuration > Security Service > Content Filter > Filter Profile > Add or Edit > Custom Service to open the Custom Service screen. You can create a list of good (allowed) web site addresses and a list of bad (blocked) web site addresses. You can also block web sites based on whether the web sites address contains a keyword. Use this screen to add or remove specific sites or keywords from the filter list. ZyWALL ATP Series Users Guide 536 Chapter 27 Content Filter Figure 363 Configuration > Security Service > Content Filter > Filter Profile > Custom Service The following table describes the labels in this screen. Table 212 Configuration > Security Service > Content Filter > Profile > Custom Service LABEL Name DESCRIPTION Enter a descriptive name for this content filtering profile name. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Enter a description for the content filtering profile rule to help identify the purpose of rule. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-

sensitive. Description Enable Custom Service Allow Web traffic for trusted web sites only This field is optional. Select this check box to allow trusted web sites and block forbidden web sites. Content filter list customization may be enabled and disabled without re-

entering these site names. When this box is selected, the Zyxel Device blocks Web access to sites that are not on the Trusted Web Sites list. If they are chosen carefully, this is the most effective way to block objectionable material. ZyWALL ATP Series Users Guide 537 Chapter 27 Content Filter Table 212 Configuration > Security Service > Content Filter > Profile > Custom Service (continued) LABEL Check Common Trusted/

Forbidden List DESCRIPTION Select this check box to check the common trusted and forbidden web sites lists. See Section 27.3 on page 539 and Section 27.4 on page 540 for information on configuring these lists. Select the check box(es) to restrict a feature. Select the check box(es) to restrict a feature. Restricted Web Features Block ActiveX Java Cookies Web Proxy Allow Java/ActiveX/Cookies/

Web proxy to trusted web sites Trusted Web Sites Add Edit Remove

#

Trusted Web Site Add Edit Remove

#

When you download a page containing ActiveX or Java, that part of the web page will be blocked with an X. When you download a page coming from a Web Proxy, the whole web page will be blocked. When you download a page containing cookies, the cookies will be removed, but the page will not be blocked. ActiveX is a tool for building dynamic and active web pages and distributed object applications. When you visit an ActiveX web site, ActiveX controls are downloaded to your browser, where they remain in case you visit the site again. Java is a programming language and development environment for building downloadable Web components or Internet and intranet business applications of all kinds. Cookies are files stored on a computers hard drive. Some web servers use them to track usage and provide service based on ID. A server that acts as an intermediary between a user and the Internet to provide security, administrative control, and caching service. When a proxy server is located on the WAN it is possible for LAN users to circumvent content filtering by pointing to this proxy server. When this box is selected, the Zyxel Device will permit Java, ActiveX and Cookies from sites on the Trusted Web Sites list to the LAN. In certain cases, it may be desirable to allow Java, ActiveX or Cookies from sites that are known and trusted. These are sites that you want to allow access to, regardless of their content rating, can be allowed by adding them to this list. Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. This displays the index number of the trusted web sites. This column displays the trusted web sites already added. Enter host names such as www.good-site.com into this text field. Do not enter the complete URL of the site that is, do not include http://. All subdomains are allowed. For example, entering *zyxel.com also allows www.zyxel.com, partner.zyxel.com, press.zyxel.com, and so on. You can also enter just a top level domain. For example, enter *.com to allow all .com domains. Use up to 127 characters (0-9a-z-). The casing does not matter. * can be used as a wildcard to match any string. The entry must contain at least one . or it will be invalid. Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. This displays the index number of the forbidden web sites. ZyWALL ATP Series Users Guide 538 Chapter 27 Content Filter Table 212 Configuration > Security Service > Content Filter > Profile > Custom Service (continued) LABEL Forbidden Web Sites DESCRIPTION This list displays the forbidden web sites already added. Enter host names such as www.bad-site.com into this text field. Do not enter the complete URL of the site that is, do not include http://. All subdomains are also blocked. For example, entering *bad-site.com also blocks www.bad-

site.com, partner.bad-site.com, press.bad-site.com, and do on. You can also enter just a top level domain. For example, enter *.com to block all .com domains. Use up to 127 characters (0-9a-z-). The casing does not matter. * can be used as a wildcard to match any string. The entry must contain at least one . or it will be invalid. This section allows you to block Web sites with URLs that contain certain keywords in the domain name or IP address. Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. This displays the index number of the blocked URL keywords. This list displays the keywords already added. Enter a keyword or a numerical IP address to block. You can also enter a numerical IP address. Use up to 127 case-insensitive characters (0-9a-zA-Z;/?:@&=+$\.-_!~*()%). *

can be used as a wildcard to match any string. Use |* to indicate a single wildcard character. For example enter *Bad_Site* to block access to any web page that includes the exact phrase Bad_Site. This does not block access to web pages that only include part of the phrase (such as Bad for example). Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. Blocked URL Keywords Add Edit Remove

#

Blocked URL Keywords OK Cancel 27.3 Content Filter Trusted Web Sites Screen Click Configuration > Security Service > Content Filter > Trusted Web Sites to open the Trusted Web Sites screen. You can create a common list of good (allowed) web site addresses. When you configure Filter Profiles, you can select the option to check the Common Trusted Web Sites list. Use this screen to add or remove specific sites from the filter list. ZyWALL ATP Series Users Guide 539 Chapter 27 Content Filter Figure 364 Configuration > Security Service > Content Filter > Trusted Web Sites The following table describes the labels in this screen. Table 213 Configuration > Security Service > Content Filter > Trusted Web Sites LABEL Common Trusted Web Sites Add Edit Remove

#

Trusted Web Site Apply Reset DESCRIPTION These are sites that you want to allow access to, regardless of their content rating, can be allowed by adding them to this list. Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. This displays the index number of the trusted web sites. This column displays the trusted web sites already added. Enter host names such as www.good-site.com into this text field. Do not enter the complete URL of the site that is, do not include http://. All subdomains are allowed. For example, entering zyxel.com also allows www.zyxel.com, partner.zyxel.com, press.zyxel.com, and so on. You can also enter just a top level domain. For example, enter .com to allow all .com domains. Use up to 127 characters (0-9a-z-). The casing does not matter. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. 27.4 Content Filter Forbidden Web Sites Screen Click Configuration > Security Service > Content Filter > Forbidden Web Sites to open the Forbidden Web Sites screen. You can create a common list of bad (blocked) web site addresses. When you configure Filter Profiles, you can select the option to check the Common Forbidden Web Sites list. Use this screen to add or remove specific sites from the filter list. ZyWALL ATP Series Users Guide 540 Chapter 27 Content Filter Figure 365 Configuration > Security Service > Content Filter > Forbidden Web Sites The following table describes the labels in this screen. Table 214 Configuration > Security Service > Content Filter > Forbidden Web Sites LABEL Forbidden Web Site List Add Edit Remove

#

Forbidden Web Sites Apply Cancel DESCRIPTION Sites that you want to block access to, regardless of their content rating, can be allowed by adding them to this list. Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. This displays the index number of the forbidden web sites. This list displays the forbidden web sites already added. Enter host names such as www.bad-site.com into this text field. Do not enter the complete URL of the site that is, do not include http://. All subdomains are also blocked. For example, entering bad-site.com also blocks www.bad-

site.com, partner.bad-site.com, press.bad-site.com, and do on. You can also enter just a top level domain. For example, enter .com to block all .com domains. Use up to 127 characters (0-9a-z-). The casing does not matter. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. 27.5 Content Filter Technical Reference This section provides content filtering background information. External Content Filter Server Lookup Procedure The content filter lookup process is described below. ZyWALL ATP Series Users Guide 541 Chapter 27 Content Filter Figure 366 Content Filter Lookup Procedure 1 A computer behind the Zyxel Device tries to access a web site. 2 3 4 5 The Zyxel Device looks up the web site in its cache. If an attempt to access the web site was made in the past, a record of that web sites category will be in the Zyxel Devices cache. The Zyxel Device blocks, blocks and logs or just logs the request based on your configuration. Use the Content Filter Cache screen to configure how long a web site address remains in the cache as well as view those web site addresses. All of the web site address records are also cleared from the local cache when the Zyxel Device restarts. If the Zyxel Device has no record of the web site, it queries the external content filter database and simultaneously sends the request to the web server. The external content filter server sends the category information back to the Zyxel Device, which then blocks and/or logs access to the web site based on the settings in the content filter profile. The web sites address and category are then stored in the Zyxel Devices content filter cache. ZyWALL ATP Series Users Guide 542 CHAPTER 28 Anti-Malware 28.1 Overview Use the Zyxel Devices anti-malware feature to protect your connected network from malware

(malicious software) infection, such as computer virus, worms, and spyware. The Zyxel Device checks traffic going in both directions for signature matches. In the following figure, the Zyxel Device checks traffic coming from the WAN zone (which includes two interfaces) to the LAN zone. Figure 367 Zyxel Device Anti-Malware Example The anti-malware matches a file with those in a malware database. This is done as files go through the Zyxel Device. Virus, Worm, and Spyware A computer virus is a type of malicious software designed to corrupt and/or alter the operation of other legitimate programs. A worm is a self-replicating virus that resides in active memory and duplicates itself. The effect of a virus attack varies from doing so little damage that you are unaware your computer is infected to wiping out the entire contents of a hard drive to rendering your computer inoperable. Spyware infiltrate your device and secretly gathers information about you, such as your network activity, passwords, bank details, and so on. ZyWALL ATP Series Users Guide 543 Chapter 28 Anti-Malware Hash Value A hash function is an algorithm that maps data of arbitrary size to data of fixed size. The value returned by a hash function is a hash value. Hash values can be used to identify the contents of a file. During an anti-malware file scan, the hash value of a file is matched with signatures. At the time of writing, MD5

(Message Digest 5) is supported. MD5 is a hash algorithm used to authenticate packet data. Local Signature Databases The Zyxel Device downloads the signature(s) after it is registered and the anti-malware license is activated at myZyxel. A signature is a unique string of bits, or binary pattern, of a malware. A signature acts as a fingerprint that can be used to detect and identify specific malware. The Zyxel Device downloads the following signatures:

Anti-malware signature Threat Intelligence Machine Learning These signatures are periodically updated if you have a valid license. See Section 28.2 on page 548 for how the Zyxel Device updates these signatures for the anti-malware license. Cloud Query Another method of malware protection is through cloud query. This process is illustrated in the next figure. If Cloud Query is enabled, the Zyxel Device queries the Defend Center database by sending the files hash value (A) and receiving the scan results (B) through the Defend Center (DC). Figure 368 Cloud Query Anti-Malware Licensing Having extensive, up-to-date signatures with the most common malware is critical to making the anti-

malware service work effectively. Section 7.2 on page 189 shows licensing information for the different signature databases that can be used by the Zyxel Device. After the anti-malware license expires, you need to purchase an iCard to update your local signature database and use cloud query. Extend your license in the Registration > Service screen. Anti-Malware Scan Process Before going through the Anti-Malware scan, the Zyxel Device first identifies the packets sent by the following four major protocols with corresponding standard ports:

FTP (File Transfer Protocol) ZyWALL ATP Series Users Guide 544 Chapter 28 Anti-Malware HTTP (Hyper Text Transfer Protocol) SMTP (Simple Mail Transfer Protocol) POP3 (Post Office Protocol version 3) The Zyxel Device records the order of packets in TCP connection-oriented sessions to check for matching malware signatures. The order of non-setup packets such as SYN, ACK and FIN is ignored. Anti-Malware Scanning Procedure:

1 The Zyxel Device checks every packet of the file for matches with the local signature databases. If a malware pattern signature is matched, the actions you specify for identified malware will be applied. If Destroy infected file is enabled, the file will be modified. Logs/alerts will be sent according to your settings. Note: The receiver is not notified if a file is modified by the Zyxel Device. If the file cannot be used, the receiver should contact the Zyxel Device administrator to confirm if the Zyxel Device modified the file by checking the logs. 2 If no match is found with the local databases, the Zyxel Device uses Cloud Query to forward the files hash value to Defend Center. 3 Defend Center checks its database for malware signature matches and sends the results back to the Zyxel Device. If a malware signature is matched, the actions you specify for identified malware will be applied. If Destroy infected file is enabled, the file will be modified. Logs/alerts will be sent according to your settings. The next figure shows a flow chart detailing the anti-malware scan. ZyWALL ATP Series Users Guide 545 Chapter 28 Anti-Malware Figure 369 Anti-Malware flowchart ZyWALL ATP Series Users Guide 546 Chapter 28 Anti-Malware Cloud Query Supported File Types At the time of writing, the following file types are supported by Cloud Query:

7z Archive (7z) Executables (exe) AVI Video (avi) Macromedia Flash Data (swf) BMP Image (bmp) BZ2 Archive (bz2) GIF Image (gif) GZ Archive (gz) JPG Image (jpg) MS Office Document (doc...) RM Video (rm) ZIP Archive (zip) MOV Video (mov) MP3 Audio (mp3) PNG Image (png) PDF Document

(pdf) MPG Video (mpg) RAR Archive (rar) RTF Document (rtf) TIFF Image (tif) WAV Audio (wav) Notes About the Zyxel Device Anti-Malware The following lists important notes about the Zyxel Devices anti-malware feature:

1 Zyxels anti-malware feature can detect polymorphic malware (see Section 28.6 on page 554). 2 When malware is detected, a log is created or an alert message is sent to the administrator depending on your log settings. 3 Changes to the Zyxel Devices anti-malware settings only affect new sessions, not sessions that already existed before you applied the changed settings. 4 5 Enabling Cloud Query may affect file transfer speeds. The Zyxel Device does not scan the following file/traffic types:

Simultaneous downloads of a file using multiple connections. For example, when you use FlashGet to download sections of a file simultaneously. Encrypted traffic. This could be password-protected files or VPN traffic where the Zyxel Device is not the endpoint (pass-through VPN traffic). Traffic through custom (non-standard) ports. The Zyxel Device scans whatever port number is specified for FTP in the ALG screen. All compressed files within a compressed file. Note that a single file can still be decompressed and scanned if you select Enable file decompression (ZIP and RAR). Traffic compressed or encoded using a method the Zyxel Device does not support. Finding Out More See Section 28.6 on page 554 for anti-malware background information. 28.1.1 What You Can Do in this Chapter Use the Anti-Malware screen (Section 28.2 on page 548) to turn anti-malware on or off, and check the anti-malware signature status. In addition, you can set up anti-malware black (blocked) and white (allowed) lists of malware patterns. Use the Signature screen (Section 28.5 on page 553) to search for particular signatures and get more information about them. ZyWALL ATP Series Users Guide 547 Chapter 28 Anti-Malware 28.2 Anti-Malware Screen Click Configuration > Security Service > Anti-Malware to display the configuration screen as shown next. Click the Anti-Malware icon for more information on the Zyxel Devices security features. Note: The threat intelligence machine learning (TIML) feature is not available if the gold security pack is expired. Neither will the Zyxel Device update the TIML signatures, nor will it scan the TIML signatures that were downloaded when you used the gold security pack. See Subscription Services Available on page 186 for more information on the subscription services for the two types of security packs. Note: If Destroy infected file is disabled and log is set to no, the Zyxel Device will still perform the scan but will not do anything else. It is recommended to enable at least one of the two functions. If Destroy infected file is disabled, any malicious file found can still be executed by the end user after it is forwarded. The administrator would have to inform the user if there is an infected file. ZyWALL ATP Series Users Guide 548 Chapter 28 Anti-Malware Figure 370 Configuration > Security Service > Anti-Malware ZyWALL ATP Series Users Guide 549 Chapter 28 Anti-Malware The following table describes the labels in this screen. Table 215 Configuration > Security Service > Anti-Malware LABEL General Setting Enable DESCRIPTION Select this checkbox to activate the anti-malware feature to protect your connected network from infection and the installation of malicious software. Scan and detect EICAR test virus Enable Cloud Query Available File Types Applied File Types Selecting this checkbox also activates the threat intelligence machine learning (TIML) feature. TIML signatures come from the sandboxing inspection results and helps the Zyxel Device block possible malicious or suspicious files. Select this option to have the Zyxel Device check for the EICAR test file and treat it in the same way as a real malware file. The EICAR test file is a standardized test file for signature based anti-malware scanners. When the scanner detects the EICAR file, it responds in the same way as if it found a real malware. Besides straightforward detection, the EICAR file can also be compressed to test whether the anti-malware software can detect it in a compressed file. The test string consists of the following human-readable ASCII characters. X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

Select this check box to enable the cloud query service. This improves the effectiveness of malware detection, but can affect file transfer speeds as it needs to send information to the cloud. File types that can be checked by the Zyxel Device through cloud query are listed here. Note that the files on this list are currently bypassed. To use the cloud query feature on a specific file type, click this file type and then click the right arrow button. See available file types in Section 28.1 on page 543. File types that go through the cloud query process are listed here. If you dont want a file type to be checked, click this file type and then click the left arrow button. Destroy infected file When you select this check box, if a malware signature is matched, the Zyxel Device Log Check White List Add Edit Remove Activate Inactivate Status

#

File Pattern Check Black List Add Edit Remove overwrites the infected portion of the file with zeros before being forwarded to the user. The uninfected portion of the file will pass through unmodified. These are the log options:

no: Do not create a log when a packet matches a signature(s). log: Create a log on the Zyxel Device when a packet matches a signature(s). log alert: An alert is an emailed log for more serious events that may need more immediate attention. Select this option to have the Zyxel Device send an alert when a packet matches a signature(s). Select this check box to have the Zyxel Device not perform the anti-malware check on files with names that match the white list patterns. Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. This is the entrys index number in the list. This is the file name pattern. If a files name matches this pattern, the Zyxel Device does not check the file for malware. Select this check box to log and delete files with names that match the black list patterns. Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. ZyWALL ATP Series Users Guide 550 Chapter 28 Anti-Malware Table 215 Configuration > Security Service > Anti-Malware (continued) LABEL Activate Inactivate Status DESCRIPTION To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. This is the entrys index number in the list. This is the file name pattern. If a files name that matches this pattern, the Zyxel Device logs and then destroys the file. Select this check box to have the Zyxel Device scan a compressed file (the file does not need to have a zip or rar file extension). The Zyxel Device first decompresses the file and then scans the contents for malware. Note: The Zyxel Device decompresses a compressed file once. The Zyxel Device does NOT decompress any file(s) within a compressed file. When you select this check box, the Zyxel Device deletes compressed files that use password encryption. Select this check box to have the Zyxel Device delete any compressed files that it cannot decompress. The Zyxel Device cannot decompress password protected files or a file within another compressed file. There are also limits to the number of compressed files that the Zyxel Device can concurrently decompress. Note: The Zyxel Devices firmware package cannot go through the Zyxel Device with this check box enabled. The Zyxel Device classifies the firmware package as a file that cannot be decompressed and then deletes it. Clear this check box when you download a firmware package from the Zyxel website. Its OK to upload a firmware package to the Zyxel Device with the check box selected.

#

File Pattern File decompression Enable file decompression (ZIP and RAR) Destroy compressed files that could not be decompressed Signature Information Current Version Released Date Update Signatures Apply Reset The following fields display information on the current signature set that the Zyxel Device is using. This field displays the signature set version number currently used by the Zyxel Device. This number gets larger as the set is enhanced. This field displays the date and time the set was released. Click this link to go to the screen you can use to download signatures from the update server. Click Apply to save your changes. Click Reset to return the screen to its last-saved settings. 28.3 The Black List Screen A black list allows you to specify the file or encryption pattern that you want to block. False positives occur when a non-infected file matches a malware signature. Enter a file or encryption pattern that would cause the Zyxel Device to log and then destroy this file. Click Configuration > Security Service > Anti-Malware > Black/White List > Black List to display the following screen. Use Add to put a new entry in the list or Edit to change an existing one or Remove to delete an existing entry. ZyWALL ATP Series Users Guide 551 Chapter 28 Anti-Malware Figure 371 Configuration > Security Service > Anti-Malware > Black/White List > Black List The following table describes the fields in this screen. Table 216 Configuration > Security Service > Anti-Malware > Black/White List > Black List LABEL Check Black List DESCRIPTION Select this check box to log and delete files with names or encryption algorithm (MD5 Hash) that match the black list patterns. Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. This is the entrys index number in the list. The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. This field displays the type (MD5 Hash or File Pattern) used to distinguish whether a file should be blocked. Select the type (MD5 Hash or File Pattern) that you want to use to distinguish whether a file should be blocked. This field displays the file or encryption pattern of the entry. Enter the file or encryption pattern for this entry. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Add Edit Remove Activate Inactivate

#

Status Type Value Apply Reset 28.4 The White List Screen A white list allows you to specify the file or encryption pattern to allow in order to avoid false positives. False positives occur when a non-infected file matches a malware signature. Enter a file or encryption pattern that would cause the Zyxel Device to allow this file. Click Configuration > Security Service > Anti-Malware > Black/White List > White List to display the following screen. Use Add to put a new entry in the list or Edit to change an existing one or Remove to delete an existing entry. ZyWALL ATP Series Users Guide 552 Chapter 28 Anti-Malware Figure 372 Configuration > Security Service > Anti-Malware > Black/White List > White List The following table describes the fields in this screen. Table 217 Configuration > Security Service > Anti-Malware > Black/White List > White List LABEL Check White List DESCRIPTION Select this check box to have the Zyxel Device not perform the anti-malware check on files with names or algorithm (MD5 Hash) that match the white list patterns. Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. This is the entrys index number in the list. The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. This field displays the type (MD5 Hash or File Pattern) used to distinguish whether a file should be allowed. Select the type (MD5 Hash or File Pattern) that you want to use to distinguish whether a file should be allowed. This field displays the file or encryption pattern of the entry. Enter the file or encryption pattern for this entry. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Add Edit Remove Activate Inactivate

#

Status Type Value Apply Reset 28.5 Anti-Malware Signature Searching Click Configuration > Security Service > Anti-Malware > Signature to display this screen. Use this screen to locate signatures and display details about them. If your web browser opens a warning screen about a script making the web browser run slowly and the computer unresponsive, just click No to continue. Click a columns heading cell to sort the table entries by that columns criteria. Click the heading cell again to reverse the sort order. ZyWALL ATP Series Users Guide 553 Chapter 28 Anti-Malware Figure 373 Configuration > Security Service > Anti-Malware > Signature The following table describes the labels in this screen. Table 218 Configuration > Security Service > Anti-Malware > Signature LABEL Signatures Search DESCRIPTION Enter the name, part of the name or keyword of the signature(s) you want to find and click Search. This search is not case-sensitive and accepts numerical strings. Click Export to have the Zyxel Device save all of the anti-malware signatures to your computer in a .txt file. This is the entrys index number in the list. This is the name of the anti-malware signature. Click the Name column heading to sort your search results in ascending or descending order according to the signature name. Click a signatures name to see details about the malware. Query all signatures and export Query Result

#

Name 28.6 Anti-Malware Technical Reference Types of Malware The following table describes some of the common malware. Table 219 Common Malware Types TYPE File Infector Boot Sector Virus Macro Virus Email Virus Polymorphic Virus DESCRIPTION This is a small program that embeds itself in a legitimate program. A file infector is able to copy and attach itself to other programs that are executed on an infected computer. This type of virus infects the area of a hard drive that a computer reads and executes during startup. The virus causes computer crashes and to some extend renders the infected computer inoperable. Macro viruses or Macros are small programs that are created to perform repetitive actions. Macros run automatically when a file to which they are attached is opened. Macros spread more rapidly than other types of viruses as data files are often shared on a network. Email viruses are malicious programs that spread through email. A polymorphic virus (also known as a mutation virus) tries to evade detection by changing a portion of its code structure after each execution or self replication. This makes it harder for an anti-malware scanner to detect or intercept it. A polymorphic virus can also belong to any of the virus types discussed above. ZyWALL ATP Series Users Guide 554 Chapter 28 Anti-Malware Malware Infection and Prevention The following describes a simple life cycle of malware. 1 A computer gets a copy of malware from a source such as the Internet, email, file sharing or any removable storage media. The malware is harmless until the execution of an infected program. 2 3 The malware spreads to other files and programs on the computer. The infected files are unintentionally sent to another computer thus starting the spread of the malware. 4 Once the malware is spread through the network, the number of infected networked computers can grow exponentially. Types of Anti-Malware Scanner The section describes two types of anti-malware scanner: host-based and network-based. A host-based anti-malware (HAM) scanner is often software installed on computers and/or servers in the network. It inspects files for malware patterns as they are moved in and out of the hard drive. However, host-based anti-malware scanners cannot eliminate all malware for a number of reasons:

HAM scanners are slow in stopping malware threats through real-time traffic (such as from the Internet). HAM scanners may reduce computing performance as they also share the resources (such as CPU time) on the computer for file inspection. You have to update the malware signatures and/or perform malware scans on all computers in the network regularly. A network-based anti-malware (NAM) scanner is often deployed as a dedicated security device (such as your Zyxel Device) on the network edge. NAM scanners inspect real-time data traffic (such as email messages or web) that tends to bypass HAM scanners. The following lists some of the benefits of NAM scanners. NAM scanners stop malware threats at the network edge before they enter or exit a network. NAM scanners reduce computing loading on computers as the read-time data traffic inspection is done on a dedicated security device. ZyWALL ATP Series Users Guide 555 CHAPTER 29 Reputation Filter 29.1 Overview Use the Reputation Filter screens to configure settings for IP reputation and botnet filtering. 29.1.1 What You Need to Know IP Reputation IP reputation checks the reputation of an IP address from a database. An IP address with bad reputation associates with suspicious activities, such as spam, virus, and/or phishing. The Zyxel Device will respond when there are packets coming from an IPv4 address with bad reputation. Botnet Filtering A botnet is a network consisting of computers that are infected with malware and remotely controlled. The infected computers will contact and wait for instructions from a command and control (C&C) server(s). An attacker can control the botnet by setting up a C&C server and sending commands to the infected computers. Alternatively, a peer-to-peer network approach is used. The infected computer scans and communicates with the peer devices in the same botnet to share commands or malware sent by the C&C server. 29.1.2 What You Can Do in this Chapter Use the IP Reputation screen (Section 29.2 on page 556) to enable IP reputation and specify what action the Zyxel Device takes when any IP address with bad reputation is detected. Use the Botnet Filter screen (Section 29.3 on page 561) to enable botnet filtering and specify what action the Zyxel Device takes when any suspicious activity is detected. 29.2 IP Reputation Screen When you register for and enable the IP reputation service, your Zyxel Device downloads signature files that identifies reputation of IPv4 addresses. You can have the Zyxel Device forward, block, and/or log packets from IPv4 addresses based on these signatures and categories. Use this screen to enable IP reputation and specify the action the Zyxel Device takes when it detects a suspicious activity or a connection attempt to or from an IPv4 address with bad reputation. Click Configuration > Security Service > Reputation Filter > IP Reputation > General to display the configuration screen as shown next. ZyWALL ATP Series Users Guide 556 Chapter 29 Reputation Filter Figure 374 Configuration > Security Service > Reputation Filter > IP Reputation > General The following table describes the labels in this screen. Table 220 Configuration > Security Service > Reputation Filter > IP Reputation > General LABEL IP Blocking Enable Action DESCRIPTION Threat Level Threshold Select this option to turn on IP blocking on the Zyxel Device. Otherwise, deselect it. Set what action the Zyxel Device takes when packets come from an IPv4 address with bad reputation. forward: Select this action to have the Zyxel Device allow the packet to go through. block: Select this action to have the Zyxel Device deny the packets and send a TCP RST to both the sender and receiver when a packet comes from an IPv4 address with bad reputation. Select the threshold threat level to which the Zyxel Device will take action (high, medium and above, Low and above). The threat level is determined by the IP reputation engine. It grades IPv4 addresses. high: An IPv4 address that scores 0 to 20 points. medium and above: An IPv4 address that scores 0-60 points. Low and above: An IPv4 address that scores 0-80 pointgs. ZyWALL ATP Series Users Guide 557 Chapter 29 Reputation Filter Table 220 Configuration > Security Service > Reputation Filter > IP Reputation > General (continued) LABEL Log DESCRIPTION These are the log options:

no: Do not create a log when the packet comes from an IPv4 address with bad reputation. log: Create a log on the Zyxel Device when the packet comes from an IPv4 address with bad reputation. log alert: An alert is an emailed log for more serious events that may need more immediate attention. Select this option to have the Zyxel Device send an alert when the packet comes from an IPv4 address with bad reputation. Select the categories of packets that come from the Internet and are known to pose a security threat to users or their computers. Otherwise, deselect it. Types of Cyber Threats Coming From The Internet Anonymous Proxies Sites and proxies that act as an intermediary for surfing to other websites in an anonymous fashion, whether to circumvent Web filtering or for other reasons. For example, blog.go2.tw, anonymizer.com, www.qu365.com. Denial of Service Sites that issue Denial of Service (DoS) attacks, such as DoS, DDoS, SYN flood, and anomalous traffic detection. DoS attacks can flood your Internet connection with invalid packets and connection requests, using so much bandwidth and so many resources that Internet access becomes unavailable. The goal of DoS attacks is not to steal information, but to disable a device or network on the Internet. A Distributed Denial of Service (DDoS) attack is one in which multiple compromised systems attack a single target, thereby causing denial of service for users of the targeted system. SYN flood is an attack that attackers flood SYN packets to a server in TCP handshakes, and not respond with ACK packets on purpose. This keeps the server waiting for attackers responses to establish TCP connections, and make the server unavailable. Anomalous traffic detection could be malicious activities, such as malware outbreaks or hacking attempts. Sites that distribute exploits or exploit kits to infect website visitors devices. Exploits include shellcode, root kits, worms, or viruses that download additional malware to infect devices. An exploit kit consists of different exploits. Sites that have bad reputation and associate with suspicious activities, such as spam, virus, and/or phishing. Sites that run unauthorized system vulnerabilities scan to look for vulnerabilities in website visitors devices. Sites that have been promoted through spam techniques. For example, img.tongji.linezing.com, banner.chinesegamer.net. Sites that act as the exit nodes in a Tor (The Onion Router) network. Tor is a service that keep users anonymous in the Internet and make users Internet activities untraceable. Tor hides users real IP addresses by encrypting data and transmitting the encrypted data in a chain of selected nodes acting as intermediaries. Each node can only decrypt the data sent from the node before it. The first node that receives the encrypted data is called the entry node. The last node is the last intermediary that the encrypted data will go through before it arrives at the destination. Exploits Negative Reputation Scanners Spam Sources TOR Proxies ZyWALL ATP Series Users Guide 558 Chapter 29 Reputation Filter Table 220 Configuration > Security Service > Reputation Filter > IP Reputation > General (continued) LABEL DESCRIPTION Sites that launch web attacks, such as SQL injection, cross site scripting, iframe injection, and brute force attack. Web Attacks SQL injection (SQLI) is an attack that attackers insert malicious SQL (Structured Query Language) code into a web application database query. Attackers can then access, add, modify, or delete data in users databases. Cross site scripting (XSS) is an attack that attackers injects malicious scripts to websites or web applications in the form of HTML or JavaScript code. The scripts execute when users visit the infected web page or perform the infected web applications. XSS will cause failures to encrypt traffic, cookie stealing, identity impersonation, and phishing. Iframe injection is an attack that attackers injects malicious iframe (inline frame) tags to websites. The malicious iframe tag downloads malware to the devices of the infected websites visitors, and steal users sensitive information. An iframe tag is an HTML tag that is used to embed contents from another source in a website, but attackers misuse this feature. Brute force attack is an attack that attackers attempt to gain access to websites or device via a succession of different passwords. Select the categories of packets that come from the Internet and local network. The categories of packets are known to pose a security threat to users or their computers. Otherwise, deselect it. Sites that use bots (zombies) including command-and-control (C&C) servers. Sites that are used for deceptive or fraudulent purposes (e.g. phishing), such as stealing financial or other user account information. These sites are most often designed to appear as legitimate sites in order to mislead users into entering their credentials. For example, optimizedby.rmxads.com, 218.1.71.226/.../e3b. Enter an IPv4 address of a website, and click the Query button to check if the website associates with suspicious activities that could pose a security threat to users or their computers. The Zyxel Device comes with signatures for IP reputation. These signatures are continually updated as new malware evolves. New signatures can be downloaded to the Zyxel Device periodically if you have subscribed for the IP reputation signatures service. You need to create an account at myZyxel, register your Zyxel Device and then subscribe for IP reputation service in order to be able to download new signatures from myZyxel (see the Registration screens). The following fields display information on the current signature set that the Zyxel Device is using. This field displays the signature set version number currently used by the Zyxel Device. This number gets larger as new signatures are added. This field displays the number of signatures in this set. This field displays the date and time the set was released. Click this to go to the Configuration > Licensing > Signature Update screen to check for new signatures at myZyxel. You can schedule or immediately download signatures. Click Apply to save your changes. Click Reset to return the screen to its last-saved settings. Types of Cyber Threats Coming From The Internet And Local Networks Botnets Phishing Test IP Threat Category IP to test Signature Information Current Version Signature Number Released Date Update Signatures Apply Reset 29.2.1 IP Reputation White List Screen Use this screen to create white list entries. The Zyxel Device will allow the incoming and outgoing packets from the listed IPv4 addresses. ZyWALL ATP Series Users Guide 559 Chapter 29 Reputation Filter You can add up to 256 entries in the IP reputation white list. Figure 375 Configuration > Security Service > Reputation Filter > IP Reputation > White List The following table describes the labels in this screen. Table 221 Configuration > Security Service > Reputation Filter > IP Reputation > White List LABEL White List Check White List DESCRIPTION Select this check box and the Zyxel Device will allow the incoming packets that come from the listed IPv4 addresses. Add Edit Remove Activate Inactivate

#

Status IPv4 Address Apply Reset Note: Enable IP blocking in the Configuration > Security Service > Reputation Filter > IP Reputation > General screen for the white list to take effect. Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. This is the entrys index number in the list. The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. This field displays the IPv4 address of this entry. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. 29.2.2 IP Reputation Black List Screen Use this screen to create black list entries. The Zyxel Device will block the incoming and outgoing packets from the listed IPv4 addresses. You can add up to 256 entries in the IP reputation black list. ZyWALL ATP Series Users Guide 560 Chapter 29 Reputation Filter Figure 376 Configuration > Security Service > Reputation Filter > IP Reputation > Black List The following table describes the labels in this screen. Table 222 Configuration > Security Service > Reputation Filter > IP Reputation > Black List LABEL Black List Check Black List DESCRIPTION Select this check box and the Zyxel Device will block the incoming packets that come from the listed IPv4 addresses. Add Edit Remove Activate Inactivate

#

Status IPv4 Address Apply Reset Note: Enable IP blocking in the Configuration > Security Service > Reputation Filter > IP Reputation > General screen for the black list to take effect. Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. This is the entrys index number in the list. The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. This field displays the IPv4 address of this entry. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. 29.3 Botnet Filter Screen The Zyxel Devices botnet filtering service allows you to detect and block connection attempts to or from the C&C server or known botnet IP addresses. When you register for and enable the botnet filtering service, your Zyxel Device downloads signature files that contain known botnet domain names and IP addresses. The Zyxel Device will also access an external database that has millions of web sites categorized based on content. You can have the Zyxel Device allow, block, block and/or log access to web sites or hosts based on these signatures and categories. ZyWALL ATP Series Users Guide 561 Chapter 29 Reputation Filter Use this screen to enable botnet filtering and specify the action the Zyxel Device takes when it detects a suspicious activity or a connection attempt to or from a botnet C&C server. Click the Botnet Filter icon for more information on the Zyxel Devices security features. Click Configuration > Security Service > Reputation Filter > Botnet Filter to display the configuration screen as shown next. Figure 377 Configuration > Security Service > Reputation Filter > Botnet Filter > General The following table describes the labels in this screen. Table 223 Configuration > Security Service > Reputation Filter > Botnet Filter > General LABEL URL Blocking Enable Select this option to turn on URL blocking on the Zyxel Device. DESCRIPTION ZyWALL ATP Series Users Guide 562 Chapter 29 Reputation Filter Table 223 Configuration > Security Service > Reputation Filter > Botnet Filter > General (continued) LABEL Action DESCRIPTION Set what action the Zyxel Device takes when it detects a connection attempt to or from the web pages of the specified categories. block: Select this action to have the Zyxel Device block access to the web pages that match the categories that you select above. warn: Select this action to have the Zyxel Device display a warning message to the access requesters for the web pages before allowing users to access web pages that match the categories that you select above. pass: Select this action to have the Zyxel Device allow access to the web pages that match the categories that you select above. These are the log options:

no: Do not create a log when it detects a connection attempt to or from the web pages of the specified categories. log: Create a log on the Zyxel Device when it detects a connection attempt to or from the web pages of the specified categories. Log Message to display when a site is blocked Denied Access Message Redirect URL Managed Categories Anonymizers Botnet C&C Compromised Malware Phishing & Fraud Spam Sites Enter a message to be displayed when the botnet filter blocks access to a web page. Use up to 127 characters (0-9a-zA-Z;/?:@&=+$\.-_!~*'()%,). For example, Access to this web page is not allowed. Please contact the network administrator. It is also possible to leave this field blank if you have a URL specified in the Redirect URL field. In this case if the botnet filter blocks access to a web page, the Zyxel Device just opens the web page you specified without showing a denied access message. Enter the URL of the web page to which you want to send users when their web access is blocked by the botnet filter. The web page you specify here opens in a new frame below the denied access message. Use http:// or https:// followed by up to 262 characters (0-9a-zA-Z;/?:@&=+$\.-_!~*'()%). For example, http://192.168.1.17/blocked access. Select the categories of web pages that are known to pose a security threat to users or their computers. Otherwise, deselect it. Sites and proxies that act as an intermediary for surfing to other Web sites in an anonymous fashion, whether to circumvent Web filtering or for other reasons. For example, blog.go2.tw, anonymizer.com, www.qu365.com. Sites that use bots (zombies) including command-and-control (C&C) servers. Sites that have been compromised by someone other than the site owner in order to install malicious programs without the user's knowledge. Includes sites that may be vulnerable to a particular high-risk attack. For example, www.wokoo.net, movie.sx.zj.cn. Sites that install unwanted software on a user's computer with the intent to enable third-

party monitoring or make system changes without the user's consent. For example, www.tqlkg.com, aladel.net. Sites that are used for deceptive or fraudulent purposes (e.g. phishing), such as stealing financial or other user account information. These sites are most often designed to appear as legitimate sites in order to mislead users into entering their credentials. For example, optimizedby.rmxads.com, 218.1.71.226/.../e3b. Sites that have been promoted through spam techniques. For example, img.tongji.linezing.com, banner.chinesegamer.net. ZyWALL ATP Series Users Guide 563 Chapter 29 Reputation Filter Table 223 Configuration > Security Service > Reputation Filter > Botnet Filter > General (continued) LABEL Signature Information DESCRIPTION The Zyxel Device comes with signatures for the botnet filter. These signatures are continually updated as new malware evolves. New signatures can be downloaded to the Zyxel Device periodically if you have subscribed for the botnet filter signatures service. You need to create an account at myZyxel, register your Zyxel Device and then subscribe for botnet filter service in order to be able to download new signatures from myZyxel (see the Registration screens). The following fields display information on the current signature set that the Zyxel Device is using. This field displays the signature set version number currently used by the Zyxel Device. This number gets larger as new signatures are added. This field displays the number of signatures in this set. This field displays the date and time the set was released. Click this to go to the Configuration > Licensing > Signature Update screen to check for new signatures at myZyxel. You can schedule or immediately download signatures. Click Apply to save your changes. Click Reset to return the screen to its last-saved settings. Current Version Signature Number Released Date Update Signatures Apply Reset 29.3.1 Botnet Filter White List Screen Use this screen to create white list entries. The Zyxel Device will allow the incoming packets from the listed IPv4 addresses and URLs. Figure 378 Configuration > Security Service > Reputation Filter > Botnet Filter > White List The following table describes the labels in this screen. DESCRIPTION Table 224 Configuration > Security Service > Reputation Filter > Botnet Filter > White List LABEL White List Add Edit Remove

#

White List Apply Reset Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. This is the entrys index number in the list. This field displays the URL of this entry. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. ZyWALL ATP Series Users Guide 564 Chapter 29 Reputation Filter 29.3.2 Botnet Filter Black List Screen Use this screen to create black list entries. The Zyxel Device will block the incoming packets from the listed IPv4 addresses and URLs. Figure 379 Configuration > Security Service > Reputation Filter > Botnet Filter > Black List The following table describes the labels in this screen. DESCRIPTION Table 225 Configuration > Security Service > Reputation Filter > Botnet Filter > Black List LABEL Black List Add Edit Remove

#

Black List Apply Reset Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. This is the entrys index number in the list. This field displays the URL of this entry. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. ZyWALL ATP Series Users Guide 565 CHAPTER 30 IDP 30.1 Overview This chapter introduces packet inspection IDP (Intrusion, Detection and Prevention), custom signatures, and updating signatures. An IDP system can detect malicious or suspicious packets and respond instantaneously. IDP on the Zyxel Device protects against network-based intrusions. 30.1.1 What You Can Do in this Chapter Use the Security Service > IDP screen (Section 30.2 on page 566) to view registration and signature information. Use the Security Service > IDP > Custom Signature > Add screens (Section 30.3 on page 572) to create a new custom signature, edit an existing signature, delete existing signatures or save signatures to your computer. 30.1.2 What You Need To Know Packet Inspection Signatures A signature is a pattern of malicious or suspicious packet activity. You can specify an action to be taken if the system matches a stream of data to a malicious signature. You can change the action in the profile screens. Packet inspection examine OSI (Open System Interconnection) layer-4 to layer-7 packet contents for malicious data. Generally, packet inspection signatures are created for known attacks while anomaly detection looks for abnormal behavior. Applying Your IDP Configuration Changes to the Zyxel Devices IDP settings affect new sessions, but not the sessions that already existed before you applied the new settings. 30.1.3 Before You Begin Register for a trial IDP subscription in the Registration screen. This gives you access to free signature updates. This is important as new signatures are created as new attacks evolve. When the trial subscription expires, purchase and enter a license key using the same screens to continue the subscription. 30.2 The IDP Screen An IDP profile is a set of packet inspection signatures. ZyWALL ATP Series Users Guide 566 Chapter 30 IDP Click Configuration > Security Service > IDP to open this screen. Use this screen to view registration and signature information. Note: You must register in order to update packet inspection signatures. See the Registration screens. If you try to enable IDP when the IDP service has not yet been registered, a warning screen displays and IDP is not enabled. Click the IDP icon for more information on the Zyxel Devices security features. Figure 380 Configuration > Security Service > IDP ZyWALL ATP Series Users Guide 567 Chapter 30 IDP The following table describes the fields in this screen. Table 226 Configuration > Security Service > IDP LABEL General Settings DESCRIPTION Enable Select this check box to activate the IDP feature which detects and prevents malicious or suspicious packets and responds instantaneously. Query Signatures Name Signature ID Search all custom signatures Severity Classification Type Platform Service Action Activation Log Query Result Custom Signature Rules Add Edit Remove Export Type the name or part of the name of the signature(s) you want to find. Type the ID or part of the ID of the signature(s) you want to find. Select this check box to include signatures you created or imported in the Custom Signatures screen in the search. You can search for specific signatures by name or ID. If the name and ID fields are left blank, then all signatures are searched according to the criteria you select. Search for signatures by severity level(s). Hold down the [Ctrl] key if you want to make multiple selections. These are the severities as defined in the Zyxel Device. The number in brackets is the number you use if using commands. Severe (5): These denote attacks that try to run arbitrary code or gain system privileges. High (4): These denote known serious vulnerabilities or attacks that are probably not false alarms. Medium (3): These denote medium threats, access control attacks or attacks that could be false alarms. Low (2): These denote mild threats or attacks that could be false alarms. Very-Low (1): These denote possible attacks caused by traffic such as Ping, trace route, ICMP queries etc. Search for signatures by attack type(s) (see Table 227 on page 569). Attack types are known as policy types in the group view screen. Hold down the [Ctrl] key if you want to make multiple selections. Search for signatures created to prevent intrusions targeting specific operating system(s). Hold down the [Ctrl] key if you want to make multiple selections. Search for signatures by IDP service group(s). See Table 227 on page 569 for group details. Hold down the [Ctrl] key if you want to make multiple selections. Search for signatures by the response the Zyxel Device takes when a packet matches a signature.Hold down the [Ctrl] key if you want to make multiple selections. Search for activated and/or inactivated signatures here. Search for signatures by log option here. The results are displayed in a table showing the SID, Name, Severity, Classification Type, Platform, Service, Log, and Action criteria as selected in the search. Click the SID column header to sort search results by signature ID. Use this part of the screen to create, edit, delete or export (save to your computer) custom signatures. Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. To save an entry or entries as a file on your computer, select them and click Export. Click Save in the file download dialog box and then select a location and name for the file. Custom signatures must end with the rules file name extension, for example, MySig.rules. ZyWALL ATP Series Users Guide 568 Chapter 30 IDP Table 226 Configuration > Security Service > IDP (continued) LABEL

#

SID DESCRIPTION This is the entrys index number in the list. SID is the signature ID that uniquely identifies a signature. Click the SID header to sort signatures in ascending or descending order. It is automatically created when you click the Add icon to create a new signature. You can edit the ID, but it cannot already exist and it must be in the 9000000 to 9999999 range. This is the name of your custom signature. Duplicate names can exist, but it is advisable to use unique signature names that give some hint as to intent of the signature and the type of attack it is supposed to prevent. Use this part of the screen to import custom signatures (previously saved to your computer) to the Zyxel Device. Note: The name of the complete custom signature file on the Zyxel Device is custom.rules. If you import a file named custom.rules, then all custom signatures on the Zyxel Device are overwritten with the new file. If this is not your intention, make sure that the files you import are not named custom.rules. Type the file path and name of the custom signature file you want to import in the text box (or click Browse to find it on your computer) and then click Importing to transfer the file to the Zyxel Device. New signatures then display in the Zyxel Device IDP > Custom Signatures screen. The following fields display information on the current signature set that the Zyxel Device is using. This field displays the IDP signature set version number. This number gets larger as the set is enhanced. This field displays the number of IDP signatures in this set. This number usually gets larger as the set is enhanced. Older signatures and rules may be removed if they are no longer applicable or have been supplanted by newer ones. This field displays the date and time the set was released. Click this link to go to the screen you can use to download signatures from the update server. Name Customer Signature Rule Importing File Path Signature Information Current Version Signature Number Released Date Update Signatures Policy Types This table describes Policy Types as categorized in the Zyxel Device. Table 227 Policy Types POLICY TYPE Access Control Any DESCRIPTION Access control refers to procedures and controls that limit or detect access. Access control attacks try to bypass validation checks in order to access network resources such as servers, directories, and files. Any attack includes all other kinds of attacks that are not specified in the policy such as password, spoof, hijack, phishing, and close-in. Backdoor/Trojan Horse A backdoor (also called a trapdoor) is hidden software or a hardware mechanism that can be triggered to gain access to a program, online service or an entire computer system. A Trojan horse is a harmful program that is hidden inside apparently harmless programs or data. Although a virus, a worm and a Trojan are different types of attacks, they can be blended into one attack. For example, W32/Blaster and W32/Sasser are blended attacks that feature a combination of a worm and a Trojan. ZyWALL ATP Series Users Guide 569 Chapter 30 IDP Table 227 Policy Types (continued) POLICY TYPE DESCRIPTION A Botnet is a number of Internet computers that have been set up to forward BotNet transmissions including spam or viruses to other computers on the Internet though their owners are unaware of it. It is also a collection of Internet-connected programs communicating with other similar programs in order to perform tasks and participate in distributed Denial-Of-Service attacks. A buffer overflow occurs when a program or process tries to store more data in a buffer

(temporary data storage area) than it was intended to hold. The excess information can overflow into adjacent buffers, corrupting or overwriting the valid data held in them. Buffer Overflow DoS/DDoS Instant Messenger Mail Misc P2P Scan SPAM Stream Media Tunnel Intruders could run codes in the overflow buffer region to obtain control of the system, install a backdoor or use the victim to launch attacks on other devices. The goal of Denial of Service (DoS) attacks is not to steal information, but to disable a device or network on the Internet. A Distributed Denial of Service (DDoS) attack is one in which multiple compromised systems attack a single target, thereby causing denial of service for users of the targeted system. IM (Instant Messenger) refers to chat applications. Chat is real-time, text-based communication between two or more users via networks-connected computers. After you enter a chat (or chat room), any room member can type a message that will appear on the monitors of all the other participants. A Mail or email bombing attack involves sending several thousand identical messages to an electronic mailbox in order to overflow it, making it unusable. Miscellaneous attacks takes advantage of vulnerable computer networks and web servers by forcing cache servers or web browsers into disclosing user-specific information that might be sensitive and confidential. The most common type of Misc. attacks are HTTP Response Smuggling, HTTP Response Splitting and JSON Hijacking. Peer-to-peer (P2P) is where computing devices link directly to each other and can directly initiate communication with each other; they do not need an intermediary. A device can be both the client and the server. In the Zyxel Device, P2P refers to peer-to-

peer applications such as e-Mule, e-Donkey, BitTorrent, iMesh, etc. A scan describes the action of searching a network for an exposed service. An attack may then occur once a vulnerability has been found. Scans occur on several network levels. A network scan occurs at layer-3. For example, an attacker looks for network devices such as a router or server running in an IP network. A scan on a protocol is commonly referred to as a layer-4 scan. For example, once an attacker has found a live end system, he looks for open ports. A scan on a service is commonly referred to a layer-7 scan. For example, once an attacker has found an open port, say port 80 on a server, he determines that it is a HTTP service run by some web server application. He then uses a web vulnerability scanner (for example, Nikto) to look for documented vulnerabilities. Spam is unsolicited junk email sent to large numbers of people to promote products or services. A Stream Media attack occurs when a malicious network node downloads an overwhelming amount of media stream data that could potentially exhaust the entire system. This method allows users to send small requests messages that result in the streaming of large media objects, providing an opportunity for malicious users to exhaust resources in the system with little effort expended on their part. A Tunneling attack involves sending IPv6 traffic over IPv4, slipping viruses, worms and spyware through the network using secret tunnels. This method infiltrates standard security measures through IPv6 tunnels, passing through IPv4 undetected. An external signal then triggers the malware to spring to life and wreak havoc from inside the network. ZyWALL ATP Series Users Guide 570 Chapter 30 IDP Table 227 Policy Types (continued) POLICY TYPE DESCRIPTION A computer virus is a small program designed to corrupt and/or alter the operation of Virus/Worm other legitimate programs. A worm is a program that is designed to copy itself from one computer to another on a network. A worms uncontrolled replication consumes system resources, thus slowing or stopping other tasks. Web attacks refer to attacks on web servers such as IIS (Internet Information Services). Web Attack IDP Service Groups An IDP service group is a set of related packet inspection signatures. Table 228 IDP Service Groups WEB_PHP WEB_MISC WEB_ATTACKS WEB_CGI SNMP SQL RPC POP3 NNTP ORACLE MISC_DDOS MISC_EXPLOIT IMAP IM DNS FINGER WEB_IIS TFTP SMTP POP2 NETBIOS MISC_BACKDOOR ICMP n/a WEB_FRONTPAGE TELNET RSERVICES P2P MYSQL MISC FTP 30.2.1 Query Example This example shows a search with these criteria:

Severity: Severe Classification Type: Misc Platform: Windows Service: Any Actions: Any ZyWALL ATP Series Users Guide 571 Chapter 30 IDP Figure 381 Query Example Search 30.3 IDP Custom Signatures Create custom signatures for new attacks or attacks peculiar to your network. Custom signatures can also be saved to/from your computer so as to share with others. You need some knowledge of packet headers and attack types to create your own custom signatures. IP Packet Header These are the fields in an Internet Protocol (IP) version 4 packet header. Figure 382 IP v4 Packet Headers ZyWALL ATP Series Users Guide 572 Chapter 30 IDP The header fields are discussed in the following table. Table 229 IP v4 Packet Headers HEADER Version IHL DESCRIPTION The value 4 indicates IP version 4. IP Header Length is the number of 32 bit words forming the total length of the header

(usually five). The Type of Service, (also known as Differentiated Services Code Point (DSCP)) is usually set to 0, but may indicate particular quality of service needs from the network. This is the size of the datagram in bytes. It is the combined length of the header and the data. This is a 16-bit number, which together with the source address, uniquely identifies this packet. It is used during reassembly of fragmented datagrams. Flags are used to control whether routers are allowed to fragment a packet and to indicate the parts of a packet to the receiver. This is a byte count from the start of the original sent packet. This is a counter that decrements every time it passes through a router. When it reaches zero, the datagram is discarded. It is used to prevent accidental routing loops. The protocol indicates the type of transport packet being carried, for example, 1 =

ICMP; 2= IGMP; 6 = TCP; 17= UDP. This is used to detect processing errors introduced into the packet inside a router or bridge where the packet is not protected by a link layer cyclic redundancy check. Packets with an invalid checksum are discarded by all nodes in an IP network. This is the IP address of the original sender of the packet. This is the IP address of the final destination of the packet. IP options is a variable-length list of IP options for a datagram that define IP Security Option, IP Stream Identifier, (security and handling restrictions for the military), Record Route (have each router record its IP address), Loose Source Routing (specifies a list of IP addresses that must be traversed by the datagram), Strict Source Routing (specifies a list of IP addresses that must ONLY be traversed by the datagram), Timestamp (have each router record its IP address and time), End of IP List and No IP Options. Padding is used as a filler to ensure that the IP packet is a multiple of 32 bits. Type of Service Total Length Identification Flags Fragment Offset Time To Live Protocol Header Checksum Source IP Address Destination IP Address Options Padding Select Configuration > Security Service. The Custom Signature Rules section shows a summary of all custom signatures created. Click the SID or Name heading to sort. Click the Add icon to create a new signature or click the Edit icon to edit an existing signature. You can also delete custom signatures here or save them to your computer. Note: The Zyxel Device checks all signatures and continues searching even after a match is found. If two or more rules have conflicting actions for the same packet, then the Zyxel Device applies the more restrictive action (reject-both, reject-receiver or reject-sender, drop, none in this order). If a packet matches a rule for reject-receiver and it also matches a rule for reject-sender, then the Zyxel Device will reject-both. 30.3.1 Add / Edit Custom Signatures Click the Add icon to create a new signature or click the Edit icon to edit an existing signature in the screen as shown in Figure 380 on page 567. ZyWALL ATP Series Users Guide 573 Chapter 30 IDP A packet must match all items you configure in this screen before it matches the signature. The more specific your signature (including packet contents), then the fewer false positives the signature will trigger. Try to write signatures that target a vulnerability, for example a certain type of traffic on certain operating systems, instead of a specific exploit. Figure 383 Configuration > Security Service > IDP > Custom Signatures > Add/Edit ZyWALL ATP Series Users Guide 574 Chapter 30 IDP The following table describes the fields in this screen. Table 230 Configuration > Security Service > IDP > Custom Signatures > Add/Edit LABEL Name DESCRIPTION Type the name of this custom signature. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Signature ID Information Severity Platform Classification Type Frequency Threshold Header Options Network Protocol Type Of Service Identification Fragmentation Fragment Offset Time to Live Duplicate names can exist but it is advisable to use unique signature names that give some hint as to intent of the signature and the type of attack it is supposed to prevent. Refer to (but do not copy) the packet inspection signature names for hints on creating a naming convention. A signature ID is automatically created when you click the Add icon to create a new signature. You can edit the ID to create a new one (in the 9000000 to 9999999 range), but you cannot use one that already exists. You may want to do that if you want to order custom signatures by SID. Use the following fields to set general information about the signature as denoted below. The severity level denotes how serious the intrusion is. Categorize the seriousness of the intrusion here. Some intrusions target specific operating systems only. Select the operating systems that the intrusion targets, that is, the operating systems you want to protect from this intrusion. SGI refers to Silicon Graphics Incorporated, who manufactures multi-user Unix workstations that run the IRIX operating system (SGI's version of UNIX). A router is an example of a network device. Categorize the attack type here. See Table 227 on page 569 as a reference. Recurring packets of the same type may indicate an attack. Use the following field to indicate how many packets per how many seconds constitute an intrusion Select Threshold and then type how many packets (that meet the criteria in this signature) per how many seconds constitute an intrusion. Configure signatures for IP version 4. Type of service in an IP header is used to specify levels of speed and/or reliability. Some intrusions use an invalid Type Of Service number. Select the check box, then select Equal or Not-Equal and then type in a number. The identification field in a datagram uniquely identifies the datagram. If a datagram is fragmented, it contains a value that identifies the datagram to which the fragment belongs. Some intrusions use an invalid Identification number. Select the check box and then type in the invalid number that the intrusion uses. A fragmentation flag identifies whether the IP datagram should be fragmented, not fragmented or is a reserved bit. Some intrusions can be identified by this flag. Select the check box and then select the flag that the intrusion uses. When an IP datagram is fragmented, it is reassembled at the final destination. The fragmentation offset identifies where the fragment belongs in a set of fragments. Some intrusions use an invalid Fragment Offset number. Select the check box, select Equal, Smaller or Greater and then type in a number Time to Live is a counter that decrements every time it passes through a router. When it reaches zero, the datagram is discarded. Usually its used to set an upper limit on the number of routers a datagram can pass through. Some intrusions can be identified by the number in this field. Select the check box, select Equal, Smaller or Greater and then type in a number. ZyWALL ATP Series Users Guide 575 Chapter 30 IDP Table 230 Configuration > Security Service > IDP > Custom Signatures > Add/Edit (continued) LABEL IP Options DESCRIPTION IP options is a variable-length list of IP options for a datagram that define IP Security Option, IP Stream Identifier, (security and handling restrictions for the military), Record Route (have each router record its IP address), Loose Source Routing (specifies a list of IP addresses that must be traversed by the datagram), Strict Source Routing (specifies a list of IP addresses that must ONLY be traversed by the datagram), Timestamp (have each router record its IP address and time), End of IP List and No IP Options. IP Options can help identify some intrusions. Select the check box, then select an item from the list box that the intrusion uses Select the check box for the signature to check for packets that have the same source and destination IP addresses. The following fields vary depending on whether you choose TCP, UDP or ICMP. Same IP Transport Protocol Transport Protocol: TCP Port Flow Flags Sequence Number Ack Number Window Size Transport Protocol: UDP Port Transport Protocol:

ICMP Type Code ID Sequence Number Payload Options Select the check box and then enter the source and destination TCP port numbers that will trigger this signature. The selected keyword sets the criteria as to which traffic is matched. You can match traffic based on direction or whether the connection is established or not. You can also specify whether you want to match signatures per packet or in a stream of packets. Established: Match established connections. Stateless: Match packets that are not part of an established connection. To Client: Match packets that flow from server to client.. To Server: Match packets that flow from client to server. From Client: Match packets that flow from client to server. From Servers: Match packets that flow from server to client. No Stream: Match packets that have not been reassembled by the stream engine. It will not match packets that have been reassembled. Only Stream: Match packets that have been reassembled. Select what TCP flag bits the signature should check. Use this field to check for a specific TCP sequence number. Use this field to check for a specific TCP acknowledgment number. Use this field to check for a specific TCP window size. Select the check box and then enter the source and destination UDP port numbers that will trigger this signature. Use this field to check for a specific ICMP type value. Use this field to check for a specific ICMP code value. Use this field to check for a specific ICMP ID value. This is useful for covert channel programs that use static ICMP fields when they communicate. Use this field to check for a specific ICMP sequence number. This is useful for covert channel programs that use static ICMP fields when they communicate. The longer a payload option is, the more exact the match, the faster the signature processing. Therefore, if possible, it is recommended to have at least one payload option in your signature. ZyWALL ATP Series Users Guide 576 Chapter 30 IDP Table 230 Configuration > Security Service > IDP > Custom Signatures > Add/Edit (continued) LABEL DESCRIPTION This field may be used to check for abnormally sized packets or for detecting buffer overflows. Select the check box, then select Equal, Smaller or Greater and then type the payload size. Payload Size Add Edit Remove

#

Offset Content Case-insensitive Decode as URI Stream rebuilt packets are not checked regardless of the size of the payload. Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. This is the entrys index number in the list. This field specifies where to start searching for a pattern within a packet. For example, an offset of 5 would start looking for the specified pattern after the first five bytes of the payload. Type the content that the signature should search for in the packet payload. Hexadecimal code entered between pipes is converted to ASCII. For example, you could represent the ampersand as either & or |26| (26 is the hexadecimal code for the ampersand). Select Yes if content casing does NOT matter. A Uniform Resource Identifier (URI) is a string of characters for identifying an abstract or physical resource (RFC 2396). A resource can be anything that has identity, for example, an electronic document, an image, a service (today's weather report for Taiwan), a collection of other resources. An identifier is an object that can act as a reference to something that has identity. Example URIs are:

ftp://ftp.is.co.za/rfc/rfc1808.txt; ftp scheme for File Transfer Protocol services http://www.math.uio.no/faq/compression-faq/part1.html; http scheme for Hypertext Transfer Protocol services mailto:mduerst@ifi.unizh.ch; mailto scheme for electronic mail addresses telnet://melvyl.ucop.edu/; telnet scheme for interactive services via the TELNET Protocol Select Yes for the signature to search for normalized URI fields. This means that if you are writing signatures that includes normalized content, such as %2 for directory traversals, these signatures will not be triggered because the content is normalized out of the URI buffer. For example, the URI:

/scripts/..%c0%af../winnt/system32/cmd.exe?/c+ver will get normalized into:

OK Cancel

/winnt/system32/cmd.exe?/c+ver Click this button to save your changes to the Zyxel Device and return to the summary screen. Click this button to return to the summary screen without saving any changes. 30.3.2 Custom Signature Example Before creating a custom signature, you must first clearly understand the vulnerability. ZyWALL ATP Series Users Guide 577 30.3.2.1 Understand the Vulnerability Chapter 30 IDP Check the Zyxel Device logs when the attack occurs. Use web sites such as Google or Security Focus to get as much information about the attack as you can. The more specific your signature, the less chance it will cause false positives. As an example, say you want to check if your router is being overloaded with DNS queries so you create a signature to detect DNS query traffic. 30.3.2.2 Analyze Packets Use the packet capture screen and a packet analyzer (also known as a network or protocol analyzer) such as Wireshark or Ethereal to investigate some more. Figure 384 DNS Query Packet Details ZyWALL ATP Series Users Guide 578 Chapter 30 IDP From the details about DNS query you see that the protocol is UDP and the port is 53. The type of DNS packet is standard query and the Flag is 0x0100 with an offset of 2. Therefore enter |010| as the first pattern. The final custom signature should look like as shown in the following figure. Figure 385 Example Custom Signature 30.3.3 Applying Custom Signatures After you create your custom signature, it becomes available in an IDP profile (Configuration > Security Service > IDP > Profile > Edit screen). Custom signatures have an SID from 9000000 to 9999999. ZyWALL ATP Series Users Guide 579 Chapter 30 IDP Search for, then activate the signature, configure what action to take when a packet matches it and if it should generate a log or alert in a profile. Then bind the profile to a zone. 30.3.4 Verifying Custom Signatures Configure the signature to create a log when traffic matches the signature. (You may also want to configure an alert if it is for a serious attack and needs immediate attention.) After you apply the signature to a zone, you can see if it works by checking the logs (Monitor > Log). The Priority column shows warn for signatures that are configured to generate a log only. It shows critical for signatures that are configured to generate a log and alert. All IDP signatures come under the IDP category. The Note column displays ACCESS FORWARD when no action is configured for the signature. It displays ACCESS DENIED if you configure the signature action to drop the packet. The destination port is the service port (53 for DNS in this case) that the attack tries to exploit. Figure 386 Custom Signature Log 30.4 The White List Screen Use this screen to view the IDP white list. The Zyxel Device will exclude the incoming packets of the listed signature(s), and these packets wont be intercepted and will be passed through uninspected. Click Configuration > Security Service > IDP > White List to display the following screen. Use Add to put a new item in the list or Edit to change an existing one or Remove to delete an existing entry. ZyWALL ATP Series Users Guide 580 Chapter 30 IDP Figure 387 Configuration > Security Service > IDP > White List The following table describes the fields in this screen. DESCRIPTION Table 231 Configuration > Security Service > IDP > White List LABEL White List Settings Add Edit Remove

#

Signature ID Signature Name Apply Reset Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. This is the entrys index number in the list. This field displays the signature ID of this entry. This field displays the signature name of this entry. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. 30.5 IDP Technical Reference This section contains some background information on IDP. Host Intrusions The goal of host-based intrusions is to infiltrate files on an individual computer or server in with the goal of accessing confidential information or destroying information on a computer. You must install a host IDP directly on the system being protected. It works closely with the operating system, monitoring and intercepting system calls to the kernel or APIs in order to prevent attacks as well as log them. Disadvantages of host IDPs are that you have to install them on each device (that you want to protect) in your network and due to the necessarily tight integration with the host operating system, future operating system upgrades could cause problems. ZyWALL ATP Series Users Guide 581 Chapter 30 IDP Network Intrusions Network-based intrusions have the goal of bringing down a network or networks by attacking computer(s), switch(es), router(s) or modem(s). If a LAN switch is compromised for example, then the whole LAN is compromised. Host-based intrusions may be used to cause network-based intrusions when the goal of the host virus is to propagate attacks on the network, or attack computer/server operating system vulnerabilities with the goal of bringing down the computer/server. Typical network-based intrusions are SQL slammer, Blaster, Nimda MyDoom etc. Snort Signatures You may want to refer to open source Snort signatures when creating custom Zyxel Device ones. Most Snort rules are written in a single line. Snort rules are divided into two logical sections, the rule header and the rule options as shown in the following example:

alert tcp any any -> 192.168.1.0/24 111 (content:|00 01 a5|; msg:mountd access;) The text up to the first parenthesis is the rule header and the section enclosed in parenthesis contains the rule options. The words before the colons in the rule options section are the option keywords. The rule header contains the rule's:

Action Protocol Source and destination IP addresses and netmasks Source and destination ports information. The rule option section contains alert messages and information on which parts of the packet should be inspected to determine if the rule action should be taken. These are some equivalent Snort terms in the Zyxel Device. Table 232 Zyxel Device - Snort Equivalent Terms ZYXEL DEVICE TERM Type Of Service Identification Fragmentation Fragmentation Offset Time to Live IP Options Same IP Transport Protocol Transport Protocol: TCP SNORT EQUIVALENT TERM tos id fragbits fragoffset ttl ipopts sameip Port Flow Flags Sequence Number Ack Number Window Size

(In Snort rule header) flow flags seq ack window ZyWALL ATP Series Users Guide 582 Chapter 30 IDP Table 232 Zyxel Device - Snort Equivalent Terms (continued) ZYXEL DEVICE TERM Transport Protocol: UDP SNORT EQUIVALENT TERM

(In Snort rule header)

(In Snort rule header) Port Transport Protocol: ICMP Type Code ID Sequence Number Payload Options Payload Size Offset (relative to start of payload) Relative to end of last match Content Case-insensitive Decode as URI itype icode icmp_id icmp_seq

(Snort rule options) dsize offset distance content nocase uricontent Note: Not all Snort functionality is supported in the Zyxel Device. ZyWALL ATP Series Users Guide 583 CHAPTER 31 Sandboxing 31.1 Overview Zyxel cloud sandboxing is a security mechanism which provides a safe environment to separate running programs from your network and host devices. Unknown or untrusted programs/codes are uploaded to the Defend Center and executed within an isolated virtual machine (VM) to monitor and analyze the zero-day malware and advanced persistent threats (APTs) that may evade the Zyxel Devices detection, such as anti-malware. Results of cloud sandboxing are sent from the server to the Zyxel Device. By default, the Zyxel Device sandbox forwards all unknown files and uploads a copy of the files for inspection after checking the received files against its local cache. The scan result from the Defend Center (DC) is added to the Zyxel Device cache and used for future inspection. When a file with malicious or suspicious codes is detected, the Zyxel Device can take specific actions on the threats. Note: The scan result will be removed from the Zyxel Device cache after the Zyxel Device restarts. Figure 388 General Zyxel Sandbox Inspection Alternatively, you can select to hold and inspect the downloaded files for up to two seconds if the downloaded files have never been inspected before. ZyWALL ATP Series Users Guide 584 Chapter 31 Sandboxing Figure 389 Advanced Zyxel Sandbox Inspection 31.1.1 What You Need to Know The Zyxel Device may forward files with attachments before Sandbox has completed checking. If Sandbox discovers a suspect file, please contact the receiver of the suspect file and advise him/her not to open it. If he/she already opened it, then please urge him/her to run an up-to-date anti-malware scanner. If the receiver of a suspect file cannot open a file, Sandbox may have already modified the file by deleting the infected portion. Please check the logs and let the receiver know if this is so. Sandbox can only check the types of files listed under File Submission Options in the Sandboxing screen. If you disabled Scan and detect EICAR test virus in the Anti-Malware screen, then EICAR test files will be sent to Sandbox. To use the sandbox, you need to register your Zyxel Device and activate the service license at myZyxel, and then turn on the sandboxing function on the Zyxel Device. See Chapter 7 on page 186 for more information about registration and service licenses. 31.2 Sandboxing Screen Click Configuration > Security Service > Sandboxing to display the configuration screen as shown next. Use this screen to enable sandboxing and specify the actions the Zyxel Device takes when malicious or suspicious files are detected. Click the Sandboxing icon for more information on the Zyxel Devices security features. ZyWALL ATP Series Users Guide 585 Chapter 31 Sandboxing Figure 390 Configuration > Security Service > Sandboxing The following table describes the labels in this screen. DESCRIPTION Table 233 Configuration > Security Service > Sandboxing LABEL General Enable Sandboxing Action For Malicious File Log For Malicious File These are the log options for malicious files:

Select this option to turn on sandboxing on the Zyxel Device. Otherwise, deselect it. Specify whether the Zyxel Device deletes (destroy) or forwards (allow) malicious files. Malicious files are files given a high score for malware characteristics by the Defend Center. Action For Suspicious File Log For Suspicious File no: Do not create a log when a malicious file is detected. log: Create a log on the Zyxel Device when a malicious file is detected. log alert: An alert is an emailed log for more serious events that may need more immediate attention. Select this option to have the Zyxel Device send an alert when a malicious file is detected. Specify whether the Zyxel Device deletes (destroy) or forwards (allow) suspicious files. Suspicious files are files given a medium score for malware characteristics by the Defend Center. These are the log options for suspicious files:

no: Do not create a log when a suspicious file is detected. log: Create a log on the Zyxel Device when a suspicious file is detected. log alert: An alert is an emailed log for more serious events that may need more immediate attention. Select this option to have the Zyxel Device send an alert when a suspicious file is detected. ZyWALL ATP Series Users Guide 586 Chapter 31 Sandboxing DESCRIPTION Table 233 Configuration > Security Service > Sandboxing (continued) LABEL Advanced Inspection Inspect Selected Downloaded Files Select the check box to have the Zyxel Device hold the downloaded file for up to two seconds if the downloaded file has never been inspected before. The Zyxel Device will wait for the Defend Centers result and forward the file in two seconds. Sandbox detection may take longer than two seconds, so infected files could still possibly be forwarded to the user. Note: The Zyxel Device only checks the file types you selected for sandbox inspection. The scan result will be removed from the Zyxel Device cache after the Zyxel Device restarts. Specify the type of files to be sent for sandbox inspection. Click this link to see what data Zyxel collects from you and how it is used. Click Apply to save your changes. Click Reset to return the screen to its last-saved settings. File Submission Options Terms of Use Apply Reset ZyWALL ATP Series Users Guide 587 CHAPTER 32 Email Security 32.1 Overview The email security feature can mark or discard spam (unsolicited commercial or junk email). Use the white list to identify legitimate email. Use the black list to identify spam email. The Zyxel Device can also check email against a DNS black list (DNSBL) of IP addresses of servers that are suspected of being used by spammers. 32.1.1 What You Can Do in this Chapter Use the Email Security screens (Section 32.3 on page 590) to turn email security on or off and manage email security policies. Also, you can enable and configure the mail scan functions and have the Zyxel Device check email against DNS Black Lists. Use the Black/White List screens (Section 32.4 on page 593) to set up a black list to identify spam and a white list to identify legitimate email. 32.1.2 What You Need to Know White List Configure white list entries to identify legitimate email. The white list entries have the Zyxel Device classify any email that is from a specified sender or uses a specified header field and header value as being legitimate (see Email Headers for more on mail headers). The email security feature checks an email against the white list entries before doing any other email security checking. If the email matches a white list entry, the Zyxel Device classifies the email as legitimate and does not perform any more email security checking on that individual email. A properly configured white list helps keep important email from being incorrectly classified as spam. The white list can also increases the Zyxel Devices email security speed and efficiency by not having the Zyxel Device perform the full email security checking process on legitimate email. Black List Configure black list entries to identify spam. The black list entries have the Zyxel Device classify any email that is from or forwarded by a specified IP address or uses a specified header field and header value as being spam. If an email does not match any of the white list entries, the Zyxel Device checks it against the black list entries. The Zyxel Device classifies an email that matches a black list entry as spam and immediately takes the configured action for dealing with spam. If an email matches a blacklist entry, the Zyxel Device does not perform any more email security checking on that individual email. A properly configured black list helps catch spam email and increases the Zyxel Devices email security speed and efficiency. ZyWALL ATP Series Users Guide 588 Chapter 32 Email Security SMTP and POP3 Simple Mail Transfer Protocol (SMTP) is the Internets message transport standard. It controls the sending of email messages between servers. Email clients (also called email applications) then use mail server protocols such as POP (Post Office Protocol) or IMAP (Internet Message Access Protocol) to retrieve email. Email clients also generally use SMTP to send messages to a mail server. The older POP2 requires SMTP for sending messages while the newer POP3 can be used with or without it. This is why many email applications require you to specify both the SMTP server and the POP or IMAP server (even though they may actually be the same server). The Zyxel Devices email security feature checks SMTP (TCP port 25) and POP3 (TCP port 110) emails by default. You can also specify custom SMTP and POP3 ports for the Zyxel Device to check. Email Headers Every email has a header and a body. The header is structured into fields and includes the addresses of the recipient and sender, the subject, and other information about the email and its journey. The body is the actual message text and any attachments. You can have the Zyxel Device check for specific header fields with specific values. Email programs usually only show you the To:, From:, Subject:, and Date: header fields but there are others such as Received: and Content-Type:. To see all of an emails header, you can select an email in your email program and look at its properties or details. For example, in Microsofts Outlook Express, select a mail and click File > Properties > Details. This displays the emails header. Click Message Source to see the source for the entire mail including both the header and the body. Email Header Buffer Size The Zyxel Device has a 5 K buffer for an individual email header. If an emails header is longer than 5 K, the Zyxel Device only checks up to the first 5 K. DNSBL A DNS Black List (DNSBL) is a server that hosts a list of IP addresses known or suspected of having sent or forwarded spam. A DNSBL is also known as a DNS spam blocking list. The Zyxel Device can check the routing addresses of email against DNSBLs and classify an email as spam if it was sent or forwarded by a computer with an IP address in the DNSBL. Finding Out More See Section 32.5 on page 595 for more background information on email security. 32.2 Before You Begin Before using the email security features (IP Reputation, Mail Content Analysis and Virus Outbreak Detection) you must activate your email security Service license. Configure your zones before you configure email security. ZyWALL ATP Series Users Guide 589 Chapter 32 Email Security 32.3 The Email Security Screen Click Configuration > Security Service > Email Security to open the Email Security screen. Use this screen to turn the email security feature on or off and manage email security policies. You can also select the action the Zyxel Device takes when the mail sessions threshold is reached. Click the Email Security icon for more information on the Zyxel Devices security features. Figure 391 Configuration > Security Service > Email Security ZyWALL ATP Series Users Guide 590 Chapter 32 Email Security The following table describes the labels in this screen. Table 234 Configuration > Security Service > Email Security LABEL General Settings DESCRIPTION Enable Check White List Check Black List Black List Spam Tag Check IP Reputation

(SMTP Only) Check Mail Content Mail Content Spam Tag Check Virus Outbreak Virus Outbreak Tag Check Mail Phishing Mail Phishing Tag Check DNSBL DNSBL Spam Tag Select this check box to activate the settings in this section. Select this check box to check email against the white list. The Zyxel Device classifies email that matches a white list entry as legitimate (not spam). Select this check box to check email against the black list. The Zyxel Device classifies email that matches a black list entry as spam. Enter a message or label (up to 15 ASCII characters) to add to the mail subject of emails that match the Zyxel Devices spam black list. Select this to use IP reputation to identify Spam or Unwanted Bulk Email by the senders IP address. Select this to identify spam email by content, such as malicious content. Enter a message or label (up to 15 ASCII characters) to add to the beginning of the mail subject of emails that are determined to spam based on the mail content analysis. This tag is only added if the email security policy is configured to forward spam mail with a spam tag. Select this to scan emails for attached viruses. Enter a message or label (up to 15 ASCII characters) to add to the beginning of the mail subject of emails that are determined to have an attached viruses. This tag is only added if the email security policy is configured to forward spam mail with a spam tag. Phishing is an act of tricking you into providing login or personal information with malicious emails or website links. Select this to identify emails sent from suspicious websites known for phishing. Enter a message or label (up to 15 ASCII characters) to add to the beginning of the mail subject of emails that have suspicious websites links. This tag is only added if the email security action is configured to forward spam mail with a spam tag. Select this check box to check email against the Zyxel Devices configured DNSBL domains. The Zyxel Device classifies email that matches a DNS black list as spam. Enter a message or label (up to 15 ASCII characters) to add to the beginning of the mail subject of emails that have a sender or relay IP address in the header that matches a black list maintained by one of the DNSBL domains listed in the Zyxel Device. This tag is only added if the email security policy is configured to forward spam mail with a spam tag. DNSBL Domain List Add Edit Remove Activate Inactivate Status

#

Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. This is the entrys index number in the list. ZyWALL ATP Series Users Guide 591 Chapter 32 Email Security Table 234 Configuration > Security Service > Email Security LABEL DNSBL Domain DESCRIPTION This is the name of a domain that maintains DNSBL servers. Enter the domain that is maintaining a DNSBL. Use this section to set how the Zyxel Device is to handle spam mail. Actions for Spam Mail SMTP POP3 Log Action taken when mail sessions threshold is reached Query Timeout Settings SMTP POP3 Timeout Value Timeout Tag Timeout X-Header Max. IPs Checking Per Mail Select how the Zyxel Device is to handle spam SMTP mail. Select drop to discard spam SMTP mail. Select forward to allow spam SMTP mail to go through. Select forward with tag to add a spam tag to an SMTP spam mails mail subject and send it on to the destination. Select how the Zyxel Device is to handle spam POP3 mail. Select forward to allow spam POP3 mail to go through. Select forward with tag to add a spam tag to an POP3 spam mails mail subject and send it on to the destination. Select whether to have the ZyXEL device generate a log (log), log and alert (log alert) or neither (no) by default when traffic matches a signature in this category. An email session is when an email client and email server (or two email servers) connect through the Zyxel Device. Select how to handle concurrent email sessions that exceed the maximum number of concurrent email sessions that the email security feature can handle. See the chapter of product specifications for the threshold. Select Forward Session to have the Zyxel Device allow the excess email sessions without any spam filtering. Select Drop Session to have the Zyxel Device drop mail connections to stop the excess email sessions. The email client or server will have to re-attempt to send or receive email later when the number of email sessions is under the threshold. Select how the Zyxel Device is to handle SMTP mail query timeout. Select drop to discard SMTP mail. Select forward to allow SMTP mail to go through. Select forward with tag to add a tag to an SMTP query timeout mails mail subject and send it on to the destination. Select how the Zyxel Device is to handle POP3 mail query timeout. Select forward to allow POP3 mail to go through. Select forward with tag to add a tag to an POP3 query timeout mails mail subject and send it on to the destination. Set how long the Zyxel Device waits for a reply from the mail scan server. If there is no reply before this time period expires, the Zyxel Device takes the action defined in the relevant Actions when Query Timeout field. Enter a message or label (up to 15 ASCII characters) to add to the mail subject of emails that the Zyxel Device forwards if queries to the mail scan servers time out. Specify the name and value for the X-Header to be added when queries to the mail scan servers time out. Set the maximum number of sender and relay server IP addresses in the mail header to check against the DNSBL domain servers. ZyWALL ATP Series Users Guide 592 Chapter 32 Email Security Table 234 Configuration > Security Service > Email Security LABEL IP Selection Per Mail DESCRIPTION Select first N IPs to have the Zyxel Device start checking from the first IP address in the mail header. This is the IP of the sender or the first server that forwarded the mail. Select last N IPs to have the Zyxel Device start checking from the last IP address in the mail header. This is the IP of the last server that forwarded the mail. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Apply Reset 32.4 The Black List / White List Screen Click Configuration > Security Service > Email Security > Black /White List to display the Black List / White List screen. Configure the black list to identify spam email. You can create black list entries based on the senders or relay servers IP address or email address. You can also create entries that check for particular email header fields with specific values or specific subject text. Click a columns heading cell to sort the table entries by that columns criteria. Click the heading cell again to reverse the sort order. Figure 392 Configuration > Security Service > Email Security > Black/White List The following table describes the labels in this screen. DESCRIPTION Table 235 Configuration > Security Service > Email Security > Black/White List LABEL Rule Summary Add Edit Remove Activate Inactivate Status Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. This is the entrys index number in the list. This field displays whether the entry is based on the emails subject, source or relay IP address, source email address, or header.

#

Type ZyWALL ATP Series Users Guide 593 Chapter 32 Email Security Table 235 Configuration > Security Service > Email Security > Black/White List (continued) LABEL Content DESCRIPTION This field displays the subject content, source or relay IP address, source email address, or header value for which the entry checks. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Apply Reset 32.4.1 The Black or White List Add/Edit Screen In the Black List or White List screen, click the Add icon or an Edit icon to display the following screen. Use this screen to configure an email security black list entry to identify spam email. You can create entries based on specific subject text, or the senders or relays IP address or email address. You can also create entries that check for particular header fields and values. Figure 393 Configuration > Security Service > Email Security > Black/White List > Black List (or White List) >

Add The following table describes the labels in this screen. Table 236 Configuration > Security Service > Email Security > Black/White List > Black/White List > Add LABEL Enable Rule DESCRIPTION Select this to have the Zyxel Device use this entry as part of the black or white list. Type To actually use the entry, you must also turn on the use of the list in the corresponding list screen, enable the email security feature in the email security general screen, and configure an email security policy to use the list. Use this field to base the entry on the emails subject, source or relay IP address, source email address, or header. Select Subject to have the Zyxel Device check email for specific content in the subject line. Select IP Address to have the Zyxel Device check email for a specific source or relay IP address. Select IPv6 Address to have the Zyxel Device check email for a specific source or relay IPv6 address. Select E-Mail Address to have the Zyxel Device check email for a specific source email address or domain name. Select Mail Header to have the Zyxel Device check email for specific header fields and values. Configure black list header entries to check for email from bulk mail programs or with content commonly used in spam. Configure white list header entries to allow certain header values that identify the email as being from a trusted source. ZyWALL ATP Series Users Guide 594 Chapter 32 Email Security Table 236 Configuration > Security Service > Email Security > Black/White List > Black/White List > Add LABEL Mail Subject Keyword DESCRIPTION This field displays when you select the Subject type. Enter up to 63 ASCII characters of text to check for in email headers. Spaces are not allowed, although you could substitute a question mark (?). See Section 32.4.2 on page 595 for more details. This field displays when you select the IP Address type. Enter an IP address in dotted decimal notation. This field displays when you select the IPv6 Address type. Enter an IPv6 address with prefix. This field displays when you select the IP type. Enter the subnet mask here, if applicable. This field displays when you select the E-Mail type. Enter a keyword (up to 63 ASCII characters). See Section 32.4.2 on page 595 for more details. This field displays when you select the Mail Header type. Type the name part of an email header (the part that comes before the colon). Use up to 63 ASCII characters. For example, if you want the entry to check the Received: header for a specific mail servers domain, enter Received here. This field displays when you select the Mail Header type. Type the value part of an email header (the part that comes after the colon). Use up to 63 ASCII characters. For example, if you want the entry to check the Received: header for a specific mail servers domain, enter the mail servers domain here. Sender or Mail Relay IP Address Sender or Mail Relay IPv6 Address Netmask Sender E-Mail Address Mail Header Field Name Field Value Keyword OK Cancel See Section 32.4.2 on page 595 for more details. Click OK to save your changes. Click Cancel to exit this screen without saving your changes. 32.4.2 Regular Expressions in Black or White List Entries The following applies for a black or white list entry based on an email subject, email address, or email header value. Use a question mark (?) to let a single character vary. For example, use a?c (without the quotation marks) to specify abc, acc and so on. You can also use a wildcard (*). For example, if you configure *def.com, any email address that ends in def.com matches. So mail.def.com matches. The wildcard can be anywhere in the text string and you can use more than one wildcard. You cannot use two wildcards side by side, there must be other characters between them. The Zyxel Device checks the first header with the name you specified in the entry. So if the email has more than one Received header, the Zyxel Device checks the first one. 32.5 Email Security Technical Reference Here is more detailed email security information. ZyWALL ATP Series Users Guide 595 Chapter 32 Email Security DNSBL The Zyxel Device checks only public sender and relay IP addresses, it does not check private IP addresses. The Zyxel Device sends a separate query (DNS lookup) for each sender or relay IP address in the emails header to each of the Zyxel Devices DNSBL domains at the same time. The DNSBL servers send replies as to whether or not each IP address matches an entry in their list. Each IP address has a separate reply. As long as the replies are indicating the IP addresses do not match entries on the DNSBL lists, the Zyxel Device waits until it receives at least one reply for each IP address. If the Zyxel Device receives a DNSBL reply that one of the IP addresses is in the DNSBL list, the Zyxel Device immediately classifies the email as spam and takes the email security policys configured action for spam. The Zyxel Device does not wait for any more DNSBL replies. If the Zyxel Device receives at least one non-spam reply for each of an emails routing IP addresses, the Zyxel Device immediately classifies the email as legitimate and forwards it. Any further DNSBL replies that come after the Zyxel Device classifies an email as spam or legitimate have no effect. The Zyxel Device records DNSBL responses for IP addresses in a cache for up to 72 hours. The Zyxel Device checks an emails sender and relay IP addresses against the cache first and only sends DNSBL queries for IP addresses that are not in the cache. Here is an example of an email classified as spam based on DNSBL replies. Figure 394 DNSBL Spam Detection Example IPs: a.a.a.a b.b.b.b 1 4 m ot s p a 2 a.a.a.a ?

b.b.b.b ?

a.a.a.a N a.a.a.a?

b.b.b.b?

DNSBL A DNSBL B a.a.a.a?b.b.b.b?

b.b.b.b Spam DNSBL C 3 1 The Zyxel Device receives an email that was sent from IP address a.a.a.a and relayed by an email server at IP address b.b.b.b. The Zyxel Device sends a separate query to each of its DNSBL domains for IP address a.a.a.a. The Zyxel Device sends another separate query to each of its DNSBL domains for IP address b.b.b.b. 2 DNSBL A replies that IP address a.a.a.a does not match any entries in its list (not spam). ZyWALL ATP Series Users Guide 596 Chapter 32 Email Security 3 DNSBL C replies that IP address b.b.b.b matches an entry in its list. 4 The Zyxel Device immediately classifies the email as spam and takes the action for spam that you defined in the email security policy. In this example it was an SMTP mail and the defined action was to drop the mail. The Zyxel Device does not wait for any more DNSBL replies. Here is an example of an email classified as legitimate based on DNSBL replies. Figure 395 DNSBL Legitimate Email Detection Example IPs: c.c.c.c d.d.d.d 1 4 DNSBL A DNSBL B DNSBL C c.c.c.c ?

d.d.d.d ?

c.c.c.c?

d.d.d.d?

d.d.d.d Not spam c.c.c.c?d.d.d.d?

c.c.c.c Not spam 2 3 1 The Zyxel Device receives an email that was sent from IP address c.c.c.c and relayed by an email server at IP address d.d.d.d. The Zyxel Device sends a separate query to each of its DNSBL domains for IP address c.c.c.c. The Zyxel Device sends another separate query to each of its DNSBL domains for IP address d.d.d.d. 2 DNSBL B replies that IP address d.d.d.d does not match any entries in its list (not spam). 3 DNSBL C replies that IP address c.c.c.c does not match any entries in its list (not spam). 4 Now that the Zyxel Device has received at least one non-spam reply for each of the emails routing IP addresses, the Zyxel Device immediately classifies the email as legitimate and forwards it. The Zyxel Device does not wait for any more DNSBL replies. If the Zyxel Device receives conflicting DNSBL replies for an email routing IP address, the Zyxel Device classifies the email as spam. Here is an example. ZyWALL ATP Series Users Guide 597 Chapter 32 Email Security Figure 396 Conflicting DNSBL Replies Example IPs: a.b.c.d w.x.y.z 1 4 m ot s p a 2 a.b.c.d ?

w .x.y.z ?

a.b.c.d N a.b.c.d?

w.x.y.z?

a.b.c.d Spam!

a.b.c.d?w.x.y.z?

3 DNSBL A DNSBL B DNSBL C 1 The Zyxel Device receives an email that was sent from IP address a.b.c.d and relayed by an email server at IP address w.x.y.z. The Zyxel Device sends a separate query to each of its DNSBL domains for IP address a.b.c.d. The Zyxel Device sends another separate query to each of its DNSBL domains for IP address w.x.y.z. 2 DNSBL A replies that IP address a.b.c.d does not match any entries in its list (not spam). 3 While waiting for a DNSBL reply about IP address w.x.y.z, the Zyxel Device receives a reply from DNSBL B saying IP address a.b.c.d is in its list. 4 The Zyxel Device immediately classifies the email as spam and takes the action for spam that you defined in the email security policy. In this example it was an SMTP mail and the defined action was to drop the mail. The Zyxel Device does not wait for any more DNSBL replies. ZyWALL ATP Series Users Guide 598 CHAPTER 33 SSL Inspection 33.1 Overview Secure Socket Layer (SSL) traffic, such as https://www.google.com/HTTPS, FTPs, POP3s, SMTPs, etc. is encrypted, and cannot be inspected using Security Service profiles such as App Patrol, Content Filter, Intrusion, Detection and Prevention (IDP), or Anti-Malware. The Zyxel Device uses SSL Inspection to decrypt SSL traffic, sends it to the Security Service engines for inspection, then encrypts traffic that passes inspection and forwards it to the destination server, such as Google. An example process is shown in the following figure. User U sends a HTTPS request (SSL) to destination server D, via the Zyxel Device, Z. The traffic matches an SSL Inspection profile in a security policy, so the Zyxel Device decrypts the traffic using SSL Inspection. The decrypted traffic is then inspected by the Security Service profiles in the same security profile that matched the SSL Inspection profile. If all is OK, then the Zyxel Device re-encrypts the traffic using SSL Inspection and forwards it to the destination server D. SSL traffic could be in the opposite direction for other examples. Figure 397 SSL Inspection Overview HTTPS SSL Inspection Decrypt Security Service AP CF IDP Anti-Malware SSL Inspection Encrypt Note: Email security cannot be applied to traffic decrypted by SSL Inspection. 33.1.1 What You Can Do in this Chapter Use the Security Service > SSL Inspection > Profile screen (Section 33.2 on page 600) to view SSL Inspection profiles. Click the Add or Edit icon in this screen to configure the CA certificate, action and log in an SSL Inspection profile. Use the Security Service > SSL Inspection > Exclude List screens (Section 33.3 on page 605) to create a whitelist of destination servers to which traffic is passed through uninspected. 33.1.2 What You Need To Know Supported Cipher Suite DES (Data Encryption Standard) ZyWALL ATP Series Users Guide 599 Chapter 33 SSL Inspection 3DES AES (Advanced Encryption Standard) SSLv3/TLS1.0 (Transport Layer Security) Support SSLv3/TLS1.0 is currently supported with option to pass or block SSLv2 traffic Traffic using TLS1.1 (Transport Layer Security) or TLS1.2 is downgraded to TLS1.0 for SSL Inspection No Compression Support Now No Client Authentication Request Support Now Finding Out More See Configuration > Object > Certificate > My Certificates for information on creating certificates on the Zyxel Device. See Monitor > Security Statistics > SSL Inspection to get usage data and easily add a destination server to the whitelist of exclusion servers. See Configuration > Security Policy > Policy Control > Policy to bind an SSL Inspection profile to a traffic flow(s). 33.1.3 Before You Begin If you dont want to use the default Zyxel Device certificate, then create a new certificate in Object >

Certificate > My Certificates. Decide what destination servers to which traffic is sent directly without inspection. This may be a matter of privacy and legality regarding inspecting an individuals encrypted session, such as financial websites. This may vary by locale. 33.2 The SSL Inspection Profile Screen An SSL Inspection profile is a template with pre-configured certificate, action and log. Click Configuration > Security Service > SSL Inspection > Profile to open this screen. Figure 398 Configuration > Security Service > SSL Inspection > Profile The following table describes the fields in this screen. Table 237 Configuration > Security Service > SSL Inspection > Profile LABEL Profile Management DESCRIPTION Add Edit Click Add to create a new profile. Select an entry and click this to be able to modify it. ZyWALL ATP Series Users Guide 600 Chapter 33 SSL Inspection Table 237 Configuration > Security Service > SSL Inspection > Profile (continued) LABEL Remove References

#

Name Description CA Certificate Reference Action DESCRIPTION Select an entry and click this to delete it. Select an entry and click References to open a screen that shows which settings use the entry. Click Refresh to update information on this screen. This is the entrys index number in the list. This displays the name of the profile. This displays the description of the profile. This displays the CA certificate being used in this profile. This displays the number of times an object reference is used in a profile. Click this icon to apply the entry to a security policy. Go to the Configuration > Security Policy > Policy Control screen to check the result. 33.2.1 Apply to a Security Policy Click the icon in the Action field to apply the entry to a security policy. Go to the Configuration > Security Policy > Policy Control screen to check the result. ZyWALL ATP Series Users Guide 601 Chapter 33 SSL Inspection Figure 399 Configuration > Security Service > SSL Inspection > Action The following table describes the labels in this screen. DESCRIPTION Click Show Filter to display IPv4 and IPv6 (if enabled) security policy search filters. Table 238 Configuration > Security Service > SSL Inspection > Action LABEL Show Filter/Hide Filter IPv4 / IPv6 Configuration From / To Use IPv4 / IPv6 search filters to find specific IPv4 and IPv6 (if enabled) security policies based on direction, application, user, source, destination and/or schedule. Select a zone to view all security policies from a particular zone and/or to a particular zone. any means all zones. ZyWALL ATP Series Users Guide 602 Chapter 33 SSL Inspection Table 238 Configuration > Security Service > SSL Inspection > Action LABEL DESCRIPTION Type an IPv4 or IPv6 IP address to view all security policies based on the IPv4 / IPv6 source address object used. IPv4 / IPv6 Source An IPv4 IP address is written as four integer blocks separated by periods. This is an example IPv4 address: 172.16.6.7. An 128-bit IPv6 address is written as eight 16-bit hexadecimal blocks separated by colons

(:). This is an example IPv6 address: 2001:0db8:1a2b:0015:0000:0000:1a2f:0000. IPv4 / IPv6 Destination Type an IPv4 or IPv6 IP address to view all security policies based on the IPv4 / IPv6 destination address object used. Service User Schedule Priority Status Name From / To An IPv4 IP address is written as four integer blocks separated by periods. This is an example IPv4 address: 172.16.6.7. An 128-bit IPv6 address is written as eight 16-bit hexadecimal blocks separated by colons

(:). This is an example IPv6 address: 2001:0db8:1a2b:0015:0000:0000:1a2f:0000. View all security policies based the service object used. View all security policies based on user or user group object used. View all security policies based on the schedule object used. This is the position of your Security Policy in the global policy list (including all through-Zyxel Device and to-Zyxel Device policies). The ordering of your policies is important as policies are applied in sequence. Default displays for the default Security Policy behavior that the Zyxel Device performs on traffic that does not match any other Security Policy. This icon is lit when the entry is active and dimmed when the entry is inactive. This is the name of the Security policy. This is the direction of travel of packets. Select from which zone the packets come and to which zone they go. Security Policies are grouped based on the direction of travel of packets to which they apply. For example, from LAN to LAN means packets traveling from a computer or subnet on the LAN to either another computer or subnet on the LAN. From any displays all the Security Policies for traffic going to the selected To Zone. To any displays all the Security Policies for traffic coming from the selected From Zone. From any to any displays all of the Security Policies. To ZyWALL policies are for traffic that is destined for the Zyxel Device and control which computers can manage the Zyxel Device. IPv4 / IPv6 Source This displays the IPv4 / IPv6 source address object, including geographic address and FQDN IPv4 / IPv6 Destination Service User Schedule Action Log Profile OK Cancel

(group) objects, to which this Security Policy applies. This displays the IPv4 / IPv6 destination address object, including geographic address and FQDN (group) objects, to which this Security Policy applies. This displays the service object to which this Security Policy applies. This is the user name or user group name to which this Security Policy applies. This field tells you the schedule object that the policy uses. none means the policy is active at all times if enabled. This field displays whether the Security Policy silently discards packets without notification

(deny), permits the passage of packets (allow) or drops packets with notification (reject) Select whether to have the Zyxel Device generate a log (log), log and alert (log alert) or not

(no) when the policy is matched to the criteria listed above. This field shows you which Security Service profiles (application patrol, content filter, IDP, anti-

malware, email security) apply to this Security policy. Click an applied Security Service profile icon to edit the profile directly. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving. ZyWALL ATP Series Users Guide 603 Chapter 33 SSL Inspection 33.2.2 Add / Edit SSL Inspection Profiles Click Configuration > Security Service > SSL Inspection > Profile > Add to create a new profile or select an existing profile and click Edit to change its settings. Figure 400 Configuration > Security Service > SSL Inspection > Profile > Add / Edit The following table describes the fields in this screen. Table 239 Configuration > Security Service > SSL Inspection > Profile > Add / Edit LABEL Name DESCRIPTION This is the name of the profile. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. These are valid, unique profile names:

MyProfile mYProfile Mymy12_3-4 Description CA Certificate SSL/TLS version supported minimum Log These are invalid profile names:

1mYProfile My Profile MyProfile?

Whatalongprofilename123456789012 Enter additional information about this SSL Inspection entry. You can enter up to 60 characters

("0-9", "a-z", "A-Z", "-" and "_"). This contains the default certificate and the certificates created in Object > Certificate > My Certificates. Choose the certificate for this profile. SSL Inspection supports SSLv3, TLS1.0, TLS1.1, and TLS1.2 to use Secure Sockets Layer (SSL) or Transport Layer Security (TLS) if you want encrypted traffic. These are the log options for unsupported traffic that matches traffic bound to this policy:

no: Select this option to have the Zyxel Device create no log for unsupported traffic that log: Select this option to have the Zyxel Device create a log for unsupported traffic that matches traffic bound to this policy. matches traffic bound to this policy log alert: An alert is an emailed log for more serious events that may need more immediate attention. They also appear in red in the Monitor > Log screen. Select this option to have the Zyxel Device send an alert for unsupported traffic that matches traffic bound to this policy. ZyWALL ATP Series Users Guide 604 Chapter 33 SSL Inspection Table 239 Configuration > Security Service > SSL Inspection > Profile > Add / Edit (continued) LABEL Action for Connection with unsupported suit DESCRIPTION SSL Inspection supports these cipher suites:

Log Action for connection with untrusted cert chain Log DES 3DES AES Select to pass or block unsupported traffic (such as other cipher suites, compressed traffic, client authentication requests, and so on) that matches traffic bound to this policy here. These are the log options for unsupported traffic that matches traffic bound to this policy:

no: Select this option to have the Zyxel Device create no log for unsupported traffic that log: Select this option to have the Zyxel Device create a log for unsupported traffic that matches traffic bound to this policy. matches traffic bound to this policy log alert: An alert is an emailed log for more serious events that may need more immediate attention. They also appear in red in the Monitor > Log screen. Select this option to have the Zyxel Device send an alert for unsupported traffic that matches traffic bound to this policy. A certificate chain is a certification process that involves the following certificates between the SSL/TLS server and a client. A certificate chain will fail if one of the following certificates is not correct. A certificate owned by a user The certificate signed by a certification authority A root certificate Select to pass, inspect, or block an untrusted certification chain. These are the log options for unsupported traffic that matches traffic bound to this policy:

no: Select this option to have the Zyxel Device create no log for unsupported traffic that log: Select this option to have the Zyxel Device create a log for unsupported traffic that matches traffic bound to this policy. matches traffic bound to this policy log alert: An alert is an emailed log for more serious events that may need more immediate attention. They also appear in red in the Monitor > Log screen. Select this option to have the Zyxel Device send an alert for unsupported traffic that matches traffic bound to this policy. OK Cancel Click OK to save your settings to the Zyxel Device, and return to the profile summary page. Click Cancel to return to the profile summary page without saving any changes. 33.3 Exclude List Screen There may be privacy and legality issues regarding inspecting a user's encrypted session. The legal issues may vary by locale, so it's important to check with your legal department to make sure that its OK to intercept SSL traffic from your Zyxel Device users. To ensure individual privacy and meet legal requirements, you can configure an exclusion list to exclude matching sessions to destination servers. This traffic is not intercepted and is passed through uninspected. Click Configuration > Security Service > SSL Inspection > Exclude List to display the following screen. Use Add to put a new item in the list or Edit to change an existing one or Remove to delete an existing entry. ZyWALL ATP Series Users Guide 605 Chapter 33 SSL Inspection Figure 401 Configuration > Security Service > SSL Inspection > Exclude List (> Add/Edit) The following table describes the fields in this screen. Table 240 Configuration > Security Service > SSL Inspection > Exclude List LABEL General Settings DESCRIPTION Enable Logs for Exclude List Exclude List Settings Add Edit Remove

#

Exclude List of Certificate Identity Apply Reset Click this to create a log for traffic that bypasses SSL Inspection. Use this part of the screen to create, edit, or delete items in the SSL Inspection exclusion list. Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. This is the entrys index number in the list. SSL traffic to a server to be excluded from SSL Inspection is identified by its certificate. Identify the certificate in one of the following ways:

The Common Name (CN) of the certificate. The common name of the certificate can be created in the Object > Certificate > My Certificates screen. Type an IPv4 or IPv6 address. For example, type 192.168.1.35, or 2001:7300:3500::1 Type an IPv4/IPv6 in CIDR notation. For example, type 192.168.1.1/24, or 2001:7300:3500::1/

64 Type an IPv4/IPv6 address range. For example, type 192.168.1.1-192.168.1.35, or 2001:7300:3500::1-2001:7300:3500::35 Type an email address. For example, type abc@zyxel.com.tw Type a DNS name or a common name (wildcard char: '*', escape char: '\'). Use up to 127 case-insensitive characters (0-9a-zA-Z`~!@#$%^&*()-_=+[]{}\|;:',.<>/?). * can be used as a wildcard to match any string. Use \* to indicate a single wildcard character. Alternatively, to automatically add an entry for existing SSL traffic to a destination server, go to Monitor > Security Statistics > SSL Inspection > Certificate Cache List, select an item and then click Add to Exclude List. The item will then appear here. Click Apply to save your settings to the Zyxel Device. Click Reset to return to the profile summary page without saving any changes. ZyWALL ATP Series Users Guide 606 Chapter 33 SSL Inspection 33.4 Certificate Update Screen Use this screen to update the latest certificates of servers using SSL connections to the Zyxel Device network. User U sends an SSL request to destination server D (1), via the Zyxel Device, Z. D replies (2); Z intercepts the response from D and checks if the certificate has been previously signed. Z then replies to D (3) and also to U (4). Ds latest certificate is stored at myZyxel (M) along with other server certificates and can be downloaded to the Zyxel Device. Figure 402 SSL Inspection Certificate Update Overview Click Configuration > Security Service > SSL Inspection > Certificate Update to display the following screen. Figure 403 Configuration > Security Service > SSL Inspection > Certificate Update ZyWALL ATP Series Users Guide 607 Chapter 33 SSL Inspection The following table describes the fields in this screen. Table 241 Configuration > Security Service > SSL Inspection > Certificate Update LABEL Certificate Information DESCRIPTION Current Version Released Date Certificate Update Update Now Auto Update Apply Reset This displays the current certificate set version. This field displays the date and time the current certificate set was released. You should have Internet access and have activated SSL Inspection on the Zyxel Device at myZyxel. Click this button to download the latest certificate set (Windows, MAC OS X, and Android) from the myZyxel and update it on the Zyxel Device. Select this to automatically have the Zyxel Device update the certificate set when a new one becomes available on myZyxel. Click Apply to save your settings to the Zyxel Device. Click Reset to return to the profile summary page without saving any changes. 33.5 Install a CA Certificate in a Browser Certificates used in SSL Inspection profiles should be installed in user web browsers. Do the following steps to install a certificate in a computer with a Windows operating system (PC). First, save the certificate to your computer. 1 Run the certificate manager using certmgr.msc. 2 Go to Trusted Root Certification Authorities > Certificates. ZyWALL ATP Series Users Guide 608 Chapter 33 SSL Inspection 3 From the main menu, select Action > All Tasks > Import and run the Certificate Import Wizard to install the certificate on the PC. ZyWALL ATP Series Users Guide 609 Chapter 33 SSL Inspection 33.5.0.1 Firefox Browser If youre using a Firefox browser, in addition to the above you need to do the following to import a certificate into the browser. Click Tools > Options > Advanced > Encryption > View Certificates, click Import and enter the filename of the certificate you want to import. See the browser's help for further information. ZyWALL ATP Series Users Guide 610 CHAPTER 34 IP Exception 34.1 Overview The Zyxel Device wont intercept nor inspect the incoming packets that match the rules in the IP exception list for the anti-malware and/or IDP (Intrusion, Detection, and Prevention) features. 34.2 The IP Exception Screen Use this screen to view the IP exception list for the anti-malware and IDP (Intrusion, Detection, and Prevention) features. The Zyxel Device will exclude the incoming packets coming from the listed source IP address(es) and destined for the listed destination IP address(es). These packets wont be intercepted and will be passed through uninspected. Click Configuration > Security Service > IP Exception to display the following screen. Use Add to put a new entry in the list or Edit to change an existing one or Remove to delete an existing entry. Figure 404 Configuration > Security Service > IP Exception The following table describes the fields in this screen. DESCRIPTION Table 242 Configuration > Security Service > IP Exception LABEL IPv4/IPv6 Exception List Settings Add Edit Click this to create a new entry. Select an entry and click this to be able to modify it. ZyWALL ATP Series Users Guide 611 Chapter 34 IP Exception Table 242 Configuration > Security Service > IP Exception (continued) LABEL Remove

#

Name IPv4/IPv6 Source DESCRIPTION Select an entry and click this to delete it. This is the entrys index number in the list. This field displays the descriptive name of this entry. This field displays the source IP address (or address object) of incoming traffic. It displays any if there is no restriction on the source IP address. This field displays the destination IP address (or address object) of incoming traffic. It displays any if there is no restriction on the destination IP address. This field displays to which feature (anti-malware and/or IDP) the entry applies. This field displays if the Zyxel Device will generate a log when the incoming traffic is in the exception list. IPv4/IPv6 Destination Service to Bypass Log 34.2.1 The IP Exception Add/Edit Screen Use this screen to add or edit entries of IPv4 or IPv6 address in the IP exception list. Click Configuration > Security Service > IP Exception > Add/Edit to display the following screen. Figure 405 Configuration > Security Service > IP Exception > Add/Edit The following table describes the fields in this screen. DESCRIPTION Use this to configure any new settings objects that you need to use in this screen. Table 243 Configuration > Security Service > IP Exception > Add/Edit LABEL Create New Object Name Description Source Enter a descriptive name of this entry. Enter the description for this entry. You can use up to 60 printable ASCII characters. Select any or an address object of the source IP address for this entry. Select any so theres no restriction on the source IP address. ZyWALL ATP Series Users Guide 612 Chapter 34 IP Exception Table 243 Configuration > Security Service > IP Exception > Add/Edit (continued) LABEL Destination DESCRIPTION Select any or an address object of the destination IP address for this entry. Select any so theres no restriction on the destination IP address. Select Yes to have the Zyxel Device generate a log when the incoming traffic is in the exception list. Otherwise, select No. Select Anti-Malware and/or IDP that the entry will apply to. Click OK to save your customized settings and exit this screen. Click Cancel to exit this screen without saving. Log Service to Bypass OK Cancel ZyWALL ATP Series Users Guide 613 CHAPTER 35 Object 35.1 Zones Overview Set up zones to configure network security and network policies in the Zyxel Device. A zone is a group of interfaces and/or VPN tunnels. The Zyxel Device uses zones instead of interfaces in many security and policy settings, such as Secure Policies rules, Security Service, and remote management. Zones cannot overlap. Each Ethernet interface, VLAN interface, bridge interface, PPPoE/PPTP interface and VPN tunnel can be assigned to at most one zone. Virtual interfaces are automatically assigned to the same zone as the interface on which they run. Figure 406 Example: Zones Use the Zone screens (see Section 35.8.2 on page 670) to manage the Zyxel Devices zones. 35.1.1 What You Need to Know Zones effectively divide traffic into three types--intra-zone traffic, inter-zone traffic, and extra-zone traffic. ZyWALL ATP Series Users Guide 614 Chapter 35 Object Intra-zone Traffic Intra-zone traffic is traffic between interfaces or VPN tunnels in the same zone. For example, in Figure 406 on page 614, traffic between VLAN 2 and the Ethernet is intra-zone traffic. Inter-zone Traffic Inter-zone traffic is traffic between interfaces or VPN tunnels in different zones. For example, in Figure 406 on page 614, traffic between VLAN 1 and the Internet is inter-zone traffic. This is the normal case when zone-based security and policy settings apply. Extra-zone Traffic Extra-zone traffic is traffic to or from any interface or VPN tunnel that is not assigned to a zone. For example, in Figure 406 on page 614, traffic to or from computer C is extra-zone traffic. Some zone-based security and policy settings may apply to extra-zone traffic, especially if you can set the zone attribute in them to Any or All. See the specific feature for more information. 35.1.2 The Zone Screen The Zone screen provides a summary of all zones. In addition, this screen allows you to add, edit, and remove zones. To access this screen, click Configuration > Object > Zone. Figure 407 Configuration > Object > Zone The following table describes the labels in this screen. Table 244 Configuration > Object > Zone LABEL User Configuration /

System Default Add DESCRIPTION The Zyxel Device comes with pre-configured System Default zones that you cannot delete. You can create your own User Configuration zones Click this to create a new, user-configured zone. ZyWALL ATP Series Users Guide 615 Chapter 35 Object Table 244 Configuration > Object > Zone (continued) LABEL Edit DESCRIPTION Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove a user-configured trunk, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Select an entry and click References to open a screen that shows which settings use the entry. Click Refresh to update information in this screen. This field is a sequential value, and it is not associated with any interface. This field displays the name of the zone. This field displays the names of the interfaces that belong to each zone. This field displays the number of times an Object Reference is used in a policy. Remove References

#

Name Member Reference 35.1.2.1 Zone Edit The Zone Edit screen allows you to add or edit a zone. To access this screen, go to the Zone screen (see Section 35.8.2 on page 670), and click the Add icon or an Edit icon. Figure 408 Configuration > Object > Zone > Add The following table describes the labels in this screen. Table 245 Configuration > Object > Zone > Add/Edit LABEL Name DESCRIPTION For a system default zone, the name is read only. Member List For a user-configured zone, type the name used to refer to the zone. You may use 1-31 alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Available lists the interfaces and VPN tunnels that do not belong to any zone. Select the interfaces and VPN tunnels that you want to add to the zone you are editing, and click the right arrow button to add them. Member lists the interfaces and VPN tunnels that belong to the zone. Select any interfaces that you want to remove from the zone, and click the left arrow button to remove them. ZyWALL ATP Series Users Guide 616 Chapter 35 Object Table 245 Configuration > Object > Zone > Add/Edit (continued) LABEL OK Cancel DESCRIPTION Click OK to save your customized settings and exit this screen. Click Cancel to exit this screen without saving. 35.2 User/Group Overview This section describes how to set up user accounts, user groups, and user settings for the Zyxel Device. You can also set up rules that control when users have to log in to the Zyxel Device before the Zyxel Device routes traffic for them. The User screen (see Section 35.13.1 on page 713) provides a summary of all user accounts. The Group screen (see Section 35.2.3 on page 624) provides a summary of all user groups. In addition, this screen allows you to add, edit, and remove user groups. User groups may consist of access users and other user groups. You cannot put admin users in user groups. The Setting screen (see Section 35.2.4 on page 625) controls default settings, login settings, lockout settings, and other user settings for the Zyxel Device. You can also use this screen to specify when users must log in to the Zyxel Device before it routes traffic for them. The MAC Address screen (see Section 35.2.5 on page 630) allows you to configure the MAC addresses or OUI (Organizationally Unique Identifier) of wireless clients for MAC authentication using the local user database. The OUI is the first three octets in a MAC address and uniquely identifies the manufacturer of a network device. 35.2.1 What You Need To Know User Account A user account defines the privileges of a user logged into the Zyxel Device. User accounts are used in security policies and application patrol, in addition to controlling access to configuration and services in the Zyxel Device. User Types These are the types of user accounts the Zyxel Device uses. ABILITIES Table 246 Types of User Accounts TYPE Admin Users admin limited-admin LOGIN METHOD(S) Change Zyxel Device configuration (web, CLI) WWW, TELNET, SSH, FTP, Console Look at Zyxel Device configuration (web, CLI) WWW, TELNET, SSH, Console Perform basic diagnostics (CLI) Access Users user guest ext-user Access network services WWW, TELNET, SSH Browse user-mode commands (CLI) Access network services External user account WWW WWW ZyWALL ATP Series Users Guide 617 Chapter 35 Object Table 246 Types of User Accounts (continued) TYPE ext-group-user guest-manager dynamic-guest ABILITIES External group user account Create dynamic guest accounts Access network services LOGIN METHOD(S) WWW WWW Hotspot Portal Note: The default admin account is always authenticated locally, regardless of the authentication method setting. (See Chapter 35 on page 685 for more information about authentication methods.) Ext-User Accounts Set up an ext-user account if the user is authenticated by an external server and you want to set up specific policies for this user in the Zyxel Device. If you do not want to set up policies for this user, you do not have to set up an ext-user account. All ext-user users should be authenticated by an external server, such as AD, LDAP or RADIUS. If the Zyxel Device tries to use the local database to authenticate an ext-user, the authentication attempt always fails. (This is related to AAA servers and authentication methods, which are discussed in those chapters in this guide.) Note: If the Zyxel Device tries to authenticate an ext-user using the local database, the attempt always fails. Once an ext-user user has been authenticated, the Zyxel Device tries to get the user type (see Table 246 on page 617) from the external server. If the external server does not have the information, the Zyxel Device sets the user type for this session to User. For the rest of the user attributes, such as reauthentication time, the Zyxel Device checks the following places, in order. 1 2 User account in the remote server. User account (Ext-User) in the Zyxel Device. 3 Default user account for AD users (ad-users), LDAP users (ldap-users) or RADIUS users (radius-users) in the Zyxel Device. See Setting up User Attributes in an External Server for a list of attributes and how to set up the attributes in an external server. Ext-Group-User Accounts Ext-Group-User accounts work are similar to ext-user accounts but allow you to group users by the value of the group membership attribute configured for the AD or LDAP server. See Section 35.9.5.1 on page 679 for more on the group membership attribute. Dynamic-Guest Accounts Dynamic guest accounts are guest accounts, but are created dynamically and stored in the Zyxel Devices local user database. A dynamic guest account has a dynamically-created user name and ZyWALL ATP Series Users Guide 618 Chapter 35 Object password. A dynamic guest account user can access the Zyxel Devices services only within a given period of time and will become invalid after the expiration date/time. There are three types of dynamic guest accounts depending on how they are created or authenticated: billing-users, ua-users and trial-users. billing-users are guest account created with the guest manager account or an external printer and paid by cash or created and paid via the on-line payment service. ua-users are users that log in from the user agreement page. trial-users are free guest accounts that are created with the Free Time function. User Groups User groups may consist of user accounts or other user groups. Use user groups when you want to create the same rule for several user accounts, instead of creating separate rules for each one. Note: You cannot put access users and admin users in the same user group. Note: You cannot put the default admin account into any user group. The sequence of members in a user group is not important. User Awareness By default, users do not have to log into the Zyxel Device to use the network services it provides. The Zyxel Device automatically routes packets for everyone. If you want to restrict network services that certain users can use via the Zyxel Device, you can require them to log in to the Zyxel Device first. The Zyxel Device is then aware of the user who is logged in and you can create user-aware policies that define what services they can use. See Section 35.2.6 on page 632 for a user-aware login example. Finding Out More See Section 35.2.6 on page 632 for some information on users who use an external authentication server in order to log in. The Zyxel Device supports TTLS using PAP so you can use the Zyxel Devices local user database to authenticate users with WPA or WPA2 instead of needing an external RADIUS server. 35.2.2 User/Group User Summary Screen The User screen provides a summary of all user accounts. To access this screen, login to the Web Configurator, and click Configuration > Object > User/Group. ZyWALL ATP Series Users Guide 619 Chapter 35 Object Figure 409 Configuration > Object > User/Group > User The following table describes the labels in this screen. Table 247 Configuration > Object > User/Group > User LABEL Add Edit Remove References

#

User Name User Type DESCRIPTION Click this to create a new entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Select an entry and click References to open a screen that shows which settings use the entry. This field is a sequential value, and it is not associated with a specific user. This field displays the user name of each user. This field displays the types of user accounts the Zyxel Device uses:

admin - this user can look at and change the configuration of the Zyxel Device limited-admin - this user can look at the configuration of the Zyxel Device but not to dynamic-guest - this user has access to the Zyxel Devices services but cannot look at the user - this user has access to the Zyxel Devices services and can also browse user-mode guest - this user has access to the Zyxel Devices services but cannot look at the ext-user - this user account is maintained in a remote server, such as RADIUS or LDAP. See Ext-User Accounts on page 618 for more information about this type. ext-group-user - this user account is maintained in a remote server, such as RADIUS or LDAP. See Ext-Group-User Accounts on page 618 for more information about this type. guest-manager - this user can log in via the web configurator login screen and create dynamic guest accounts using the Account Generator screen that pops up. change it configuration. commands (CLI). configuration Description Reference This field displays the description for each user. This displays the number of times an object reference is used in a profile. 35.2.2.1 User Add/Edit Screen The User Add/Edit screen allows you to create a new user account or edit an existing one. 35.2.2.2 Rules for User Names Enter a user name from 1 to 31 characters. The user name can only contain the following characters:

Alphanumeric A-z 0-9 (there is no unicode support) ZyWALL ATP Series Users Guide 620 Chapter 35 Object _ [underscores]

- [dashes]

The first character must be alphabetical (A-Z a-z), an underscore (_), or a dash (-). Other limitations on user names are:

User names are case-sensitive. If you enter a user 'bob' but use 'BOB' when connecting via CIFS or FTP, it will use the account settings used for 'BOB' not bob. User names have to be different than user group names. Here are the reserved user names:

adm debug ldap-users operator sync admin any devicehaecived ftp lp radius-users uucp mail root zyxel bin games news shutdown daemon halt nobody sshd To access this screen, go to the User screen (see Section 35.13.1 on page 713), and click either the Add icon or an Edit icon. Figure 410 Configuration > Object > User/Group > User > Add ZyWALL ATP Series Users Guide 621 Chapter 35 Object The following table describes the labels in this screen. Table 248 Configuration > Object > User/Group > User > Add LABEL User Name User Type Password Retype Group Identifier Associated AAA Server Object Description Email Mobile Number DESCRIPTION Type the user name for this user account. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-

sensitive. User names have to be different than user group names, and some words are reserved. See Section 35.2.2.2 on page 620. This field displays the types of user accounts the Zyxel Device uses:

admin - this user can look at and change the configuration of the Zyxel Device limited-admin - this user can look at the configuration of the Zyxel Device but not to user - this user has access to the Zyxel Devices services and can also browse user-mode guest - this user has access to the Zyxel Devices services but cannot look at the change it commands (CLI). configuration. ext-user - this user account is maintained in a remote server, such as RADIUS or LDAP. See Ext-User Accounts on page 618 for more information about this type. ext-group-user - this user account is maintained in a remote server, such as RADIUS or LDAP. See Ext-Group-User Accounts on page 618 for more information about this type. This field is not available if you select the ext-user or ext-group-user type. Enter a password of from 1 to 64 characters for this user account. If you selected Enable Password Complexity in Configuration > Object > User/Group > Setting, it must consist of at least 8 characters and at most 64. At least 1 character must be a number, at least 1 a lower case letter, at least 1 an upper case letter and at least 1 a special character from the keyboard, such as !@#$%^&*()_+. This field is not available if you select the ext-user or ext-group-user type. This field is available for a ext-group-user type user account. Specify the value of the AD or LDAP servers Group Membership Attribute that identifies the group to which this user belongs. This field is available for a ext-group-user type user account. Select the AAA server to use to authenticate this accounts users. Enter the description of each user, if any. You can use up to 60 printable ASCII characters. Default descriptions are provided. Type one or more valid email addresses for this user so that email messages can be sent to this user if required. A valid email address must contain the @ character. For example, this is a valid email address: abc@example.com. Type a valid mobile telephone number for this user so that SMS messages can be sent to this user if required. A valid mobile telephone number can be up to 20 characters in length, including the numbers 1~9 and the following characters in the square brackets [+*#()-]. ZyWALL ATP Series Users Guide 622 Chapter 35 Object Table 248 Configuration > Object > User/Group > User > Add (continued) LABEL Send Code DESCRIPTION This button is available when the user type is admin or limited-admin. Click this and an authorization email or SMS message with a code of six digits will be sent to the email addresses or mobile telephone number you put in. Enter the verification code to verify your email addresses or mobile telephone number. Figure 411 Verification Code for Email Figure 412 Verification Code for Mobile Telephone Number Authentication Timeout Settings Lease Time Reauthentication Time User VLAN ID If you want the system to use default settings, select Use Default Settings. If you want to set authentication timeout to a value other than the default settings, select Use Manual Settings then fill your preferred values in the fields that follow. If you select Use Default Settings in the Authentication Timeout Settings field, the default lease time is shown. If you select Use Manual Settings, you need to enter the number of minutes this user has to renew the current session before the user is logged out. You can specify 1 to 1440 minutes. You can enter 0 to make the number of minutes unlimited. Admin users renew the session every time the main screen refreshes in the Web Configurator. Access users can renew the session by clicking the Renew button on their screen. If you allow access users to renew time automatically (see Section 35.2.4 on page 625), the users can select this check box on their screen as well. In this case, the session is automatically renewed before the lease time expires. If you select Use Default Settings in the Authentication Timeout Settings field, the default lease time is shown. If you select Use Manual Settings, you need to type the number of minutes this user can be logged into the Zyxel Device in one session before the user has to log in again. You can specify 1 to 1440 minutes. You can enter 0 to make the number of minutes unlimited. Unlike Lease Time, the user has no opportunity to renew the session without logging out. This field is available for a ext-group-user type user account. Select this option to enable dynamic VLAN assignment on the Zyxel Device. When a user is authenticated successfully, all data traffic from this user is tagged with the VLAN ID number you specify here. This allows you to assign a user of the ext-group-user type to a specific VLAN based on the user credentials instead of using an AAA server. ZyWALL ATP Series Users Guide 623 Chapter 35 Object Table 248 Configuration > Object > User/Group > User > Add (continued) LABEL Configuration Validation OK Cancel DESCRIPTION Use a user account from the group specified above to test if the configuration is correct. Enter the accounts user name in the User Name field and click Test. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. 35.2.3 User/Group Group Summary Screen User groups consist of access users and other user groups. You cannot put admin users in user groups. The Group screen provides a summary of all user groups. In addition, this screen allows you to add, edit, and remove user groups. To access this screen, login to the Web Configurator, and click Configuration >

Object > User/Group > Group. Figure 413 Configuration > Object > User/Group > Group The following table describes the labels in this screen. See Section 35.2.3.1 on page 624 for more information as well. Table 249 Configuration > Object > User/Group > Group LABEL Add Edit DESCRIPTION Click this to create a new entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Removing a group does not remove the user accounts in the group. Select an entry and click References to open a screen that shows which settings use the entry. This field is a sequential value, and it is not associated with a specific user group. This field displays the name of each user group. This field displays the description for each user group. This field lists the members in the user group. Each member is separated by a comma. This displays the number of times an object reference is used in a profile. Remove References

#

Group Name Description Member Reference 35.2.3.1 Group Add/Edit Screen The Group Add/Edit screen allows you to create a new user group or edit an existing one. To access this screen, go to the Group screen (see Section 35.2.3 on page 624), and click either the Add icon or an Edit icon. ZyWALL ATP Series Users Guide 624 Chapter 35 Object Figure 414 Configuration > Object > User/Group > Group > Add The following table describes the labels in this screen. Table 250 Configuration > Object > User/Group > Group > Add LABEL Name DESCRIPTION Type the name for this user group. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-

sensitive. User group names have to be different than user names. Enter the description of the user group, if any. You can use up to 60 characters, punctuation marks, and spaces. The Member list displays the names of the users and user groups that have been added to the user group. The order of members is not important. Select users and groups from the Available list that you want to be members of this group and move them to the Member list. You can double-click a single entry to move it or use the [Shift] or [Ctrl] key to select multiple entries and use the arrow button to move them. Move any members you do not want included to the Available list. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. Description Member List OK Cancel 35.2.4 User/Group Setting Screen The Setting screen controls default settings, login settings, lockout settings, and other user settings for the Zyxel Device. You can also use this screen to specify when users must log in to the Zyxel Device before it routes traffic for them. To access this screen, login to the Web Configurator, and click Configuration > Object > User/Group >

Setting. ZyWALL ATP Series Users Guide 625 Chapter 35 Object Figure 415 Configuration > Object > User/Group > Setting The following table describes the labels in this screen. Table 251 Configuration > Object > User/Group > Setting LABEL User Authentication Timeout Settings Default Authentication Timeout Settings DESCRIPTION Edit These authentication timeout settings are used by default when you create a new user account. They also control the settings for any existing user accounts that are set to use the default settings. You can still manually configure any user accounts authentication timeout settings. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. ZyWALL ATP Series Users Guide 626 Chapter 35 Object Table 251 Configuration > Object > User/Group > Setting (continued) LABEL

#

DESCRIPTION This field is a sequential value, and it is not associated with a specific entry. These are the kinds of user account the Zyxel Device supports. admin - this user can look at and change the configuration of the Zyxel User Type Lease Time Reauthentication Time Miscellaneous Settings Allow renewing lease time automatically Enable user idle detection User idle timeout Login Security Password must changed every (days):

Password reset link (FQDN/

IP):

Enable Password Complexity limited-admin - this user can look at the configuration of the Zyxel Device user - this user has access to the Zyxel Devices services but cannot look at guest - this user has access to the Zyxel Devices services but cannot look Device but not to change it the configuration at the configuration ext-user - this user account is maintained in a remote server, such as RADIUS or LDAP. See Ext-User Accounts on page 618 for more information about this type. ext-group-user - this user account is maintained in a remote server, such as RADIUS or LDAP. See Ext-Group-User Accounts on page 618 for more information about this type. This is the default lease time in minutes for each type of user account. It defines the number of minutes the user has to renew the current session before the user is logged out. Admin users renew the session every time the main screen refreshes in the Web Configurator. Access users can renew the session by clicking the Renew button on their screen. If you allow access users to renew time automatically (see Section 35.2.4 on page 625), the users can select this check box on their screen as well. In this case, the session is automatically renewed before the lease time expires. This is the default reauthentication time in minutes for each type of user account. It defines the number of minutes the user can be logged into the Zyxel Device in one session before having to log in again. Unlike Lease Time, the user has no opportunity to renew the session without logging out. Select this check box if access users can renew lease time automatically, as well as manually, simply by selecting the Updating lease time automatically check box on their screen. This is applicable for access users. Select this check box if you want the Zyxel Device to monitor how long each access user is logged in and idle (in other words, there is no traffic for this access user). The Zyxel Device automatically logs out the access user once the User idle timeout has been reached. This is applicable for access users. This field is effective when Enable user idle detection is checked. Type the number of minutes each access user can be logged in and idle before the Zyxel Device automatically logs out the access user. Enter how often users must change their password when they log into the Zyxel Device. You can choose from once a day to once a year. Associate the password expiration to a specific Zyxel Device. Default is this Zyxel Device (myrouter) or select Custom and enter the IP address or Fully Qualified Domain Name (FQDN). Select this to enforce the following conditions in a user password. Requiring a strong password is good for security. The conditions are that the password must consist of at least 8 characters and at most 64. At least 1 character must be a number, at least 1 a lower case letter, at least 1 an upper case letter and at least 1 a special character from the keyboard, such as !@#$%^&*()_+. ZyWALL ATP Series Users Guide 627 Chapter 35 Object Table 251 Configuration > Object > User/Group > Setting (continued) LABEL User Logon Settings DESCRIPTION Limit the number of simultaneous logons for administration account Maximum number per administration account Limit the number of simultaneous logons for access account Maximum number per access account User Lockout Settings Enable logon retry limit Maximum retry count Lockout period Apply Reset Select this check box if you want to set a limit on the number of simultaneous logins by admin users. If you do not select this, admin users can login as many times as they want at the same time using the same or different IP addresses. This field is effective when Limit ... for administration account is checked. Type the maximum number of simultaneous logins by each admin user. Select this check box if you want to set a limit on the number of simultaneous logins by non-admin users. If you do not select this, access users can login as many times as they want as long as they use different IP addresses. This field is effective when Limit ... for access account is checked. Type the maximum number of simultaneous logins by each access user. Select this check box to set a limit on the number of times each user can login unsuccessfully (for example, wrong password) before the IP address is locked out for a specified amount of time. This field is effective when Enable logon retry limit is checked. Type the maximum number of times each user can login unsuccessfully before the IP address is locked out for the specified lockout period. The number must be between 1 and 99. This field is effective when Enable logon retry limit is checked. Type the number of minutes the user must wait to try to login again, if logon retry limit is enabled and the maximum retry count is reached. This number must be between 1 and 65,535 (about 45.5 days). Click Apply to save the changes. Click Reset to return the screen to its last-saved settings. 35.2.4.1 Default User Authentication Timeout Settings Edit Screens The Default Authentication Timeout Settings Edit screen allows you to set the default authentication timeout settings for the selected type of user account. These default authentication timeout settings also control the settings for any existing user accounts that are set to use the default settings. You can still manually configure any user accounts authentication timeout settings. To access this screen, go to the Configuration > Object > User/Group > Setting screen (see Section 35.2.4 on page 625), and click one of the Default Authentication Timeout Settings sections Edit icons. Figure 416 Configuration > Object > User/Group > Setting > Edit ZyWALL ATP Series Users Guide 628 Chapter 35 Object The following table describes the labels in this screen. Table 252 Configuration > Object > User/Group > Setting > Edit LABEL User Type DESCRIPTION This read-only field identifies the type of user account for which you are configuring the default settings. admin - this user can look at and change the configuration of the Zyxel Device limited-admin - this user can look at the configuration of the Zyxel Device but not to dynamic-guest - this user has access to the Zyxel Devices services but cannot look at user - this user has access to the Zyxel Devices services but cannot look at the guest - this user has access to the Zyxel Devices services but cannot look at the change it. the configuration. configuration. configuration. ext-user - this user account is maintained in a remote server, such as RADIUS or LDAP. See Ext-User Accounts on page 618 for more information about this type. ext-group-user - this user account is maintained in a remote server, such as RADIUS or LDAP. See Ext-Group-User Accounts on page 618 for more information about this type. guest-manager - this user can log in via the web configurator login screen and create dynamic guest accounts using the Account Generator screen that pops up. Lease Time Enter the number of minutes this type of user account has to renew the current session before the user is logged out. You can specify 1 to 1440 minutes. You can enter 0 to make the number of minutes unlimited. Admin users renew the session every time the main screen refreshes in the Web Configurator. Access users can renew the session by clicking the Renew button on their screen. If you allow access users to renew time automatically (see Section 35.2.4 on page 625), the users can select this check box on their screen as well. In this case, the session is automatically renewed before the lease time expires. Type the number of minutes this type of user account can be logged into the Zyxel Device in one session before the user has to log in again. You can specify 1 to 1440 minutes. You can enter 0 to make the number of minutes unlimited. Unlike Lease Time, the user has no opportunity to renew the session without logging out. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. Reauthentication Time OK Cancel 35.2.4.2 User Aware Login Example Access users cannot use the Web Configurator to browse the configuration of the Zyxel Device. Instead, after access users log into the Zyxel Device, the following screen appears. ZyWALL ATP Series Users Guide 629 Chapter 35 Object Figure 417 Web Configurator for Non-Admin Users The following table describes the labels in this screen. Table 253 Web Configurator for Non-Admin Users LABEL User-defined lease time (max

... minutes) Renew DESCRIPTION Access users can specify a lease time shorter than or equal to the one that you specified. The default value is the lease time that you specified. Access users can click this button to reset the lease time, the amount of time remaining before the Zyxel Device automatically logs them out. The Zyxel Device sets this amount of time according to the:

User-defined lease time field in this screen Lease time field in the User Add/Edit screen (see Section 35.2.5.1 on page 631) Lease time field in the Setting screen (see Section 35.2.4 on page 625). This box appears if you checked the Allow renewing lease time automatically box in the Setting screen. (See Section 35.2.4 on page 625.) Access users can select this check box to reset the lease time automatically 30 seconds before it expires. Otherwise, access users have to click the Renew button to reset the lease time. This field displays the amount of lease time that remains, though the user might be able to reset it. This field displays the amount of time that remains before the Zyxel Device automatically logs the access user out, regardless of the lease time. Updating lease time automatically Remaining time before lease timeout Remaining time before auth. timeout 35.2.5 User/Group MAC Address Summary Screen This screen shows the MAC addresses of wireless clients, which can be authenticated by their MAC addresses using the local user database. Click Configuration > Object > User/Group > MAC Address to open this screen. Note: You need to configure an SSID security profiles MAC authentication settings to have the AP use the Zyxel Devices local database to authenticate wireless clients by their MAC addresses. ZyWALL ATP Series Users Guide 630 Chapter 35 Object Figure 418 Configuration > Object > User/Group > MAC Address The following table describes the labels in this screen. Table 254 Configuration > Object > User/Group > MAC Address LABEL Add Edit DESCRIPTION Click this to create a new entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. This field displays the MAC address or OUI (Organizationally Unique Identifier of computer hardware manufacturers) of wireless clients using MAC authentication with the Zyxel Device local user database. This field displays a description of the device identified by the MAC address or OUI. Remove MAC Address/

OUI Description 35.2.5.1 MAC Address Add/Edit Screen This screen allows you to create a new allowed device or edit an existing one. To access this screen, go to the MAC Address screen (see Section 35.2.5 on page 630), and click either the Add icon or an Edit icon. Figure 419 Configuration > Object > User/Group > MAC Address > Add The following table describes the labels in this screen. Table 255 Configuration > Object > User/Group > MAC Address > Add LABEL MAC Address/

OUI DESCRIPTION Type the MAC address (six hexadecimal number pairs separated by colons or hyphens) or OUI

(three hexadecimal number pairs separated by colons or hyphens) to identify specific wireless clients for MAC authentication using the Zyxel Device local user database. The OUI is the first three octets in a MAC address and uniquely identifies the manufacturer of a network device. Enter an optional description of the wireless device(s) identified by the MAC or OUI. You can use up to 60 characters, punctuation marks, and spaces. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. Description OK Cancel ZyWALL ATP Series Users Guide 631 Chapter 35 Object 35.2.6 User /Group Technical Reference This section provides some information on users who use an external authentication server in order to log in. Setting up User Attributes in an External Server To set up user attributes, such as reauthentication time, in LDAP or RADIUS servers, use the following keywords in the user configuration file. Table 256 LDAP/RADIUS: Keywords for User Attributes KEYWORD type leaseTime reauthTime CORRESPONDING ATTRIBUTE IN WEB CONFIGURATOR User Type. Possible Values: admin, limited-admin, dynamic-guest, user, guest. Lease Time. Possible Values: 1-1440 (minutes). Reauthentication Time. Possible Values: 1-1440 (minutes). The following examples show you how you might set up user attributes in LDAP and RADIUS servers. Figure 420 LDAP Example: Keywords for User Attributes type: admin leaseTime: 99 reauthTime: 199 Figure 421 RADIUS Example: Keywords for User Attributes type=user;leaseTime=222;reauthTime=222 Creating a Large Number of Ext-User Accounts If you plan to create a large number of Ext-User accounts, you might use CLI commands, instead of the Web Configurator, to create the accounts. Extract the user names from the LDAP or RADIUS server, and create a shell script that creates the user accounts. 35.3 AP Profile Overview This section shows you how to configure preset profiles for the Access Points (APs) connected to your Zyxel Devices wireless network. The Radio screen (Section 35.3.1 on page 633) creates radio configurations that can be used by the APs. The SSID screen (Section 35.3.2 on page 639) configures three different types of profiles for your networked APs. 35.3.0.1 What You Need To Know The following terms and concepts may help as you read this section. ZyWALL ATP Series Users Guide 632 Chapter 35 Object Wireless Profiles At the heart of all wireless AP configurations on the Zyxel Device are profiles. A profile represents a group of saved settings that you can use across any number of connected APs. You can set up the following wireless profile types:

Radio - This profile type defines the properties of an APs radio transmitter. You can have a maximum of 32 radio profiles on the Zyxel Device. SSID - This profile type defines the properties of a single wireless network signal broadcast by an AP. Each radio on a single AP can broadcast up to 8 SSIDs. You can have a maximum of 32 SSID profiles on the Zyxel Device. Security - This profile type defines the security settings used by a single SSID. It controls the encryption method required for a wireless client to associate itself with the SSID. You can have a maximum of 32 security profiles on the Zyxel Device. MAC Filtering - This profile provides an additional layer of security for an SSID, allowing you to block access or allow access to that SSID based on wireless client MAC addresses. If a clients MAC address is on the list, then it is either allowed or denied, depending on how you set up the MAC Filter profile. You can have a maximum of 32 MAC filtering profiles on the Zyxel Device. SSID The SSID (Service Set IDentifier) is the name that identifies the Service Set with which a wireless station is associated. Wireless stations associating to the access point (AP) must have the same SSID. In other words, it is the name of the wireless network that clients use to connect to it. WEP WEP (Wired Equivalent Privacy) encryption scrambles all data packets transmitted between the AP and the wireless stations associated with it in order to keep network communications private. Both the wireless stations and the access points must use the same WEP key for data encryption and decryption. WPA and WPA2 Wi-Fi Protected Access (WPA) is a subset of the IEEE 802.11i standard. WPA2 (IEEE 802.11i) is a wireless security standard that defines stronger encryption, authentication and key management than WPA. Key differences between WPA(2) and WEP are improved data encryption and user authentication. IEEE 802.1x The IEEE 802.1x standard outlines enhanced security methods for both the authentication of wireless stations and encryption key management. Authentication is done using an external RADIUS server. 35.3.1 Radio Screen This screen allows you to create radio profiles for the APs on your network. A radio profile is a list of settings that a supported managed AP (NWA5121-N for example) can use to configure either one of its two radio transmitters. To access this screen click Configuration > Object > AP Profile. Note: You can have a maximum of 32 radio profiles on the Zyxel Device. ZyWALL ATP Series Users Guide 633 Chapter 35 Object Figure 422 Configuration > Object > AP Profile > Radio The following table describes the labels in this screen. Table 257 Configuration > Object > AP Profile > Radio LABEL Add Edit Remove Activate Inactivate References

#

Status Profile Name Frequency Band Schedule Apply Reset DESCRIPTION Click this to add a new radio profile. Click this to edit the selected radio profile. Click this to remove the selected radio profile. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. Click this to view which other objects are linked to the selected radio profile. This field is a sequential value, and it is not associated with a specific profile. This icon is lit when the entry is active and dimmed when the entry is inactive. This field indicates the name assigned to the radio profile. This field indicates the frequency band which this radio profile is configured to use. This field displays the schedule object which defines when this radio profile can be used. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. ZyWALL ATP Series Users Guide 634 Chapter 35 Object 35.3.1.1 Add/Edit Radio Profile This screen allows you to create a new radio profile or edit an existing one. To access this screen, click the Add button or select a radio profile from the list and click the Edit button. Figure 423 Configuration > Object > AP Profile > Add/Edit Radio Profile The following table describes the labels in this screen. Table 258 Configuration > Object > AP Profile > Add/Edit Radio Profile LABEL Hide / Show Advanced Settings Create New Object General Settings DESCRIPTION Click this to hide or show the Advanced Settings in this window. Use this to configure any new settings objects that you need to use in this screen. Activate Profile Name Schedule 802.11 Band Select this option to make this profile active. Enter up to 31 alphanumeric characters to be used as this profiles name. Spaces and underscores are allowed. This field displays the schedule object which defines when this radio profile can be used. Select how to let wireless clients connect to the AP. 11b/g: allows either IEEE 802.11b or IEEE 802.11g compliant WLAN devices to associate with the AP. The AP adjusts the transmission rate automatically according to the wireless standard supported by the wireless devices. 11b/g/n: allows IEEE802.11b, IEEE802.11g and IEEE802.11n compliant WLAN devices to associate with the AP. The transmission rate of your AP might be reduced. 11a: allows only IEEE 802.11a compliant WLAN devices to associate with the AP. 11a/n: allows both IEEE802.11n and IEEE802.11a compliant WLAN devices to associate with the AP. The transmission rate of your AP might be reduced. 11ac: allows only IEEE802.11ac compliant WLAN devices to associate with the AP. Note: If you select 11ac but the WLAN devices in the network do not support IEEE 802.11ac, the Zyxel Device automatically sets the AP to use 11a/n. ZyWALL ATP Series Users Guide 635 Chapter 35 Object Table 258 Configuration > Object > AP Profile > Add/Edit Radio Profile (continued) LABEL DESCRIPTION Select the wireless channel bandwidth you want the AP to use. Channel Width Channel Selection Enable DCS Client Aware 2.4 GHz Channel Selection Method Channel ID Time Interval DCS Time Interval Schedule A standard 20 MHz channel offers transfer speeds of up to 144Mbps (2.4GHz) or 217Mbps

(5GHZ) whereas a 40MHz channel uses two standard channels and offers speeds of up to 300Mbps (2.4GHz) or 450Mbps (5GHZ). An IEEE 802.11ac-specific 80MHz channel offers speeds of up to 1.3Gbps. 40 MHz (channel bonding or dual channel) bonds two adjacent radio channels to increase throughput. A 80 MHz channel consists of two adjacent 40 MHz channels. The wireless clients must also support 40 MHz or 80 MHz. It is often better to use the 20 MHz setting in a location where the environment hinders the wireless signal. Because not all devices support 40 MHz and/or 80 MHz channels, select 20/40MHz or 20/

40/80MHz to allow the AP to adjust the channel bandwidth automatically. Select 20MHz if you want to lessen radio interference with other wireless devices in your neighborhood or the wireless clients do not support channel bonding. Note: If the environment has poor signal-to-noise (SNR), the Zyxel Device will switch to a lower bandwidth. Select the wireless channel which this radio profile should use. It is recommended that you choose the channel least in use by other APs in the region where this profile will be implemented. This will reduce the amount of interference between wireless clients and the AP to which this profile is assigned. Select DCS to have the AP automatically select the radio channel upon which it broadcasts by scanning the area around it and determining what channels are currently being used by other devices. Select Manual and specify the channels the AP uses. This field is available when you set Channel Selection to DCS. Select this to have the AP wait until all connected clients have disconnected before switching channels. If you disable this then the AP switches channels immediately regardless of any client connections. In this instance, clients that are connected to the AP when it switches channels are dropped. This field is available when you set Channel Selection to DCS. Select auto to have the AP search for available channels automatically in the 2.4 GHz band. The available channels vary depending on what you select in the 2.4 GHz Channel Deployment field. Select manual and specify the channels the AP uses in the 2.4 GHz band. This field is available only when you set Channel Selection to DCS and set 2.4 GHz Channel Selection Method to manual. Select the check boxes of the channels that you want the AP to use. Select this option to have the AP survey the other APs within its broadcast radius at the end of the specified time interval. This field is available when you set Channel Selection to DCS. Enter a number of minutes. This regulates how often the AP surveys the other APs within its broadcast radius. If the channel on which it is currently broadcasting suddenly comes into use by another AP, the AP will then dynamically select the next available clean channel or a channel with lower interference. Select this option to have the AP survey the other APs within its broadcast radius at a specific time on selected days of the week. ZyWALL ATP Series Users Guide 636 Chapter 35 Object Table 258 Configuration > Object > AP Profile > Add/Edit Radio Profile (continued) LABEL Start Time Week Days 2.4 GHz Channel Deployment DESCRIPTION Specify the time of the day (in 24-hour format) to have the AP use DCS to automatically scan and find a less-used channel. Select each day of the week to have the AP use DCS to automatically scan and find a less-

used channel. This field is available only when you set Channel Selection to DCS and set 2.4 GHz Channel Selection Method to auto. Select Three-Channel Deployment to limit channel switching to channels 1,6, and 11, the three channels that are sufficiently attenuated to have almost no impact on one another. In other words, this allows you to minimize channel interference by limiting channel-

hopping to these three safe channels. Select Four-Channel Deployment to limit channel switching to four channels. Depending on the country domain, if the only allowable channels are 1-11 then the Zyxel Device uses channels 1, 4, 7, 11 in this configuration; otherwise, the Zyxel Device uses channels 1, 5, 9, 13 in this configuration. Four channel deployment expands your pool of possible channels while keeping the channel interference to a minimum. Enable 5 GHz DFS Aware 5 GHz Channel Selection Method Advanced Settings Country Code Note: For US and Canada models, country code is fixed to US or Canada respectively and is not user selectable. This field is available only when you select 11a, 11a/n or 11ac in the 802.11 Band field. Select this if your APs are operating in an area known to have RADAR devices. This allows the device to downgrade its frequency to below 5 GHz in the event a RADAR signal is detected, thus preventing it from interfering with that signal. Enabling this forces the AP to select a non-DFS channel. This shows auto and allows the AP to search for available channels automatically in the 5 GHz band. Select the country code of APs that are connected to the Zyxel Device to be the same as where the Zyxel Device is located/installed. The available channels vary depending on the country you select. Be sure to select the correct/same country for both radios on an AP and all connected APs, in order to prevent roaming failure and interference to other systems. Note: For US and Canada models, country code is fixed to US or Canada respectively and is not user selectable. Guard Interval This field is available only when the channel width is 20/40MHz or 20/40/80MHz. Set the guard interval for this radio profile to either Short or Long. The guard interval is the gap introduced between data transmission from users in order to reduce interference. Reducing the interval increases data transfer rates but also increases interference. Increasing the interval reduces data transfer rates but also reduces interference. Select this to enable A-MPDU aggregation. Message Protocol Data Unit (MPDU) aggregation collects Ethernet frames along with their 802.11n headers and wraps them in a 802.11n MAC header. This method is useful for increasing bandwidth throughput in environments that are prone to high error rates. Enter the maximum frame size to be aggregated. Enter the maximum number of frames to be aggregated each time. Enable A-MPDU Aggregation A-MPDU Limit A-MPDU Subframe ZyWALL ATP Series Users Guide 637 Chapter 35 Object Table 258 Configuration > Object > AP Profile > Add/Edit Radio Profile (continued) LABEL DESCRIPTION Select this to enable A-MSDU aggregation. Enable A-MSDU Aggregation Mac Service Data Unit (MSDU) aggregation collects Ethernet frames without any of their 802.11n headers and wraps the header-less payload in a single 802.11n MAC header. This method is useful for increasing bandwidth throughput. It is also more efficient than A-MPDU except in environments that are prone to high error rates. Enter the maximum frame size to be aggregated. A-MSDU Limit RTS/CTS Threshold Use RTS/CTS to reduce data collisions on the wireless network if you have wireless clients that are associated with the same AP but out of range of one another. When enabled, a wireless client sends an RTS (Request To Send) and then waits for a CTS (Clear To Send) before it transmits. This stops wireless clients from transmitting packets at the same time

(and causing data collisions). A wireless client sends an RTS for all packets larger than the number (of bytes) that you enter here. Set the RTS/CTS equal to or higher than the fragmentation threshold to turn RTS/

CTS off. When a wirelessly networked device sends a beacon, it includes with it a beacon interval. This specifies the time period before the device sends the beacon again. The interval tells receiving devices on the network how long they can wait in low-power mode before waking up to handle the beacon. A high value helps save current consumption of the access point. Delivery Traffic Indication Message (DTIM) is the time period after which broadcast and multicast packets are transmitted to mobile clients in the Active Power Management mode. A high DTIM value can cause clients to lose connectivity with the network. This value can be set from 1 to 255. Select the check box to use the signal threshold to ensure wireless clients receive good throughput. This allows only wireless clients with a strong signal to connect to the AP. Clear the check box to not require wireless clients to have a minimum signal strength to connect to the AP. Set a minimum client signal strength. A wireless client is allowed to connect to the AP only when its signal strength is stronger than the specified threshold. Beacon Interval DTIM Enable Signal Threshold Station Signal Threshold Disassociate Station Threshold

-20 dBm is the strongest signal you can require and -76 is the weakest. Set a minimum kick-off signal strength. When a wireless clients signal strength is lower than the specified threshold, the Zyxel Device disconnects the wireless client from the AP. Allow Station Connection after Multiple Retries Station Retry Count Multicast Settings Transmission Mode Multicast Rate

(Mbps)

-20 dBm is the strongest signal you can require and -90 is the weakest. Select this option to allow a wireless client to try to associate with the AP again after it is disconnected due to weak signal strength. Set the maximum number of times a wireless client can attempt to re-connect to the AP Use this section to set a transmission mode and maximum rate for multicast traffic. Set how the AP handles multicast traffic. Select Multicast to Unicast to broadcast wireless multicast traffic to all of the wireless clients as unicast traffic. Unicast traffic dynamically changes the data rate based on the applications bandwidth requirements. The retransmit mechanism of unicast traffic provides more reliable transmission of the multicast traffic, although it also produces duplicate packets. Select Fixed Multicast Rate to send wireless multicast traffic at a single data rate. You must know the multicast applications bandwidth requirements and set it in the following field. If you set the multicast transmission mode to fixed multicast rate, set the data rate for multicast traffic here. For example, to deploy 4 Mbps video, select a fixed multicast rate higher than 4 Mbps. ZyWALL ATP Series Users Guide 638 Chapter 35 Object Table 258 Configuration > Object > AP Profile > Add/Edit Radio Profile (continued) LABEL OK Cancel DESCRIPTION Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. 35.3.2 SSID Screen The SSID screens allow you to configure three different types of profiles for your networked APs: an SSID list, which can assign specific SSID configurations to your APs; a security list, which can assign specific encryption methods to the APs when allowing wireless clients to connect to them; and a MAC filter list, which can limit connections to an AP based on wireless clients MAC addresses. 35.3.2.1 SSID List This screen allows you to create and manage SSID configurations that can be used by the APs. An SSID, or Service Set IDentifier, is basically the name of the wireless network to which a wireless client can connect. The SSID appears as readable text to any device capable of scanning for wireless frequencies

(such as the WiFi adapter in a laptop), and is displayed as the wireless network name when a person makes a connection to it. To access this screen click Configuration > Object > AP Profile > SSID. Note: You can have a maximum of 32 SSID profiles on the Zyxel Device. Figure 424 Configuration > Object > AP Profile > SSID List The following table describes the labels in this screen. Table 259 Configuration > Object > AP Profile > SSID List LABEL Add Edit Remove References DESCRIPTION Click this to add a new SSID profile. Click this to edit the selected SSID profile. Click this to remove the selected SSID profile. Click this to view which other objects are linked to the selected SSID profile (for example, radio profile). This field is a sequential value, and it is not associated with a specific profile. This field indicates the name assigned to the SSID profile. This field indicates the SSID name as it appears to wireless clients. This field indicates which (if any) security profile is associated with the SSID profile. This field indicates the QoS type associated with the SSID profile.

#

Profile Name SSID Security Profile QoS ZyWALL ATP Series Users Guide 639 Chapter 35 Object Table 259 Configuration > Object > AP Profile > SSID List (continued) LABEL MAC Filtering Profile VLAN ID DESCRIPTION This field indicates which (if any) MAC Filter Profile is associated with the SSID profile. This field indicates the VLAN ID associated with the SSID profile. 35.3.2.2 Add/Edit SSID Profile This screen allows you to create a new SSID profile or edit an existing one. To access this screen, click the Add button or select an SSID profile from the list and click the Edit button. Figure 425 Configuration > Object > AP Profile > SSID > Add/Edit SSID Profile The following table describes the labels in this screen. Table 260 Configuration > Object > AP Profile > SSID > Add/Edit SSID Profile LABEL Create new Object Profile Name DESCRIPTION Select an object type from the list to create a new one associated with this SSID profile. Enter up to 31 alphanumeric characters for the profile name. This name is only visible in the Web Configurator and is only for management purposes. Spaces and underscores are allowed. Enter the SSID name for this profile. This is the name visible on the network to wireless clients. Enter up to 32 characters, spaces and underscores are allowed. Select a security profile from this list to associate with this SSID. If none exist, you can use the Create new Object menu to create one. SSID Security Profile Note: It is highly recommended that you create security profiles for all of your SSIDs to enhance your network security. ZyWALL ATP Series Users Guide 640 Chapter 35 Object Table 260 Configuration > Object > AP Profile > SSID > Add/Edit SSID Profile (continued) LABEL MAC Filtering Profile DESCRIPTION Select a MAC filtering profile from the list to associate with this SSID. If none exist, you can use the Create new Object menu to create one. MAC filtering allows you to limit the wireless clients connecting to your network through a particular SSID by wireless client MAC addresses. Any clients that have MAC addresses not in the MAC filtering profile of allowed addresses are denied connections. The disable setting means no MAC filtering is used. Select a Quality of Service (QoS) access category to associate with this SSID. Access categories minimize the delay of data packets across a wireless network. Certain categories, such as video or voice, are given a higher priority due to the time sensitive nature of their data packets. QoS access categories are as follows:

disable: Turns off QoS for this SSID. All data packets are treated equally and not tagged with access categories. WMM: Enables automatic tagging of data packets. The Zyxel Device assigns access categories to the SSID by examining data as it passes through it and making a best guess effort. If something looks like video traffic, for instance, it is tagged as such. WMM_VOICE: All wireless traffic to the SSID is tagged as voice data. This is recommended if an SSID is used for activities like placing and receiving VoIP phone calls. WMM_VIDEO: All wireless traffic to the SSID is tagged as video data. This is recommended for activities like video conferencing. WMM_BEST_EFFORT: All wireless traffic to the SSID is tagged as best effort, meaning the data travels the best route it can without displacing higher priority traffic. This is good for activities that do not require the best bandwidth throughput, such as surfing the Internet. WMM_BACKGROUND: All wireless traffic to the SSID is tagged as low priority or background traffic, meaning all other access categories take precedence over this one. If traffic from an SSID does not have strict throughput requirements, then this access category is recommended. For example, an SSID that only has network printers connected to it. Define the maximum incoming and outgoing transmission data rate per wireless station Define the maximum incoming transmission data rate (either in Mbps or Kbps) on a per-station basis. Define the maximum outgoing transmission data rate (either in Mbps or Kbps) on a per-station basis. To improve network performance and avoid interference in the 2.4 GHz frequency band, you can enable this feature to use the 5 GHz band first. You should set 2.4GHz and 5 GHz radio profiles to use the same SSID and security settings. Select standard to have the AP try to connect the wireless clients to the same SSID using the 5 GHZ band. Connections to an SSID using the 2.4GHz band are still allowed. Otherwise, select disable to turn off this feature. This field is not available when you disable Band Select. Select this option and set the threshold number of the connected wireless clients at which the Zyxel Device disables the band select feature. QoS Rate Limiting (Per Station Traffic Rate) Downlink:

Uplink:

Band Select:

Stop Threshold Balance Ratio This field is not available when you disable Band Select. Select this option and set a ratio of the wireless clients using the 5 GHz band to the wireless clients using the 2.4 GHz band. Forwarding Mode Select a forwarding mode (Tunnel or Local bridge) for traffic from this SSID. ZyWALL ATP Series Users Guide 641 Chapter 35 Object Table 260 Configuration > Object > AP Profile > SSID > Add/Edit SSID Profile (continued) LABEL VLAN ID DESCRIPTION If you selected Local Bridge forwarding mode, enter the VLAN ID that will be used to tag all traffic originating from this SSID if the VLAN is different from the native VLAN. All the wireless stations traffic goes through the associated APs gateway. If you selected the Tunnel forwarding mode, select a VLAN interface. All the wireless stations traffic is forwarded to the Zyxel Device first. Select this if you want to hide your SSID from wireless clients. This tells any wireless clients in the vicinity of the AP using this SSID profile not to display its SSID name as a potential connection. Not all wireless clients respect this flag and display it anyway. When an SSID is hidden and a wireless client cannot see it, the only way you can connect to the SSID is by manually entering the SSID name in your wireless connection setup screen(s)

(these vary by client, client connectivity software, and operating system). Select this option to prevent crossover traffic from within the same SSID. Select this option and set whether the SSID is enabled or disabled on each day of the week. You also need to select the hour and minute (in 24-hour format) to specify the time period of each day during which the SSID is enabled/enabled. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. VLAN Interface Hidden SSID Enable Intra-BSS Traffic Blocking Schedule SSID OK Cancel 35.3.2.3 Security List This screen allows you to manage wireless security configurations that can be used by your SSIDs. Wireless security is implemented strictly between the AP broadcasting the SSID and the stations that are connected to it. To access this screen click Configuration > Object > AP Profile > SSID > Security List. Note: You can have a maximum of 32 security profiles on the Zyxel Device. Figure 426 Configuration > Object > AP Profile > SSID > Security List The following table describes the labels in this screen. Table 261 Configuration > Object > AP Profile > SSID > Security List LABEL Add Edit Remove DESCRIPTION Click this to add a new security profile. Click this to edit the selected security profile. Click this to remove the selected security profile. ZyWALL ATP Series Users Guide 642 Chapter 35 Object Table 261 Configuration > Object > AP Profile > SSID > Security List (continued) LABEL References DESCRIPTION Click this to view which other objects are linked to the selected security profile (for example, SSID profile). This field is a sequential value, and it is not associated with a specific profile. This field indicates the name assigned to the security profile. This field indicates this profiles security mode (if any).

#

Profile Name Security Mode ZyWALL ATP Series Users Guide 643 Chapter 35 Object 35.3.2.4 Add/Edit Security Profile This screen allows you to create a new security profile or edit an existing one. To access this screen, click the Add button or select a security profile from the list and click the Edit button. Note: This screens options change based on the Security Mode selected. Only the default screen is displayed here. Figure 427 Configuration > Object > AP Profile > SSID > Security Profile > Add/Edit Security Profile ZyWALL ATP Series Users Guide 644 Chapter 35 Object The following table describes the labels in this screen. Table 262 Configuration > Object > AP Profile > SSID > Security Profile > Add/Edit Security Profile LABEL Profile Name DESCRIPTION Enter up to 31 alphanumeric characters for the profile name. This name is only visible in the Web Configurator and is only for management purposes. Spaces and underscores are allowed. Select a security mode from the list: none, wep, wpa2, or wpa2-mix. IEEE 802.11r fast roaming, which is also known as Fast BSS Transition (FT), allows wireless clients to quickly move from one AP to another in a WiFi network that uses WPA2 with 802.1x authentication. Information from the original association is passed to the target AP when the client roams. The client doesnt need to perform the whole 802.1x authentication process. Messages exchanged between the target AP and client are reduced and performed using one of the two methods:

Security Mode Fast Roaming Settings 802.11r Radius Server Type Primary / Secondary Radius Server Activate Radius Server IP Address Radius Server Port Radius Server Secret Primary / Secondary Accounting Server Activate Accounting Server IP Address Accounting Server Port Accounting Share Secret Accounting Interim Update Interim Interval Over-the-DS: The wireless client communicates with the target AP via the current AP. The communication is sent to the target AP through the wired Ethernet connection. Over-the-Air: The wireless client communicates directly with the target AP. Select this to turn on IEEE 802.11r fast roaming on the AP (Zyxel Device). This is good for wireless clients that transport a lot of real-time interactive traffic, such as voice and video. Wireless clients should also support WPA2 and fast roaming to associate with the AP (Zyxel Device) and roam seamlessly. Select Internal to use the Zyxel Devices internal authentication database, or External to use an external RADIUS server for authentication. Select this to have the Zyxel Device use the specified RADIUS server. Enter the IP address of the RADIUS server to be used for authentication. Enter the port number of the RADIUS server to be used for authentication. Enter the shared secret password of the RADIUS server to be used for authentication. Select the check box to enable user accounting through an external authentication server. Enter the IP address of the external accounting server in dotted decimal notation. Enter the port number of the external accounting server. Enter a password (up to 128 alphanumeric characters) as the key to be shared between the external accounting server and the AP. The key must be the same on the external accounting server and your AP. The key is not sent over the network. This field is available only when you enable user accounting through an external accounting server. Select this to have the AP send accounting update messages to the accounting server at the interval you specify. Specify the time interval for how often the AP is to send an interim update message with current client statistics to the accounting server. MAC Authentication Select this to use an external server or the Zyxel Devices local database to authenticate wireless clients by their MAC addresses. Users cannot get an IP address if the MAC authentication fails. Delimiter

(Account) An external server can use the wireless clients account (username/password) or Calling Station ID for MAC authentication. Configure the ones the external server uses. Select the separator the external server uses for the two-character pairs within account MAC addresses. ZyWALL ATP Series Users Guide 645 Chapter 35 Object Case (Account) Delimiter (Calling Station ID) Case (Calling Station ID) 802.1X Auth. Method Reauthenticatio n Timer Table 262 Configuration > Object > AP Profile > SSID > Security Profile > Add/Edit Security Profile LABEL DESCRIPTION Select the case (upper or lower) the external server requires for letters in the account MAC addresses. RADIUS servers can require the MAC address in the Calling Station ID RADIUS attribute. Select the separator the external server uses for the pairs in calling station MAC addresses. Select the case (upper or lower) the external server requires for letters in the calling station MAC addresses. Select this to enable 802.1x secure authentication. This field is available only when you set the RADIUS server type to Internal. Select an authentication method if you have created any in the Configuration > Object >

Auth. Method screen. Enter the interval (in seconds) between authentication requests. Enter a 0 for unlimited requests. The following fields are available if you set Security Mode to wep. Idle Timeout Enter the idle interval (in seconds) that a client can be idle before authentication is discontinued. Authentication Type Select a WEP authentication method. Choices are Open or Share key. Key Length Select the bit-length of the encryption key to be used in WEP connections. If you select WEP-64:

Enter 10 hexadecimal digits in the range of A-F, a-f and 0-9 (for example, 0x11AA22BB33) for each Key used. or Enter 5 ASCII characters (case sensitive) ranging from a-z, A-Z and 0-9 (for example, MyKey) for each Key used. If you select WEP-128:

Enter 26 hexadecimal digits in the range of A-F, a-f and 0-9 (for example, 0x00112233445566778899AABBCC) for each Key used. or Enter 13 ASCII characters (case sensitive) ranging from a-z, A-Z and 0-9 (for example, MyKey12345678) for each Key used. Based on your Key Length selection, enter the appropriate length hexadecimal or ASCII key. Key 1~4 The following fields are available if you set Security Mode to wpa, wpa2 or wpa2-mix. PSK Select this option to use a Pre-Shared Key with WPA encryption. Enter a pre-shared key of between 8 and 63 case-sensitive ASCII characters (including spaces and symbols) or 64 hexadecimal characters. Select an encryption cipher type from the list. auto - This automatically chooses the best available cipher based on the cipher in use Pre-Shared Key Cipher Type by the wireless client that is attempting to make a connection. tkip - This is the Temporal Key Integrity Protocol encryption method added later to the WEP encryption protocol to further secure. Not all wireless clients may support this. aes - This is the Advanced Encryption Standard encryption method. It is a more recent development over TKIP and considerably more robust. Not all wireless clients may support this. Idle Timeout Group Key Update Timer Enter the idle interval (in seconds) that a client can be idle before authentication is discontinued. Enter the interval (in seconds) at which the AP updates the group WPA encryption key. ZyWALL ATP Series Users Guide 646 Chapter 35 Object Table 262 Configuration > Object > AP Profile > SSID > Security Profile > Add/Edit Security Profile LABEL Management Frame Protection DESCRIPTION This field is available only when you select wpa2 or wpa2-mix in the Security Mode field and set Cipher Type to aes. Data frames in 802.11 WLANs can be encrypted and authenticated with WEP, WPA or WPA2. But 802.11 management frames, such as beacon/probe response, association request, association response, de-authentication and disassociation are always unauthenticated and unencrypted. IEEE 802.11w Protected Management Frames allows APs to use the existing security mechanisms (encryption and authentication methods defined in IEEE 802.11i WPA/WPA2) to protect management frames. This helps prevent wireless DoS attacks. Select the check box to enable management frame protection (MFP) to add security to 802.11 management frames. Select Optional if you do not require the wireless clients to support MFP. Management frames will be encrypted if the clients support MFP. Select Required and wireless clients must support MFP in order to join the APs wireless network. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. OK Cancel 35.3.2.5 MAC Filter List This screen allows you to create and manage security configurations that can be used by your SSIDs. To access this screen click Configuration > Object > AP Profile > SSID > MAC Filter List. Note: You can have a maximum of 32 MAC filtering profiles on the Zyxel Device. Figure 428 Configuration > Object > AP Profile > SSID > MAC Filter List The following table describes the labels in this screen. Table 263 Configuration > Object > AP Profile > SSID > MAC Filter List LABEL Add Edit Remove References DESCRIPTION Click this to add a new MAC filtering profile. Click this to edit the selected MAC filtering profile. Click this to remove the selected MAC filtering profile. Click this to view which other objects are linked to the selected MAC filtering profile (for example, SSID profile). This field is a sequential value, and it is not associated with a specific profile. This field indicates the name assigned to the MAC filtering profile. This field indicates this profiles filter action (if any).

#

Profile Name Filter Action ZyWALL ATP Series Users Guide 647 Chapter 35 Object 35.3.2.6 Add/Edit MAC Filter Profile This screen allows you to create a new MAC filtering profile or edit an existing one. To access this screen, click the Add button or select a MAC filter profile from the list and click the Edit button. Figure 429 SSID > MAC Filter List > Add/Edit MAC Filter Profile The following table describes the labels in this screen. Table 264 SSID > MAC Filter List > Add/Edit MAC Filter Profile LABEL Profile Name DESCRIPTION Enter up to 31 alphanumeric characters for the profile name. This name is only visible in the Web Configurator and is only for management purposes. Spaces and underscores are allowed. Select allow to permit the wireless client with the MAC addresses in this profile to connect to the network through the associated SSID; select deny to block the wireless clients with the specified MAC addresses. Click this to add a MAC address to the profiles list. Click this to edit the selected MAC address in the profiles list. Click this to remove the selected MAC address from the profiles list. This field is a sequential value, and it is not associated with a specific profile. This field specifies a MAC address associated with this profile. This field displays a description for the MAC address associated with this profile. You can click the description to make it editable. Enter up to 60 characters, spaces and underscores allowed. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. Filter Action Add Edit Remove

#

MAC Description OK Cancel 35.4 MON Profile 35.4.1 Overview This screen allows you to set up monitor mode configurations that allow your connected APs to scan for other wireless devices in the vicinity. Once detected, you can use the Rogue AP screen (Section 8.4 on page 205) to classify them as either rogue or friendly and then manage them accordingly. ZyWALL ATP Series Users Guide 648 Chapter 35 Object The MON Profile screen (Section 35.4.2 on page 649) creates preset monitor mode configurations that can be used by the APs. 35.4.1.1 What You Need To Know The following terms and concepts may help as you read this chapter. Active Scan An active scan is performed when an 802.11-compatible wireless monitoring device is explicitly triggered to scan a specified channel or number of channels for other wireless devices broadcasting on the 802.11 frequencies by sending probe request frames. Passive Scan A passive scan is performed when an 802.11-compatible monitoring device is set to periodically listen to a specified channel or number of channels for other wireless devices broadcasting on the 802.11 frequencies. 35.4.2 Configuring MON Profile This screen allows you to create monitor mode configurations that can be used by the APs. To access this screen, login to the Web Configurator, and click Configuration > Object > MON Profile. Figure 430 Configuration > Object > MON Profile The following table describes the labels in this screen. Table 265 Configuration > Object > MON Profile LABEL Add Edit Remove Activate Inactivate References DESCRIPTION Click this to add a new monitor mode profile. Click this to edit the selected monitor mode profile. Click this to remove the selected monitor mode profile. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. Click this to view which other objects are linked to the selected monitor mode profile (for example, an AP management profile). This field is a sequential value, and it is not associated with a specific user. This icon is lit when the entry is active and dimmed when the entry is inactive.

#

Status ZyWALL ATP Series Users Guide 649 Chapter 35 Object Table 265 Configuration > Object > MON Profile (continued) LABEL Profile Name Apply Reset DESCRIPTION This field indicates the name assigned to the monitor profile. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. 35.4.3 Add/Edit MON Profile This screen allows you to create a new monitor mode profile or edit an existing one. To access this screen, click the Add button or select and existing monitor mode profile and click the Edit button. Figure 431 Configuration > Object > MON Profile > Add/Edit MON Profile The following table describes the labels in this screen. Table 266 Configuration > Object > MON Profile > Add/Edit MON Profile LABEL Activate Profile Name DESCRIPTION Select this to activate this monitor mode profile. This field indicates the name assigned to the monitor mode profile. ZyWALL ATP Series Users Guide 650 Chapter 35 Object Table 266 Configuration > Object > MON Profile > Add/Edit MON Profile (continued) LABEL Channel dwell time DESCRIPTION Enter the interval (in milliseconds) before the AP switches to another channel for monitoring. Select auto to have the AP switch to the next sequential channel once the Channel dwell time expires. Select manual to set specific channels through which to cycle sequentially when the Channel dwell time expires. Selecting this options makes the Scan Channel List options available. Select the country code of APs that are connected to the Zyxel Device to be the same as where the Zyxel Device is located/installed. Scan Channel Mode Country Code The available channels vary depending on the country you selected. Be sure to select the correct/same country for both radios on an AP and all connected APs, in order to prevent roaming failure and interference to other systems. Note: For US and Canada models, country code is fixed to US or Canada respectively and is not user selectable. Set Scan Channel List

(2.4 GHz) Move a channel from the Available channels column to the Channels selected column to have the APs using this profile scan that channel when Scan Channel Mode is set to manual. Set Scan Channel List

(5 GHz) These channels are limited to the 2 GHz range (802.11 b/g/n). Move a channel from the Available channels column to the Channels selected column to have the APs using this profile scan that channel when Scan Channel Mode is set to manual. OK Cancel These channels are limited to the 5 GHz range (802.11 a/n). Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. 35.4.4 Technical Reference The following section contains additional technical information about the features described in this chapter. Rogue APs Rogue APs are wireless access points operating in a networks coverage area that are not under the control of the networks administrators, and can open up holes in a networks security. Attackers can take advantage of a rogue APs weaker (or non-existent) security to gain access to the network, or set up their own rogue APs in order to capture information from wireless clients. If a scan reveals a rogue AP, you can use commercially-available software to physically locate it. ZyWALL ATP Series Users Guide 651 Chapter 35 Object Figure 432 Rogue AP Example In the example above, a corporate networks security is compromised by a rogue AP (RG) set up by an employee at his workstation in order to allow him to connect his notebook computer wirelessly (A). The companys legitimate wireless network (the dashed ellipse B) is well-secured, but the rogue AP uses inferior security that is easily broken by an attacker (X) running readily available encryption-cracking software. In this example, the attacker now has access to the company network, including sensitive data stored on the file server (C). Friendly APs If you have more than one AP in your wireless network, you should also configure a list of friendly APs. Friendly APs are other wireless access points that are detected in your network, as well as any others that you know are not a threat (those from recognized networks, for example). It is recommended that you export (save) your list of friendly APs often, especially if you have a network with a large number of access points. 35.5 ZyMesh Overview This section shows you how to configure ZyMesh profiles for the Zyxel Device to apply to the managed APs. ZyMesh is a Zyxel proprietary protocol that creates wireless mesh links between managed APs to expand the wireless network. Managed APs can provide services or forward traffic between the Zyxel Device and wireless clients. ZyMesh also allows the Zyxel Device to use CAPWAP to automatically update the configuration settings on the managed APs (in repeater mode) through wireless connections. The managed APs (in repeater mode) are provisioned hop by hop. The managed APs in a ZyMesh must use the same SSID, channel number and pre-shared key. A manged AP can be either a root AP or repeater in a ZyMesh. ZyWALL ATP Series Users Guide 652 Chapter 35 Object Note: All managed APs should be connected to the Zyxel Device directly to get the configuration file before being deployed to build a ZyMesh. Ensure you restart the managed AP after you change its operating mode using the Configuration > Wireless >

AP Management screen (see Section 8.3 on page 193). Root AP: a managed AP that can transmit and receive data from the Zyxel Device via a wired Ethernet connection. Repeater: a managed AP that transmits and/or receives data from the Zyxel Device via a wireless connection through a root AP. Note: When managed APs are deployed to form a ZyMesh for the first time, the root AP must be connected to an AP controller (the Zyxel Device). In the following example, managed APs 1 and 2 act as a root AP and managed APs A, B and C are repeaters. The maximum number of hops (the repeaters between a wireless client and the root AP) you can have in a ZyMesh varies according to how many wireless clients a managed AP can support. Note: A ZyMesh link with more hops has lower throughput. Note: When the wireless connection between the root AP and the repeater is up, in order to prevent bridge loops, the repeater would not be able to transmit data through its Ethernet port(s). The repeater then could only receive power from a PoE device if you use PoE to provide power to the managed AP via an 8-ping Ethernet cable. ZyWALL ATP Series Users Guide 653 Chapter 35 Object 35.5.1 ZyMesh Profile This screen allows you to manage and create ZyMesh profiles that can be used by the APs. To access this screen, click Configuration > Object > ZyMesh Profile. Figure 433 Configuration > Object > ZyMesh Profile The following table describes the labels in this screen. DESCRIPTION Click this to display a greater or lesser number of configuration fields. Table 267 Configuration > Object > ZyMesh Profile LABEL Hide / Show Advanced Settings ZyMesh Provision Group By default, this shows the MAC address used by the Zyxel Devices first Ethernet port. Say you have two AP controllers (Zyxel Devices) in your network and the primary AP controller is not reachable. You may want to deploy the second/backup AP controller in your network to replace the primary AP controller. In this case, it is recommended that you enter the primary AP controllers ZyMesh Provision Group MAC address in the second AP controllers ZyMesh Provision Group field. If you didnt change the second AP controllers MAC address, managed APs in an existing ZyMesh can still access the networks through the second AP controller and communicate with each other. But new managed APs will not be able to communicate with the managed APs in the existing ZyMesh, which is set up with the primary AP controllers MAC address. To allow all managed APs to communicate in the same ZyMesh, you can just set the second AP controller to use the primary AP controllers MAC address. Otherwise, reset all managed APs to the factory defaults and set up a new ZyMesh with the second AP controllers MAC address. Click this button and follow the on-screen instructions to update the AP controllers MAC address. Click this to add a new profile. Click this to edit the selected profile. Click this to remove the selected profile. This field is a sequential value, and it is not associated with a specific profile. Next Add Edit Remove

#

ZyWALL ATP Series Users Guide 654 Chapter 35 Object Table 267 Configuration > Object > ZyMesh Profile (continued) LABEL Profile Name ZyMesh SSID DESCRIPTION This field indicates the name assigned to the profile. This field shows the SSID specified in this ZyMesh profile. 35.5.2 Add/Edit ZyMesh Profile This screen allows you to create a new ZyMesh profile or edit an existing one. To access this screen, click the Add button or select and existing profile and click the Edit button. Figure 434 Configuration > Object > ZyMesh Profile > Add/Edit ZyMesh Profile The following table describes the labels in this screen. Table 268 Configuration > Object > ZyMesh Profile > Add/Edit ZyMesh Profile LABEL Profile Name ZyMesh SSID DESCRIPTION Enter up to 31 alphanumeric characters for the profile name. Enter the SSID with which you want the managed AP to connect to a root AP or repeater to build a ZyMesh link. Pre-Shared Key OK Cancel Note: The ZyMesh SSID is hidden in the outgoing beacon frame so a wireless device cannot obtain the SSID through scanning using a site survey tool. Enter a pre-shared key of between 8 and 63 case-sensitive ASCII characters (including spaces and symbols) or 64 hexadecimal characters. The key is used to encrypt the wireless traffic between the APs. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. 35.6 Address/Geo IP Overview Address objects can represent a single IP address or a range of IP addresses. Address groups are composed of address objects and other address groups. The Address screen (Section 35.6.2 on page 656) provides a summary of all addresses in the Zyxel Device. Use the Address Add/Edit screen to create a new address or edit an existing one. Use the Address Group summary screen (Section 35.6.3 on page 660) and the Address Group Add/

Edit screen, to maintain address groups in the Zyxel Device. Use the Geo IP screen (Section 35.6.4 on page 662) to update the database of country-to-IP address mappings and to manually configure country-to-IP address mappings. ZyWALL ATP Series Users Guide 655 Chapter 35 Object 35.6.1 What You Need To Know Address objects and address groups are used in dynamic routes, security policies, application patrol, content filtering, and VPN connection policies. For example, addresses are used to specify where content restrictions apply in content filtering. Please see the respective sections for more information about how address objects and address groups are used in each one. Address groups are composed of address objects and address groups. The sequence of members in the address group is not important. 35.6.2 Address Summary Screen The address screens are used to create, maintain, and remove addresses. There are the types of address objects:

HOST - the object uses an IP Address to define a host address RANGE - the object uses a range address defined by a Starting IP Address and an Ending IP Address SUBNET - the object uses a network address defined by a Network IP address and Netmask subnet mask INTERFACE IP - the object uses the IP address of one of the Zyxel Devices interfaces INTERFACE SUBNET - the object uses the subnet mask of one of the Zyxel Devices interfaces INTERFACE GATEWAY - the object uses the gateway IP address of one of the Zyxel Devices interfaces GEOGRAPHY - the object uses the IP addresses of a country to represent a country FQDN - the object uses a FQDN (Fully Qualified Domain Name). An FQDN consists of a host and domain name. For example, www.zyxel.com is a fully qualified domain name, where www is the host, zyxel is the second-level domain, and com is the top level domain. mail.myZyxel.com.tw is also an FQDN, where mail is the host, myZyxel is the third-level domain, com is the second-level domain, and tw is the top level domain. Table 269 FQDN Example HTTP://

WWW. host name ZYXEL. COM second-level domain name FQDN top-level domain name Uniform Resource Locator (URL) In an address FQDN object, you can also use one wildcard. For example, *.zyxel.com. An FQDN is resolved to its IP address using the DNS server configured on the Zyxel Device. The Address screen provides a summary of all addresses in the Zyxel Device. To access this screen, click Configuration > Object > Address > Address. Click a columns heading cell to sort the table entries by that columns criteria. Click the heading cell again to reverse the sort order. ZyWALL ATP Series Users Guide 656 Chapter 35 Object Figure 435 Configuration > Object > Address/Geo IP > Address The following table describes the labels in this screen. See Section 35.6.2.1 on page 658 for more information as well. DESCRIPTION Table 270 Configuration > Object > Address/Geo IP > Address LABEL IPv4 Address Configuration Add Edit Remove Click this to create a new entry. Double-click an entry or select it and click Edit to be able to modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Select an entry and click References to open a screen that shows which settings use the entry. This field is a sequential value, and it is not associated with a specific address. This field displays the configured name of each address object. This field displays the type of each address object. INTERFACE means the object uses the settings of one of the Zyxel Devices interfaces. This field displays the IPv4 addresses represented by each address object. If the objects settings are based on one of the Zyxel Devices interfaces, the name of the interface displays first followed by the objects current address settings. References

#

Name Type IPv4 Address ZyWALL ATP Series Users Guide 657 Chapter 35 Object DESCRIPTION This displays the number of times an object reference is used in a profile. Table 270 Configuration > Object > Address/Geo IP > Address (continued) LABEL Reference IPv6 Address Configuration Add Edit Remove Click this to create a new entry. Double-click an entry or select it and click Edit to be able to modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Select an entry and click References to open a screen that shows which settings use the entry. This field is a sequential value, and it is not associated with a specific address. This field displays the configured name of each address object. This field displays the type of each address object. INTERFACE means the object uses the settings of one of the Zyxel Devices interfaces. This field displays the IPv6 addresses represented by each address object. If the objects settings are based on one of the Zyxel Devices interfaces, the name of the interface displays first followed by the objects current address settings. This displays the number of times an object reference is used in a profile. References

#

Name Type IPv6 Address Reference 35.6.2.1 IPv4 Address Add/Edit Screen The Configuration > Object > Address/GeoIP > Address > Add/Edit (IPv4) screen allows you to create a new address or edit an existing one. To access this screen, go to the Address screen (see Section 35.6.2 on page 656), and click either the Add icon or an Edit icon in the IPv4 Address Configuration section. Figure 436 Configuration > Object > Address/GeoIP > Address > Add/Edit (IPv4) t The following table describes the labels in this screen. Table 271 Configuration > Object > Address/GeoIP > Address > Add/Edit (IPv4) LABEL Name DESCRIPTION Type the name used to refer to the address. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-

sensitive. Select the type of address you want to create. Address Type Note: The Zyxel Device automatically updates address objects that are based on an interfaces IP address, subnet, or gateway if the interfaces IP address settings change. For example, if you change 1s IP address, the Zyxel Device automatically updates the corresponding interface-based, LAN subnet address object. IP Address Starting IP Address This field is only available if the Address Type is HOST. This field cannot be blank. Enter the IP address that this address object represents. This field is only available if the Address Type is RANGE. This field cannot be blank. Enter the beginning of the range of IP addresses that this address object represents. ZyWALL ATP Series Users Guide 658 Chapter 35 Object Table 271 Configuration > Object > Address/GeoIP > Address > Add/Edit (IPv4) LABEL Ending IP Address DESCRIPTION This field is only available if the Address Type is RANGE. This field cannot be blank. Enter the end of the range of IP address that this address object represents. This field is only available if the Address Type is SUBNET, in which case this field cannot be blank. Enter the IP address of the network that this address object represents. This field is only available if the Address Type is SUBNET, in which case this field cannot be blank. Enter the subnet mask of the network that this address object represents. Use dotted decimal format. If you selected INTERFACE IP, INTERFACE SUBNET, or INTERFACE GATEWAY as the Address Type, use this field to select the interface of the network that this address object represents. If you selected GEOGRAPHY as the Address Type, use this field to select a country or continent. A GEOGRAPHY object uses the data from the country-to-IP/continent-to-IP address database. Go to the Configuration > Object > Address/Geo IP > Geo IP screen to configure the custom country-to-IP/continent-to-IP address mappings for a GEOGRAPHY object. If you selected Geography as the Address Type, use this field to select a country. If you selected FQDN as the Address Type, use this field to enter a fully qualified domain name. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. Network Netmask Interface Region Country FQDN OK Cancel 35.6.2.2 IPv6 Address Add/Edit Screen The Configuration > Object > Address/GeoIP > Address > Add/Edit (IPv6) screen allows you to create a new address or edit an existing one. To access this screen, go to the Address screen (see Section 35.6.2 on page 656), and click either the Add icon or an Edit icon in the IPv6 Address Configuration section. Figure 437 Configuration > Object > Address/GeoIP > Address > Add/Edit (IPv6) The following table describes the labels in this screen. Table 272 Configuration > Object > Address/GeoIP > Address > Add/Edit (IPv6) LABEL Name DESCRIPTION Type the name used to refer to the address. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-

sensitive. Select the type of address you want to create. Object Type Note: The Zyxel Device automatically updates address objects that are based on an interfaces IP address, subnet, or gateway if the interfaces IP address settings change. For example, if you change 1s IP address, the Zyxel Device automatically updates the corresponding interface-based, LAN subnet address object. IPv6 Address This field is only available if the Address Type is HOST. This field cannot be blank. Enter the IP address that this address object represents. ZyWALL ATP Series Users Guide 659 Chapter 35 Object Table 272 Configuration > Object > Address/GeoIP > Address > Add/Edit (IPv6) LABEL IPv6 Starting Address IPv6 Ending Address IPv6 Address Prefix Interface DESCRIPTION This field is only available if the Address Type is RANGE. This field cannot be blank. Enter the beginning of the range of IP addresses that this address object represents. This field is only available if the Address Type is RANGE. This field cannot be blank. Enter the end of the range of IP address that this address object represents. This field is only available if the Address Type is SUBNET. This field cannot be blank. Enter the IPv6 address prefix that the Zyxel Device uses for the LAN IPv6 address. If you selected INTERFACE IP, INTERFACE SUBNET, or INTERFACE GATEWAY as the Address Type, use this field to select the interface of the network that this address object represents. IPv6 Address Type Select whether the IPv6 address is a link-local IP address (LINK LOCAL), static IP address Region FQDN OK Cancel

(STATIC), an IPv6 StateLess Address Auto Configuration IP address (SLAAC), or is obtained from a DHCPv6 server (DHCPv6). If you selected Geography as the Address Type, use this field to select a country or continent. If you selected FQDN as the Address Type, use this field to enter a fully qualified domain name. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. 35.6.3 Address Group Summary Screen The Address Group screen provides a summary of all address groups. To access this screen, click Configuration > Object > Address/Geo IP > Address Group. Click a columns heading cell to sort the table entries by that columns criteria. Click the heading cell again to reverse the sort order. Figure 438 Configuration > Object > Address/Geo IP > Address Group The following table describes the labels in this screen. See Section 35.6.3.1 on page 661 for more information as well. Table 273 Configuration > Object > Address/Geo IP > Address Group LABEL DESCRIPTION IPv4 Address Group Configuration Add Edit Remove Click this to create a new entry. Double-click an entry or select it and click Edit to be able to modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Select an entry and click References to open a screen that shows which settings use the entry. This field is a sequential value, and it is not associated with a specific address group. This field displays the name of each address group. References

#

Name ZyWALL ATP Series Users Guide 660 Chapter 35 Object DESCRIPTION This field displays the description of each address group, if any. This displays the number of times an object reference is used in a profile. Table 273 Configuration > Object > Address/Geo IP > Address Group (continued) LABEL Description Reference IPv6 Address Group Configuration Add Edit Remove Click this to create a new entry. Double-click an entry or select it and click Edit to be able to modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Select an entry and click References to open a screen that shows which settings use the entry. This field is a sequential value, and it is not associated with a specific address group. This field displays the name of each address group. This field displays the description of each address group, if any. This displays the number of times an object reference is used in a profile. References

#

Name Description Reference 35.6.3.1 Address Group Add/Edit Screen The Address Group Add/Edit screen allows you to create a new address group or edit an existing one. To access this screen, go to the Address Group screen (see Section 35.6.3 on page 660), and click either the Add icon or an Edit icon in the IPv4 Address Group Configuration or IPv6 Address Group Configuration section. Figure 439 IPv4/IPv6 Address Group Configuration > Add The following table describes the labels in this screen. Table 274 IPv4/IPv6 Address Group Configuration > Add LABEL Name DESCRIPTION Enter a name for the address group. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-

sensitive. This field displays the description of each address group, if any. You can use up to 60 characters, punctuation marks, and spaces. Description ZyWALL ATP Series Users Guide 661 Chapter 35 Object Table 274 IPv4/IPv6 Address Group Configuration > Add (continued) LABEL Address Type DESCRIPTION Select the type of address you want to create. Member List Note: The Zyxel Device automatically updates address objects that are based on an interfaces IP address, subnet, or gateway if the interfaces IP address settings change. For example, if you change 1s IP address, the Zyxel Device automatically updates the corresponding interface-based, LAN subnet address object. The Member list displays the names of the address and address group objects that have been added to the address group. The order of members is not important. Select items from the Available list that you want to be members and move them to the Member list. You can double-click a single entry to move it or use the [Shift] or [Ctrl] key to select multiple entries and use the arrow button to move them. Move any members you do not want included to the Available list. OK Cancel Note: Only objects of the same address type can be added to a address group. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. 35.6.4 Geo IP Summary Screen Use this screen to update the database of country-to-IP and continent-to-IP address mappings and manually configure custom country-to-IP and continent-to-IP address mappings in geographic address objects. You can then use geographic address objects in security policies to forward or deny traffic to whole countries or regions. Click a columns heading cell to sort the table entries by that columns criteria. Click the heading cell again to reverse the sort order. ZyWALL ATP Series Users Guide 662 Chapter 35 Object Figure 440 Configuration > Object > Address/Geo IP > Geo IP ZyWALL ATP Series Users Guide 663 Chapter 35 Object The following table describes the labels in this screen. Table 275 Configuration > Object > Address/Geo IP > Geo IP LABEL Country Database Update Latest Version DESCRIPTION This is the latest country-to-IP address database version on myZyxel. You need to have a registered Content Filter Service license. Current Version Update Now Auto Update This is the country-to-IP address database version currently on the Zyxel Device. Click this to check for the latest country-to-IP address database version on myZyxel. The latest version is downloaded to the Zyxel Device and replaces the current version if it is newer. There are logs to show the update status. You need to have a registered Content Filter Service license. If you want the Zyxel Device to check weekly for the latest country-to-IP address database version on myZyxel, select the checkbox, choose a day and time each week and then click Apply. The default day and time displayed is the Zyxel Device current day and time. Custom IPv4/IPv6 to Geography Rules IPv4/IPv6 to Geography Add Remove Enter an IP address, then click this button to query which country this IP address belongs to. Click this to create a new entry. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. This field is a sequential value, and it is not associated with a specific entry. This field displays the name of the country or region that is associated with this IP address. This field displays whether this address object is HOST, RANGE or SUBNET. This field displays the IPv4/IPv6 addresses represented by the type of address object. Enter a country name, then click the Region to Continent button to query which continent this country belongs to. Select a continent, then click the Region List button to query which countries belong to the continent. Click Apply to save the changes. Click Reset to return the screen to its last-saved settings.

#

Geolocation Type IPv4/IPv6 Address Region vs. Continent Region Continent Apply Reset 35.6.4.1 Add Custom IPv4/IPv6 Address to Geography Screen This screen allows you to create a new geography-to-IP address mapping. To access this screen, go to the Geo IP screen (see Section 35.6.4 on page 662), and click the Add icon in the Custom IPv4 to Geography Rules or Custom IPv6 to Geography Rules section. ZyWALL ATP Series Users Guide 664 Chapter 35 Object Figure 441 Geo IP > Add The following table describes the labels in this screen. Table 276 Geo IP > Add LABEL Region Address Type IP Address IP Starting Address IP Ending Address Network /

Netmask IPv6 Address Prefix OK Cancel DESCRIPTION Select the country or continent that maps to this IP address. Select the type of address you want to create. Choices are: HOST, RANGE, SUBNET. This field is only available if the Address Type is HOST. This field cannot be blank. Enter the IP address that this address object represents. This field is only available if the Address Type is RANGE. This field cannot be blank. Enter the beginning of the range of IP addresses that this address object represents. This field is only available if the Address Type is RANGE. This field cannot be blank. Enter the end of the range of IP address that this address object represents. These fields are only available if the IPv4 Address Type is SUBNET. They cannot be blank. Enter the network IP and subnet mask that defines the IPv4 subnet. This field is only available if the IPv6 Address Type is SUBNET. This field cannot be blank. Enter the IPv6 address prefix that the Zyxel Device uses for the LAN IPv6 address. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. 35.7 Service Overview Use service objects to define TCP applications, UDP applications, and ICMP messages. You can also create service groups to refer to multiple service objects in other features. Use the Service screens (Section 35.7.2 on page 666) to view and configure the Zyxel Devices list of services and their definitions. Use the Service Group screens (Section 35.7.2 on page 666) to view and configure the Zyxel Devices list of service groups. 35.7.1 What You Need to Know IP Protocols IP protocols are based on the eight-bit protocol field in the IP header. This field represents the next-level protocol that is sent in this packet. This section discusses three of the most common IP protocols. ZyWALL ATP Series Users Guide 665 Chapter 35 Object Computers use Transmission Control Protocol (TCP, IP protocol 6) and User Datagram Protocol (UDP, IP protocol 17) to exchange data with each other. TCP guarantees reliable delivery but is slower and more complex. Some uses are FTP, HTTP, SMTP, and TELNET. UDP is simpler and faster but is less reliable. Some uses are DHCP, DNS, RIP, and SNMP. TCP creates connections between computers to exchange data. Once the connection is established, the computers exchange data. If data arrives out of sequence or is missing, TCP puts it in sequence or waits for the data to be re-transmitted. Then, the connection is terminated. In contrast, computers use UDP to send short messages to each other. There is no guarantee that the messages arrive in sequence or that the messages arrive at all. Both TCP and UDP use ports to identify the source and destination. Each port is a 16-bit number. Some port numbers have been standardized and are used by low-level system processes; many others have no particular meaning. Unlike TCP and UDP, Internet Control Message Protocol (ICMP, IP protocol 1) is mainly used to send error messages or to investigate problems. For example, ICMP is used to send the response if a computer cannot be reached. Another use is ping. ICMP does not guarantee delivery, but networks often treat ICMP messages differently, sometimes looking at the message itself to decide where to send it. Service Objects and Service Groups Use service objects to define IP protocols. TCP applications UDP applications ICMP messages user-defined services (for other types of IP protocols) These objects are used in policy routes, security policies, and IDP profiles. Use service groups when you want to create the same rule for several services, instead of creating separate rules for each service. Service groups may consist of services and other service groups. The sequence of members in the service group is not important. 35.7.2 The Service Summary Screen The Service summary screen provides a summary of all services and their definitions. In addition, this screen allows you to add, edit, and remove services. To access this screen, log in to the Web Configurator, and click Configuration > Object > Service >

Service. Click a columns heading cell to sort the table entries by that columns criteria. Click the heading cell again to reverse the sort order. ZyWALL ATP Series Users Guide 666 Chapter 35 Object Figure 442 Configuration > Object > Service > Service The following table describes the labels in this screen. Table 277 Configuration > Object > Service > Service LABEL Add Edit Remove DESCRIPTION Click this to create a new entry. Double-click an entry or select it and click Edit to be able to modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Select an entry and click References to open a screen that shows which settings use the entry. This field is a sequential value, and it is not associated with a specific service. This field displays the name of each service. This field displays a description of each service. This displays the number of times an object reference is used in a profile. References

#

Name Content Reference 35.7.2.1 The Service Add/Edit Screen The Service Add/Edit screen allows you to create a new service or edit an existing one. To access this screen, go to the Service screen (see Section 35.7.2 on page 666), and click either the Add icon or an Edit icon. Figure 443 Configuration > Object > Service > Service > Edit ZyWALL ATP Series Users Guide 667 Chapter 35 Object The following table describes the labels in this screen. Table 278 Configuration > Object > Service > Service > Edit LABEL Name DESCRIPTION Type the name used to refer to the service. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-

sensitive. Select the protocol the service uses. Choices are: TCP, UDP, ICMP, ICMPv6, and User Defined. This field appears if the IP Protocol is TCP or UDP. Specify the port number(s) used by this service. If you fill in one of these fields, the service uses that port. If you fill in both fields, the service uses the range of ports. This field appears if the IP Protocol is ICMP or ICMPv6. Select the ICMP message used by this service. This field displays the message text, not the message number. This field appears if the IP Protocol is User Defined. Enter the number of the next-level protocol (IP protocol). Allowed values are 1 - 255. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. IP Protocol Starting Port Ending Port ICMP Type IP Protocol Number OK Cancel 35.7.3 The Service Group Summary Screen The Service Group summary screen provides a summary of all service groups. In addition, this screen allows you to add, edit, and remove service groups. To access this screen, log in to the Web Configurator, and click Configuration > Object > Service >

Service Group. Figure 444 Configuration > Object > Service > Service Group The following table describes the labels in this screen. See Section 35.7.3.1 on page 669 for more information as well. Table 279 Configuration > Object > Service > Service Group LABEL Add Edit DESCRIPTION Click this to create a new entry. Double-click an entry or select it and click Edit to be able to modify the entrys settings. ZyWALL ATP Series Users Guide 668 Chapter 35 Object Table 279 Configuration > Object > Service > Service Group (continued) LABEL Remove DESCRIPTION To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Select an entry and click References to open a screen that shows which settings use the entry. This field is a sequential value, and it is not associated with a specific service group. This field displays the Server Group supported type, which is according to your configurations in the Service Group Add/Edit screen. There are 3 types of families:

: Supports IPv4 only

: Supports IPv6 only This field displays the name of each service group.

: Supports both IPv4 and IPv6 By default, the Zyxel Device uses services starting with Default_Allow_ in the security policies to allow certain services to connect to the Zyxel Device. This field displays the description of each service group, if any. This displays the number of times an object reference is used in a profile. References

#

Family Name Description Reference 35.7.3.1 The Service Group Add/Edit Screen The Service Group Add/Edit screen allows you to create a new service group or edit an existing one. To access this screen, go to the Service Group screen (see Section 35.7.3 on page 668), and click either the Add icon or an Edit icon. Figure 445 Configuration > Object > Service > Service Group > Edit The following table describes the labels in this screen. Table 280 Configuration > Object > Service > Service Group > Edit LABEL Name DESCRIPTION Enter the name of the service group. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-

sensitive. Enter a description of the service group, if any. You can use up to 60 printable ASCII characters. Description ZyWALL ATP Series Users Guide 669 Chapter 35 Object Table 280 Configuration > Object > Service > Service Group > Edit (continued) LABEL Configuration DESCRIPTION The Member list displays the names of the service and service group objects that have been added to the service group. The order of members is not important. Select items from the Available list that you want to be members and move them to the Member list. You can double-click a single entry to move it or use the [Shift] or [Ctrl] key to select multiple entries and use the arrow button to move them. Move any members you do not want included to the Available list. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. OK Cancel 35.8 Schedule Overview Use schedules to set up one-time and recurring schedules for policy routes, security policies, application patrol, and content filtering. The Zyxel Device supports one-time and recurring schedules. One-time schedules are effective only once, while recurring schedules usually repeat. Both types of schedules are based on the current date and time in the Zyxel Device. Note: Schedules are based on the Zyxel Devices current date and time. Use the Schedule summary screen (Section 35.8.2 on page 670) to see a list of all schedules in the Zyxel Device. Use the One-Time Schedule Add/Edit screen (Section 35.8.2.1 on page 671) to create or edit a one-

time schedule. Use the Recurring Schedule Add/Edit screen (Section 35.8.2.2 on page 672) to create or edit a recurring schedule. Use the Schedule Group screen (Section 35.8.3 on page 673) to merge individual schedule objects as one object. 35.8.1 What You Need to Know One-time Schedules One-time schedules begin on a specific start date and time and end on a specific stop date and time. One-time schedules are useful for long holidays and vacation periods. Recurring Schedules Recurring schedules begin at a specific start time and end at a specific stop time on selected days of the week (Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, and Saturday). Recurring schedules always begin and end in the same day. Recurring schedules are useful for defining the workday and off-

work hours. 35.8.2 The Schedule Screen The Schedule screen provides a summary of all schedules in the Zyxel Device. To access this screen, click Configuration > Object > Schedule. ZyWALL ATP Series Users Guide 670 Chapter 35 Object Figure 446 Configuration > Object > Schedule The following table describes the labels in this screen. See Section 35.8.2.1 on page 671 and Section 35.8.2.2 on page 672 for more information as well. Table 281 Configuration > Object > Schedule LABEL One Time DESCRIPTION Add Edit Remove References

#

Name Start Day /

Time Stop Day /

Time Reference Recurring Add Edit Remove References

#

Name Start Time Stop Time Reference Click this to create a new entry. Double-click an entry or select it and click Edit to be able to modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Select an entry and click References to open a screen that shows which settings use the entry. This field is a sequential value, and it is not associated with a specific schedule. This field displays the name of the schedule, which is used to refer to the schedule. This field displays the date and time at which the schedule begins. This field displays the date and time at which the schedule ends. This displays the number of times an object reference is used in a profile. Click this to create a new entry. Double-click an entry or select it and click Edit to be able to modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Select an entry and click References to open a screen that shows which settings use the entry. This field is a sequential value, and it is not associated with a specific schedule. This field displays the name of the schedule, which is used to refer to the schedule. This field displays the time at which the schedule begins. This field displays the time at which the schedule ends. This displays the number of times an object reference is used in a profile. 35.8.2.1 The One-Time Schedule Add/Edit Screen The One-Time Schedule Add/Edit screen allows you to define a one-time schedule or edit an existing one. To access this screen, go to the Schedule screen (see Section 35.8.2 on page 670), and click either the Add icon or an Edit icon in the One Time section. ZyWALL ATP Series Users Guide 671 Chapter 35 Object Figure 447 Configuration > Object > Schedule > Edit (One Time) The following table describes the labels in this screen. Table 282 Configuration > Object > Schedule > Edit (One Time) LABEL Configuration DESCRIPTION Name Day Time StartDate StartTime StopDate StopTime OK Cancel Type the name used to refer to the one-time schedule. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Specify the year, month, and day when the schedule begins. Year - 1900 - 2999 Month - 1 - 12 Day - 1 - 31 (it is not possible to specify illegal dates, such as February 31.) Specify the hour and minute when the schedule begins. Hour - 0 - 23 Minute - 0 - 59 Specify the year, month, and day when the schedule ends. Year - 1900 - 2999 Month - 1 - 12 Day - 1 - 31 (it is not possible to specify illegal dates, such as February 31.) Specify the hour and minute when the schedule ends. Hour - 0 - 23 Minute - 0 - 59 Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. 35.8.2.2 The Recurring Schedule Add/Edit Screen The Recurring Schedule Add/Edit screen allows you to define a recurring schedule or edit an existing one. To access this screen, go to the Schedule screen (see Section 35.8.2 on page 670), and click either the Add icon or an Edit icon in the Recurring section. ZyWALL ATP Series Users Guide 672 Chapter 35 Object Figure 448 Configuration > Object > Schedule > Edit (Recurring) The Year, Month, and Day columns are not used in recurring schedules and are disabled in this screen. The following table describes the remaining labels in this screen. Table 283 Configuration > Object > Schedule > Edit (Recurring) LABEL Configuration DESCRIPTION Name Date Time StartTime StopTime Weekly Week Days OK Cancel Type the name used to refer to the recurring schedule. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Specify the hour and minute when the schedule begins each day. Hour - 0 - 23 Minute - 0 - 59 Specify the hour and minute when the schedule ends each day. Hour - 0 - 23 Minute - 0 - 59 Select each day of the week the recurring schedule is effective. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. 35.8.3 The Schedule Group Screen The Schedule Group screen provides a summary of all groups of schedules in the Zyxel Device. To access this screen, click Configuration > Object > Schedule >Group. ZyWALL ATP Series Users Guide 673 Chapter 35 Object Figure 449 Configuration > Object > Schedule > Schedule Group The following table describes the fields in the above screen. Table 284 Configuration > Object > Schedule > Schedule Group LABEL Configuration DESCRIPTION Add Edit Remove References

#

Name Description Members Reference Click this to create a new entry. Double-click an entry or select it and click Edit to be able to modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Select an entry and click References to open a screen that shows which settings use the entry. This field is a sequential value, and it is not associated with a specific schedule. This field displays the name of the schedule group, which is used to refer to the schedule. This field displays the description of the schedule group. This field lists the members in the schedule group. Each member is separated by a comma. This displays the number of times an object reference is used in a profile. 35.8.3.1 The Schedule Group Add/Edit Screen The Schedule Group Add/Edit screen allows you to define a schedule group or edit an existing one. To access this screen, go to the Schedule screen (see), and click either the Add icon or an Edit icon in the Schedule Group section. ZyWALL ATP Series Users Guide 674 Chapter 35 Object Figure 450 Configuration > Schedule > Schedule Group > Add The following table describes the fields in the above screen. Table 285 Configuration > Schedule > Schedule Group > Add LABEL Group Members DESCRIPTION Name Description Member List OK Cancel Type the name used to refer to the recurring schedule. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Enter a description of the service group, if any. You can use up to 60 printable ASCII characters. The Member list displays the names of the service and service group objects that have been added to the service group. The order of members is not important. Select items from the Available list that you want to be members and move them to the Member list. You can double-click a single entry to move it or use the [Shift] or

[Ctrl] key to select multiple entries and use the arrow button to move them. Move any members you do not want included to the Available list. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. 35.9 AAA Server Overview You can use a AAA (Authentication, Authorization, Accounting) server to provide access control to your network. The AAA server can be a Active Directory, LDAP, or RADIUS server. Use the AAA Server screens to create and manage objects that contain settings for using AAA servers. You use AAA server objects in configuring ext-group-user user objects and authentication method objects (see Chapter 35 on page 685). ZyWALL ATP Series Users Guide 675 Chapter 35 Object 35.9.1 Directory Service (AD/LDAP) LDAP/AD allows a client (the Zyxel Device) to connect to a server to retrieve information from a directory. A network example is shown next. Figure 451 Example: Directory Service Client and Server The following describes the user authentication procedure via an LDAP/AD server. 1 A user logs in with a user name and password pair. 2 The Zyxel Device tries to bind (or log in) to the LDAP/AD server. 3 When the binding process is successful, the Zyxel Device checks the user information in the directory against the user name and password pair. 4 If it matches, the user is allowed access. Otherwise, access is blocked. 35.9.2 RADIUS Server RADIUS (Remote Authentication Dial-In User Service) authentication is a popular protocol used to authenticate users by means of an external server instead of (or in addition to) an internal device user database that is limited to the memory capacity of the device. In essence, RADIUS authentication allows you to validate a large number of users from a central location. Figure 452 RADIUS Server Network Example 35.9.3 ASAS ASAS (Authenex Strong Authentication System) is a RADIUS server that works with the One-Time Password

(OTP) feature. Purchase a Zyxel Device OTP package in order to use this feature. The package contains server software and physical OTP tokens (PIN generators). Do the following to use OTP. See the documentation included on the ASAS CD for details. ZyWALL ATP Series Users Guide 676 Chapter 35 Object 1 Install the ASAS server software on a computer. 2 Create user accounts on the Zyxel Device and in the ASAS server. 3 Import each tokens database file (located on the included CD) into the server. 4 Assign users to OTP tokens (on the ASAS server). 5 Configure the ASAS as a RADIUS server in the Zyxel Devices Configuration > Object > AAA Server screens. 6 Give the OTP tokens to (local or remote) users. Use the Configuration > Object > AAA Server > Active Directory (or LDAP) screens (Section 35.9.5 on page 678) to configure Active Directory or LDAP server objects. Use the Configuration > Object > AAA Server > RADIUS screen (Section 35.9.2 on page 676) to configure the default external RADIUS server to use for user authentication. 35.9.4 What You Need To Know AAA Servers Supported by the Zyxel Device The following lists the types of authentication server the Zyxel Device supports. Local user database The Zyxel Device uses the built-in local user database to authenticate administrative users logging into the Zyxel Devices Web Configurator or network access users logging into the network through the Zyxel Device. You can also use the local user database to authenticate VPN users. Directory Service (LDAP/AD) LDAP (Lightweight Directory Access Protocol)/AD (Active Directory) is a directory service that is both a directory and a protocol for controlling access to a network. The directory consists of a database specialized for fast information retrieval and filtering activities. You create and store user profile and login information on the external server. RADIUS RADIUS (Remote Authentication Dial-In User Service) authentication is a popular protocol used to authenticate users by means of an external or built-in RADIUS server. RADIUS authentication allows you to validate a large number of users from a central location. Directory Structure The directory entries are arranged in a hierarchical order much like a tree structure. Normally, the directory structure reflects the geographical or organizational boundaries. The following figure shows a basic directory structure branching from countries to organizations to organizational units to individuals. ZyWALL ATP Series Users Guide 677 Chapter 35 Object Figure 453 Basic Directory Structure Root US Japan Sprint UPS NEC Sales RD3 QA CSO Sales RD Countries (c) Organizations (o) Organization Units (ou) Unique Common Name

(cn) Distinguished Name (DN) A DN uniquely identifies an entry in a directory. A DN consists of attribute-value pairs separated by commas. The leftmost attribute is the Relative Distinguished Name (RDN). This provides a unique name for entries that have the same parent DN (cn=domain1.com, ou=Sales, o=MyCompany in the following examples). cn=domain1.com, ou = Sales, o=MyCompany, c=US cn=domain1.com, ou = Sales, o=MyCompany, c=JP Base DN A base DN specifies a directory. A base DN usually contains information such as the name of an organization, a domain name and/or country. For example, o=MyCompany, c=UK where o means organization and c means country. Bind DN A bind DN is used to authenticate with an LDAP/AD server. For example a bind DN of cn=zywallAdmin allows the Zyxel Device to log into the LDAP/AD server using the user name of zywallAdmin. The bind DN is used in conjunction with a bind password. When a bind DN is not specified, the Zyxel Device will try to log in as an anonymous user. If the bind password is incorrect, the login will fail. 35.9.5 Active Directory or LDAP Server Summary Use the Active Directory or LDAP screen to manage the list of AD or LDAP servers the Zyxel Device can use in authenticating users. Click Configuration > Object > AAA Server > Active Directory (or LDAP) to display the Active Directory (or LDAP) screen. ZyWALL ATP Series Users Guide 678 Chapter 35 Object Figure 454 Configuration > Object > AAA Server > Active Directory (or LDAP) The following table describes the labels in this screen. Table 286 Configuration > Object > AAA Server > Active Directory (or LDAP) LABEL Add Edit DESCRIPTION Click this to create a new entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Select an entry and click References to open a screen that shows which settings use the entry. This field is a sequential value, and it is not associated with a specific AD or LDAP server. This field displays the name of the Active Directory. This is the address of the AD or LDAP server. This specifies a directory. For example, o=Zyxel, c=US. Remove References

#

Name Server Address Base DN 35.9.5.1 Adding an Active Directory or LDAP Server Click Object > AAA Server > Active Directory (or LDAP) to display the Active Directory (or LDAP) screen. Click the Add icon or an Edit icon to display the following screen. Use this screen to create a new AD or LDAP entry or edit an existing one. ZyWALL ATP Series Users Guide 679 Chapter 35 Object Figure 455 Configuration > Object > AAA Server > Active Directory (or LDAP) > Add The following table describes the labels in this screen. Table 287 Configuration > Object > AAA Server > Active Directory (or LDAP) > Add LABEL Name Description Server Address Backup Server Address DESCRIPTION Enter a descriptive name (up to 63 alphanumerical characters) for identification purposes. Enter the description of each server, if any. You can use up to 60 printable ASCII characters. Enter the address of the AD or LDAP server. If the AD or LDAP server has a backup server, enter its address here. ZyWALL ATP Series Users Guide 680 Chapter 35 Object Table 287 Configuration > Object > AAA Server > Active Directory (or LDAP) > Add (continued) LABEL Port DESCRIPTION Specify the port number on the AD or LDAP server to which the Zyxel Device sends authentication requests. Enter a number between 1 and 65535. Base DN Use SSL Search time limit Case-sensitive User Names Bind DN Password This port number should be the same on all AD or LDAP server(s) in this group. Specify the directory (up to 127 alphanumerical characters). For example, o=Zyxel, c=US. This is only for LDAP. Select Use SSL to establish a secure connection to the AD or LDAP server(s). Specify the timeout period (between 1 and 300 seconds) before the Zyxel Device disconnects from the AD or LDAP server. In this case, user authentication fails. Search timeout occurs when either the user information is not in the AD or LDAP server(s) or the AD or LDAP server(s) is down. Select this if the server checks the case of the usernames. Specify the bind DN for logging into the AD or LDAP server. Enter up to 127 alphanumerical characters. For example, cn=zywallAdmin specifies zywallAdmin as the user name. If required, enter the password (up to 15 alphanumerical characters) for the Zyxel Device to bind (or log in) to the AD or LDAP server. Retype to Confirm Retype your new password for confirmation. Login Name Attribute Alternative Login Name Attribute Group Membership Attribute Enter the type of identifier the users are to use to log in. For example name or email address. If there is a second type of identifier that the users can use to log in, enter it here. For example name or email address. An AD or LDAP server defines attributes for its accounts. Enter the name of the attribute that the Zyxel Device is to check to determine to which group a user belongs. The value for this attribute is called a group identifier; it determines to which group a user belongs. You can add ext-group-user user objects to identify groups based on these group identifier values. For example you could have an attribute named memberOf with values like sales, RD, and management. Then you could also create a ext-group-user user object for each group. One with sales as the group identifier, another for RD and a third for management. Select the Enable checkbox to enable domain authentication for MSChap. This is only for Active Directory. Enter the user name for the user who has rights to add a machine to the domain. This is only for Active Directory. Enter the password for the associated user name. This is only for Active Directory. Domain Authentication for MSChap User Name User Password Retype to Confirm Retype your new password for confirmation. Realm NetBIOS Name This is only for Active Directory. Enter the realm FQDN. This is only for Active Directory. Type the NetBIOS name. This field is optional. NetBIOS packets are TCP or UDP packets that enable a computer to connect to and communicate with a LAN which allows local computers to find computers on the remote network and vice versa. ZyWALL ATP Series Users Guide 681 Chapter 35 Object Table 287 Configuration > Object > AAA Server > Active Directory (or LDAP) > Add (continued) LABEL Configuration Validation OK Cancel DESCRIPTION Use a user account from the server specified above to test if the configuration is correct. Enter the accounts user name in the Username field and click Test. Click OK to save the changes. Click Cancel to discard the changes. 35.9.6 RADIUS Server Summary Use the RADIUS screen to manage the list of RADIUS servers the Zyxel Device can use in authenticating users. Click Configuration > Object > AAA Server > RADIUS to display the RADIUS screen. Figure 456 Configuration > Object > AAA Server > RADIUS The following table describes the labels in this screen. Table 288 Configuration > Object > AAA Server > RADIUS LABEL Add Edit DESCRIPTION Click this to create a new entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Select an entry and click References to open a screen that shows which settings use the entry. This field displays the index number. This is the name of the RADIUS server entry. This is the address of the AD or LDAP server. Remove References

#

Name Server Address 35.9.6.1 Adding a RADIUS Server Click Configuration > Object > AAA Server > RADIUS to display the RADIUS screen. Click the Add icon or an Edit icon to display the following screen. Use this screen to create a new AD or LDAP entry or edit an existing one. ZyWALL ATP Series Users Guide 682 Chapter 35 Object Figure 457 Configuration > Object > AAA Server > RADIUS > Add The following table describes the labels in this screen. DESCRIPTION Enter a descriptive name (up to 63 alphanumerical characters) for identification purposes. Enter the description of each server, if any. You can use up to 60 printable ASCII characters. Enter the address of the RADIUS server. Specify the port number on the RADIUS server to which the Zyxel Device sends authentication requests. Enter a number between 1 and 65535. If the RADIUS server has a backup server, enter its address here. Table 289 Configuration > Object > AAA Server > RADIUS > Add LABEL Name Description Server Address Authentication Port Backup Server Address Backup Authentication Port Specify the port number on the RADIUS server to which the Zyxel Device sends authentication requests. Enter a number between 1 and 65535. ZyWALL ATP Series Users Guide 683 Chapter 35 Object Table 289 Configuration > Object > AAA Server > RADIUS > Add (continued) LABEL Key DESCRIPTION Enter a password (up to 15 alphanumeric characters) as the key to be shared between the external authentication server and the Zyxel Device. Change of Authorization The key is not sent over the network. This key must be the same on the external authentication server and the Zyxel Device. The external RADIUS server can change its authentication policy and send CoA (Change of Authorization) or RADIUS Disconnect messages in order to terminate the subscribers service. Select this option to allow the Zyxel Device to disconnect wireless clients based on the information (such as clients user name and MAC address) specified in CoA or RADIUS Disconnect messages sent by the RADIUS server. Enter the IP address or Fully-Qualified Domain Name (FQDN) of the RADIUS accounting server. Specify the port number on the RADIUS server to which the Zyxel Device sends accounting information. Enter a number between 1 and 65535. If the RADIUS server has a backup accounting server, enter its address here. Specify the port number on the RADIUS server to which the Zyxel Device sends accounting information. Enter a number between 1 and 65535. Enter a password (up to 15 alphanumeric characters) as the key to be shared between the external authentication server and the Zyxel Device. The key is not sent over the network. This key must be the same on the external authentication server and the Zyxel Device. At times the Zyxel Device may not be able to use the primary RADIUS accounting server. Specify the number of times the Zyxel Device should reattempt to use the primary RADIUS server before attempting to use the secondary RADIUS server. This also sets how many times the Zyxel Device will attempt to use the secondary RADIUS server. For example, you set this field to 3. If the Zyxel Device does not get a response from the primary RADIUS server, it tries again up to three times. If there is no response, the Zyxel Device tries the secondary RADIUS server up to three times. If there is also no response from the secondary RADIUS server, the Zyxel Device stops attempting to authenticate the subscriber. The subscriber will see a message that says the RADIUS server was not found. This field is configurable only after you configure a RADIUS accounting server address. Select this to have the Zyxel Device send subscriber status updates to the RADIUS server at the interval you specify. Specify the time interval for how often the Zyxel Device is to send a subscriber status update to the RADIUS server. Specify the timeout period (between 1 and 300 seconds) before the Zyxel Device disconnects from the RADIUS server. In this case, user authentication fails. Search timeout occurs when either the user information is not in the RADIUS server or the RADIUS server is down. Type the IP address of the NAS (Network Access Server). If the RADIUS server requires the Zyxel Device to provide the Network Access Server identifier attribute with a specific value, enter it here. Select this if you want configure your username as case-sensitive. Server Address Accounting Port Backup Server Address Backup Accounting Port Key Maximum Retry Count Enable Accounting Interim Update Interim Interval Timeout NAS IP Address NAS Identifier Case-sensitive User Names ZyWALL ATP Series Users Guide 684 Chapter 35 Object Table 289 Configuration > Object > AAA Server > RADIUS > Add (continued) LABEL Group Membership Attribute DESCRIPTION A RADIUS server defines attributes for its accounts. Select the name and number of the attribute that the Zyxel Device is to check to determine to which group a user belongs. If it does not display, select user-defined and specify the attributes number. This attributes value is called a group identifier; it determines to which group a user belongs. You can add ext-group-user user objects to identify groups based on these group identifier values. For example you could have an attribute named memberOf with values like sales, RD, and management. Then you could also create a ext-group-user user object for each group. One with sales as the group identifier, another for RD and a third for management. Click OK to save the changes. Click Cancel to discard the changes. OK Cancel 35.10 Auth. Method Overview Authentication method objects set how the Zyxel Device authenticates wireless, HTTP/HTTPS clients, and peer IPSec routers (extended authentication) clients. Configure authentication method objects to have the Zyxel Device use the local user database, and/or the authentication servers and authentication server groups specified by AAA server objects. By default, user accounts created and stored on the Zyxel Device are authenticated locally. Use the Configuration > Object > Auth. Method screens (Section 35.10.3 on page 686) to create and manage authentication method objects. Use the Configuration > Object > Auth. Method > Two-Factor Authentication screen (Section 35.10.4 on page 688) to configure double-layer security to access a secured network behind the Zyxel Device via a VPN tunnel, Web Configurator, SSH, or Telnet. 35.10.1 Before You Begin Configure AAA server objects before you configure authentication method objects. 35.10.2 Example: Selecting a VPN Authentication Method After you set up an authentication method object in the Auth. Method screens, you can use it in the VPN Gateway screen to authenticate VPN users for establishing a VPN connection. Refer to the chapter on VPN for more information. Follow the steps below to specify the authentication method for a VPN connection. 1 Access the Configuration > VPN > IPSec VPN > VPN Gateway > Edit screen. 2 Click Show Advance Setting and select Enable Extended Authentication. 3 Select Server Mode and select an authentication method object from the drop-down list box. 4 Click OK to save the settings. ZyWALL ATP Series Users Guide 685 Chapter 35 Object Figure 458 Example: Using Authentication Method in VPN 35.10.3 Authentication Method Objects Click Configuration > Object > Auth. Method to display the screen as shown. Note: You can create up to 16 authentication method objects. Figure 459 Configuration > Object > Auth. Method The following table describes the labels in this screen. Table 290 Configuration > Object > Auth. Method LABEL Add Edit DESCRIPTION Click this to create a new entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Select an entry and click References to open a screen that shows which settings use the entry. This field displays the index number. This field displays a descriptive name for identification purposes. This field displays the authentication method(s) for this entry. Remove References

#

Method Name Method List 35.10.3.1 Creating an Authentication Method Object Follow the steps below to create an authentication method object. 1 Click Configuration > Object > Auth. Method. 2 Click Add. ZyWALL ATP Series Users Guide 686 Chapter 35 Object 3 Specify a descriptive name for identification purposes in the Name field. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. For example, My_Device. 4 Click Add to insert an authentication method in the table. 5 6 Select a server object from the Method List drop-down list box. You can add up to four server objects to the table. The ordering of the Method List column is important. The Zyxel Device authenticates the users using the databases (in the local user database or the external authentication server) in the order they appear in this screen. If two accounts with the same username exist on two authentication servers you specify, the Zyxel Device does not continue the search on the second authentication server when you enter the username and password that doesnt match the one on the first authentication server. Note: You can NOT select two server objects of the same type. 7 Click OK to save the settings or click Cancel to discard all changes and return to the previous screen. Figure 460 Configuration > Object > Auth. Method > Add The following table describes the labels in this screen. Table 291 Configuration > Object > Auth. Method > Add LABEL Name DESCRIPTION Specify a descriptive name for identification purposes. Add Edit Remove Move

#

You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. For example, My_Device. Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. To change a methods position in the numbered list, select the method and click Move to display a field to type a number for where you want to put it and press [ENTER] to move the rule to the number that you typed. The ordering of your methods is important as Zyxel Device authenticates the users using the authentication methods in the order they appear in this screen. This field displays the index number. ZyWALL ATP Series Users Guide 687 Chapter 35 Object Table 291 Configuration > Object > Auth. Method > Add (continued) LABEL Method List DESCRIPTION Select a server object from the drop-down list box. You can create a server object in the AAA Server screen. The Zyxel Device authenticates the users using the databases (in the local user database or the external authentication server) in the order they appear in this screen. If two accounts with the same username exist on two authentication servers you specify, the Zyxel Device does not continue the search on the second authentication server when you enter the username and password that doesnt match the one on the first authentication server. Click OK to save the changes. Click Cancel to discard the changes. OK Cancel 35.10.4 Two-Factor Authentication VPN Access Use two-factor authentication to have double-layer security to access a secured network behind the Zyxel Device via a VPN tunnel, Web Configurator, SSH, or Telnet. The first layer is the VPN client/Zyxel Devices login user name / password and the second layer is an authorized SMS (via mobile phone number) or email address. 35.10.4.1 Overview This section introduces how two-factor authentication works. Figure 461 Two-Factor Authentication ZyWALL ATP Series Users Guide 688 Chapter 35 Object Via a VPN tunnel 1 A user runs a VPN client and logs in with the user name and password for this VPN tunnel. 2 3 4 5 6 The VPN tunnel is created from the VPN client device to the Zyxel Device. The Zyxel Device requests the users user-name, password and mobile phone number or email address from the Active Directory, RADIUS server or local Zyxel Device database in order to authenticate this user's use of the VPN tunnel (factor 1). If they are not found, then the Zyxel Device terminates the VPN tunnel. If all correct credentials are found, then the Zyxel Device will request the Cloud SMS system to send an authorization SMS or email to the client requesting VPN access (factor 2). The client should access the authorization link sent via SMS or email by the Cloud SMS system within a specified deadline (Valid Time). If the authorization is correct and received on time, then the client can have VPN access to the secured network. If the authorization deadline has expired, then the client will have to run the VPN client again. If authorization credentials are incorrect or if the SMS/email was not received, then the client must check with the network administrator. Via the Web Configurator, SSH, or Telnet 1 An admin user is trying to log into the Zyxel Device using the Web Configurator, SSH, or Telnet. 2 3 4 5 The Zyxel Device requests the admin users user-name, password and mobile phone number or email address from the Active Directory, RADIUS server or local Zyxel Device database in order to authenticate this admin user. If all correct credentials are found, then the Zyxel Device will request the Cloud SMS system to send an authorization SMS or email to the admin user. The admin user should access the authorization link sent via SMS or email by the Cloud SMS system within a specified deadline (Valid Time). If the authorization is correct and received on time, then the client can access to the secured network. If the authorization deadline has expired, then the admin user will have to try again. If authorization credentials are incorrect or if the SMS/email was not received, then the admin user must check with the network administrator. 35.10.4.2 Pre-configuration Before configuration, you must:

Set up the users user-name, password and email address or mobile number in the Active Directory, RADIUS server or local Zyxel Device database Configure the VPN tunnel for this user on the Zyxel Device Have an account with ViaNett to be able to send SMS/email authorization requests Enable HTTP and/or HTTPS in System > WWW > Service Control Enable SSH and/or Telnet in System > SSH and/or System > TELNET Configure SMS in System > Notification > SMS. ZyWALL ATP Series Users Guide 689 Chapter 35 Object Add HTTP, HTTPS, SSH, and/or, TELNET in the Object > Service > Service Group >

Default_Allow_WAN_To_ZyWALL service group. Two-Factor authentication may fail if one of the above is not configured or:

The user did not receive the authorization SMS or email. Check if the mobile telephone number or email address of the user in the Active Directory, RADIUS Server or local Zyxel Device database is configured correctly ViaNett Authentication failed and no SMS was sent. Check that SMS is enabled and credentials are correct in System > Notification > SMS. Mail server authentication failed. Check if the System > Notification > Mail Server settings are correct. The authorization timed out. Extend the Valid Time in Configuration > Object > Auth. Method > Two-

factor Authentication > VPN Access. Use this screen to select the users and VPN service(s) that requires two-factor authentication. Go to Configuration > Object > Auth. Method > Two-factor Authentication > VPN Access and configure the following screen as shown. Figure 462 Configuration > Object > Auth. Method > Two-factor Authentication > VPN Access ZyWALL ATP Series Users Guide 690 Chapter 35 Object The following table describes the labels in this screen. Table 292 Configuration > Object > Auth. Method > Two-factor Authentication > VPN Access LABEL General Settings Enable DESCRIPTION Valid Time Two-factor Authentication for Services:

User/Group Delivery Settings Deliver Authorize Link Method:

Authorize Link URL Address:

Message Select the check box to require double-layer security to access a secured network behind the Zyxel Device via a VPN tunnel. Enter the maximum time (in minutes) that the user must click or tap the authorization link in the SMS or email in order to get authorization for the VPN connection. Select which kinds of VPN tunnels require Two-Factor Authentication. You should have configured the VPN tunnel first. SSL VPN Access IPSec VPN Access L2TP/IPSec VPN Access This list displays the names of the users and user groups that can be selected for two-factor authentication. The order of members is not important. Select users and groups from the Selectable User/Group Objects list that require two-factor authentication for VPN access to a secured network behind the Zyxel Device and move them to the Selected User/Group Objects list. You can double-click a single entry to move it or use the [Shift] or [Ctrl] key to select multiple entries and use the arrow button to move them. Similarly, move user/groups that do not you do not require two-factor authentication back to the Selectable User/Group Objects list. Use this section to configure how to send an SMS or email for authorization. Select one or both methods:

SMS: Object > User/Group > User must contain a valid mobile telephone number. A valid mobile telephone number can be up to 20 characters in length, including the numbers 1~9 and the following characters in the square brackets [+*#()-]. Email: Object > User/Group > User must contain a valid email address. A valid email address must contain the @ character. For example, this is a valid email address:

abc@example.com Configure the link that the user will receive in the SMS or email. The user must be able to access the link. http/https: you must enable HTTP or HTTPS in System > WWW > Service Control From Interface/User-Defined: select the Zyxel Device WAN interface (wan1/2) or select User-Defined and then enter an IP address. You can either create a default message in the text box or upload a message file (Use Multilingual file) from your computer. The message file must be named '2FA-msg.txt' and be in UTF-8 format. To create the file, click Download the default 2FA-msg.txt example and edit the file for your needs. (If you make a mistake, use Restore Customized File to Default to restore your customized file to the default.) Use Select a File Path to locate the final file on your computer and then click Upload to transfer it to the Zyxel Device. Apply Reset The message in either the text box or the file must contain the <url> variable within angle brackets, while the <user>, <host>, and <time> variables are optional. Click Apply to save the changes. Click Reset to return the screen to its last-saved settings. 35.10.5 Two-Factor Authentication Admin Access Use this screen to select the service (Web, SSH, and TELNET) that requires two-factor authentication for the admin user. Go to Configuration > Object > Auth. Method > Two-factor Authentication > Admin Access and configure the following screen as shown. ZyWALL ATP Series Users Guide 691 Chapter 35 Object Figure 463 Configuration > Object > Auth. Method > Two-factor Authentication > Admin Access The following table describes the labels in this screen. Table 293 Configuration > Object > Auth. Method > Two-factor Authentication > Admin Access LABEL General Settings Enable DESCRIPTION Select the check box to require double-layer security to access a secured network behind the Zyxel Device via the Web Configurator, SSH, or Telnet. Enter the maximum time (in minutes) that the user must click or tap the authorization link in the SMS or email in order to get authorization for logins via the Web Configurator, SSH, or Telnet. Select which services require Two-Factor Authentication for the admin user. Web SSH TELNET This list displays the names of the users and user groups that can be selected for two-factor authentication. The order of members is not important. Select users and groups from the Selectable User Objects list that require two-factor authentication for VPN access to a secured network behind the Zyxel Device and move them to the Selected User Objects list. You can double-click a single entry to move it or use the [Shift] or [Ctrl] key to select multiple entries and use the arrow button to move them. Valid Time Two-factor Authentication for Services:

User Delivery Settings Similarly, move user/groups that do not you do not require two-factor authentication back to the Selectable User Objects list. Use this section to configure how to send an SMS or email for authorization. ZyWALL ATP Series Users Guide 692 Chapter 35 Object Table 293 Configuration > Object > Auth. Method > Two-factor Authentication > Admin Access LABEL Deliver Authorize Link Method:

DESCRIPTION Select one or both methods:

SMS: Object > User/Group > User must contain a valid mobile telephone number. A valid mobile telephone number can be up to 20 characters in length, including the numbers 1~9 and the following characters in the square brackets [+*#()-]. Email: Object > User/Group > User must contain a valid email address. A valid email address must contain the @ character. For example, this is a valid email address:

abc@example.com Apply Reset Click Apply to save the changes. Click Reset to return the screen to its last-saved settings. 35.11 Certificate Overview The Zyxel Device can use certificates (also called digital IDs) to authenticate users. Certificates are based on public-private key pairs. A certificate contains the certificate owners identity and public key. Certificates provide a way to exchange public keys for use in authentication. Use the My Certificates screens (see Section 35.11.3 on page 696 to Section 35.11.3.3 on page 704) to generate and export self-signed certificates or certification requests and import the CA-signed certificates. Use the Trusted Certificates screens (see Section 35.11.4 on page 705 to Section 35.11.4.2 on page 709) to save CA certificates and trusted remote host certificates to the Zyxel Device. The Zyxel Device trusts any valid certificate that you have imported as a trusted certificate. It also trusts any valid certificate signed by any of the certificates that you have imported as a trusted certificate. 35.11.1 What You Need to Know When using public-key cryptology for authentication, each host has two keys. One key is public and can be made openly available. The other key is private and must be kept secure. These keys work like a handwritten signature (in fact, certificates are often referred to as digital signatures). Only you can write your signature exactly as it should look. When people know what your signature looks like, they can verify whether something was signed by you, or by someone else. In the same way, your private key writes your digital signature and your public key allows people to verify whether data was signed by you, or by someone else. This process works as follows. 1 2 3 4 Tim wants to send a message to Jenny. He needs her to be sure that it comes from him, and that the message content has not been altered by anyone else along the way. Tim generates a public key pair

(one public key and one private key). Tim keeps the private key and makes the public key openly available. This means that anyone who receives a message seeming to come from Tim can read it and verify whether it is really from him or not. Tim uses his private key to sign the message and sends it to Jenny. Jenny receives the message and uses Tims public key to verify it. Jenny knows that the message is from Tim, and that although other people may have been able to read the message, no-one can have altered it (because they cannot re-sign the message with Tims private key). ZyWALL ATP Series Users Guide 693 Chapter 35 Object 5 Additionally, Jenny uses her own private key to sign a message and Tim uses Jennys public key to verify the message. The Zyxel Device uses certificates based on public-key cryptology to authenticate users attempting to establish a connection, not to encrypt the data that you send after establishing a connection. The method used to secure the data that you send through an established connection depends on the type of connection. For example, a VPN tunnel might use the triple DES encryption algorithm. The certification authority uses its private key to sign certificates. Anyone can then use the certification authoritys public key to verify the certificates. A certification path is the hierarchy of certification authority certificates that validate a certificate. The Zyxel Device does not trust a certificate if any certificate on its path has expired or been revoked. Certification authorities maintain directory servers with databases of valid and revoked certificates. A directory of certificates that have been revoked before the scheduled expiration is called a CRL

(Certificate Revocation List). The Zyxel Device can check a peers certificate against a directory servers list of revoked certificates. The framework of servers, software, procedures and policies that handles keys is called PKI (public-key infrastructure). Advantages of Certificates Certificates offer the following benefits. The Zyxel Device only has to store the certificates of the certification authorities that you decide to trust, no matter how many devices you need to authenticate. Key distribution is simple and very secure since you can freely distribute public keys and you never need to transmit private keys. Self-signed Certificates You can have the Zyxel Device act as a certification authority and sign its own certificates. Factory Default Certificate The Zyxel Device generates its own unique self-signed certificate when you first turn it on. This certificate is referred to in the GUI as the factory default certificate. Certificate File Formats Any certificate that you want to import has to be in one of these file formats:

Binary X.509: This is an ITU-T recommendation that defines the formats for X.509 certificates. PEM (Base-64) encoded X.509: This Privacy Enhanced Mail format uses lowercase letters, uppercase letters and numerals to convert a binary X.509 certificate into a printable form. Binary PKCS#7: This is a standard that defines the general syntax for data (including digital signatures) that may be encrypted. A PKCS #7 file is used to transfer a public key certificate. The private key is not included. The Zyxel Device currently allows the importation of a PKS#7 file that contains a single certificate. PEM (Base-64) encoded PKCS#7: This Privacy Enhanced Mail (PEM) format uses lowercase letters, uppercase letters and numerals to convert a binary PKCS#7 certificate into a printable form. ZyWALL ATP Series Users Guide 694 Chapter 35 Object Binary PKCS#12: This is a format for transferring public key and private key certificates. The private key in a PKCS #12 file is within a password-encrypted envelope. The files password is not connected to your certificates public or private passwords. Exporting a PKCS #12 file creates this and you must provide it to decrypt the contents when you import the file into the Zyxel Device. Note: Be careful not to convert a binary file to text during the transfer process. It is easy for this to occur since many programs use text files by default. 35.11.2 Verifying a Certificate Before you import a trusted certificate into the Zyxel Device, you should verify that you have the correct certificate. You can do this using the certificates fingerprint. A certificates fingerprint is a message digest calculated using the MD5 or SHA1 algorithm. The following procedure describes how to check a certificates fingerprint to verify that you have the actual certificate. 1 Browse to where you have the certificate saved on your computer. 2 Make sure that the certificate has a .cer or .crt file name extension. Figure 464 Remote Host Certificates 3 Double-click the certificates icon to open the Certificate window. Click the Details tab and scroll down to the Thumbprint Algorithm and Thumbprint fields. Figure 465 Certificate Details ZyWALL ATP Series Users Guide 695 Chapter 35 Object 4 Use a secure method to verify that the certificate owner has the same information in the Thumbprint Algorithm and Thumbprint fields. The secure method may very based on your situation. Possible examples would be over the telephone or through an HTTPS connection. 35.11.3 The My Certificates Screen Click Configuration > Object > Certificate > My Certificates to open the My Certificates screen. This is the Zyxel Devices summary list of certificates and certification requests. Figure 466 Configuration > Object > Certificate > My Certificates The following table describes the labels in this screen. Table 294 Configuration > Object > Certificate > My Certificates LABEL PKI Storage Space in Use DESCRIPTION This bar displays the percentage of the Zyxel Devices PKI storage space that is currently in use. When the storage space is almost full, you should consider deleting expired or unnecessary certificates before adding more certificates. Click this to go to the screen where you can have the Zyxel Device generate a certificate or a certification request. Double-click an entry or select it and click Edit to open a screen with an in-depth list of information about the certificate. The Zyxel Device keeps all of your certificates unless you specifically delete them. Uploading a new firmware or default configuration file does not delete your certificates. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Subsequent certificates move up by one when you take this action. You cannot delete certificates that any of the Zyxel Devices features are configured to use. Select an entry and click References to open a screen that shows which settings use the entry. Add Edit Remove References ZyWALL ATP Series Users Guide 696 Chapter 35 Object Table 294 Configuration > Object > Certificate > My Certificates (continued) LABEL Download DESCRIPTION Click this and the following screen will appear. Type the selected certificates password and save the selected certificate to your computer. Figure 467 Download a Certificate ZyWALL ATP Series Users Guide 697 Chapter 35 Object Table 294 Configuration > Object > Certificate > My Certificates (continued) LABEL Email DESCRIPTION Click this to email the selected certificate to the configured email address(es) for SSL connection establishment. This enables you to establish an SSL connection on your laptops, tablets, or smartphones. Click this and the following screen will appear. Here are the field descriptions:

Mail Subject: Type the subject line for outgoing email from the Zyxel Device. Mail To: Type the email address (or addresses) to which the outgoing email is delivered. Send Certificate with Private Key: Select the check box to send the selected certificate with a private key. Password: Enter a private key of up to 31 keyboard characters for the certificate. The special characters listed in the brackets [;\|`~!@#$%^&*()_+\\{}':,./<>=-"]

are allowed. E-mail Content: Create the email content in English, and use up to 250 keyboard characters. The special characters listed in the brackets

[;\|`~!@#$%^&*()_+\\{}':,./<>=-"] are allowed. Compress as a ZIP File: Select the check box to compress the selected certificate. Make sure the endpoint devices can decompress ZIP files before sending the compressed certificate. It's recommended to compress the certificate with a private key. Some email servers block PKCS #12 files. Send Email: Click this to send the selected certificate. Cancel: Click this to return to the previous screen without saving your changes. Figure 468 Email My Certificate

#

Name This field displays the certificate index number. The certificates are listed in alphabetical order. This field displays the name used to identify this certificate. It is recommended that you give each certificate a unique name. ZyWALL ATP Series Users Guide 698 Chapter 35 Object Table 294 Configuration > Object > Certificate > My Certificates (continued) LABEL Type DESCRIPTION This field displays what kind of certificate this is. REQ represents a certification request and is not yet a valid certificate. Send a certification request to a certification authority, which then issues a certificate. Use the My Certificate Import screen to import the certificate and replace the request. SELF represents a self-signed certificate. CERT represents a certificate issued by a certification authority. This field displays identifying information about the certificates owner, such as CN (Common Name), OU (Organizational Unit or department), O (Organization or company) and C

(Country). It is recommended that each certificate have unique subject information. This field displays identifying information about the certificates issuing certification authority, such as a common name, organizational unit or department, organization or company and country. With self-signed certificates, this is the same information as in the Subject field. This field displays the date that the certificate becomes applicable. This field displays the date that the certificate expires. The text displays in red and includes an Expired! message if the certificate has expired. Click Import to open a screen where you can save a certificate to the Zyxel Device. Click Refresh to display the current validity status of the certificates. Subject Issuer Valid From Valid To Import Refresh 35.11.3.1 The My Certificates Add Screen Click Configuration > Object > Certificate > My Certificates and then the Add icon to open the My Certificates Add screen. Use this screen to have the Zyxel Device create a self-signed certificate, enroll a certificate with a certification authority or generate a certification request. ZyWALL ATP Series Users Guide 699 Chapter 35 Object Figure 469 Configuration > Object > Certificate > My Certificates > Add The following table describes the labels in this screen. Table 295 Configuration > Object > Certificate > My Certificates > Add LABEL Name Subject Information Organizational Unit DESCRIPTION Type a name to identify this certificate. You can use up to 31 alphanumeric and

;~!@#$%^&()_+[]{},.=- characters. Use these fields to record information that identifies the owner of the certificate. You do not have to fill in every field, although you must specify a Host IP Address, Host IPv6 Address, Host Domain Name, or E-Mail. The certification authority may add fields (such as a serial number) to the subject information when it issues a certificate. It is recommended that each certificate have unique subject information. Select a radio button to identify the certificates owner by IP address, domain name or email address. Type the IP address (in dotted decimal notation), domain name or email address in the field provided. The domain name or email address is for identification purposes only and can be any string. A domain name can be up to 255 characters. You can use alphanumeric characters, the hyphen and periods. An email address can be up to 63 characters. You can use alphanumeric characters, the hyphen, the @ symbol, periods and the underscore. Identify the organizational unit or department to which the certificate owner belongs. You can use up to 31 characters. You can use alphanumeric characters, the hyphen and the underscore. ZyWALL ATP Series Users Guide 700 Chapter 35 Object Table 295 Configuration > Object > Certificate > My Certificates > Add (continued) LABEL Organization DESCRIPTION Identify the company or group to which the certificate owner belongs. You can use up to 31 characters. You can use alphanumeric characters, the hyphen and the underscore. Identify the town or city where the certificate owner is located. You can use up to 31 characters. You can use alphanumeric characters, the hyphen and the underscore. Identify the state or province where the certificate owner is located. You can use up to 31 characters. You can use alphanumeric characters, the hyphen and the underscore. Identify the nation where the certificate owner is located. You can use up to 31 characters. You can use alphanumeric characters, the hyphen and the underscore. Select RSA to use the Rivest, Shamir and Adleman public-key algorithm. Select DSA to use the Digital Signature Algorithm public-key algorithm. Select a number from the drop-down list box to determine how many bits the key should use (512 to 2048). The longer the key, the more secure it is. A longer key also uses more PKI storage space. Select this to have Zyxel Device generate and store a request for server authentication certificate. Select this to have Zyxel Device generate and store a request for client authentication certificate. Select this to have Zyxel Device generate and store a request for IKE Intermediate authentication certificate. Select this to have the Zyxel Device generate the certificate and act as the Certification Authority (CA) itself. This way you do not need to apply to a certification authority for certificates. Select this to have the Zyxel Device generate and store a request for a certificate. Use the My Certificate Details screen to view the certification request and copy it to send to the certification authority. Copy the certification request from the My Certificate Details screen (see Section 35.11.3.2 on page 701) and then send it to the certification authority. Click OK to begin certificate or certification request generation. Click Cancel to quit and return to the My Certificates screen. Town (City) State, (Province) Country Key Type Key Length Extended Key Usage Server Authentication Client Authentication IKE Intermediate Create a self-signed certificate Create a certification request and save it locally for later manual enrollment OK Cancel If you configured the My Certificate Create screen to have the Zyxel Device enroll a certificate and the certificate enrollment is not successful, you see a screen with a Return button that takes you back to the My Certificate Create screen. Click Return and check your information in the My Certificate Create screen. Make sure that the certification authority information is correct and that your Internet connection is working properly if you want the Zyxel Device to enroll a certificate online. 35.11.3.2 The My Certificates Edit Screen Click Configuration > Object > Certificate > My Certificates and then the Edit icon to open the My Certificate Edit screen. You can use this screen to view in-depth certificate information and change the certificates name. ZyWALL ATP Series Users Guide 701 Chapter 35 Object Figure 470 Configuration > Object > Certificate > My Certificates > Edit The following table describes the labels in this screen. Table 296 Configuration > Object > Certificate > My Certificates > Edit LABEL Name DESCRIPTION This field displays the identifying name of this certificate. You can use up to 31 alphanumeric and ;~!@#$%^&()_+[]{},.=- characters. This field displays for a certificate, not a certification request. Click the Refresh button to have this read-only text box display the hierarchy of certification authorities that validate the certificate (and the certificate itself). Certification Path If the issuing certification authority is one that you have imported as a trusted certification authority, it may be the only certification authority in the list (along with the certificate itself). If the certificate is a self-signed certificate, the certificate itself is the only one in the list. The Zyxel Device does not trust the certificate and displays Not trusted in this field if any certificate on the path has expired or been revoked. Click Refresh to display the certification path. Refresh ZyWALL ATP Series Users Guide 702 Chapter 35 Object Table 296 Configuration > Object > Certificate > My Certificates > Edit (continued) LABEL Certificate Information Type DESCRIPTION These read-only fields display detailed information about the certificate. Signature Algorithm This field displays the type of algorithm that was used to sign the certificate. The Zyxel This field displays general information about the certificate. CA-signed means that a Certification Authority signed the certificate. Self-signed means that the certificates owner signed the certificate (not a certification authority). X.509 means that this certificate was created and signed according to the ITU-T X.509 recommendation that defines the formats for public-key certificates. This field displays the X.509 version number. This field displays the certificates identification number given by the certification authority or generated by the Zyxel Device. This field displays information that identifies the owner of the certificate, such as Common Name (CN), Organizational Unit (OU), Organization (O), State (ST), and Country (C). This field displays identifying information about the certificates issuing certification authority, such as Common Name, Organizational Unit, Organization and Country. With self-signed certificates, this is the same as the Subject Name field. none displays for a certification request. Device uses rsa-pkcs1-sha1 (RSA public-private key encryption algorithm and the SHA1 hash algorithm). Some certification authorities may use rsa-pkcs1-md5 (RSA public-private key encryption algorithm and the MD5 hash algorithm). This field displays the date that the certificate becomes applicable. none displays for a certification request. This field displays the date that the certificate expires. The text displays in red and includes an Expired! message if the certificate has expired. none displays for a certification request. This field displays the type of algorithm that was used to generate the certificates key pair

(the Zyxel Device uses RSA encryption) and the length of the key set in bits (1024 bits for example). This field displays the certificate owners IP address (IP), domain name (DNS) or email address (EMAIL). This field displays for what functions the certificates key can be used. For example, DigitalSignature means that the key can be used to sign certificates and KeyEncipherment means that the key can be used to encrypt text. Version Serial Number Subject Issuer Valid From Valid To Key Algorithm Subject Alternative Name Key Usage Extended Key Usage This field displays how the Zyxel Device generates and stores a request for server Basic Constraint MD5 Fingerprint SHA1 Fingerprint authentication, client authentication, or IKE Intermediate authentication certificate. This field displays general information about the certificate. For example, Subject Type=CA means that this is a certification authoritys certificate and Path Length Constraint=1 means that there can only be one certification authority in the certificates path. This field does not display for a certification request. This is the certificates message digest that the Zyxel Device calculated using the MD5 algorithm. This is the certificates message digest that the Zyxel Device calculated using the SHA1 algorithm. ZyWALL ATP Series Users Guide 703 Chapter 35 Object Table 296 Configuration > Object > Certificate > My Certificates > Edit (continued) LABEL Certificate in PEM

(Base-64) Encoded Format DESCRIPTION This read-only text box displays the certificate or certification request in Privacy Enhanced Mail (PEM) format. PEM uses lowercase letters, uppercase letters and numerals to convert a binary certificate into a printable form. You can copy and paste a certification request into a certification authoritys web page, an email that you send to the certification authority or a text editor and save the file on a management computer for later manual enrollment. You can copy and paste a certificate into an email to send to friends or colleagues or you can copy and paste a certificate into a text editor and save the file on a management computer for later distribution (via floppy disk for example). Use this button to save a copy of the certificate without its private key. Click this button and then Save in the File Download screen. The Save As screen opens, browse to the location that you want to use and click Save. If you want to export the certificate with its private key, create a password and type it here. Make sure you keep this password in a safe place. You will need to use it if you import the certificate to another device. Use this button to save a copy of the certificate with its private key. Type the certificates password and click this button. Click Save in the File Download screen. The Save As screen opens, browse to the location that you want to use and click Save. Click OK to save your changes back to the Zyxel Device. You can only change the name. Click Cancel to quit and return to the My Certificates screen. Export Certificate Only Password Export Certificate with Private Key OK Cancel 35.11.3.3 The My Certificates Import Screen Click Configuration > Object > Certificate > My Certificates > Import to open the My Certificate Import screen. Follow the instructions in this screen to save an existing certificate to the Zyxel Device. Note: You can import a certificate that matches a corresponding certification request that was generated by the Zyxel Device. You can also import a certificate in PKCS#12 format, including the certificates public and private keys. The certificate you import replaces the corresponding request in the My Certificates screen. You must remove any spaces from the certificates filename before you can import it. Figure 471 Configuration > Object > Certificate > My Certificates > Import ZyWALL ATP Series Users Guide 704 Chapter 35 Object The following table describes the labels in this screen. Table 297 Configuration > Object > Certificate > My Certificates > Import LABEL File Path DESCRIPTION Type in the location of the file you want to upload in this field or click Browse to find it. You cannot import a certificate with the same name as a certificate that is already in the Zyxel Device. Click Browse to find the certificate file you want to upload. This field only applies when you import a binary PKCS#12 format file. Type the files password that was created when the PKCS #12 file was exported. Click OK to save the certificate on the Zyxel Device. Click Cancel to quit and return to the My Certificates screen. Browse Password OK Cancel 35.11.4 The Trusted Certificates Screen Click Configuration > Object > Certificate > Trusted Certificates to open the Trusted Certificates screen. This screen displays a summary list of certificates that you have set the Zyxel Device to accept as trusted. The Zyxel Device also accepts any valid certificate signed by a certificate on this list as being trustworthy; thus you do not need to import any certificate that is signed by one of these certificates. Figure 472 Configuration > Object > Certificate > Trusted Certificates The following table describes the labels in this screen. Table 298 Configuration > Object > Certificate > Trusted Certificates LABEL PKI Storage Space in Use DESCRIPTION This bar displays the percentage of the Zyxel Devices PKI storage space that is currently in use. When the storage space is almost full, you should consider deleting expired or unnecessary certificates before adding more certificates. Double-click an entry or select it and click Edit to open a screen with an in-depth list of information about the certificate. The Zyxel Device keeps all of your certificates unless you specifically delete them. Uploading a new firmware or default configuration file does not delete your certificates. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Subsequent certificates move up by one when you take this action. You cannot delete certificates that any of the Zyxel Devices features are configured to use. Select an entry and click References to open a screen that shows which settings use the entry. This field displays the certificate index number. The certificates are listed in alphabetical order. Edit Remove References

#

ZyWALL ATP Series Users Guide 705 Chapter 35 Object Table 298 Configuration > Object > Certificate > Trusted Certificates (continued) LABEL Name Subject DESCRIPTION This field displays the name used to identify this certificate. This field displays identifying information about the certificates owner, such as CN (Common Name), OU (Organizational Unit or department), O (Organization or company) and C

(Country). It is recommended that each certificate have unique subject information. This field displays identifying information about the certificates issuing certification authority, such as a common name, organizational unit or department, organization or company and country. With self-signed certificates, this is the same information as in the Subject field. This field displays the date that the certificate becomes applicable. This field displays the date that the certificate expires. The text displays in red and includes an Expired! message if the certificate has expired. Click Import to open a screen where you can save the certificate of a certification authority that you trust, from your computer to the Zyxel Device. Click this button to display the current validity status of the certificates. Issuer Valid From Valid To Import Refresh 35.11.4.1 The Trusted Certificates Edit Screen Click Configuration > Object > Certificate > Trusted Certificates and then a certificates Edit icon to open the Trusted Certificates Edit screen. Use this screen to view in-depth information about the certificate, change the certificates name and set whether or not you want the Zyxel Device to check a certification authoritys list of revoked certificates before trusting a certificate issued by the certification authority. ZyWALL ATP Series Users Guide 706 Chapter 35 Object Figure 473 Configuration > Object > Certificate > Trusted Certificates > Edit ZyWALL ATP Series Users Guide 707 Chapter 35 Object The following table describes the labels in this screen. Table 299 Configuration > Object > Certificate > Trusted Certificates > Edit LABEL Name Certification Path Refresh Enable X.509v3 CRL Distribution Points and OCSP checking OCSP Server URL ID Password LDAP Server Address Port ID Password Certificate Information Type Version Serial Number Subject Issuer DESCRIPTION This field displays the identifying name of this certificate. You can change the name. You can use up to 31 alphanumeric and ;~!@#$%^&()_+[]{},.=- characters. Click the Refresh button to have this read-only text box display the end entitys certificate and a list of certification authority certificates that shows the hierarchy of certification authorities that validate the end entitys certificate. If the issuing certification authority is one that you have imported as a trusted certificate, it may be the only certification authority in the list (along with the end entitys own certificate). The Zyxel Device does not trust the end entitys certificate and displays Not trusted in this field if any certificate on the path has expired or been revoked. Click Refresh to display the certification path. Select this check box to turn on/off certificate revocation. When it is turned on, the Zyxel Device validates a certificate by getting Certificate Revocation List (CRL) through HTTP or LDAP (can be configured after selecting the LDAP Server check box) and online responder

(can be configured after selecting the OCSP Server check box). Select this check box if the directory server uses OCSP (Online Certificate Status Protocol). Type the protocol, IP address and path name of the OCSP server. The Zyxel Device may need to authenticate itself in order to assess the OCSP server. Type the login name (up to 31 ASCII characters) from the entity maintaining the server (usually a certification authority). Type the password (up to 31 ASCII characters) from the entity maintaining the OCSP server

(usually a certification authority). Select this check box if the directory server uses LDAP (Lightweight Directory Access Protocol). LDAP is a protocol over TCP that specifies how clients access directories of certificates and lists of revoked certificates. Type the IP address (in dotted decimal notation) of the directory server. Use this field to specify the LDAP server port number. You must use the same server port number that the directory server uses. 389 is the default server port number for LDAP. The Zyxel Device may need to authenticate itself in order to assess the CRL directory server. Type the login name (up to 31 ASCII characters) from the entity maintaining the server

(usually a certification authority). Type the password (up to 31 ASCII characters) from the entity maintaining the CRL directory server (usually a certification authority). These read-only fields display detailed information about the certificate. This field displays general information about the certificate. CA-signed means that a Certification Authority signed the certificate. Self-signed means that the certificates owner signed the certificate (not a certification authority). X.509 means that this certificate was created and signed according to the ITU-T X.509 recommendation that defines the formats for public-key certificates. This field displays the X.509 version number. This field displays the certificates identification number given by the certification authority. This field displays information that identifies the owner of the certificate, such as Common Name (CN), Organizational Unit (OU), Organization (O) and Country (C). This field displays identifying information about the certificates issuing certification authority, such as Common Name, Organizational Unit, Organization and Country. With self-signed certificates, this is the same information as in the Subject Name field. ZyWALL ATP Series Users Guide 708

 

 

Chapter 35 Object Table 299 Configuration > Object > Certificate > Trusted Certificates > Edit (continued) LABEL Signature Algorithm This field displays the type of algorithm that was used to sign the certificate. Some DESCRIPTION Valid From Valid To Key Algorithm Subject Alternative Name Key Usage Basic Constraint MD5 Fingerprint SHA1 Fingerprint Certificate certification authorities use rsa-pkcs1-sha1 (RSA public-private key encryption algorithm and the SHA1 hash algorithm). Other certification authorities may use rsa-pkcs1-md5 (RSA public-private key encryption algorithm and the MD5 hash algorithm). This field displays the date that the certificate becomes applicable. The text displays in red and includes a Not Yet Valid! message if the certificate has not yet become applicable. This field displays the date that the certificate expires. The text displays in red and includes an Expiring! or Expired! message if the certificate is about to expire or has already expired. This field displays the type of algorithm that was used to generate the certificates key pair

(the Zyxel Device uses RSA encryption) and the length of the key set in bits (1024 bits for example). This field displays the certificates owners IP address (IP), domain name (DNS) or email address (EMAIL). This field displays for what functions the certificates key can be used. For example, DigitalSignature means that the key can be used to sign certificates and KeyEncipherment means that the key can be used to encrypt text. authentication, client authentication, or IKE Intermediate authentication certificate. This field displays general information about the certificate. For example, Subject Type=CA means that this is a certification authoritys certificate and Path Length Constraint=1 means that there can only be one certification authority in the certificates path. This is the certificates message digest that the Zyxel Device calculated using the MD5 algorithm. You can use this value to verify with the certification authority (over the phone for example) that this is actually their certificate. This is the certificates message digest that the Zyxel Device calculated using the SHA1 algorithm. You can use this value to verify with the certification authority (over the phone for example) that this is actually their certificate. This read-only text box displays the certificate or certification request in Privacy Enhanced Mail (PEM) format. PEM uses lowercase letters, uppercase letters and numerals to convert a binary certificate into a printable form. Extended Key Usage This field displays the method that the Zyxel Device generates and stores a request for server You can copy and paste the certificate into an email to send to friends or colleagues or you can copy and paste the certificate into a text editor and save the file on a management computer for later distribution (via floppy disk for example). Click this button and then Save in the File Download screen. The Save As screen opens, browse to the location that you want to use and click Save. Click OK to save your changes back to the Zyxel Device. You can only change the name. Click Cancel to quit and return to the Trusted Certificates screen. Export Certificate OK Cancel 35.11.4.2 The Trusted Certificates Import Screen Click Configuration > Object > Certificate > Trusted Certificates > Import to open the Trusted Certificates Import screen. Follow the instructions in this screen to save a trusted certificate to the Zyxel Device. Note: You must remove any spaces from the certificates filename before you can import the certificate. ZyWALL ATP Series Users Guide 709 Chapter 35 Object Figure 474 Configuration > Object > Certificate > Trusted Certificates > Import The following table describes the labels in this screen. Table 300 Configuration > Object > Certificate > Trusted Certificates > Import LABEL File Path DESCRIPTION Type in the location of the file you want to upload in this field or click Browse to find it. You cannot import a certificate with the same name as a certificate that is already in the Zyxel Device. Click Browse to find the certificate file you want to upload. Click OK to save the certificate on the Zyxel Device. Click Cancel to quit and return to the previous screen. Browse OK Cancel 35.11.5 Certificates Technical Reference OCSP OCSP (Online Certificate Status Protocol) allows an application or device to check whether a certificate is valid. With OCSP the Zyxel Device checks the status of individual certificates instead of downloading a Certificate Revocation List (CRL). OCSP has two main advantages over a CRL. The first is real-time status information. The second is a reduction in network traffic since the Zyxel Device only gets information on the certificates that it needs to verify, not a huge list. When the Zyxel Device requests certificate status information, the OCSP server returns a expired, current or unknown response. 35.12 ISP Account Overview Use ISP accounts to manage Internet Service Provider (ISP) account information for PPPoE/PPTP/L2TP interfaces. An ISP account is a profile of settings for Internet access using PPPoE, PPTP or L2TP. Use the Object > ISP Account screens (Section 35.12.1 on page 710) to create and manage ISP accounts in the Zyxel Device. 35.12.1 ISP Account Summary This screen provides a summary of ISP accounts in the Zyxel Device. To access this screen, click Configuration > Object > ISP Account. ZyWALL ATP Series Users Guide 710 Chapter 35 Object Figure 475 Configuration > Object > ISP Account The following table describes the labels in this screen. See the ISP Account Add/Edit section below for more information as well. Table 301 Configuration > Object > ISP Account LABEL Add Edit Remove DESCRIPTION Click this to create a new entry. Double-click an entry or select it and click Edit to be able to modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Select an entry and click References to open a screen that shows which settings use the entry. This field is a sequential value, and it is not associated with a specific entry. This field displays the profile name of the ISP account. This name is used to identify the ISP account. This field displays the protocol used by the ISP account. This field displays the authentication type used by the ISP account. References

#

Profile Name Protocol Authentication Type User Name This field displays the user name of the ISP account. 35.12.1.1 ISP Account Add/Edit The ISP Account Add/Edit screen lets you add information about new accounts and edit information about existing accounts. To open this window, open the ISP Account screen. (See Section 35.12.1 on page 710.) Then, click on an Add icon or Edit icon to open the ISP Account Edit screen below. ZyWALL ATP Series Users Guide 711 Chapter 35 Object Figure 476 Configuration > Object > ISP Account > Edit The following table describes the labels in this screen. Table 302 Configuration > Object > ISP Account > Edit LABEL Profile Name DESCRIPTION This field is read-only if you are editing an existing account. Type in the profile name of the ISP account. The profile name is used to refer to the ISP account. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. This field is read-only if you are editing an existing account. Select the protocol used by the ISP account. Your ISP will provide you with a related username, password and IP (server) information. Options are:

pppoe - This ISP account uses the PPPoE protocol. pptp - This ISP account uses the PPTP protocol. l2tp - This ISP account uses the L2TP protocol. Use the drop-down list box to select an authentication protocol for outgoing calls. Options are:

CHAP/PAP - Your Zyxel Device accepts either CHAP or PAP when requested by this remote node. Chap - Your Zyxel Device accepts CHAP only. PAP - Your Zyxel Device accepts PAP only. MSCHAP - Your Zyxel Device accepts MSCHAP only. MSCHAP-V2 - Your Zyxel Device accepts MSCHAP-V2 only. This field is available if this ISP account uses the PPTP protocol. Use the drop-down list box to select the type of Microsoft Point-to-Point Encryption (MPPE). Options are:

nomppe - This ISP account does not use MPPE. mppe-40 - This ISP account uses 40-bit MPPE. mppe-128 - This ISP account uses 128-bit MMPE. Type the user name given to you by your ISP. Protocol Authentication Type Encryption Method User Name ZyWALL ATP Series Users Guide 712 Chapter 35 Object Table 302 Configuration > Object > ISP Account > Edit (continued) LABEL Password DESCRIPTION Type the password associated with the user name above. The password can only consist of alphanumeric characters (A-Z, a-z, 0-9). This field can be blank. Type your password again to make sure that you have entered is correctly. Retype to Confirm IP Address/FQDN Enter the IP address or Fully-Qualified Domain Name (FQDN) of the PPTP or L2TP server. Connection ID This field is available if this ISP account uses the PPTP protocol. Type your identification name for the PPTP server. This field can be blank. If this ISP account uses the PPPoE protocol, type the PPPoE service name to access. PPPoE uses the specified service name to identify and reach the PPPoE server. This field can be blank. If this ISP account uses the PPTP protocol, this field is not displayed. Select On button to turn on stac compression, and select Off to turn off stac compression. Stac compression is a data compression technique capable of compressing data by a factor of about four. This value specifies the number of seconds that must elapse without outbound traffic before the Zyxel Device automatically disconnects from the PPPoE/PPTP server. This value must be an integer between 0 and 360. If this value is zero, this timeout is disabled. Click OK to save your changes back to the Zyxel Device. If there are no errors, the program returns to the ISP Account screen. If there are errors, a message box explains the error, and the program stays in the ISP Account Edit screen. Click Cancel to return to the ISP Account screen without creating the profile (if it is new) or saving any changes to the profile (if it already exists). Service Name Compression Idle Timeout OK Cancel 35.13 DHCPv6 Overview This section describes how to configure DHCPv6 request type and lease type objects. The Request screen (see Section 35.13.1 on page 713) allows you to configure DHCPv6 request type objects. The Lease screen (see Section 35.2.3 on page 624) allows you to configure DHCPv6 lease type objects. 35.13.1 The DHCPv6 Request Screen The Request screen allows you to add, edit, and remove DHCPv6 request type objects. To access this screen, login to the Web Configurator, and click Configuration > Object > DHCPv6 > Request. Figure 477 Configuration > Object > DHCPv6 > Request ZyWALL ATP Series Users Guide 713 Chapter 35 Object The following table describes the labels in this screen. DESCRIPTION Table 303 Configuration > Object > DHCPv6 > Request LABEL Configuration Add Edit Click this to create a new entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Select an entry and click References to open a screen that shows which settings use the entry. This field is a sequential value, and it is not associated with a specific object. This field displays the name of each request object. This field displays the request type of each request object. This field displays the interface used for each request object. This field displays the value for each request object. Remove References

#

Name Type Interface Value 35.13.1.1 DHCPv6 Request Add/Edit Screen The Request Add/Edit screen allows you to create a new request object or edit an existing one. To access this screen, go to the Request screen (see Section 35.13.1 on page 713), and click either the Add icon or an Edit icon. Figure 478 Configuration > DHCPv6 > Request > Add The following table describes the labels in this screen. Table 304 Configuration > DHCPv6 > Request > Add LABEL Name DESCRIPTION Type the name for this request object. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-

sensitive. Select the request type for this request object. You can choose from Prefix Delegation, DNS Server, NTP Server, or SIP Server. Select the interface for this request object. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. Request Type Interface OK Cancel ZyWALL ATP Series Users Guide 714 Chapter 35 Object 35.13.2 The DHCPv6 Lease Screen The Lease screen allows you to add, edit, and remove DHCPv6 lease type objects. To access this screen, login to the Web Configurator, and click Configuration > Object > DHCPv6 > Lease. Figure 479 Configuration > Object > DHCPv6 > Lease The following table describes the labels in this screen. DESCRIPTION Table 305 Configuration > Object > DHCPv6 > Lease LABEL Configuration Add Edit Click this to create a new entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Select an entry and click References to open a screen that shows which settings use the entry. This field is a sequential value, and it is not associated with a specific object. This field displays the name of each lease object. This field displays the request type of each lease object. This field displays the interface used for each lease object. This field displays the value for each lease object. Remove References

#

Name Type Interface Value 35.13.2.1 DHCPv6 Lease Add/Edit Screen The Lease Add/Edit screen allows you to create a new lease object or edit an existing one. To access this screen, go to the Lease screen (see Section 35.13.2 on page 715), and click either the Add icon or an Edit icon. Figure 480 Configuration > DHCPv6 > Lease > Add ZyWALL ATP Series Users Guide 715 Chapter 35 Object The following table describes the labels in this screen. Table 306 Configuration > DHCPv6 > Lease > Add/Edit LABEL Name DESCRIPTION Type the name for this lease object. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-

sensitive. Select the lease type for this lease object. You can choose from Prefix Delegation, DNS Server, Address, Address Pool, NTP Server, or SIP Server. Select the interface for this lease object. If you select Prefix Delegation or Address in the Lease Type field, enter the DUID of the interface. If you select Address in the Lease Type field, enter the IP address of the DHCPv6 server. If you select Prefix Delegation or Address in the Lease Type field, enter the IPv6 prefix of the interface. If you select DNS Server in the Lease Type field, select a request object or User Defined in the DNS Server field and enter the IP address of the DNS server in the User Defined Address field below. If you select Address Pool in the Lease Type field, enter the first of the contiguous addresses in the IP address pool. If you select Address Pool in the Lease Type field, enter the last of the contiguous addresses in the IP address pool. If you select NTP Server in the Lease Type field, select a request object or User Defined in the NTP Server field and enter the IP address of the NTP server in the User Defined Address field below. If you select SIP Server in the Lease Type field, select a request object or User Defined in the SIP field and enter the IP address of the SIP server in the User Defined Address field below. If you select DNS Server, NTP Server, or SIP Server as your lease type, you must enter the IP address of the server your selected. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. Lease Type Interface DUID Address Prefix DNS Server Starting IP Address End IP Address NTP Server SIP Server User Defined Address OK Cancel ZyWALL ATP Series Users Guide 716 CHAPTER 36 Device HA 36.1 Device HA Overview Device HA lets a backup (or passive) Zyxel Device (B) automatically take over if the master (or active) Zyxel Device (A) fails. Figure 481 Device HA Backup Taking Over for the Master 36.1.1 What You Can Do in These Screens Use the Device HA Status screen (Section 36.2 on page 717) to see the license status for Device HA Pro, and see the status of the active and passive devices. Use the Device HA Pro screen (Section 36.3 on page 719) to configure Device HA Pro global settings, monitored interfaces and synchronization settings. Use the View Log screen (Section 36.4 on page 722) to see logs of the active and passive devices. 36.2 Device HA Status Use this screen to view Device HA Pro license status and details on the active and passive Zyxel Devices. Go to Configuration > Device HA > Device HA Status to view the following screen. ZyWALL USG Series Users Guide 717 Chapter 36 Device HA Figure 482 Configuration > Device HA > Device HA Status The following table describes the labels in this screen. Table 307 Configuration > Device HA > Device HA Status LABEL Active Device Status Health Status S/N Virtual MAC Synch Status Passive Device Status Health Status S/N Virtual MAC Synch Status Device HA Pro License DESCRIPTION This section displays information on the active Zyxel Device with an activated Device HA Pro license. This displays Off or On depending on whether Device HA Pro is disabled or enabled on the active Zyxel Device. This displays the serial number of the active Zyxel Device. This displays the hardware MAC address of the active Zyxel Device with an activated Device HA Pro license. This displays the synchronization progress, No Progress / Fail / Abort / Success / In Progress, between the active Zyxel Device with an activated Device HA Pro license and the passive Zyxel Device. This section displays information on the passive Zyxel Device with an activated Device HA Pro license. This displays Off or On depending on whether Device HA Pro is disabled or enabled on the passive Zyxel Device. This displays the serial number of the passive Zyxel Device. This displays the hardware MAC address of the passive Zyxel Device. This displays the synchronization progress, No Progress / Fail / Abort / Success / In Progress, between the passive Zyxel Device with an activated Device HA Pro license and the active Zyxel Device. These are the steps to activate a Device HA Pro license on your active and passive Zyxel Devices. 1. See your Device HA Pro iCard. The card contains two keys. 2. Register your active and passive Zyxel Devices at myZyxel. 3. Activate the license by entering one key on the active Zyxel Device and the other key on the passive Zyxel Device. It doesnt matter which Zyxel Device is actually active or passive as this is dynamic in Device HA Pro. ZyWALL USG Series Users Guide 718 Chapter 36 Device HA Table 307 Configuration > Device HA > Device HA Status (continued) LABEL DESCRIPTION This field displays whether a service license is enabled at myZyxel (Activated) or not

(Not Activated) or expired (Expired). It displays the remaining Grace Period if your license has Expired. It displays Not Licensed if there isnt a license to be activated for this service. If you need a license or a trial license has expired, click Buy to buy a new one. If a Standard license has expired, click Renew to extend the license. Then, click Activate to connect with the myZyxel server to activate the new license. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Service Status Apply Reset 36.3 Device HA Pro You need a license to use Device HA Pro. Device HA Pro is easier to deploy than Device HA, is more reliable (no risk of overloading), and faster (Device HA causes a connection break of 10~30 seconds while Device HA Pro just has 1~2 seconds). In addition to configuration file backup in Device HA, device time, TCP sessions (IPv4/IPv6), IPSec VPN sessions, login/logout information, DHCP table, IP/MAC binding table and license status can also be backed up using Device HA Pro. Active and Passive Devices Device HA Pro uses a dedicated heartbeat link between an active device (master) and a passive device (backup) for status syncing and backup to the passive device. On the passive device, all ports are disabled except for the port with the heartbeat link. In the following example, Zyxel Device A is the active device that is connected to passive device Zyxel Device B via a dedicated link that is used for heartbeat control, configuration synchronization and troubleshooting. All links on Zyxel Device B are down except for the dedicated heartbeat link. Note: The dedicated heartbeat link port must be the highest-numbered copper Ethernet port on each Zyxel Device for Device HA Pro to work. Figure 483 Device HA Pro Failover from the active Zyxel Device to the passive Zyxel Device is activated when:

A monitored interface is down. A monitored service (daemon) is down. The heartbeat link exceeds the failure tolerance. ZyWALL USG Series Users Guide 719 Chapter 36 Device HA After failover, the initial active Zyxel Device becomes the passive Zyxel Device after it recovers. 36.3.1 Deploying Device HA Pro 1 Register either the active or passive Zyxel Device with a Device HA Pro license at myZyxel. Check that its properly licensed in Licensing > Registration > Service in the active Zyxel Device. 2 Make sure the passive Zyxel Device is offline, then enable Device HA in Device HA > General in the passive Zyxel Device. 3 Must make sure the FTP port in System > FTP (default 21) is the same on both Zyxel Devices. FTP is used for transferring files in the event of failover from active to passive Zyxel Device. 4 Connect the passive Zyxel Device to the active Zyxel Device using the highest-numbered copper Ethernet ports on both Zyxel Devices. This is the heartbeat interface. Make sure that this interface is not already configured for other features such as LAG, VLAN, Bridge. 5 If both Zyxel Devices are turned on at the same time with Device HA enabled, then they may send the heartbeat at the same time. In this case, the Zyxel Device with the bigger MAC address becomes the passive Zyxel Device. 6 When using Device HA Pro to synchronize firmware, the location of the running firmware must be the same in both active and passive Zyxel Devices. For example, if the running firmware is in partition 1 in the active Zyxel Device (standby firmware in partition 2), then the running firmware must also be in partition 1 in the passive Zyxel Device (standby firmware in partition 2). 36.3.2 Configuring Device HA Pro Go to Configuration > Device HA > Device HA Pro and configure the following screen. ZyWALL USG Series Users Guide 720 Chapter 36 Device HA Figure 484 Configuration > Device HA > Device HA Pro The following table describes the labels in this screen. Table 308 Configuration > Device HA > Device HA Pro LABEL Enable Device HA Enable Configuration Provisioning From Active Device. DESCRIPTION Select this to turn the Zyxel Devices Device HA Pro feature on. Select this to have a passive Zyxel Device copy the active Zyxel Devices configuration, signatures (anti-malware, IDP/application patrol, botnet filter, and IP reputation), and certificates. Serial Number of Licensed Device for License Synchronization Active Device Management IP Passive Device Management IP Note: Only Zyxel Devices of the same model and firmware version can synchronize. Type the serial number of the Zyxel Device (active or passive) with the Device HA Pro subscribed license. Type the IPv4 address of the highest-numbered copper Ethernet port on the active Zyxel Device (the heartbeat dedicated link port). Type the IPv4 address of the highest-numbered copper Ethernet port on the passive Zyxel Device (the heartbeat dedicated link port). Note: The active and passive Zyxel Device Management IP addresses must be in the same subnet. Subnet Mask Type the subnet mask for the management IP addresses. ZyWALL USG Series Users Guide 721 Chapter 36 Device HA Table 308 Configuration > Device HA > Device HA Pro (continued) LABEL Password DESCRIPTION Type a synchronization password of between 1 and 32 single-byte printable characters. You will be prompted for the password before synchronization takes place. Type the exact same synchronization password as typed above. Type the number of seconds (1-10) allowed for absence of a heartbeat signal before a failure of the active Zyxel Device is recorded. Type the number of heartbeat failures allowed before failover is activated on the passive Zyxel Device. Select an interface in Available Interfaces and click the right-arrow button to move it to Monitor Interface to become a Device HA pro monitored interface. To remove a Device HA pro monitored interface, select it in Monitor Interface and click the left-

arrow button to move it to Available Interfaces. Select this to have the passive Zyxel Device take over when a monitored interface fails. Select this to have the passive Zyxel Device take over when a monitored service daemon on the active Zyxel Device fails. Click Apply to save your Device HA Pro configurations back to the Zyxel Device but keep the Zyxel Device using Device HA (general). Click Reset to return the screen to its last-saved settings. Retype to Confirm Heartbeat Interval Heartbeat Lost Tolerance Monitor Interface Failover Detection Enable Failover When Interface Failure

(Option) Enable Failover When Device Service Fails

(Option) Apply Reset 36.4 View Log Use this screen to see Device HA Pro logs on the active and passive Zyxel Devices. Go to Configuration > Device HA > View Log to display the following screen. ZyWALL USG Series Users Guide 722 Chapter 36 Device HA Figure 485 Configuration > Device HA > View Log The following table describes the labels in this screen. DESCRIPTION Table 309 Configuration > Device HA > View Log LABEL Logs Active Device Passive Device Refresh This displays Device HA Pro logs on the active Zyxel Device. This displays Device HA Pro logs on the passive Zyxel Device. Click Refresh to update information in this screen. ZyWALL USG Series Users Guide 723 CHAPTER 37 Cloud CNM 37.1 Cloud CNM Overview You need licenses to use Cloud CNM SecuManager and Cloud CNM SecuReporter. You need the SecuManager license to get a CNM ID with which you can access the SecuManager server. It is independent from the Zyxel Devices. The SecuReporter license must be activated on each Zyxel Device. 37.1.1 What You Can Do in this Chapter Use the Cloud CNM > SecuManager screen (Section 37.2 on page 724) to enable and configure management of the Zyxel Device by a Central Network Management system. Use the Cloud CNM > SecuReporter screen (Section 37.3 on page 727) to enable SecuReporter logging on your Zyxel Device, see license status, type, expiration date and access a link to the SecuReporter web portal. The SecuReporter web portal collects and analyzes logs from your Zyxel Device in order to identify anomalies, alert on potential internal / external threats, and report on network usage. 37.2 Cloud CNM SecuManager Cloud CNM SecuManager is a Virtual Machine-based (VM) management system that uses the TR-069 protocol to encapsulate commands to ZyWALL/USG devices for management and monitoring; these devices must have firmware that supports the TR-069 protocol. In the following figure, SP is the management service provider, while A and B are sites with devices being managed by SP. ZyWALL ATP Series Users Guide 724 Chapter 37 Cloud CNM Figure 486 Cloud CNM SecuManager Example Network Topology Cloud CNM SecuManager features include:

Batch import of managed devices at one time using one CSV file See an overview of all managed devices and system information in one place Monitor and manage devices Install firmware to multiple devices of the same model at one time Backup and restore device configuration View the location of managed devices on a map Receive notification for events and alarms, such as when a device goes down Graphically monitor individual devices and see related statistics Directly access a device for remote configuration Create four types of administrators with different privileges Perform Site-to-Site, Hub & Spoke, Fully-meshed and Remote Access VPN provisioning. To allow Cloud CNM SecuManager management of your Zyxel Device:

You must have a Cloud CNM SecuManager license with CNM ID number or a Cloud CNM SecuManager server URL. The Zyxel Device must be able to communicate with the Cloud CNM SecuManager server. You must configure Configuration > Cloud CNM > SecuManager to allow the Zyxel Device to find the Cloud CNM SecuManager server. ZyWALL ATP Series Users Guide 725 Chapter 37 Cloud CNM Figure 487 Configuration > Cloud CNM > SecuManager The following table describes the labels in this screen. Table 310 Configuration > Cloud CNM > SecuManager LABEL Show Advanced Settings / Hide Advanced Settings Enable Auto DESCRIPTION Click this button to display a greater or lesser number of configuration fields. Select this to allow management of the Zyxel Device by Cloud CNM SecuManager. Select this if your Cloud CNM SecuManager server can access myZyxel to automatically get the VM server URL from myZyxel. You also need CNM ID from the Cloud CNM SecuManager license. myZyxel associates the CNM ID with the CNM URL which identifies the server on which Cloud CNM SecuManager is installed. Therefore you dont need to enter the CNM URL when you select Auto. Select this if your Cloud CNM SecuManager server cannot access myZyxel. Select this if your VM server or Zyxel Device are in a private network, or if the VM server is behind a NAT router. You then need to manually enter the VM server URL into the Zyxel Device. Enter the IPv4 IP address of the Cloud CNM SecuManager server followed by the port number (default 7547 for HTTPS or 7549 for HTPP) followed by the CNM ID from the license in CNM URL. For example, if you installed Cloud CNM SecuManager on a server with IP address 1.1.1.1 and CNM ID V6ABQNTPYGD, then type 1.1.1.1:7547/

V6ABQNTPYG or 1.1.1.1:7549/V6ABQNTPYG as the CNM URL. Choose the CNM URL protocol: HTTP or HTTPS. If you enter 1.1.1.1:7547 as the CNM URL, you must choose HTTPS as the Transfer Protocol, and then the whole CNM URL is https://

1.1.1.1:7547. If you enter 1.1.1.1:7549 as the CNM URL, you must choose HTTP as the Transfer Protocol, and then the whole CNM URL is http://1.1.1.1:7549. Enable this to have the Zyxel Device inform the Cloud CNM SecuManager server of its presence at regular intervals. CNM URL Custom CNM URL Transfer Protocol Periodic Inform ZyWALL ATP Series Users Guide 726 Chapter 37 Cloud CNM Table 310 Configuration > Cloud CNM > SecuManager (continued) LABEL Interval HTTPS Authentication Server Certificate Apply Reset DESCRIPTION Type how often the Zyxel Device should inform Cloud CNM SecuManager server of its presence. Select the check box if you have a HTTPs server certificate. Select a certificate the HTTPS server (the Zyxel Device) uses to authenticate itself to the HTTPS client. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Note: See the Cloud CNM SecuManager Users Guide for more information on Cloud CNM SecuManager. 37.3 Cloud CNM SecuReporter Cloud CNM SecuReporter is a security analytics portal that collects and analyzes logs from SecuReporter-licensed Zyxel Devices in order to identify anomalies, alert on potential internal / external threats, and report on network usage. You need to buy a license for SecuReporter for your Zyxel Device and register it at myZyxel. You must be a registered user at myZyxel. You can access the portal from a web browser and also get notifications sent to an app on your mobile phone. ZyWALL ATP Series Users Guide 727 Chapter 37 Cloud CNM Figure 488 Cloud CNM SecuReporter Application Scenario How to activate and enable SecuReporter 1 Does Service Status displays Activated in the Configuration > Cloud CNM > SecuReporter screen? If not, you have to log in to myZyxel.com and activate the SecuReporter license for this Zyxel Device. The Zyxel Device must be able to communicate with the myZyxel server. Your SecuReporter license displays in Configuration > Licensing > Registration > Service after you activate the SecuReporter license at myZyxel. ZyWALL ATP Series Users Guide 728 Chapter 37 Cloud CNM Figure 489 Configuration > Licensing > Registration > Service 2 After the SecuReporter license is activated, go back to the Configuration > Cloud CNM > SecuReporter screen, and select the categories of logs that you want this Zyxel Device to send to the SecuReporter portal. 3 Select Enable SecuReporter. Do not go to the SecuReporter portal until after you have enabled SecuReporter on this Zyxel Devicee and applied the settings. You can also see license status, type, expiration date. 4 Click Apply and wait. How to add this Zyxel Device to SecuReporter 1 Log in to the SecuReporter portal. 2 Go to Settings > Organization & Devices > Add to create an organization. 3 Add this Zyxel Device to an Organization using the hyper link under Unclaimed Device. SecuReporter Banner The SecuReporter banner appears when:

1 2 SecuReporter hasnt been enabled before. The Zyxel Device is not added to an organization yet. Figure 490 SecuReporter Banner Click the Continue button in the SecuReporter banner to configure the SecuReporter settings. ZyWALL ATP Series Users Guide 729 Chapter 37 Cloud CNM Server Status: This is the connection status between the Zyxel Device and the SecuReporter server. This field shows Connected when the Zyxel Device can synchronize with the SecuReporter server. This field shows Timeout when the Zyxel Device cant synchronize with the SecuReporter server. This field shows Fail when the connection between the Zyxel Device and the SecuReporter server is down. Device Name: Enter the name of the Zyxel Device. This Zyxel Device will be added to a new or existing organization. Organization: This field appears if you havent created an organization in the SecuReporter server. Type a name of up to 255 characters and description to create a new organization. Select from existing organization: Select an existing organization from the drop-down list box to add the Zyxel Device to the selected organization. Create new organization: Type a name of up to 255 characters and description to create a new organization. Partially Anonymous: Select this and personal data, such as user names, MAC addresses, email addresses, and host names, will be replaced with artificial identifiers in downloaded logs. Fully Anonymous: Select this and personal data, such as user names, MAC addresses, email addresses, and host names, will be replaced with anonymized information in downloaded logs. Non-Anonymous: Select this and personal data, such as user names, MAC addresses, email addresses, and host names, will be identifiable in downloaded logs. Figure 491 SecuReporter Banner Settings Click Configuration > Cloud CNM > SecuReporter to open the following screen. ZyWALL ATP Series Users Guide 730 Chapter 37 Cloud CNM Figure 492 Configuration > Cloud CNM > SecuReporter The following table describes the labels in this screen. Table 311 Configuration > Cloud CNM > SecuReporter LABEL Enable SecuReporter DESCRIPTION Security-related logs are sent to the SecuReporter portal. Click the General Data Protection Regulation (GDPR) privacy link below to see the Zyxel privacy policy. This must be selected to have SecuReporter collect and analyze logs from this Zyxel Device. Its selected by default if you have activated a SecuReporter Standard license, You need to select this if you have a SecuReporter Trial license. This field is not available if you do not have a SecuReporter license. Select the categories of logs that you want this Zyxel Device to send to SecuReporter for analysis and trend spotting. Categories SecuReporter Service License Status Service Status This field displays whether a service license is enabled at myZyxel (Activated) or not (Not Activated) or expired (Expired). It displays the remaining Grace Period if your license has Expired. It displays Not Licensed if there isnt a license to be activated for this service. This field displays whether you applied for a trial application (Trial) or registered this service with your iCards PIN number (Standard). This field is blank when the service is not activated. This field displays the date your service expires. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Service Type Expiration Date Apply Reset ZyWALL ATP Series Users Guide 731 CHAPTER 38 System 38.1 Overview Use the system screens to configure general Zyxel Device settings. 38.1.1 What You Can Do in this Chapter Use the System > Host Name screen (see Section 38.2 on page 733) to configure a unique name for the Zyxel Device in your network. Use the System > USB Storage screen (see Section 38.3 on page 733) to configure the settings for the connected USB devices. Use the System > Date/Time screen (see Section 38.4 on page 734) to configure the date and time for the Zyxel Device. Use the System > Console Speed screen (see Section 38.5 on page 738) to configure the console port speed when you connect to the Zyxel Device via the console port using a terminal emulation program. Use the System > DNS screen (see Section 38.6 on page 739) to configure the DNS (Domain Name System) server used for mapping a domain name to its corresponding IP address and vice versa. Use the System > WWW screens (see Section 38.7 on page 749) to configure settings for HTTP or HTTPS access to the Zyxel Device and how the login and access user screens look. Use the System > SSH screen (see Section 38.8 on page 766) to configure SSH (Secure SHell) used to securely access the Zyxel Devices command line interface. You can specify which zones allow SSH access and from which IP address the access can come. Use the System > TELNET screen (see Section 38.9 on page 771) to configure Telnet to access the Zyxel Devices command line interface. Specify which zones allow Telnet access and from which IP address the access can come. Use the System > FTP screen (see Section 38.10 on page 773) to specify from which zones FTP can be used to access the Zyxel Device. You can also specify from which IP addresses the access can come. You can upload and download the Zyxel Devices firmware and configuration files using FTP. Your Zyxel Device can act as an SNMP agent, which allows a manager station to manage and monitor the Zyxel Device through the network. Use the System > SNMP screen (see Section 38.11 on page 775) to configure SNMP settings, including from which zones SNMP can be used to access the Zyxel Device. You can also specify from which IP addresses the access can come. Use the Auth. Server screen (Section 38.12 on page 781) to configure the Zyxel Device to operate as a RADIUS server. Use the Notification > Mail Server screen (Section 38.13 on page 783) to configure the Zyxel Device to operate as a RADIUS server. Use the Notification > SMS screen (Section 38.14 on page 785) to turn on the SMS service on the Zyxel Device in order to send dynamic guest account information in text messages and authorization for VPN tunnel access to a secured network. Use the System > Language screen (see Section 38.15 on page 786) to set a language for the Zyxel Devices Web Configurator screens. ZyWALL ATP Series Users Guide 732 Chapter 38 System Use the System > IPv6 screen (see Section 38.16 on page 787) to enable or disable IPv6 support on the Zyxel Device. Use the System > ZON screen (see Section 38.17 on page 787) to enable or disable the Zyxel One Network (ZON) utility that uses Zyxel Discovery Protocol (ZDP) for discovering and configuring ZDP-

aware Zyxel devices in the same network as the computer on which ZON is installed. Note: See each section for related background information and term definitions. 38.2 Host Name A host name is the unique name by which a device is known on a network. Click Configuration > System

> Host Name to open the Host Name screen. Figure 493 Configuration > System > Host Name The following table describes the labels in this screen. Table 312 Configuration > System > Host Name LABEL System Name DESCRIPTION Enter a descriptive name to identify your Zyxel Device device. This name can be up to 64 alphanumeric characters long. Spaces are not allowed, but dashes (-) underscores (_) and periods (.) are accepted. Enter the domain name (if you know it) here. This name is propagated to DHCP clients connected to interfaces with the DHCP server enabled. This name can be up to 254 alphanumeric characters long. Spaces are not allowed, but dashes - are accepted. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Domain Name Apply Reset 38.3 USB Storage The Zyxel Device can use a connected USB device to store the system log and other diagnostic information. Use this screen to turn on this feature and set a disk full warning limit. Note: Only connect one USB device. It must allow writing (it cannot be read-only) and use the FAT16, FAT32, EXT2, or EXT3 file system. ZyWALL ATP Series Users Guide 733 Chapter 38 System Click Configuration > System > USB Storage to open the screen as shown next. Figure 494 Configuration > System > USB Storage The following table describes the labels in this screen. DESCRIPTION Select this if you want to use the connected USB device(s). Table 313 Configuration > System > USB Storage LABEL Activate USB storage service Disk full warning when remaining space is less than Apply Reset Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Set a number and select a unit (MB or %) to have the Zyxel Device send a warning message when the remaining USB storage space is less than the value you set here. 38.4 Date and Time For effective scheduling and logging, the Zyxel Device system time must be accurate. The Zyxel Devices Real Time Chip (RTC) keeps track of the time and date. There is also a software mechanism to set the time manually or get the current time and date from an external server. To change your Zyxel Devices time based on your local time zone and date, click Configuration >

System > Date/Time. The screen displays as shown. You can manually set the Zyxel Devices time and date or have the Zyxel Device get the date and time from a time server. ZyWALL ATP Series Users Guide 734 Chapter 38 System Figure 495 Configuration > System > Date and Time The following table describes the labels in this screen. DESCRIPTION Table 314 Configuration > System > Date and Time LABEL Current Time and Date Current Time Current Date Time and Date Setup Manual This field displays the present time of your Zyxel Device. This field displays the present date of your Zyxel Device. New Time (hh-mm-

ss) Select this radio button to enter the time and date manually. If you configure a new time and date, time zone and daylight saving at the same time, the time zone and daylight saving will affect the new time and date you entered. When you enter the time settings manually, the Zyxel Device uses the new setting once you click Apply. This field displays the last updated time from the time server or the last time configured manually. When you set Time and Date Setup to Manual, enter the new time in this field and then click Apply. ZyWALL ATP Series Users Guide 735 Chapter 38 System Table 314 Configuration > System > Date and Time (continued) LABEL New Date (yyyy-

mm-dd) DESCRIPTION This field displays the last updated date from the time server or the last date configured manually. When you set Time and Date Setup to Manual, enter the new date in this field and then click Apply. Select this radio button to have the Zyxel Device get the time and date from the time server you specify below. The Zyxel Device requests time and date settings from the time server under the following circumstances. Get from Time Server Time Server Address Sync. Now Time Zone Setup Time Zone Automatically Sync Time Zone Daylight Saving Enable Daylight Savings Automatically adjust clock for Daylight Saving Time Start Date End Date When the Zyxel Device starts up. When you click Apply or Synchronize Now in this screen. 24-hour intervals after starting up. Enter the IP address or URL of your time server. Check with your ISP/network administrator if you are unsure of this information. Click this button to have the Zyxel Device get the time and date from a time server (see the Time Server Address field). This also saves your changes (except the daylight saving settings). Choose the time zone of your location. This will set the time difference between your time zone and Greenwich Mean Time (GMT). Select this for the Zyxel Device to automatically get its time zone. Daylight savings is a period from late spring to early fall when many countries set their clocks ahead of normal local time by one hour to give more daytime light in the evening. Select this option if you use Daylight Saving Time. Select this for the Zyxel Device to automatically adjust the time if daylight savings is implemented in its time zone. Configure the day and time when Daylight Saving Time starts if you selected Enable Daylight Saving. The at field uses the 24 hour format. Here are a couple of examples:

Daylight Saving Time starts in most parts of the United States on the second Sunday of March. Each time zone in the United States starts using Daylight Saving Time at 2 A.M. local time. So in the United States you would select Second, Sunday, March and type 2 in the at field. Daylight Saving Time starts in the European Union on the last Sunday of March. All of the time zones in the European Union start using Daylight Saving Time at the same moment (1 A.M. GMT or UTC). So in the European Union you would select Last, Sunday, March. The time you type in the at field depends on your time zone. In Germany for instance, you would type 2 because Germany's time zone is one hour ahead of GMT or UTC (GMT+1). Configure the day and time when Daylight Saving Time ends if you selected Enable Daylight Saving. The at field uses the 24 hour format. Here are a couple of examples:

Daylight Saving Time ends in the United States on the first Sunday of November. Each time zone in the United States stops using Daylight Saving Time at 2 A.M. local time. So in the United States you would select First, Sunday, November and type 2 in the at field. Daylight Saving Time ends in the European Union on the last Sunday of October. All of the time zones in the European Union stop using Daylight Saving Time at the same moment (1 A.M. GMT or UTC). So in the European Union you would select Last, Sunday, October. The time you type in the at field depends on your time zone. In Germany for instance, you would type 2 because Germany's time zone is one hour ahead of GMT or UTC (GMT+1). ZyWALL ATP Series Users Guide 736 Chapter 38 System Table 314 Configuration > System > Date and Time (continued) LABEL Offset DESCRIPTION Specify how much the clock changes when daylight saving begins and ends. Enter a number from 1 to 5.5 (by 0.5 increments). For example, if you set this field to 3.5, a log occurred at 6 P.M. in local official time will appear as if it had occurred at 10:30 P.M. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Apply Reset 38.4.1 Pre-defined NTP Time Servers List When you turn on the Zyxel Device for the first time, the date and time start at 2003-01-01 00:00:00. The Zyxel Device then attempts to synchronize with one of the following pre-defined list of Network Time Protocol (NTP) time servers. The Zyxel Device continues to use the following pre-defined list of NTP time servers if you do not specify a time server or it cannot synchronize with the time server you specified. Table 315 Default Time Servers 0.pool.ntp.org 1.pool.ntp.org 2.pool.ntp.org When the Zyxel Device uses the pre-defined list of NTP time servers, it randomly selects one server and tries to synchronize with it. If the synchronization fails, then the Zyxel Device goes through the rest of the list in order from the first one tried until either it is successful or all the pre-defined NTP time servers have been tried. 38.4.2 Time Server Synchronization Click the Synchronize Now button to get the time and date from the time server you specified in the Time Server Address field. When the Loading screen appears, you may have to wait up to one minute. Figure 496 Synchronization in Process The Current Time and Current Date fields will display the appropriate settings if the synchronization is successful. If the synchronization was not successful, a log displays in the View Log screen. Try re-configuring the Date/Time screen. To manually set the Zyxel Device date and time. 1 Click System > Date/Time. 2 Select Manual under Time and Date Setup. ZyWALL ATP Series Users Guide 737 Chapter 38 System 3 4 5 Enter the Zyxel Devices time in the New Time field. Enter the Zyxel Devices date in the New Date field. Under Time Zone Setup, select your Time Zone from the list. 6 As an option you can select the Enable Daylight Saving check box to adjust the Zyxel Device clock for daylight savings. 7 Click Apply. To get the Zyxel Device date and time from a time server 1 Click System > Date/Time. 2 3 Select Get from Time Server under Time and Date Setup. Under Time Zone Setup, select your Time Zone from the list. 4 As an option you can select the Enable Daylight Saving check box to adjust the Zyxel Device clock for daylight savings. 5 Under Time and Date Setup, enter a Time Server Address (Table 315 on page 737). 6 Click Apply. 38.5 Console Port Speed This section shows you how to set the console port speed when you connect to the Zyxel Device via the console port using a terminal emulation program. Click Configuration > System > Console Speed to open the Console Speed screen. Figure 497 Configuration > System > Console Speed ZyWALL ATP Series Users Guide 738 Chapter 38 System The following table describes the labels in this screen. Table 316 Configuration > System > Console Speed LABEL Console Port Speed Use the drop-down list box to change the speed of the console port. Your Zyxel Device DESCRIPTION supports 9600, 19200, 38400, 57600, and 115200 bps (default) for the console port. The Console Port Speed applies to a console port connection using terminal emulation software and NOT the Console in the Zyxel Device Web Configurator Status screen. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Apply Reset 38.6 DNS Overview DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa. The DNS server is extremely important because without it, you must know the IP address of a machine before you can access it. 38.6.1 DNS Server Address Assignment The Zyxel Device can get the DNS server addresses in the following ways. The ISP tells you the DNS server addresses, usually in the form of an information sheet, when you sign up. If your ISP gives you DNS server addresses, manually enter them in the DNS server fields. If your ISP dynamically assigns the DNS server IP addresses (along with the Zyxel Devices WAN IP address), set the DNS server fields to get the DNS server address from the ISP. You can manually enter the IP addresses of other DNS servers. 38.6.2 Configuring the DNS Screen Click Configuration > System > DNS to change your Zyxel Devices DNS settings. Use the DNS screen to configure the Zyxel Device to use a DNS server to resolve domain names for Zyxel Device system features like VPN, DDNS and the time server. You can also configure the Zyxel Device to accept or discard DNS queries. Use the Network > Interface screens to configure the DNS server information that the Zyxel Device sends to the specified DHCP client devices. A name query begins at a client computer and is passed to a resolver, a DNS client service, for resolution. The Zyxel Device can be a DNS client service. The Zyxel Device can resolve a DNS query locally using cached Resource Records (RR) obtained from a previous query (and kept for a period of time). If the Zyxel Device does not have the requested information, it can forward the request to DNS servers. This is known as recursion. The Zyxel Device can ask a DNS server to use recursion to resolve its DNS client requests. If recursion on the Zyxel Device or a DNS server is disabled, they cannot forward DNS requests for resolution. A Domain Name Server (DNS) amplification attack is a kind of Distributed Denial of Service (DDoS) attack that uses publicly accessible open DNS servers to flood a victim with DNS response traffic. An open DNS server is a DNS server which is willing to resolve recursive DNS queries from anyone on the Internet. ZyWALL ATP Series Users Guide 739 Chapter 38 System In a DNS amplification attack, an attacker sends a DNS name lookup request to an open DNS server with the source address spoofed as the victims address. When the DNS server sends the DNS record response, it is sent to the victim. Attackers can request as much information as possible to maximize the amplification effect. Configure the Security Option Control section in the Configuration > System > DNS screen (click Show Advanced Settings to display it) if you suspect the Zyxel Device is being used (either by hackers or by a corrupted open DNS server) in a DNS amplification attack. Figure 498 Configuration > System > DNS ZyWALL ATP Series Users Guide 740 Chapter 38 System The following table describes the labels in this screen. Table 317 Configuration > System > DNS LABEL Address/PTR Record Add Edit Remove

#

FQDN IP Address CNAME Record Add Edit Remove

#

Alias Name FQDN Domain Zone Forwarder Add Edit Remove Move

#

DESCRIPTION This record specifies the mapping of a Fully-Qualified Domain Name (FQDN) to an IP address. An FQDN consists of a host and domain name. For example, www.zyxel.com.tw is a fully qualified domain name, where www is the host, zyxel is the third-level domain, com is the second-level domain, and tw is the top level domain. Click this to create a new entry. Double-click an entry or select it and click Edit to be able to modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Note that subsequent entries move up by one when you take this action. This is the index number of the address/PTR record. This is a hosts fully qualified domain name. This is the IP address of a host. This record specifies an alias for a FQDN. Use this record to bind all subdomains with the same IP address as the FQDN without having to update each one individually, which increases chance for errors. See CNAME Record (Section 38.6.6 on page 744) for more details. Click this to create a new entry. Double-click an entry or select it and click Edit to be able to modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Note that subsequent entries move up by one when you take this action. This is the index number of the domain zone forwarder record. The ordering of your rules is important as rules are applied in sequence. A hyphen (-) displays for the default domain zone forwarder record. The default record is not configurable. The Zyxel Device uses this default record if the domain zone that needs to be resolved does not match any of the other domain zone forwarder records. Enter an Alias name. Use *. as prefix for a wildcard domain name. For example,

*.example.com. Enter the Fully Qualified Domain Name (FQDN). This specifies a DNS servers IP address. The Zyxel Device can query the DNS server to resolve domain zones for features like VPN, DDNS and the time server. When the Zyxel Device needs to resolve a domain zone, it checks it against the domain zone forwarder entries in the order that they appear in this list. Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry. Double-click an entry or select it and click Edit to be able to modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Note that subsequent entries move up by one when you take this action. To change an entrys position in the numbered list, select the method and click Move to display a field to type a number for where you want to put it and press [ENTER] to move the rule to the number that you typed. This is the index number of the domain zone forwarder record. The ordering of your rules is important as rules are applied in sequence. A hyphen (-) displays for the default domain zone forwarder record. The default record is not configurable. The Zyxel Device uses this default record if the domain zone that needs to be resolved does not match any of the other domain zone forwarder records. ZyWALL ATP Series Users Guide 741 Chapter 38 System Table 317 Configuration > System > DNS (continued) LABEL Domain Zone Type DNS Server Query Via MX Record (for My FQDN) Add Edit Remove

#

Domain Name IP/FQDN Security Option Control Edit Priority Name Address Additional Info from Cache Query Recursion Service Control Add Edit Remove Move DESCRIPTION A domain zone is a fully qualified domain name without the host. For example, zyxel.com.tw is the domain zone for the www.zyxel.com.tw fully qualified domain name. A * means all domain zones. This displays whether the DNS server IP address is assigned by the ISP dynamically through a specified interface or configured manually (User-Defined). This is the IP address of a DNS server. This field displays N/A if you have the Zyxel Device get a DNS server IP address from the ISP dynamically but the specified interface is not active. This is the interface through which the Zyxel Device sends DNS queries to the entrys DNS server. If the Zyxel Device connects through a VPN tunnel, tunnel displays. A MX (Mail eXchange) record identifies a mail server that handles the mail for a particular domain. Click this to create a new entry. Double-click an entry or select it and click Edit to be able to modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Note that subsequent entries move up by one when you take this action. This is the index number of the MX record. This is the domain name where the mail is destined for. This is the IP address or Fully-Qualified Domain Name (FQDN) of a mail server that handles the mail for the domain specified in the field above. Click Show Advanced Settings to display this part of the screen. There are two control policies: Default and Customize. Click either control policy and then click this button to change allow or deny actions for Query Recursion and Additional Info from Cache. The Customize control policy is checked first and if an address object match is not found, the Default control policy is checked. You may change the name of the Customize control policy. These are the object addresses used in the control policy. RFC1918 refers to private IP address ranges. It can be modified in Object > Address. This displays if the Zyxel Device is allowed or denied to cache Resource Records (RR) obtained from previous DNS queries. This displays if the Zyxel Device is allowed or denied to forward DNS client requests to DNS servers for resolution. This specifies from which computers and zones you can send DNS queries to the Zyxel Device. Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry. Double-click an entry or select it and click Edit to be able to modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Note that subsequent entries move up by one when you take this action. To change an entrys position in the numbered list, select the method and click Move to display a field to type a number for where you want to put it and press [ENTER] to move the rule to the number that you typed. ZyWALL ATP Series Users Guide 742 Chapter 38 System Table 317 Configuration > System > DNS (continued) LABEL

#

DESCRIPTION This the index number of the service control rule. The ordering of your rules is important as rules are applied in sequence. The entry with a hyphen (-) instead of a number is the Zyxel Devices (non-configurable) default policy. The Zyxel Device applies this to traffic that does not match any other configured rule. It is not an editable rule. To apply other behavior, configure a rule that traffic will match so the Zyxel Device will not have to use the default policy. This is the zone on the Zyxel Device the user is allowed or denied to access. This is the object name of the IP address(es) with which the computer is allowed or denied to send DNS queries. This displays whether the Zyxel Device accepts DNS queries from the computer with the IP address specified above through the specified zone (Accept) or discards them (Deny). Zone Address Action 38.6.3 (IPv6) Address Record An address record contains the mapping of a Fully-Qualified Domain Name (FQDN) to an IP address. The Zyxel Device allows you to configure address records about the Zyxel Device itself or another device. This way you can keep a record of DNS names and addresses that people on your network may use frequently. If the Zyxel Device receives a DNS query for an FQDN for which the Zyxel Device has an address record, the Zyxel Device can send the IP address in a DNS response without having to query a DNS name server. 38.6.4 PTR Record A PTR (pointer) record is also called a reverse record or a reverse lookup record. It is a mapping of an IP address to a domain name. 38.6.5 Adding an (IPv6) Address/PTR Record Click the Add icon in the Address/PTR Record or IPv6 Address/PTR Record table to add an IPv4 or IPv6 address/PTR record. Figure 499 Configuration > System > DNS > Address/PTR Record Edit ZyWALL ATP Series Users Guide 743 Chapter 38 System The following table describes the labels in this screen. Table 318 Configuration > System > DNS > (IPv6) Address/PTR Record Edit LABEL FQDN DESCRIPTION Type a Fully-Qualified Domain Name (FQDN) of a server. An FQDN starts with a host name and continues all the way up to the top-level domain name. For example, www.zyxel.com.tw is a fully qualified domain name, where www is the host, zyxel is the third-level domain, com is the second-level domain, and tw is the top level domain. Underscores are not allowed. IP Address OK Cancel Use "*." as a prefix in the FQDN for a wildcard domain name (for example, *.example.com). Enter the IP address of the host in dotted decimal notation. Click OK to save your customized settings and exit this screen. Click Cancel to exit this screen without saving. 38.6.6 CNAME Record A Canonical Name Record or CNAME record is a type of resource record in the Domain Name System

(DNS) that specifies that the domain name is an alias of another, canonical domain name. This allows users to set up a record for a domain name which translates to an IP address, in other words, the domain name is an alias of another. This record also binds all the subdomains to the same IP address without having to create a record for each, so when the IP address is changed, all subdomains IP address is updated as well, with one edit to the record. For example, the domain name zyxel.com is hooked up to a record named A which translates it to 11.22.33.44. You also have several subdomains, like mail.zyxel.com, ftp.zyxel.com and you want this subdomain to point to your main domain zyxel.com. Edit the IP Address in record A and all subdomains will follow automatically. This eliminates chances for errors and increases efficiency in DNS management. 38.6.7 Adding a CNAME Record Click the Add icon in the CNAME Record table to add a record. Use *. as a prefix for a wildcard domain name. For example *.zyxel.com. Figure 500 Configuration > System > DNS > CNAME Record > Add ZyWALL ATP Series Users Guide 744 Chapter 38 System The following table describes the labels in this screen. Table 319 Configuration > System > DNS > CNAME Record > Add LABEL Alias name DESCRIPTION Enter an Alias Name. Use "*." as a prefix in the Alias name for a wildcard domain name (for example, *.example.com). Type a Fully-Qualified Domain Name (FQDN) of a server. An FQDN starts with a host name and continues all the way up to the top-level domain name. For example, www.zyxel.com.tw is a fully qualified domain name, where www is the host, zyxel is the third-level domain, com is the second-level domain, and tw is the top level domain. Underscores are not allowed. Use "*." as a prefix in the FQDN for a wildcard domain name (for example,

*.example.com). Click OK to save your customized settings and exit this screen. Click Cancel to exit this screen without saving. FQDN OK Cancel 38.6.8 Domain Zone Forwarder A domain zone forwarder contains a DNS servers IP address. The Zyxel Device can query the DNS server to resolve domain zones for features like VPN, DDNS and the time server. A domain zone is a fully qualified domain name without the host. For example, zyxel.com.tw is the domain zone for the www.zyxel.com.tw fully qualified domain name. 38.6.9 Adding a Domain Zone Forwarder Click the Add icon in the Domain Zone Forwarder table to add a domain zone forwarder record. Figure 501 Configuration > System > DNS > Domain Zone Forwarder Add ZyWALL ATP Series Users Guide 745 Chapter 38 System The following table describes the labels in this screen. Table 320 Configuration > System > DNS > Domain Zone Forwarder Add LABEL Domain Zone DESCRIPTION A domain zone is a fully qualified domain name without the host. For example, zyxel.com.tw is the domain zone for the www.zyxel.com.tw fully qualified domain name. For example, whenever the Zyxel Device receives needs to resolve a zyxel.com.tw domain name, it can send a query to the recorded name server IP address. Enter * if all domain zones are served by the specified DNS server(s). Select DNS Server(s) from ISP if your ISP dynamically assigns DNS server information. You also need to select an interface through which the ISP provides the DNS server IP address(es). The interface should be activated and set to be a DHCP client. The fields below display the (read-

only) DNS server IP address(es) that the ISP assigns. N/A displays for any DNS server IP address fields for which the ISP does not assign an IP address. Select Public DNS Server if you have the IP address of a DNS server. Enter the DNS server's IP address in the field to the right. The Zyxel Device must be able to connect to the DNS server without using a VPN tunnel. The DNS server could be on the Internet or one of the Zyxel Devices local networks. You cannot use 0.0.0.0. Use the Query via field to select the interface through which the Zyxel Device sends DNS queries to a DNS server. Select Private DNS Server if you have the IP address of a DNS server to which the Zyxel Device connects through a VPN tunnel. Enter the DNS server's IP address in the field to the right. You cannot use 0.0.0.0. Click OK to save your customized settings and exit this screen. Click Cancel to exit this screen without saving. DNS Server OK Cancel 38.6.10 MX Record A MX (Mail eXchange) record indicates which host is responsible for the mail for a particular domain, that is, controls where mail is sent for that domain. If you do not configure proper MX records for your domain or other domain, external email from other mail servers will not be able to be delivered to your mail server and vice versa. Each host or domain can have only one MX record, that is, one domain is mapping to one host. 38.6.11 Adding a MX Record Click the Add icon in the MX Record table to add a MX record. Figure 502 Configuration > System > DNS > MX Record Add ZyWALL ATP Series Users Guide 746 Chapter 38 System The following table describes the labels in this screen. Table 321 Configuration > System > DNS > MX Record Add LABEL Domain Name IP Address/FQDN DESCRIPTION Enter the domain name where the mail is destined for. Enter the IP address or Fully-Qualified Domain Name (FQDN) of a mail server that handles the mail for the domain specified in the field above. Click OK to save your customized settings and exit this screen. Click Cancel to exit this screen without saving. OK Cancel 38.6.12 Security Option Control Configure the Security Option Control section in the Configuration > System > DNS screen (click Show Advanced Settings to display it) if you suspect the Zyxel Device is being used by hackers in a DNS amplification attack. One possible strategy would be to deny Query Recursion and Additional Info from Cache in the default policy and allow Query Recursion and Additional Info from Cache only from trusted DNS servers identified by address objects and added as members in the customized policy. 38.6.13 Editing a Security Option Control Click a control policy and then click Edit to change allow or deny actions for Query Recursion and Additional Info from Cache. Figure 503 Configuration > System > DNS > Security Option Control Edit (Customize) ZyWALL ATP Series Users Guide 747 Chapter 38 System The following table describes the labels in this screen. Table 322 Configuration > System > DNS > Security Option Control Edit (Customize) LABEL Name DESCRIPTION You may change the name for the customized security option control policy. The customized security option control policy is checked first and if an address object match is not found, the Default control policy is checked. Choose if the ZyWALL/USG is allowed or denied to forward DNS client requests to DNS servers for resolution. This can apply to specific open DNS servers using the address objects in a customized rule. Choose if the ZyWALL/USG is allowed or denied to cache Resource Records (RR) obtained from previous DNS queries. Specifying address objects is not available in the default policy as all addresses are included. This box displays address objects created in Object > Address. Select one (or more), and click the > arrow to have it (them) join the Member list of address objects that will apply to this rule. For example, you could specify an open DNS server suspect of sending compromised resource records by adding an address object for that server to the member list. This box displays address objects that will apply to this rule. Click OK to save your customized settings and exit this screen. Click Cancel to exit this screen without saving. Query Recursion Additional Info from Cache Address List Available Member OK Cancel 38.6.14 Adding a DNS Service Control Rule Click the Add icon in the Service Control table to add a service control rule. Figure 504 Configuration > System > DNS > Service Control Rule Add The following table describes the labels in this screen. Table 323 Configuration > System > DNS > Service Control Rule Add LABEL Create new Object Address Object DESCRIPTION Use this to configure any new settings objects that you need to use in this screen. Select ALL to allow or deny any computer to send DNS queries to the Zyxel Device. Select a predefined address object to just allow or deny the computer with the IP address that you specified to send DNS queries to the Zyxel Device. Select ALL to allow or prevent DNS queries through any zones. Zone Select a predefined zone on which a DNS query to the Zyxel Device is allowed or denied. ZyWALL ATP Series Users Guide 748 Chapter 38 System Table 323 Configuration > System > DNS > Service Control Rule Add (continued) LABEL Action DESCRIPTION Select Accept to have the Zyxel Device allow the DNS queries from the specified computer. Select Deny to have the Zyxel Device reject the DNS queries from the specified computer. Click OK to save your customized settings and exit this screen. Click Cancel to exit this screen without saving. OK Cancel 38.7 WWW Overview The following figure shows secure and insecure management of the Zyxel Device coming in from the WAN. HTTPS and SSH access are secure. HTTP and Telnet access are not secure. Note: To allow the Zyxel Device to be accessed from a specified computer using a service, make sure you do not have a service control rule or to-Zyxel Device security policy rule to block that traffic. To stop a service from accessing the Zyxel Device, clear Enable in the corresponding service screen. 38.7.1 Service Access Limitations A service cannot be used to access the Zyxel Device when:

You have disabled that service in the corresponding screen. The allowed IP address (address object) in the Service Control table does not match the client IP address (the Zyxel Device disallows the session). The IP address (address object) in the Service Control table is not in the allowed zone or the action is set to Deny. There is a security policy rule that blocks it. 1 2 3 4 38.7.2 System Timeout There is a lease timeout for administrators. The Zyxel Device automatically logs you out if the management session remains idle for longer than this timeout period. The management session does not time out when a statistics screen is polling. Each user is also forced to log in the Zyxel Device for authentication again when the reauthentication time expires. You can change the timeout settings in the User/Group screens. 38.7.3 HTTPS You can set the Zyxel Device to use HTTP or HTTPS (HTTPS adds security) for Web Configurator sessions. Specify which zones allow Web Configurator access and from which IP address the access can come. ZyWALL ATP Series Users Guide 749 Chapter 38 System HTTPS (HyperText Transfer Protocol over Secure Socket Layer, or HTTP over SSL) is a web protocol that encrypts and decrypts web pages. Secure Socket Layer (SSL) is an application-level protocol that enables secure transactions of data by ensuring confidentiality (an unauthorized party cannot read the transferred data), authentication (one party can identify the other party) and data integrity (you know if data has been changed). It relies upon certificates, public keys, and private keys. HTTPS on the Zyxel Device is used so that you can securely access the Zyxel Device using the Web Configurator. The SSL protocol specifies that the HTTPS server (the Zyxel Device) must always authenticate itself to the HTTPS client (the computer which requests the HTTPS connection with the Zyxel Device), whereas the HTTPS client only should authenticate itself when the HTTPS server requires it to do so (select Authenticate Client Certificates in the WWW screen). Authenticate Client Certificates is optional and if selected means the HTTPS client must send the Zyxel Device a certificate. You must apply for a certificate for the browser from a CA that is a trusted CA on the Zyxel Device. Please refer to the following figure. 1 2 HTTPS connection requests from an SSL-aware web browser go to port 443 (by default) on the Zyxel Devices web server. HTTP connection requests from a web browser go to port 80 (by default) on the Zyxel Devices web server. Figure 505 HTTP/HTTPS Implementation Note: If you disable HTTP in the WWW screen, then the Zyxel Device blocks all HTTP connection attempts. 38.7.4 Configuring WWW Service Control Click Configuration > System > WWW to open the WWW screen. Use this screen to specify from which zones you can access the Zyxel Device using HTTP or HTTPS. You can also specify which IP addresses the access can come from. Note: Admin Service Control deals with management access (to the Web Configurator). User Service Control deals with user access to the Zyxel Device (logging into SSL VPN for example). ZyWALL ATP Series Users Guide 750 Chapter 38 System Figure 506 Configuration > System > WWW > Service Control The following table describes the labels in this screen. Table 324 Configuration > System > WWW > Service Control LABEL HTTPS Enable DESCRIPTION Select the check box to allow or disallow the computer with the IP address that matches the IP address(es) in the Service Control table to access the Zyxel Device Web Configurator using secure HTTPs connections. ZyWALL ATP Series Users Guide 751 Chapter 38 System Table 324 Configuration > System > WWW > Service Control (continued) LABEL Server Port Authenticate Client Certificates Server Certificate Redirect HTTP to HTTPS Admin/User Service Control Add Edit Remove Move

#

Zone Address Action HTTP Enable Server Port Admin/User Service Control Add DESCRIPTION The HTTPS server listens on port 443 by default. If you change the HTTPS server port to a different number on the Zyxel Device, for example 8443, then you must notify people who need to access the Zyxel Device Web Configurator to use https://Zyxel Device IP Address:8443 as the URL. Select Authenticate Client Certificates (optional) to require the SSL client to authenticate itself to the Zyxel Device by sending the Zyxel Device a certificate. To do that the SSL client must have a CA-signed certificate from a CA that has been imported as a trusted CA on the Zyxel Device (see Section 38.7.7.5 on page 761 on importing certificates for details). Select a certificate the HTTPS server (the Zyxel Device) uses to authenticate itself to the HTTPS client. You must have certificates already configured in the My Certificates screen. To allow only secure Web Configurator access, select this to redirect all HTTP connection requests to the HTTPS server. Admin Service Control specifies from which zones an administrator can use HTTPS to manage the Zyxel Device (using the Web Configurator). You can also specify the IP addresses from which the administrators can manage the Zyxel Device. User Service Control specifies from which zones a user can use HTTPS to log into the Zyxel Device (to log into SSL VPN for example). You can also specify the IP addresses from which the users can access the Zyxel Device. Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry. Double-click an entry or select it and click Edit to be able to modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Note that subsequent entries move up by one when you take this action. To change an entrys position in the numbered list, select the method and click Move to display a field to type a number for where you want to put it and press [ENTER] to move the rule to the number that you typed. This is the index number of the service control rule. The entry with a hyphen (-) instead of a number is the Zyxel Devices (non-configurable) default policy. The Zyxel Device applies this to traffic that does not match any other configured rule. It is not an editable rule. To apply other behavior, configure a rule that traffic will match so the Zyxel Device will not have to use the default policy. This is the zone on the Zyxel Device the user is allowed or denied to access. This is the object name of the IP address(es) with which the computer is allowed or denied to access. This displays whether the computer with the IP address specified above can access the Zyxel Device zone(s) configured in the Zone field (Accept) or not (Deny). Select the check box to allow or disallow the computer with the IP address that matches the IP address(es) in the Service Control table to access the Zyxel Device Web Configurator using HTTP connections. You may change the server port number for a service if needed, however you must use the same port number in order to use that service to access the Zyxel Device. Admin Service Control specifies from which zones an administrator can use HTTP to manage the Zyxel Device (using the Web Configurator). You can also specify the IP addresses from which the administrators can manage the Zyxel Device. User Service Control specifies from which zones a user can use HTTP to log into the Zyxel Device (to log into SSL VPN for example). You can also specify the IP addresses from which the users can access the Zyxel Device. Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry. ZyWALL ATP Series Users Guide 752 Chapter 38 System Table 324 Configuration > System > WWW > Service Control (continued) LABEL Edit Remove DESCRIPTION Double-click an entry or select it and click Edit to be able to modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Note that subsequent entries move up by one when you take this action. To change an entrys position in the numbered list, select the method and click Move to display a field to type a number for where you want to put it and press [ENTER] to move the rule to the number that you typed. This is the index number of the service control rule. Move

#

Zone Address Action Authentication Client Authentication Method Other Enable Content Filter HTTPS Domain Filter Block/Warn Page Block/Warn Page Port Apply Reset The entry with a hyphen (-) instead of a number is the Zyxel Devices (non-configurable) default policy. The Zyxel Device applies this to traffic that does not match any other configured rule. It is not an editable rule. To apply other behavior, configure a rule that traffic will match so the Zyxel Device will not have to use the default policy. This is the zone on the Zyxel Device the user is allowed or denied to access. This is the object name of the IP address(es) with which the computer is allowed or denied to access. This displays whether the computer with the IP address specified above can access the Zyxel Device zone(s) configured in the Zone field (Accept) or not (Deny). Select a method the HTTPS or HTTP server uses to authenticate a client. You must have configured the authentication methods in the Auth. method screen. When HTTPS Domain Filter blocks a page, the connection is redirected to a local web server to display the blocking message. HSTS (HTTP Strict Transport Security) may be activated in some browsers as the browser cached certificate is different to the one displayed by the local server. In this case, you cannot see a blocking warning message. Accessing a web page may require multiple connections to different sites to get all the information in the web page. When there is a connection to a HTTPS website that belongs to a blocked category, it is filtered, but you don't receive a warning page with the option to continue. For example, you want to block www.google.com and issue a Warn action. When you connect to www.google.com another connection to pic.google.com is created to get the pictures on the Google page. www.google.com can display a warning page in your browser (and you can click Continue to forward the connection) but the connection to pic.google.com cannot display a Continue dialog, so parts of the Google page will appear blank and will not display the related picture content. Use this field to have the Zyxel Device display a warning page instead of a blank page when an HTPPS connection is redirected. Use the default port number as displayed for the warning page. If you change it, the new port number should be unique. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. 38.7.5 Service Control Rules Click Add or Edit in the Service Control table in a WWW, SSH, Telnet, FTP or SNMP screen to add a service control rule. ZyWALL ATP Series Users Guide 753 Chapter 38 System Figure 507 Configuration > System > Service Control Rule > Edit The following table describes the labels in this screen. Table 325 Configuration > System > Service Control Rule > Edit LABEL Create new Object Address Object DESCRIPTION Use this to configure any new settings objects that you need to use in this screen. Select ALL to allow or deny any computer to communicate with the Zyxel Device using this service. Select a predefined address object to just allow or deny the computer with the IP address that you specified to access the Zyxel Device using this service. Select ALL to allow or prevent any Zyxel Device zones from being accessed using this service. Select a predefined Zyxel Device zone on which a incoming service is allowed or denied. Select Accept to allow the user to access the Zyxel Device from the specified computers. Select Deny to block the users access to the Zyxel Device from the specified computers. Click OK to save your customized settings and exit this screen. Click Cancel to exit this screen without saving. Zone Action OK Cancel 38.7.6 Customizing the WWW Login Page Click Configuration > System > WWW > Login Page to open the Login Page screen. Use this screen to customize the Web Configurator login screen. You can also customize the page that displays after an access user logs into the Web Configurator to access network services like the Internet. ZyWALL ATP Series Users Guide 754 Chapter 38 System Figure 508 Configuration > System > WWW > Login Page (Desktop View) ZyWALL ATP Series Users Guide 755 Chapter 38 System Figure 509 Configuration > System > WWW > Login Page (Mobile View) The following figures identify the parts you can customize in the login and access pages. ZyWALL ATP Series Users Guide 756 Chapter 38 System Figure 510 Login Page Customization Logo Title Figure 511 Access Page Customization Logo Title Message

(color of all text) Background Note Message

(last line of text) Message

(color of all text) Note Message

(last line of text) Window Background You can specify colors in one of the following ways:

Click Color to display a screen of web-safe colors from which to choose. Enter the name of the desired color. ZyWALL ATP Series Users Guide 757 Chapter 38 System Enter a pound sign (#) followed by the six-digit hexadecimal number that represents the desired color. For example, use #000000 for black. Enter rgb followed by red, green, and blue values in parenthesis and separate by commas. For example, use rgb(0,0,0) for black. Your desired color should display in the preview screen on the right after you click in another field, click Apply, or press [ENTER]. If your desired color does not display, your browser may not support it. Try selecting another color. The following table describes the labels in the screen. Table 326 Configuration > System > WWW > Login Page LABEL Select Type DESCRIPTION Select whether the Web Configurator uses the default login screen or one that you customize in the rest of this screen. You can upload a graphic logo to be displayed on the upper left corner of the Web Configurator login screen and access page. Specify the location and file name of the logo graphic or click Browse to locate it. Logo File Customized Login Page Title Title Color Message Color Note Message Background Customized Access Page Title Message Color Note Message Background Note: Use a GIF, JPG, or PNG of 100 kilobytes or less. Click Upload to transfer the specified graphic file from your computer to the Zyxel Device. Use this section to set how the Web Configurator login screen looks. Enter the title for the top of the screen. Use up to 64 printable ASCII characters. Spaces are allowed. Specify the color of the screens title text. Specify the color of the screens text. Enter a note to display at the bottom of the screen. Use up to 64 printable ASCII characters. Spaces are allowed. Set how the screen background looks. To use a graphic, select Picture and upload a graphic. Specify the location and file name of the logo graphic or click Browse to locate it. The pictures size cannot be over 438 x 337 pixels. Note: Use a GIF, JPG, or PNG of 100 kilobytes or less. To use a color, select Color and specify the color. Use this section to customize the page that displays after an access user logs into the Web Configurator to access network services like the Internet. Enter the title for the top of the screen. Use up to 64 printable ASCII characters. Spaces are allowed. Specify the color of the screens text. Enter a note to display below the title. Use up to 64 printable ASCII characters. Spaces are allowed. Set how the windows background looks. To use a graphic, select Picture and upload a graphic. Specify the location and file name of the logo graphic or click Browse to locate it. The pictures size cannot be over 438 x 337 pixels. Note: Use a GIF, JPG, or PNG of 100 kilobytes or less. To use a color, select Color and specify the color. ZyWALL ATP Series Users Guide 758 Chapter 38 System Table 326 Configuration > System > WWW > Login Page (continued) LABEL Apply Reset DESCRIPTION Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. 38.7.7 HTTPS Example If you havent changed the default HTTPS port on the Zyxel Device, then in your browser enter https://

Zyxel Device IP Address/ as the web site address where Zyxel Device IP Address is the IP address or domain name of the Zyxel Device you wish to access. 38.7.7.1 Internet Explorer Warning Messages When you attempt to access the Zyxel Device HTTPS server, you will see the error message shown in the following screen. Figure 512 Security Alert Dialog Box (Internet Explorer) Select Continue to this website to proceed to the Web Configurator login screen. Otherwise, select Click here to close this web page to block the access. 38.7.7.2 Mozilla Firefox Warning Messages When you attempt to access the Zyxel Device HTTPS server, a The Connection is Untrusted screen appears as shown in the following screen. Click Technical Details if you want to verify more information about the certificate from the Zyxel Device. Select I Understand the Risks and then click Add Exception to add the Zyxel Device to the security exception list. Click Confirm Security Exception. ZyWALL ATP Series Users Guide 759 Chapter 38 System Figure 513 Security Certificate 1 (Firefox) Figure 514 Security Certificate 2 (Firefox) 38.7.7.3 Avoiding Browser Warning Messages Here are the main reasons your browser displays warnings about the Zyxel Devices HTTPS server certificate and what you can do to avoid seeing the warnings:

The issuing certificate authority of the Zyxel Devices HTTPS server certificate is not one of the browsers trusted certificate authorities. The issuing certificate authority of the Zyxel Device's factory default certificate is the Zyxel Device itself since the certificate is a self-signed certificate. For the browser to trust a self-signed certificate, import the self-signed certificate into your operating system as a trusted certificate. To have the browser trust the certificates issued by a certificate authority, import the certificate authoritys certificate into your operating system as a trusted certificate. 38.7.7.4 Login Screen After you accept the certificate, the Zyxel Device login screen appears. The lock displayed in the bottom of the browser status bar denotes a secure connection. ZyWALL ATP Series Users Guide 760 Chapter 38 System Figure 515 Login Screen (Internet Explorer) 38.7.7.5 Enrolling and Importing SSL Client Certificates The SSL client needs a certificate if Authenticate Client Certificates is selected on the Zyxel Device. You must have imported at least one trusted CA to the Zyxel Device in order for the Authenticate Client Certificates to be active (see the Certificates chapter for details). Apply for a certificate from a Certification Authority (CA) that is trusted by the Zyxel Device (see the Zyxel Devices Trusted CA Web Configurator screen). Figure 516 Zyxel Device Trusted CA Screen The CA sends you a package containing the CAs trusted certificate(s), your personal certificate(s) and a password to install the personal certificate(s). 38.7.7.5.1 Installing the CAs Certificate 1 Double click the CAs trusted certificate to produce a screen similar to the one shown next. ZyWALL ATP Series Users Guide 761 Chapter 38 System Figure 517 CA Certificate Example 2 Click Install Certificate and follow the wizard as shown earlier in this appendix. 38.7.7.5.2 Installing Your Personal Certificate(s) You need a password in advance. The CA may issue the password or you may have to specify it during the enrollment. Double-click the personal certificate given to you by the CA to produce a screen similar to the one shown next 1 Click Next to begin the wizard. ZyWALL ATP Series Users Guide 762 Chapter 38 System Figure 518 Personal Certificate Import Wizard 1 2 The file name and path of the certificate you double-clicked should automatically appear in the File name text box. Click Browse if you wish to import a different certificate. Figure 519 Personal Certificate Import Wizard 2 3 Enter the password given to you by the CA. ZyWALL ATP Series Users Guide 763 Chapter 38 System Figure 520 Personal Certificate Import Wizard 3 4 Have the wizard determine where the certificate should be saved on your computer or select Place all certificates in the following store and choose a different location. Figure 521 Personal Certificate Import Wizard 4 5 Click Finish to complete the wizard and begin the import process. ZyWALL ATP Series Users Guide 764 Chapter 38 System Figure 522 Personal Certificate Import Wizard 5 6 You should see the following screen when the certificate is correctly installed on your computer. Figure 523 Personal Certificate Import Wizard 6 38.7.7.6 Using a Certificate When Accessing the Zyxel Device Example Use the following procedure to access the Zyxel Device via HTTPS. 1 Enter https://Zyxel Device IP Address/ in your browsers web address field. Figure 524 Access the Zyxel Device Via HTTPS 2 When Authenticate Client Certificates is selected on the Zyxel Device, the following screen asks you to select a personal certificate to send to the Zyxel Device. This screen displays even if you only have a single certificate as in the example. ZyWALL ATP Series Users Guide 765 Chapter 38 System Figure 525 SSL Client Authentication 3 You next see the Web Configurator login screen. Figure 526 Secure Web Configurator Login Screen 38.8 SSH You can use SSH (Secure SHell) to securely access the Zyxel Devices command line interface. Specify which zones allow SSH access and from which IP address the access can come. SSH is a secure communication protocol that combines authentication and data encryption to provide secure encrypted communication between two hosts over an unsecured network. In the following figure, computer A on the Internet uses SSH to securely connect to the WAN port of the Zyxel Device for a management session. ZyWALL ATP Series Users Guide 766 Chapter 38 System Figure 527 SSH Communication Over the WAN Example 38.8.1 How SSH Works The following figure is an example of how a secure connection is established between two remote hosts using SSH v1. Figure 528 How SSH v1 Works Example 1 2 Host Identification The SSH client sends a connection request to the SSH server. The server identifies itself with a host key. The client encrypts a randomly generated session key with the host key and server key and sends the result back to the server. The client automatically saves any new server public keys. In subsequent connections, the server public key is checked against the saved version on the client computer. Encryption Method Once the identification is verified, both the client and server must agree on the type of encryption method to use. ZyWALL ATP Series Users Guide 767 Chapter 38 System 3 Authentication and Data Transmission After the identification is verified and data encryption activated, a secure tunnel is established between the client and the server. The client then sends its authentication information (user name and password) to the server to log in to the server. 38.8.2 SSH Implementation on the Zyxel Device Your Zyxel Device supports SSH versions 1 and 2 using RSA authentication and four encryption methods

(AES, 3DES, Archfour, and Blowfish). The SSH server is implemented on the Zyxel Device for management using port 22 (by default). 38.8.3 Requirements for Using SSH You must install an SSH client program on a client computer (Windows or Linux operating system) that is used to connect to the Zyxel Device over SSH. 38.8.4 Configuring SSH Click Configuration > System > SSH to change your Zyxel Devices Secure Shell settings. Use this screen to specify from which zones SSH can be used to manage the Zyxel Device. You can also specify from which IP addresses the access can come. Figure 529 Configuration > System > SSH The following table describes the labels in this screen. Table 327 Configuration > System > SSH LABEL Enable DESCRIPTION Select the check box to allow or disallow the computer with the IP address that matches the IP address(es) in the Service Control table to access the Zyxel Device CLI using this service. Select the check box to have the Zyxel Device use both SSH version 1 and version 2 protocols. If you clear the check box, the Zyxel Device uses only SSH version 2 protocol. You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management. Version 1 Server Port ZyWALL ATP Series Users Guide 768 Chapter 38 System Table 327 Configuration > System > SSH (continued) LABEL Server Certificate Select the certificate whose corresponding private key is to be used to identify the Zyxel DESCRIPTION Service Control Add Edit Remove Move

#

Zone Address Action Apply Reset Device for SSH connections. You must have certificates already configured in the My Certificates screen. This specifies from which computers you can access which Zyxel Device zones. Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry. Refer to Table 325 on page 754 for details on the screen that opens. Double-click an entry or select it and click Edit to be able to modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Note that subsequent entries move up by one when you take this action. To change an entrys position in the numbered list, select the method and click Move to display a field to type a number for where you want to put it and press [ENTER] to move the rule to the number that you typed. This the index number of the service control rule. This is the zone on the Zyxel Device the user is allowed or denied to access. This is the object name of the IP address(es) with which the computer is allowed or denied to access. This displays whether the computer with the IP address specified above can access the Zyxel Device zone(s) configured in the Zone field (Accept) or not (Deny). Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. 38.8.5 Service Control Rules Click the Add or Edit icon in the Service Control table to add a service control rule. Figure 530 Configuration > System > SSH > Service Control Rule Add/Edit The following table describes the labels in this screen. Table 328 Configuration > System > SSH > Service Control Rule Add/Edit LABEL Create new Object Address Object DESCRIPTION Use this to configure any new settings objects that you need to use in this screen. Select ALL to allow or deny any computer to communicate with the Zyxel Device using SSH. Select a predefined address object to just allow or deny the computer with the IP address that you specified to access the Zyxel Device using SSH. Select ALL to allow or prevent any Zyxel Device zones from being accessed using SSH. Zone Select a predefined Zyxel Device zone on which a incoming service is allowed or denied. ZyWALL ATP Series Users Guide 769 Chapter 38 System Table 328 Configuration > System > SSH > Service Control Rule Add/Edit (continued) LABEL Action DESCRIPTION Select Accept to allow the user to access the Zyxel Device from the specified computers. Select Deny to block the users access to the Zyxel Device from the specified computers. Click OK to save your customized settings and exit this screen. Click Cancel to exit this screen without saving. OK Cancel 38.8.6 Secure Telnet Using SSH Examples This section shows two examples using a command interface and a graphical interface SSH client program to remotely access the Zyxel Device. The configuration and connection steps are similar for most SSH client programs. Refer to your SSH client program users guide. 38.8.6.1 Example 1: Microsoft Windows This section describes how to access the Zyxel Device using the Secure Shell Client program. 1 Launch the SSH client and specify the connection information (IP address, port number) for the Zyxel Device. 2 Configure the SSH client to accept connection using SSH version 1. 3 A window displays prompting you to store the host key in you computer. Click Yes to continue. Figure 531 SSH Example 1: Store Host Key Enter the password to log in to the Zyxel Device. The CLI screen displays next. 38.8.6.2 Example 2: Linux This section describes how to access the Zyxel Device using the OpenSSH client program that comes with most Linux distributions. 1 Test whether the SSH service is available on the Zyxel Device. Enter telnet 192.168.1.1 22 at a terminal prompt and press [ENTER]. The computer attempts to connect to port 22 on the Zyxel Device (using the default IP address of 192.168.1.1). A message displays indicating the SSH protocol version supported by the Zyxel Device. ZyWALL ATP Series Users Guide 770 Chapter 38 System Figure 532 SSH Example 2: Test

$ telnet 192.168.1.1 22 Trying 192.168.1.1... Connected to 192.168.1.1. Escape character is '^]'. SSH-1.5-1.0.0 2 Enter ssh 1 192.168.1.1. This command forces your computer to connect to the Zyxel Device using SSH version 1. If this is the first time you are connecting to the Zyxel Device using SSH, a message displays prompting you to save the host information of the Zyxel Device. Type yes and press [ENTER]. Then enter the password to log in to the Zyxel Device. Figure 533 SSH Example 2: Log in

$ ssh 1 192.168.1.1 The authenticity of host '192.168.1.1 (192.168.1.1)' can't be established. RSA1 key fingerprint is 21:6c:07:25:7e:f4:75:80:ec:af:bd:d4:3d:80:53:d1. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '192.168.1.1' (RSA1) to the list of known hosts. Administrator@192.168.1.1's password:

3 The CLI screen displays next. 38.9 Telnet You can use Telnet to access the Zyxel Devices command line interface. Specify which zones allow Telnet access and from which IP address the access can come. 38.9.1 Configuring Telnet Click Configuration > System > TELNET to configure your Zyxel Device for remote Telnet access. Use this screen to specify from which zones Telnet can be used to manage the Zyxel Device. You can also specify from which IP addresses the access can come. ZyWALL ATP Series Users Guide 771 Chapter 38 System Figure 534 Configuration > System > TELNET The following table describes the labels in this screen. Table 329 Configuration > System > TELNET LABEL Enable Server Port Service Control Add Edit Remove Move

#

Zone Address Action Apply Reset DESCRIPTION Select the check box to allow or disallow the computer with the IP address that matches the IP address(es) in the Service Control table to access the Zyxel Device CLI using this service. You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management. This specifies from which computers you can access which Zyxel Device zones. Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry. Refer to Table 325 on page 754 for details on the screen that opens. Double-click an entry or select it and click Edit to be able to modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Note that subsequent entries move up by one when you take this action. To change an entrys position in the numbered list, select the method and click Move to display a field to type a number for where you want to put it and press [ENTER] to move the rule to the number that you typed. This the index number of the service control rule. The entry with a hyphen (-) instead of a number is the Zyxel Devices (non-configurable) default policy. The Zyxel Device applies this to traffic that does not match any other configured rule. It is not an editable rule. To apply other behavior, configure a rule that traffic will match so the Zyxel Device will not have to use the default policy. This is the zone on the Zyxel Device the user is allowed or denied to access. This is the object name of the IP address(es) with which the computer is allowed or denied to access. This displays whether the computer with the IP address specified above can access the Zyxel Device zone(s) configured in the Zone field (Accept) or not (Deny). Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. ZyWALL ATP Series Users Guide 772 Chapter 38 System 38.9.2 Service Control Rules Click the Add or Edit icon in the Service Control table to add a service control rule. Figure 535 Configuration > System > TELNET > Service Control Rule Add/Edit The following table describes the labels in this screen. Table 330 Configuration > System > TELNET > Service Control Rule Add/Edit LABEL Create new Object Address Object DESCRIPTION Use this to configure any new settings objects that you need to use in this screen. Select ALL to allow or deny any computer to communicate with the Zyxel Device using Telnet. Select a predefined address object to just allow or deny the computer with the IP address that you specified to access the Zyxel Device using Telnet. Select ALL to allow or prevent any Zyxel Device zones from being accessed using Telnet. Select a predefined Zyxel Device zone on which a incoming service is allowed or denied. Select Accept to allow the user to access the Zyxel Device from the specified computers. Select Deny to block the users access to the Zyxel Device from the specified computers. Click OK to save your customized settings and exit this screen. Click Cancel to exit this screen without saving. Zone Action OK Cancel 38.10 FTP You can upload and download the Zyxel Devices firmware and configuration files using FTP. To use this feature, your computer must have an FTP client. 38.10.1 Configuring FTP To change your Zyxel Devices FTP settings, click Configuration > System > FTP tab. The screen appears as shown. Use this screen to specify from which zones FTP can be used to access the Zyxel Device. You can also specify from which IP addresses the access can come. ZyWALL ATP Series Users Guide 773 Chapter 38 System Figure 536 Configuration > System > FTP The following table describes the labels in this screen. Table 331 Configuration > System > FTP LABEL Enable Server Certificate Select the certificate whose corresponding private key is to be used to identify the Zyxel Device TLS required Server Port Service Control Add Edit Remove Move

#

Zone Address Action DESCRIPTION Select the check box to allow or disallow the computer with the IP address that matches the IP address(es) in the Service Control table to access the Zyxel Device using this service. Select the check box to use FTP over TLS (Transport Layer Security) to encrypt communication. This implements TLS as a security mechanism to secure FTP clients and/or servers. You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management. for FTP connections. You must have certificates already configured in the My Certificates screen. This specifies from which computers you can access which Zyxel Device zones. Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry. Refer to Table 325 on page 754 for details on the screen that opens. Double-click an entry or select it and click Edit to be able to modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Note that subsequent entries move up by one when you take this action. To change an entrys position in the numbered list, select the method and click Move to display a field to type a number for where you want to put it and press [ENTER] to move the rule to the number that you typed. This the index number of the service control rule. The entry with a hyphen (-) instead of a number is the Zyxel Devices (non-configurable) default policy. The Zyxel Device applies this to traffic that does not match any other configured rule. It is not an editable rule. To apply other behavior, configure a rule that traffic will match so the Zyxel Device will not have to use the default policy. This is the zone on the Zyxel Device the user is allowed or denied to access. This is the object name of the IP address(es) with which the computer is allowed or denied to access. This displays whether the computer with the IP address specified above can access the Zyxel Device zone(s) configured in the Zone field (Accept) or not (Deny). ZyWALL ATP Series Users Guide 774 Chapter 38 System Table 331 Configuration > System > FTP (continued) LABEL Apply Reset DESCRIPTION Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. 38.10.2 Service Control Rules Click the Add or Edit icon in the Service Control table to add a service control rule. Figure 537 Configuration > System > FTP > Service Control Rule Add/Edit The following table describes the labels in this screen. Table 332 Configuration > System > FTP > Service Control Rule Add/Edit LABEL Create new Object Address Object DESCRIPTION Use this to configure any new settings objects that you need to use in this screen. Select ALL to allow or deny any computer to communicate with the Zyxel Device using FTP. Select a predefined address object to just allow or deny the computer with the IP address that you specified to access the Zyxel Device using FTP. Select ALL to allow or prevent any Zyxel Device zones from being accessed using FTP. Select a predefined Zyxel Device zone on which a incoming service is allowed or denied. Select Accept to allow the user to access the Zyxel Device from the specified computers. Select Deny to block the users access to the Zyxel Device from the specified computers. Click OK to save your customized settings and exit this screen. Click Cancel to exit this screen without saving. Zone Action OK Cancel 38.11 SNMP Simple Network Management Protocol is a protocol used for exchanging management information between network devices. Your Zyxel Device supports SNMP agent functionality, which allows a manager station to manage and monitor the Zyxel Device through the network. The Zyxel Device supports SNMP version one (SNMPv1), version two (SNMPv2c) and version 3 (SNMPv3). The next figure illustrates an SNMP management operation. ZyWALL ATP Series Users Guide 775 Chapter 38 System Figure 538 SNMP Management Model An SNMP managed network consists of two main types of component: agents and a manager. An agent is a management software module that resides in a managed device (the Zyxel Device). An agent translates the local management information from the managed device into a form compatible with SNMP. The manager is the console through which network administrators perform network management functions. It executes applications that control and monitor managed devices. The managed devices contain object variables/managed objects that define each piece of information to be collected about a device. Examples of variables include such as number of packets received, node port status etc. A Management Information Base (MIB) is a collection of managed objects. SNMP allows a manager and agents to communicate for the purpose of accessing these objects. SNMP itself is a simple request/response protocol based on the manager/agent model. The manager issues a request and the agent returns responses using the following protocol operations:

Get - Allows the manager to retrieve an object variable from the agent. GetNext - Allows the manager to retrieve the next object variable from a table or list within an agent. In SNMPv1, when a manager wants to retrieve all elements of a table from an agent, it initiates a Get operation, followed by a series of GetNext operations. Set - Allows the manager to set values for object variables within an agent. Trap - Used by the agent to inform the manager of some events. 38.11.1 SNMPv3 and Security SNMPv3 enhances security for SNMP management using authentication and encryption. SNMP managers can be required to authenticate with agents before conducting SNMP management sessions. ZyWALL ATP Series Users Guide 776 Chapter 38 System Security can be further enhanced by encrypting the SNMP messages sent from the managers. Encryption protects the contents of the SNMP messages. When the contents of the SNMP messages are encrypted, only the intended recipients can read them. 38.11.2 Supported MIBs The Zyxel Device supports MIB II that is defined in RFC-1213 and RFC-1215. The Zyxel Device also supports private MIBs (zywall.mib and zyxel-zywall-ZLD-Common.mib) to collect information about CPU and memory usage and VPN total throughput. The focus of the MIBs is to let administrators collect statistical data and monitor status and performance. You can download the Zyxel Devices MIBs from www.zyxel.com. 38.11.3 SNMP Traps The Zyxel Device will send traps to the SNMP manager when any one of the following events occurs. Table 333 SNMP Traps OBJECT LABEL Cold Start OBJECT ID 1.3.6.1.6.3.1.1.5.1 linkDown linkUp authenticationFailure 1.3.6.1.6.3.1.1.5.3 1.3.6.1.6.3.1.1.5.4 1.3.6.1.6.3.1.1.5.5 vpnTunnelDisconnected 1.3.6.1.4.1.890.1.6.22.2.3 vpnTunnelName 1.3.6.1.4.1.890.1.6.22.2.2.1.1 vpnIKEName 1.3.6.1.4.1.890.1.6.22.2.2.1.2 vpnTunnelSPI 1.3.6.1.4.1.890.1.6.22.2.2.1.3 DESCRIPTION This trap is sent when the Zyxel Device is turned on or an agent restarts. This trap is sent when the Ethernet link is down. This trap is sent when the Ethernet link is up. This trap is sent when an SNMP request comes from non-authenticated hosts. This trap is sent when an IPSec VPN tunnel is disconnected. This trap is sent along with the vpnTunnelDisconnected trap. This trap carries the disconnected tunnels IPSec SA name. This trap is sent along with the vpnTunnelDisconnected trap. This trap carries the disconnected tunnels IKE SA name. This trap is sent along with the vpnTunnelDisconnected trap. This trap carries the security parameter index (SPI) of the disconnected VPN tunnel. 38.11.4 Configuring SNMP To change your Zyxel Devices SNMP settings, click Configuration > System > SNMP tab. The screen appears as shown. Use this screen to configure your SNMP settings, including from which zones SNMP can be used to access the Zyxel Device. You can also specify from which IP addresses the access can come. ZyWALL ATP Series Users Guide 777 Chapter 38 System Figure 539 Configuration > System > SNMP The following table describes the labels in this screen. Table 334 Configuration > System > SNMP LABEL Enable DESCRIPTION Select the check box to allow or disallow the computer with the IP address that matches the IP address(es) in the Service Control table to access the Zyxel Device using this service. You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management. Server Port Trap Community Destination Trap CAPWAP Event SNMPv2c Get Community Set Community Type the trap community, which is the password sent with each trap to the SNMP manager. The default is public and allows all requests. Type the IP address of the station to send your SNMP traps to. Select this option to have the Zyxel Device send a trap to the SNMP manager when a managed AP is connected to or disconnected from the Zyxel Device. Select the SNMP version for the Zyxel Device. The SNMP version on the Zyxel Device must match the version on the SNMP manager. Enter the Get Community, which is the password for the incoming Get and GetNext requests from the management station. The default is public and allows all requests. Enter the Set community, which is the password for incoming Set requests from the management station. The default is private and allows all requests. ZyWALL ATP Series Users Guide 778 Chapter 38 System Table 334 Configuration > System > SNMP (continued) LABEL SNMPv3 DESCRIPTION Select the SNMP version for the Zyxel Device. The SNMP version on the Zyxel Device must match the version on the SNMP manager. SNMPv3 (RFCs 3413 to 3415) provides secure access by authenticating and encrypting data packets over the network. The Zyxel Device uses your login password as the SNMPv3 authentication and encryption passphrase. Note: Your login password must consist of at least 8 printable characters for SNMPv3. An error message will display if your login password has fewer characters. Add Edit Remove

#

User Authenticati on Privacy Privilege Service Control Add Edit Remove Move

#

Zone Address Action Apply Reset Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry. Double-click an entry or select it and click Edit to be able to modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Note that subsequent entries move up by one when you take this action. This is the index number of the entry. This displays the name of the user object to be sent to the SNMP manager along with the SNMP v3 trap. This displays the authentication algorithm used for this entry. MD5 (Message Digest 5) and SHA

(Secure Hash Algorithm) are hash algorithms used to authenticate SNMP data. SHA authentication is generally considered stronger than MD5, but is slower. This displays the encryption method for SNMP communication from this user. Methods available are:

DES - Data Encryption Standard is a widely used (but breakable) method of data encryption. It applies a 56-bit key to each 64-bit block of data. AES - Advanced Encryption Standard is another method for data encryption that also uses a secret key. AES applies a 128-bit key to 128-bit blocks of data. This displays the access rights to MIBs. Read-Write - The associated user can create and edit the MIBs on the Zyxel Device, except the user account. Read-Only - The associated user can only collect information from the Zyxel Device MIBs. This specifies from which computers you can access which Zyxel Device zones. Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry. Refer to Table 325 on page 754 for details on the screen that opens. Double-click an entry or select it and click Edit to be able to modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Note that subsequent entries move up by one when you take this action. To change an entrys position in the numbered list, select the method and click Move to display a field to type a number for where you want to put it and press [ENTER] to move the rule to the number that you typed. This the index number of the service control rule. The entry with a hyphen (-) instead of a number is the Zyxel Devices (non-configurable) default policy. The Zyxel Device applies this to traffic that does not match any other configured rule. It is not an editable rule. To apply other behavior, configure a rule that traffic will match so the Zyxel Device will not have to use the default policy. This is the zone on the Zyxel Device the user is allowed or denied to access. This is the object name of the IP address(es) with which the computer is allowed or denied to access. This displays whether the computer with the IP address specified above can access the Zyxel Device zone(s) configured in the Zone field (Accept) or not (Deny). Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. ZyWALL ATP Series Users Guide 779 Chapter 38 System 38.11.5 Add SNMPv3 User Click Add under SNMPv3 in Configuration > System > SNMP to create an SNMPv3 user for authentication with managers using SNMP v3. Use the username and password of the login accounts you specify in this screen to create accounts on the SNMP v3 manager. Figure 540 Configuration > System > SNMP(v3) > Add The following table describes the labels in this screen. Table 335 Configuration > System > SNMP(v3) > Add LABEL User DESCRIPTION Specify the username of a login account on the Zyxel Device. The associated password is used in authentication algorithms and encryption methods. Select an authentication algorithm. MD5 (Message Digest 5) and SHA (Secure Hash Algorithm) are hash algorithms used to authenticate SNMP data. SHA authentication is generally considered stronger than MD5, but is slower. Specify the encryption method for SNMP communication from this user. You can choose one of the following:

DES - Data Encryption Standard is a widely used (but breakable) method of data encryption. It applies a 56-bit key to each 64-bit block of data. AES - Advanced Encryption Standard is another method for data encryption that also uses a secret key. AES applies a 128-bit key to 128-bit blocks of data. Select the access rights to MIBs. Read-Write - The associated user can create and edit the MIBs on the Zyxel Device, except the user account. Read-Only - The associated user can only collect information from the Zyxel Device MIBs. Click OK to save the changes. Click Cancel to begin configuring this screen afresh. Authentication Privacy Privilege OK Cancel 38.11.6 Service Control Rules Click the Add or Edit icon in the Service Control table to add a service control rule. ZyWALL ATP Series Users Guide 780 Chapter 38 System Figure 541 Configuration > System > SNMP > Service Control Rule Add/Edit The following table describes the labels in this screen. Table 336 Configuration > System > SNMP > Service Control Rule Add/Edit LABEL Create new Object Address Object DESCRIPTION Use this to configure any new settings objects that you need to use in this screen. Select ALL to allow or deny any computer to communicate with the Zyxel Device using SNMP. Select a predefined address object to just allow or deny the computer with the IP address that you specified to access the Zyxel Device using SNMP. Select ALL to allow or prevent any Zyxel Device zones from being accessed using SNMP. Select a predefined Zyxel Device zone on which a incoming service is allowed or denied. Select Accept to allow the user to access the Zyxel Device from the specified computers. Select Deny to block the users access to the Zyxel Device from the specified computers. Click OK to save your customized settings and exit this screen. Click Cancel to exit this screen without saving. Zone Action OK Cancel 38.12 Authentication Server You can set the Zyxel Device to work as a RADIUS server to exchange messages with a RADIUS client, such as an AP for user authentication and authorization. Click Configuration > System > Auth. Server tab. The screen appears as shown. Use this screen to enable the authentication server feature of the Zyxel Device and specify the RADIUS clients IP address. ZyWALL ATP Series Users Guide 781 Chapter 38 System Figure 542 Configuration > System > Auth. Server The following table describes the labels in this screen. Table 337 Configuration > System > Auth. Server LABEL Enable Authentication Server Authentication Server Certificate DESCRIPTION Select the check box to have the Zyxel Device act as a RADIUS server. Select the certificate whose corresponding private key is to be used to identify the Zyxel Device to the RADIUS client. You must have certificates already configured in the My Certificates screen. Select an authentication method if you have created any in the Configuration > Object > Auth. Method screen. Use this section to configure trusted clients in the Zyxel Device RADIUS server database. Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry. Double-click an entry or select it and click Edit to be able to modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Note that subsequent entries move up by one when you take this action. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. This is the index number of the entry. This icon is lit when the entry is active and dimmed when the entry is inactive. This field indicates the name assigned to the profile. This is the IP address of the RADIUS client that is allowed to exchange messages with the Zyxel Device. This is the subnet mask of the RADIUS client. This is the description of the RADIUS client. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Authentication Method Trusted Client Add Edit Remove Activate Inactivate

#

Status Profile Name IP Address Mask Description Apply Reset ZyWALL ATP Series Users Guide 782 Chapter 38 System 38.12.1 Add/Edit Trusted RADIUS Client Click Configuration > System > Auth. Server to display the Auth. Server screen. Click the Add icon or an Edit icon to display the following screen. Use this screen to create a new entry or edit an existing one. Figure 543 Configuration > System > Auth. Server > Add/Edit The following table describes the labels in this screen. Table 338 Configuration > System > Auth. Server > Add/Edit LABEL Activate Profile Name IP Address DESCRIPTION Select this check box to make this profile active. Enter a descriptive name (up to 31 alphanumerical characters) for identification purposes. Enter the IP address of the RADIUS client that is allowed to exchange messages with the Zyxel Device. Enter the subnet mask of the RADIUS client. Enter a password (up to 64 alphanumeric characters) as the key to be shared between the Zyxel Device and the RADIUS client. The key is not sent over the network. This key must be the same on the external authentication server and the Zyxel Device. Enter the description of each server, if any. You can use up to 60 printable ASCII characters. Click OK to save the changes. Click Cancel to discard the changes. Netmask Secret Description OK Cancel 38.13 Notification > Mail Server Use this screen to configure a mail server so you can receive reports and notification emails such as when your password is about to expire. After you configure the screen, you can test the settings in Maintenance > Diagnostics > Network Tool and then select Test Email Server. See Configuration > Log &

Report > Email Daily Report to configure what reports to send and to whom. Click Configuration > System > Notification to display the Mail Server screen. ZyWALL ATP Series Users Guide 783 Chapter 38 System Figure 544 Configuration > System > Notification The following table describes the labels in this screen. Table 339 Configuration > System > Notification LABEL Mail Server Mail Subject DESCRIPTION Type the name or IP address of the outgoing SMTP server. Go to Configuration > Log & Report > Email Daily Report to type a subject line for outgoing email from the Zyxel Device. Select Append system name to add the Zyxel Devices system name to the subject. Append system name Append date time Mail Server Port TLS Security STARTTLS Authenticate Server Mail From SMTP Authentication User Name Password Retype to Confirm Time for sending report Apply Reset Select Append date time to add the Zyxel Devices system date and time to the subject. Enter the same port number here as is on the mail server for mail traffic. Select this option if the mail server uses Transport Layer Security (TLS) for encrypted communications between the mail server and the Zyxel Device. Select this option if the mail server uses SSL or TLS for encrypted communications between the mail server and the Zyxel Device. Select this if the Zyxel Device authenticates the mail server in the TLS handshake. Type the email address from which the outgoing email is delivered. This address is used in replies. Select this check box if it is necessary to provide a user name and password to the SMTP server. This box is effective when you select the SMTP Authentication check box. Type the user name to provide to the SMTP server when the log is emailed. This box is effective when you select the SMTP Authentication check box. Type a password of up to 63 characters to provide to the SMTP server when the log is emailed. Type the password again to make sure that you have entered is correctly. Select the time of day (hours and minutes) when the log is emailed. Use 24-hour notation. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. ZyWALL ATP Series Users Guide 784 Chapter 38 System 38.14 Notification > SMS The Zyxel Device supports Short Message Service (SMS) to send short text messages to mobile phone devices. At the time of writing, the Zyxel Device uses ViaNett as the SMS gateway to help forward SMS messages. You must already have a ViaNett account in order to use the SMS service. Click Configuration > System > Notification > SMS to open the following screen. Configure the settings according to your SMS service providers format. Different SMS service providers may have different format. Figure 545 Configuration > System > Notification > SMS The following table describes the labels in this screen. DESCRIPTION Table 340 Configuration > System > Notification > SMS LABEL General Settings Enable SMS Default country code for phone number SMS Provider Select the check box to turn on the SMS service. Enter the default country code for the mobile phone number to which you want to send SMS messages. Select ViaNett if you use ViaNett to help forward SMS messages. Select Email-to-SMS Provider if you use another SMS gateway to help forward SMS messages. These fields are available when the SMS Provider is Email-to-SMS Provider. Note: Go to the Configuration > System > Notification > Mail Server screen to configure a mail server first, so the Zyxel Device can send SMS messages to the SMS service provider via emails. Thus, the SMS service provider will send the SMS messages. ZyWALL ATP Series Users Guide 785 Chapter 38 System Table 340 Configuration > System > Notification > SMS (continued) LABEL Provider Domain Mail Subject Mail From Mail To ViaNett Configuration User Name Password Retype to Confirm Apply Reset DESCRIPTION Enter the domain name of your SMS service provider. The domain name can be of up to 252 characters. Select auto append to "Mail to" to add the domain name of your SMS service provider after the mobile phone number in the Mail To field. Type the subject line of up to 128 characters for outgoing e-mail from the Zyxel Device. Enter the senders email address of up to 64 characters. This email address needs to be in your SMS providers allowed sender address list. If you leave this field blank, the Zyxel Device will use the IP address or domain name of the Mail Server field in the Configuration > System > Notification > Mail Server screen. Enter the mobile phone number of up to 80 characters. You can only have one receiver. Use this variable in brackets [$mobile_number$], and the Zyxel Device will use the mobile phone number of the user logging in. Go to the Configuration > Object > User/Group > User screen to add a valid mobile telephone number for a user. These fields are available when the SMS Provider is ViaNett. Enter the user name for your ViaNett account. Type the Password associated with the user name. Type your password again for confirmation. Click this button to save your changes to the Zyxel Device. Click this button to return the screen to its last-saved settings. 38.15 Language Screen Click Configuration > System > Language to open the following screen. Use this screen to select a display language for the Zyxel Devices Web Configurator screens. Figure 546 Configuration > System > Language ZyWALL ATP Series Users Guide 786 Chapter 38 System The following table describes the labels in this screen. Table 341 Configuration > System > Language LABEL Language Setting DESCRIPTION Select a display language for the Zyxel Devices Web Configurator screens. You also need to open a new browser session to display the screens in the new language. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Apply Reset 38.16 IPv6 Screen Click Configuration > System > IPv6 to open the following screen. Use this screen to enable IPv6 support for the Zyxel Devices Web Configurator screens. Figure 547 Configuration > System > IPv6 The following table describes the labels in this screen. Table 342 Configuration > System > IPv6 LABEL Enable IPv6 DESCRIPTION Select this to have the Zyxel Device support IPv6 and make IPv6 settings be available on the screens that the functions support, such as the Configuration > Network > Interface >

Ethernet, VLAN, and Bridge screens. The Zyxel Device discards all IPv6 packets if you clear this check box. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Apply Reset 38.17 Zyxel One Network (ZON) Utility The Zyxel One Network (ZON) utility uses the Zyxel Discovery Protocol (ZDP) for discovering and configuring ZDP-aware Zyxel devices in the same broadcast domain as the computer on which ZON is installed. The ZON Utility issues requests via ZDP and in response to the query, the Zyxel device responds with basic information including IP address, firmware version, location, system and model name. The information is ZyWALL ATP Series Users Guide 787 Chapter 38 System then displayed in the ZON Utility screen and you can perform tasks like basic configuration of the devices and batch firmware upgrade in it. You can download the ZON Utility at www.zyxel.com and install it on a computer. 38.17.1 Requirements Before installing the ZON Utility on your computer, please make sure it meets the requirements listed below. Operating System At the time of writing, the ZON Utility is compatible with:

Windows 7 (both 32-bit / 64-bit versions) Windows 8 (both 32-bit / 64-bit versions) Windows 8.1 (both 32-bit / 64-bit versions) Window 10 (both 32-bit / 64-bit versions) Note: To check for your Windows operating system version, right-click on My Computer >

Properties. You should see this information in the General tab. Hardware Here are the minimum hardware requirements to use the ZON Utility on your computer. Core i3 processor 2GB RAM 100MB free hard disk WXGA (Wide XGA 1280x800) 38.17.2 Run the ZON Utility 1 Double-click the ZON Utility to run it. 2 The first time you run the ZON Utility you will see if your Zyxel Device and firmware version support the ZON Utility. Click the OK button to close this screen. ZyWALL ATP Series Users Guide 788 Chapter 38 System Figure 548 Supported Devices and Versions If you want to check the supported models and firmware versions later, you can click the Show information about ZON icon in the upper right hand corner of the screen. Then select the Supported model and firmware version link. If your device is not listed here, see the device release notes for ZON utility support. The release notes are in the firmware zip file on the Zyxel web site. Figure 549 ZON Utility Screen 3 Select a network adapter to which your supported devices are connected. ZyWALL ATP Series Users Guide 789 Chapter 38 System Figure 550 Network Adapter 4 Click the Go button for the ZON Utility to discover all supported devices in your network. Figure 551 Discovery 5 The ZON Utility screen shows the devices discovered. Figure 552 ZON Utility Screen 1 2 3 4 5 6 7 8 9 10 11 12 13 6 Select a device and then use the icons to perform actions. Some functions may not be available for your devices. The following table describes the icons numbered from left to right in the ZON Utility screen. Table 343 ZON Utility Icons ICON 1 IP configuration 2 Renew IP Address DESCRIPTION Change the selected devices IP address. Update a DHCP-assigned dynamic IP address. ZyWALL ATP Series Users Guide 790 Chapter 38 System Table 343 ZON Utility Icons ICON 3 Reboot Device 4 Reset Configuration to Default 5 Locator LED 6 Web GUI 7 Firmware Upgrade 8 Change Password 9 Configure NCC Discovery 10 ZAC 11 Clear and Rescan 12 Save Configuration 13 Settings DESCRIPTION Use this icon to restart the selected device(s). This may be useful when troubleshooting or upgrading new firmware. If you forget your password or cannot access the Web Configurator, you can use this icon to reload the factory-default configuration file. This means that you will lose all configurations that you had previously. Use this icon to locate the selected device by causing its Locator LED to blink. Use this to access the selected device web configurator from your browser. You will need a username and password to log in. Use this icon to upgrade new firmware to selected device(s) of the same model. Make sure you have downloaded the firmware from the Zyxel website to your computer and unzipped it in advance. If your Zyxel Device supports dual firmware images, the standby image will be upgraded. After the new firmware is uploaded, you Zyxel Device will reboot, and the new firmware will be the running firmware. Use this icon to change the admin password of the selected device. You must know the current admin password before changing to a new one. You must have Internet access to use this feature. Use this icon to enable or disable the Nebula Control Center (NCC) discovery feature on the selected device. If its enabled, the selected device will try to connect to the NCC. Once the selected device is connected to and has registered in the NCC, itll go into the cloud management mode. Use this icon to run the Zyxel AP Configurator of the selected AP. Use this icon to clear the list and discover all devices on the connected network again. Use this icon to save configuration changes to permanent memory on a selected device. Use this icon to select a network adaptor for the computer on which the ZON utility is installed, and the utility language. The following table describes the fields in the ZON Utility main screen. Table 344 ZON Utility Fields LABEL Type Model Firmware Version MAC Address IP Address System Name Location Status NCC Discovery DESCRIPTION This field displays an icon of the kind of device discovered. This field displays the model name of the discovered device. This field displays the firmware version of the discovered device. This field displays the MAC address of the discovered device. This field displays the IP address of an internal interface on the discovered device that first received an ZDP discovery request from the ZON utility. This field displays the system name of the discovered device. This field displays where the discovered device is. This field displays whether changes to the discovered device have been done successfully. As the Zyxel Device does not support IP Configuration, Renew IP address and Flash Locator LED, this field displays Update failed, Not support Renew IP address and Not support Flash Locator LED respectively. This field displays if the discovered device supports the Nebula Control Center (NCC) discovery feature. If its enabled, the selected device will try to connect to the NCC. Once the selected device is connected to and has registered in the NCC, itll go into the cloud management mode. ZyWALL ATP Series Users Guide 791 Chapter 38 System Table 344 ZON Utility Fields LABEL Serial Number Hardware Version DESCRIPTION Enter the admin password of the discovered device to display its serial number. This field displays the hardware version of the discovered device. 38.17.3 Zyxel One Network (ZON) System Screen Enable ZDP (ZON) and Smart Connect (Ethernet Neighbor) in the System > ZON screen. See Monitor > System Status > Ethernet Neighbor for information on using Smart Connect (Link Layer Discovery Protocol (LLDP)) for discovering and configuring LLDP-aware devices in the same broadcast domain as the Zyxel Device that youre logged into using the web configurator. The following figure shows the System > ZON screen. Figure 553 Configuration > System > ZON The following table describes the labels in this screen. Table 345 Configuration > System > ZON LABEL ZDP DESCRIPTION Zyxel Discovery Protocol (ZDP) is the protocol that the Zyxel One Network (ZON) utility uses for discovering and configuring ZDP-aware Zyxel devices in the same broadcast domain as the computer on which ZON is installed. Select to activate ZDP discovery on the Zyxel Device. Smart Connect uses Link Layer Discovery Protocol (LLDP) for discovering and configuring LLDP-aware devices in the same broadcast domain as the Zyxel Device that youre logged into using the web configurator. Select to activate LLDP discovery on the Zyxel Device. See also Monitor > System Status >

Ethernet Discovery. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Enable Smart Connect Enable Apply Reset ZyWALL ATP Series Users Guide 792 CHAPTER 39 Log and Report 39.1 Overview Use these screens to configure daily reporting and log settings. 39.1.1 What You Can Do In this Chapter Use the Email Daily Report screen (Section 39.2 on page 793) to configure where and how to send daily reports and what reports to send. Use the Log Setting screens (Section 39.3 on page 795) to specify settings for recording log messages and alerts, e-mailing them, storing them on a connected USB storage device, and sending them to remote syslog servers. 39.2 Email Daily Report Use the Email Daily Report screen to start or stop data collection and view various statistics about traffic passing through your Zyxel Device. See Configuration > System > Notification to set up the mail server. Note: Data collection may decrease the Zyxel Devices traffic throughput rate. Click Configuration > Log & Report > Email Daily Report to display the following screen. Configure this screen to have the Zyxel Device email you system statistics every day. ZyWALL ATP Series Users Guide 793 Chapter 39 Log and Report Figure 554 Configuration > Log & Report > Email Daily Report The following table describes the labels in this screen. Table 346 Configuration > Log & Report > Email Daily Report LABEL Enable Email Daily Report Mail Subject DESCRIPTION Select this to send reports by email every day. Type the subject line for outgoing email from the Zyxel Device. ZyWALL ATP Series Users Guide 794 Chapter 39 Log and Report Table 346 Configuration > Log & Report > Email Daily Report (continued) LABEL Mail To Send Report Now Click this button to have the Zyxel Device send the daily email report immediately. Report Items DESCRIPTION Type the email address (or addresses) to which the outgoing email is delivered. Select the information to include in the report. Types of information include System Resource Usage, Wireless Report, Interface Traffic Statistics and DHCP Table. Select Reset counters after sending report successfully if you only want to see statistics for a 24 hour period. Reset All Counters Click this to discard all report data and start all of the counters over at zero. Apply Reset Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. 39.3 Log Setting Screens The Log Setting screens control log messages and alerts. A log message stores the information for viewing or regular emailing later, and an alert is emailed immediately. Usually, alerts are used for events that require more serious attention, such as system errors and attacks. The Zyxel Device provides a system log and supports email profiles and remote syslog servers. View the system log in the MONITOR > Log screen. Use the email profiles to mail log messages to the specific destinations. You can also have the Zyxel Device store system logs on a connected USB storage device. The other four logs are stored on specified syslog servers. The Log Setting screens control what information the Zyxel Device saves in each log. You can also specify which log messages to email for the system log, and where and how often to email them. These screens also set for which events to generate alerts and where to email the alerts. The first Log Setting screen provides a settings summary. Use the Edit screens to configure settings such as log categories, email addresses, and server names for any log. Use the Log Category Settings screen to edit what information is included in the system log, USB storage, email profiles, and remote servers. 39.3.1 Log Setting Summary To access this screen, click Configuration > Log & Report > Log Setting. ZyWALL ATP Series Users Guide 795 Chapter 39 Log and Report Figure 555 Configuration > Log & Report > Log Setting The following table describes the labels in this screen. Table 347 Configuration > Log & Report > Log Setting LABEL Edit Activate Inactivate

#

Status Name DESCRIPTION Double-click an entry or select it and click Edit to open a screen where you can modify it. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. This field is a sequential value, and it is not associated with a specific log. The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. This field displays the type of log setting entry (system log, logs stored on a USB storage device connected to the Zyxel Device, or one of the remote servers). This field displays the format of the log. Internal - system log; you can view the log on the View Log tab. VRPT/Syslog - Zyxels Vantage Report, syslog-compatible format. CEF/Syslog - Common Event Format, syslog-compatible format. This field is a summary of the settings for each log. Please see Section 39.3.2 on page 796 for more information. Click this button to open the Log Category Settings Edit screen. Log Format Summary Log Category Settings Apply Click this button to save your changes (activate and deactivate logs) and make them take effect. 39.3.2 Edit System Log Settings The Log Settings Edit screen controls the detailed settings for each log in the system log (which includes the email profiles). Go to the Log Settings Summary screen (see Section 39.3.1 on page 795), and click the system log Edit icon. ZyWALL ATP Series Users Guide 796 Chapter 39 Log and Report Figure 556 Configuration > Log & Report > Log Setting > Edit (System Log - E-mail Servers) Figure 557 Configuration > Log & Report > Log Setting > Edit (System Log ) ZyWALL ATP Series Users Guide 797 Chapter 39 Log and Report Figure 558 Configuration > Log & Report > Log Setting > Edit (System Log - AP) The following table describes the labels in this screen. Table 348 Configuration > Log & Report > Log Setting > Edit (System Log) LABEL E-Mail Server 1/2 DESCRIPTION Active Mail Server Mail Server Port Mail Subject Send From Send Log To Send Alerts To Sending Log Day for Sending Log Time for Sending Log SMTP Authentication User Name Password Retype to Confirm Active Log and Alert System Log Select this to send log messages and alerts according to the information in this section. You specify what kinds of log messages are included in log information and what kinds of log messages are included in alerts in the Active Log and Alert section. Type the name or IP address of the outgoing SMTP server. Enter the same port number here as is on the mail server for mail traffic. Type the subject line for the outgoing email. Type the email address from which the outgoing email is delivered. This address is used in replies. Type the email address to which the outgoing email is delivered. Type the email address to which alerts are delivered. Select how often log information is emailed. Choices are: When Full, Hourly and When Full, Daily and When Full, and Weekly and When Full. This field is available if the log is emailed weekly. Select the day of the week the log is emailed. This field is available if the log is emailed weekly or daily. Select the time of day (hours and minutes) when the log is emailed. Use 24-hour notation. Select this check box if it is necessary to provide a user name and password to the SMTP server. This box is effective when you select the SMTP Authentication check box. Type the user name to provide to the SMTP server when the log is emailed. This box is effective when you select the SMTP Authentication check box. Type the password of up to 63 characters to provide to the SMTP server when the log is emailed. Type the password again to make sure that you have entered is correctly. Use the System Log drop-down list to change the log settings for all of the log categories. disable all logs (red X) - do not log any information for any category for the system log or email any logs to email server 1 or 2. enable normal logs (green check mark) - create log messages and alerts for all categories for the system log. If email server 1 or 2 also has normal logs enabled, the Zyxel Device will email logs to them. enable normal logs and debug logs (yellow check mark) - create log messages, alerts, and debugging information for all categories. The Zyxel Device does not email debugging information, even if this setting is selected. ZyWALL ATP Series Users Guide 798 Chapter 39 Log and Report Table 348 Configuration > Log & Report > Log Setting > Edit (System Log) (continued) LABEL E-mail Server 1 E-mail Server 2 Log Category System log E-mail Server 1 E-mail Server 2 Log Consolidation Active Log Consolidation Interval OK Cancel DESCRIPTION Use the E-Mail Server 1 drop-down list to change the settings for emailing logs to email server 1 for all log categories. Using the System Log drop-down list to disable all logs overrides your email server 1 settings. enable normal logs (green check mark) - email log messages for all categories to email server 1. enable alert logs (red exclamation point) - email alerts for all categories to email server 1. Use the E-Mail Server 2 drop-down list to change the settings for emailing logs to email server 2 for all log categories. Using the System Log drop-down list to disable all logs overrides your email server 2 settings. enable normal logs (green check mark) - email log messages for all categories to email server 2. enable alert logs (red exclamation point) - email alerts for all categories to email server 2. This field displays each category of messages. It is the same value used in the Display and Category fields in the View Log tab. The Default category includes debugging messages generated by open source software. Select which events you want to log by Log Category. There are three choices:

disable all logs (red X) - do not log any information from this category enable normal logs (green check mark) - create log messages and alerts from this category enable normal logs and debug logs (yellow check mark) - create log messages, alerts, and debugging information from this category; the Zyxel Device does not email debugging information, however, even if this setting is selected. Select whether each category of events should be included in the log messages when it is emailed (green check mark) and/or in alerts (red exclamation point) for the email settings specified in E-Mail Server 1. The Zyxel Device does not email debugging information, even if it is recorded in the System log. Select whether each category of events should be included in log messages when it is emailed (green check mark) and/or in alerts (red exclamation point) for the email settings specified in E-Mail Server 2. The Zyxel Device does not email debugging information, even if it is recorded in the System log. Select this to activate log consolidation. Log consolidation aggregates multiple log messages that arrive within the specified Log Consolidation Interval. In the View Log tab, the text [count=x], where x is the number of original log messages, is appended at the end of the Message field, when multiple log messages were aggregated. Type how often, in seconds, to consolidate log information. If the same log message appears multiple times, it is aggregated into one log message with the text [count=x], where x is the number of original log messages, appended at the end of the Message field. Click this to save your changes and return to the previous screen. Click this to return to the previous screen without saving your changes. ZyWALL ATP Series Users Guide 799 Chapter 39 Log and Report 39.3.3 Edit Log on USB Storage Setting The Edit Log on USB Storage Setting screen controls the detailed settings for saving logs to a connected USB storage device. Go to the Log Setting Summary screen (see Section 39.3.1 on page 795), and click the USB storage Edit icon. Figure 559 Configuration > Log & Report > Log Setting > Edit (USB Storage) The following table describes the labels in this screen. DESCRIPTION Select this to have the Zyxel Device save a copy of its system logs to a connected USB storage device. Use the Active Log section to specify what kinds of messages to include. Table 349 Configuration > Log & Report > Log Setting > Edit (USB Storage) LABEL Duplicate logs to USB storage (if ready) Enable log keep duration Keep Duration Active Log Enter a number of days that the Zyxel Device keeps this log. Select this checkbox to enter a value in the Keep Duration field. Selection Use the Selection drop-down list to change the log settings for all of the log categories. disable all logs (red X) - do not send the remote server logs for any log category. enable normal logs (green check mark) - send the remote server log messages and alerts for all log categories. enable normal logs and debug logs (yellow check mark) - send the remote server log messages, alerts, and debugging information for all log categories. ZyWALL ATP Series Users Guide 800 Chapter 39 Log and Report Table 349 Configuration > Log & Report > Log Setting > Edit (USB Storage) (continued) LABEL Log Category Selection OK Cancel DESCRIPTION This field displays each category of messages. The Default category includes debugging messages generated by open source software. Select what information you want to log from each Log Category (except All Logs; see below). Choices are:

disable all logs (red X) - do not log any information from this category enable normal logs (green check mark) - log regular information and alerts from this category enable normal logs and debug logs (yellow check mark) - log regular information, alerts, and debugging information from this category Click this to save your changes and return to the previous screen. Click this to return to the previous screen without saving your changes. 39.3.4 Edit Remote Server Log Settings The Log Settings Edit screen controls the detailed settings for each log in the remote server (syslog). Go to the Log Settings Summary screen (see Section 39.3.1 on page 795), and click a remote server Edit icon. Figure 560 Configuration > Log & Report > Log Setting > Edit (Remote Server - AC) ZyWALL ATP Series Users Guide 801 Chapter 39 Log and Report Configuration > Log & Report > Log Setting > Edit (Remote Server - AP) The following table describes the labels in this screen. Table 350 Configuration > Log & Report > Log Setting > Edit (Remote Server) LABEL Log Settings for Remote Server DESCRIPTION Active Log Format Server Address Server Port Log Facility Active Log Selection Log Category Selection OK Cancel Select this check box to send log information according to the information in this section. You specify what kinds of messages are included in log information in the Active Log section. This field displays the format of the log information. It is read-only. VRPT/Syslog - Zyxels Vantage Report, syslog-compatible format. CEF/Syslog - Common Event Format, syslog-compatible format. Type the server name or the IP address of the syslog server to which to send log information. Type the service port number used by the remote server. Select a log facility. The log facility allows you to log the messages to different files in the syslog server. Please see the documentation for your syslog program for more information. Use the Selection drop-down list to change the log settings for all of the log categories. disable all logs (red X) - do not send the remote server logs for any log category. enable normal logs (green check mark) - send the remote server log messages and alerts for all log categories. enable normal logs and debug logs (yellow check mark) - send the remote server log messages, alerts, and debugging information for all log categories. This field displays each category of messages. It is the same value used in the Display and Category fields in the View Log tab. The Default category includes debugging messages generated by open source software. Select what information you want to log from each Log Category (except All Logs; see below). Choices are:

disable all logs (red X) - do not log any information from this category enable normal logs (green check mark) - log regular information and alerts from this category enable normal logs and debug logs (yellow check mark) - log regular information, alerts, and debugging information from this category Click this to save your changes and return to the previous screen. Click this to return to the previous screen without saving your changes. ZyWALL ATP Series Users Guide 802 Chapter 39 Log and Report 39.3.5 Log Category Settings Screen The Log Category Settings screen allows you to view and to edit what information is included in the system log, USB storage, email profiles, and remote servers at the same time. It does not let you change other log settings (for example, where and how often log information is emailed or remote server names). To access this screen, go to the Log Settings Summary screen (see Section 39.3.1 on page 795), and click the Log Category Settings button. Figure 561 Log Category Settings AC Figure 562 Log Category Settings AP This screen provides a different view and a different way of indicating which messages are included in each log and each alert. Please see Section 39.3.2 on page 796, where this process is discussed. (The Default category includes debugging messages generated by open source software.) ZyWALL ATP Series Users Guide 803 Chapter 39 Log and Report The following table describes the fields in this screen. Table 351 Configuration > Log & Report > Log Setting > Log Category Settings LABEL System Log USB Storage E-mail Server 1 E-

mail E-mail Server 2 E-

mail Remote Server 1~4 Syslog Log Category System Log DESCRIPTION Use the System Log drop-down list to change the log settings for all of the log categories. disable all logs (red X) - do not log any information for any category for the system log or email any logs to email server 1 or 2. enable normal logs (green check mark) - create log messages and alerts for all categories for the system log. If email server 1 or 2 also has normal logs enabled, the Zyxel Device will email logs to them. enable normal logs and debug logs (yellow check mark) - create log messages, alerts, and debugging information for all categories. The Zyxel Device does not email debugging information, even if this setting is selected. Use the USB Storage drop-down list to change the log settings for saving logs to a connected USB storage device. disable all logs (red X) - do not log any information for any category to a connected USB storage device. enable normal logs (green check mark) - create log messages and alerts for all categories and save them to a connected USB storage device. enable normal logs and debug logs (yellow check mark) - create log messages, alerts, and debugging information for all categories and save them to a connected USB storage device. Use the E-Mail Server 1 drop-down list to change the settings for emailing logs to email server 1 for all log categories. Using the System Log drop-down list to disable all logs overrides your email server 1 settings. enable normal logs (green check mark) - email log messages for all categories to email server 1. enable alert logs (red exclamation point) - email alerts for all categories to email server 1. Use the E-Mail Server 2 drop-down list to change the settings for emailing logs to email server 2 for all log categories. Using the System Log drop-down list to disable all logs overrides your email server 2 settings. enable normal logs (green check mark) - email log messages for all categories to email server 2. enable alert logs (red exclamation point) - email alerts for all categories to email server 2. For each remote server, use the Selection drop-down list to change the log settings for all of the log categories. disable all logs (red X) - do not send the remote server logs for any log category. enable normal logs (green check mark) - send the remote server log messages and alerts for all log categories. enable normal logs and debug logs (yellow check mark) - send the remote server log messages, alerts, and debugging information for all log categories. This field displays each category of messages. It is the same value used in the Display and Category fields in the View Log tab. The Default category includes debugging messages generated by open source software. Select which events you want to log by Log Category. There are three choices:

disable all logs (red X) - do not log any information from this category enable normal logs (green check mark) - create log messages and alerts from this category enable normal logs and debug logs (yellow check mark) - create log messages, alerts, and debugging information from this category; the Zyxel Device does not email debugging information, however, even if this setting is selected. ZyWALL ATP Series Users Guide 804 Chapter 39 Log and Report Table 351 Configuration > Log & Report > Log Setting > Log Category Settings (continued) LABEL USB Storage DESCRIPTION Select which event log categories to save to a connected USB storage device. There are three choices:

disable all logs (red X) - do not log any information from this category enable normal logs (green check mark) - save log messages and alerts from this category enable normal logs and debug logs (yellow check mark) - save log messages, alerts, and debugging information from this category. Select whether each category of events should be included in the log messages when it is emailed (green check mark) and/or in alerts (red exclamation point) for the email settings specified in E-Mail Server 1. The Zyxel Device does not email debugging information, even if it is recorded in the System log. Select whether each category of events should be included in log messages when it is emailed

(green check mark) and/or in alerts (red exclamation point) for the email settings specified in E-

Mail Server 2. The Zyxel Device does not email debugging information, even if it is recorded in the System log. For each remote server, select what information you want to log from each Log Category

(except All Logs; see below). Choices are:

disable all logs (red X) - do not log any information from this category enable normal logs (green check mark) - log regular information and alerts from this category enable normal logs and debug logs (yellow check mark) - log regular information, alerts, and debugging information from this category Click this to save your changes and return to the previous screen. Click this to return to the previous screen without saving your changes. E-mail Server 1 E-

mail E-mail Server 2 E-

mail Remote Server 1~4 Syslog OK Cancel ZyWALL ATP Series Users Guide 805 CHAPTER 40 File Manager 40.1 Overview Configuration files define the Zyxel Devices settings. Shell scripts are files of commands that you can store on the Zyxel Device and run when you need them. You can apply a configuration file or run a shell script without the Zyxel Device restarting. You can store multiple configuration files and shell script files on the Zyxel Device. You can edit configuration files or shell scripts in a text editor and upload them to the Zyxel Device. Configuration files use a .conf extension and shell scripts use a .zysh extension. 40.1.1 What You Can Do in this Chapter Use the Configuration File screen (see Section 40.2 on page 808) to store and name configuration files. You can also download configuration files from the Zyxel Device to your computer and upload configuration files from your computer to the Zyxel Device. Use the Firmware Package screen (see Section 40.3 on page 812) to check your current firmware version and upload firmware to the Zyxel Device. Use the Shell Script screen (see Section 40.4 on page 818) to store, name, download, upload and run shell script files. 40.1.2 What you Need to Know Configuration Files and Shell Scripts When you apply a configuration file, the Zyxel Device uses the factory default settings for any features that the configuration file does not include. When you run a shell script, the Zyxel Device only applies the commands that it contains. Other settings do not change. ZyWALL ATP Series Users Guide 806 Chapter 40 File Manager These files have the same syntax, which is also identical to the way you run CLI commands manually. An example is shown below. Figure 563 Configuration File / Shell Script: Example

# enter configuration mode configure terminal

# change administrator password username admin password 4321 user-type admin

# configure ge3 interface ge3 ip address 172.23.37.240 255.255.255.0 ip gateway 172.23.37.254 metric 1 exit

# create address objects for remote management / to-ZyWALL firewall rules

# use the address group in case we want to open up remote management later address-object TW_SUBNET 172.23.37.0/24 object-group address TW_TEAM address-object TW_SUBNET exit

# enable Telnet access (not enabled by default, unlike other services) ip telnet server

# open WAN-to-ZyWALL firewall for TW_TEAM for remote management firewall WAN ZyWALL insert 4 sourceip TW_TEAM service TELNET action allow exit write While configuration files and shell scripts have the same syntax, the Zyxel Device applies configuration files differently than it runs shell scripts. This is explained below. Table 352 Configuration Files and Shell Scripts in the Zyxel Device Shell Scripts (.zysh) Configuration Files (.conf) Goes into CLI Privilege mode. Resets to default configuration. Goes into CLI Configuration mode. Runs the commands in the shell script. Runs the commands in the configuration file. You have to run the example in Figure 563 on page 807 as a shell script because the first command is run in Privilege mode. If you remove the first command, you have to run the example as a configuration file because the rest of the commands are executed in Configuration mode. Comments in Configuration Files or Shell Scripts In a configuration file or shell script, use # or ! as the first character of a command line to have the Zyxel Device treat the line as a comment. Your configuration files or shell scripts can use exit or a command line consisting of a single ! to have the Zyxel Device exit sub command mode. Note: exit or ! must follow sub commands if it is to make the Zyxel Device exit sub command mode. ZyWALL ATP Series Users Guide 807 Chapter 40 File Manager Line 3 in the following example exits sub command mode. interface ge1 ip address dhcp

!

Lines 1 and 3 in the following example are comments and line 4 exits sub command mode.

!

interface ge1

# this interface is a DHCP client

!

Lines 1 and 2 are comments. Line 5 exits sub command mode.

! this is from Joe

# on 2008/04/05 interface ge1 ip address dhcp

!

Errors in Configuration Files or Shell Scripts When you apply a configuration file or run a shell script, the Zyxel Device processes the file line-by-line. The Zyxel Device checks the first line and applies the line if no errors are detected. Then it continues with the next line. If the Zyxel Device finds an error, it stops applying the configuration file or shell script and generates a log. You can change the way a configuration file or shell script is applied. Include setenv stop-on-error off in the configuration file or shell script. The Zyxel Device ignores any errors in the configuration file or shell script and applies all of the valid commands. The Zyxel Device still generates a log for any errors. 40.2 The Configuration File Screen Click Maintenance > File Manager > Configuration File to open the Configuration File screen. Use the Configuration File screen to store, run, and name configuration files. You can also download configuration files from the Zyxel Device to your computer and upload configuration files from your computer to the Zyxel Device. Once your Zyxel Device is configured and functioning properly, it is highly recommended that you back up your configuration file before making further configuration changes. The backup configuration file will be useful in case you need to return to your previous settings. Filenames beginning with autoback are automatic configuration files created when new firmware is uploaded. backup-yyyy-mm-dd-hh-mm-ss.conf is the name of the automatic backup when a secure policy is added or changed. Select a configuration file, then click Apply to apply the file to the Zyxel Device . ZyWALL ATP Series Users Guide 808 Chapter 40 File Manager Configuration File Flow at Restart If there is not a startup-config.conf when you restart the Zyxel Device (whether through a management interface or by physically turning the power off and back on), the Zyxel Device uses the system-default.conf configuration file with the Zyxel Devices default settings. If there is a startup-config.conf, the Zyxel Device checks it for errors and applies it. If there are no errors, the Zyxel Device uses it and copies it to the lastgood.conf configuration file as a back up file. If there is an error, the Zyxel Device generates a log and copies the startup-config.conf configuration file to the startup-config-bad.conf configuration file and tries the existing lastgood.conf configuration file. If there isnt a lastgood.conf configuration file or it also has an error, the Zyxel Device applies the system-default.conf configuration file. You can change the way the startup-config.conf file is applied. Include the setenv-startup stop-

on-error off command. The Zyxel Device ignores any errors in the startup-config.conf file and applies all of the valid commands. The Zyxel Device still generates a log for any errors. Figure 564 Maintenance > File Manager > Configuration File Do not turn off the Zyxel Device while configuration file upload is in progress. ZyWALL ATP Series Users Guide 809 Chapter 40 File Manager The following table describes the labels in this screen. Table 353 Maintenance > File Manager > Configuration File LABEL Rename DESCRIPTION Use this button to change the label of a configuration file on the Zyxel Device. You can only rename manually saved configuration files. You cannot rename the lastgood.conf, system-

default.conf and startup-config.conf files. You cannot rename a configuration file to the name of another configuration file in the Zyxel Device. Click a configuration files row to select it and click Rename to open the Rename File screen. Figure 565 Maintenance > File Manager > Configuration File > Rename Remove Download Copy Specify the new name for the configuration file. Use up to 63 characters (including a-zA-Z0-

9;~!@#$%^&()_+[]{},.=-). Click OK to save the duplicate or click Cancel to close the screen without saving a duplicate of the configuration file. Click a configuration files row to select it and click Remove to delete it from the Zyxel Device. You can only delete manually saved configuration files. You cannot delete the system-

default.conf, startup-config.conf and lastgood.conf files. A pop-up window asks you to confirm that you want to delete the configuration file. Click OK to delete the configuration file or click Cancel to close the screen without deleting the configuration file. Click a configuration files row to select it and click Download to save the configuration to your computer. Use this button to save a duplicate of a configuration file on the Zyxel Device. Click a configuration files row to select it and click Copy to open the Copy File screen. Figure 566 Maintenance > File Manager > Configuration File > Copy Specify a name for the duplicate configuration file. Use up to 63 characters (including a-zA-Z0-

9;~!@#$%^&()_+[]{},.=-). Click OK to save the duplicate or click Cancel to close the screen without saving a duplicate of the configuration file. ZyWALL ATP Series Users Guide 810 Chapter 40 File Manager Table 353 Maintenance > File Manager > Configuration File (continued) LABEL Apply DESCRIPTION Use this button to have the Zyxel Device use a specific configuration file. Click a configuration files row to select it and click Apply to have the Zyxel Device use that configuration file. The Zyxel Device does not have to restart in order to use a different configuration file, although you will need to wait for a few minutes while the system reconfigures. The following screen gives you options for what the Zyxel Device is to do if it encounters an error in the configuration file. Figure 567 Maintenance > File Manager > Configuration File > Apply

#

File Name Immediately stop applying the configuration file - this is not recommended because it would leave the rest of the configuration blank. If the interfaces were not configured before the first error, the console port may be the only way to access the device. Immediately stop applying the configuration file and roll back to the previous configuration -

this gets the Zyxel Device started with a fully valid configuration file as quickly as possible. Ignore errors and finish applying the configuration file - this applies the valid parts of the configuration file and generates error logs for all of the configuration files errors. This lets the Zyxel Device apply most of your configuration and you can refer to the logs for what to fix. Ignore errors and finish applying the configuration file and then roll back to the previous configuration - this applies the valid parts of the configuration file, generates error logs for all of the configuration files errors, and starts the Zyxel Device with a fully valid configuration file. Click OK to have the Zyxel Device start applying the configuration file or click Cancel to close the screen This column displays the number for each configuration file entry. This field is a sequential value, and it is not associated with a specific address. The total number of configuration files that you can save depends on the sizes of the configuration files and the available flash storage space. This column displays the label that identifies a configuration file. You cannot delete the following configuration files or change their file names. The system-default.conf file contains the Zyxel Devices default settings. Select this file and click Apply to reset all of the Zyxel Device settings to the factory defaults. This configuration file is included when you upload a firmware package. The startup-config.conf file is the configuration file that the Zyxel Device is currently using. If you make and save changes during your management session, the changes are applied to this configuration file. The Zyxel Device applies configuration changes made in the Web Configurator to the configuration file when you click Apply or OK. It applies configuration changes made via commands when you use the write command. The lastgood.conf is the most recently used (valid) configuration file that was saved when the device last restarted. If you upload and apply a configuration file with an error, you can apply lastgood.conf to return to a valid configuration. ZyWALL ATP Series Users Guide 811 Chapter 40 File Manager Table 353 Maintenance > File Manager > Configuration File (continued) LABEL Size Last Modified DESCRIPTION This column displays the size (in KB) of a configuration file. This column displays the date and time that the individual configuration files were last changed or saved. The bottom part of the screen allows you to upload a new or previously saved configuration file from your computer to your Zyxel Device You cannot upload a configuration file named system-default.conf or lastgood.conf. If you upload startup-config.conf, it will replace the current configuration and immediately apply the new settings. Type in the location of the file you want to upload in this field or click Browse ... to find it. Click Browse... to find the .conf file you want to upload. The configuration file must use a

.conf filename extension. You will receive an error message if you try to upload a fie of a different format. Remember that you must decompress compressed (.zip) files before you can upload them. Click Upload to begin the upload process. This process may take up to two minutes. Upload Configuration File File Path Browse... Upload 40.3 Firmware Management Use the Firmware Management screen to check your current firmware version and upload firmware to the Zyxel Device. You can upload firmware to be the Running firmware or Standby firmware. Note: The Web Configurator is the recommended method for uploading firmware. You only need to use the command line interface if you need to recover the firmware. See the CLI Reference Guide for how to determine if you need to recover the firmware and how to recover it. Find the firmware file in a folder that (usually) uses the system model name with the model code and a bin extension. For example, a firmware for ZyWALL VPN100 is 430ABFV0b2s1.bin. The Zyxel Devices firmware package cannot go through the Zyxel Device when you enable the anti-

malware Destroy compressed files that could not be decompressed option. The Zyxel Device classifies the firmware package as not being able to be decompressed and deletes it. You can upload the firmware package to the Zyxel Device with the option enabled, so you only need to clear the Destroy compressed files that could not be decompressed option while you download the firmware package. See Section 28.2 on page 548 for more on the anti-malware Destroy compressed files that could not be decompressed option. The firmware update can take up to five minutes. Do not turn off or reset the Zyxel Device while the firmware update is in progress!

If your Zyxel Device has two firmware images installed, and one fails to boot (kernel crash, kernel panic, out-of-memory etc.), then the Zyxel Device will automatically use the (good) backup image to boot. 40.3.1 Cloud Helper Cloud Helper lets you know if there is a later firmware available on the Cloud Helper server and lets you download it if there is. ZyWALL ATP Series Users Guide 812 Chapter 40 File Manager Note: Go to myZyxel, create an account and register your Zyxel Device first. Then you will be able to see links to and get notifications on new firmware available. At the time of writing, the Firmware Upgrade license providing Cloud Helper new firmware notifications is free when you register your Zyxel Device. The license does not expire if you have firmware version 4.32 patch 1 and later. ZyWALL ATP Series Users Guide 813 Chapter 40 File Manager The following table explains the Upgrade icons in the web configurator. Table 354 Cloud Helper Firmware Icons Cloud Helper New A later firmware is available on the Cloud Helper Server. Click this icon to display a Whats New pop-up screen. You need a Firmware Upgrade license to upgrade the firmware. If you do not have a license, Upgrade Now is grayed out. If you have a license, click Upgrade Now to directly upgrade firmware to the standby partition and have the Zyxel Device reboot automatically so that the new standby firmware becomes the running firmware. The previous running firmware becomes the standby firmware. If you havent registered the Zyxel Device, a message will appear and remind you to register it. Also, Upgrade Now is grayed out. ZyWALL ATP Series Users Guide 814 Chapter 40 File Manager Table 354 Cloud Helper Firmware Icons Cloud Helper Downloading Cloud firmware is being downloaded from the Cloud Helper Server. If you select another partition or the local firmware upgrade icon, you will see the following warning message. When firmware is downloading, you can pause, resume, stop or retry the firmware download. Local Firmware Use this if you have already downloaded the latest firmware from the Zyxel website to your computer and unzipped it. Click the icon and then browse to the location of the unzipped files. If you upload the latest firmware to the running partition, the Zyxel Device will reboot automatically when it finishes uploading. If you upload the latest firmware to the standby partition, a message will appear to ask if you want to reboot the Zyxel Device. 40.3.2 The Firmware Management Screen Click Maintenance > File Manager > Firmware Management to open the Firmware Management screen. ZyWALL ATP Series Users Guide 815 Chapter 40 File Manager Figure 568 Maintenance > File Manager > Firmware Management The following table describes the labels in this screen. Table 355 Maintenance > File Manager > Firmware Management LABEL Firmware Status Reboot DESCRIPTION Click the Reboot icon to restart the Zyxel Device. If you applied changes in the Web configurator, these were saved automatically and do not change when you reboot. If you made changes in the CLI, however, you have to use the write command to save the configuration before you reboot. Otherwise, the changes are lost when you reboot. If you want the Standby firmware to be the Running firmware, then select the Standby firmware row and click Reboot. Wait a few minutes until the login screen appears. If the login screen does not appear, clear your browser cache and refresh the screen or type the IP address of the Zyxel Device in your Web browser again. You can also use the CLI command reboot to restart the Zyxel Device. This displays the system space (partition) index number where the firmware is located. The firmware can be either Standby or Running; only one firmware can be running at any one time. This indicates whether the firmware is Running, or not running but already uploaded to the Zyxel Device and is on Standby. It displays N/A if there is no firmware uploaded to that system space. This is the model name of the device which the firmware is running on. This is the firmware version and the date created. This is the date that the version of the firmware was created.

#

Status Model Version Released Date ZyWALL ATP Series Users Guide 816 Chapter 40 File Manager Table 355 Maintenance > File Manager > Firmware Management (continued) LABEL Upgrade DESCRIPTION A cloud helper icon displays if there is a later firmware on the Cloud Server than the firmware in the partition. Click the cloud helper icon to download a later firmware from the Cloud Helper Server. Cloud Firmware Information Latest Version Release Date Release Note Auto Update Daily Weekly Auto Reboot Firmware Upgrade Service Status Service Status Use the local firmware icon if you have already downloaded the latest firmware from the Zyxel website to your computer and unzipped it. You must register your Zyxel Device at myZyxel first to use cloud firmware. This displays the latest firmware version at the Cloud Helper Server. Click Check Now to see if there is a later firmware at the Cloud Server. This displays the date the latest firmware version was made available. The release note contains details of latest firmware version such as new features and bug fixes. Select this check box to have the Zyxel Device automatically check for and download new firmware to the standby partition at the time and day specified. You should select a time when your network is not busy for minimal interruption. Select this option to have the Zyxel Device check for new firmware every day at the specified time. The time format is the 24 hour clock, so 0 means midnight for example. Select this option to have the Zyxel Device check for new firmware once a week on the day and at the time specified. Select this to have the newly downloaded firmware in the standby partition become the running firmware after the Zyxel Device automatically restarts. This field displays whether the firmware license service is activated at myZyxel (Activated) or not (Not Activated). After you see the Firmware Upload in Process screen, wait a few minutes before logging into the Zyxel Device again. Figure 569 Firmware Upload In Process Note: The Zyxel Device automatically reboots after a successful upload. The Zyxel Device automatically restarts causing a temporary network disconnect. In some operating systems, you may see the following icon on your desktop. Figure 570 Network After five minutes, log in again and check your new firmware version in the Dashboard screen. If the upload was not successful, the following message appears in the status bar at the bottom of the screen. ZyWALL ATP Series Users Guide 817 Chapter 40 File Manager Figure 571 Firmware Upload Error 40.3.3 Firmware Upgrade via USB Stick In addition to uploading firmware via the web configurator or console port (see the CLI Reference Guide), you can also upload firmware directly from a USB stick connected to the Zyxel Device. 1 Create a folder on the USB stick called /[ProductName_dir]/firmware. For example, if your Zyxel Device is USG110, then create a /usg110_dir/firmware/ folder on the stick. 2 3 4 Put one firmware bin file into the firmware folder. Make sure the firmware ID and version number are correct for your model (the firmware ID is in brackets after the firmware version number - for USG100 it is AAPH). Note: Do not put more than one firmware bin file into the firmware folder. The firmware version in the USB stick must be different to the currently running firmware. If the firmware on the USB stick is older, then the Zyxel Device will upgrade to the older version. It is recommended that the firmware on the USB stick be the latest firmware version. Insert the USB stick into the Zyxel Device. The firmware uploads to the standby system space. The SYS LED blinks when the Zyxel Device automatically reboots making the upgraded firmware in standby become the running firmware. Note: If the startup-config.conf configuration file has problems and you are upgrading to 4.25 or later firmware, then the Zyxel Device will revert (failover) to the previously running firmware. If the startup-config.conf configuration file has problems and you are upgrading to earlier than 4.25 firmware, then the Zyxel Device uses the new earlier firmware, but generates a log and tries the existing lastgood.conf configuration file. If there isnt a lastgood.conf configuration file or it also has an error, the Zyxel Device applies the system-default.conf configuration file. 40.4 The Shell Script Screen Use shell script files to have the Zyxel Device execute commands that you specify. Use a text editor to create the shell script files. They must use a .zysh filename extension. Click Maintenance > File Manager > Shell Script to open the Shell Script screen. Use the Shell Script screen to store, name, download, upload and run shell script files. You can store multiple shell script files on the Zyxel Device at the same time. ZyWALL ATP Series Users Guide 818 Note: You should include write commands in your scripts. If you do not use the write command, the changes will be lost when the Zyxel Device restarts. You could use multiple write commands in a long script. Figure 572 Maintenance > File Manager > Shell Script Each field is described in the following table. Table 356 Maintenance > File Manager > Shell Script LABEL Rename DESCRIPTION Use this button to change the label of a shell script file on the Zyxel Device. You cannot rename a shell script to the name of another shell script in the Zyxel Device. Click a shell scripts row to select it and click Rename to open the Rename File screen. Figure 573 Maintenance > File Manager > Shell Script > Rename Specify the new name for the shell script file. Use up to 63 characters (including a-zA-Z0-

9;~!@#$%^&()_+[]{},.=-). Click OK to save the duplicate or click Cancel to close the screen without saving a duplicate of the configuration file. Click a shell script files row to select it and click Remove to delete the shell script file from the Zyxel Device. A pop-up window asks you to confirm that you want to delete the shell script file. Click OK to delete the shell script file or click Cancel to close the screen without deleting the shell script file. Click a shell script files row to select it and click Download to save the configuration to your computer. Remove Download ZyWALL ATP Series Users Guide 819 Chapter 40 File Manager Table 356 Maintenance > File Manager > Shell Script (continued) LABEL Copy DESCRIPTION Use this button to save a duplicate of a shell script file on the Zyxel Device. Click a shell script files row to select it and click Copy to open the Copy File screen. Figure 574 Maintenance > File Manager > Shell Script > Copy Specify a name for the duplicate file. Use up to 63 characters (including a-zA-Z0-

9;~!@#$%^&()_+[]{},.=-). Click OK to save the duplicate or click Cancel to close the screen without saving a duplicate of the configuration file. Use this button to have the Zyxel Device use a specific shell script file. Click a shell script files row to select it and click Apply to have the Zyxel Device use that shell script file. You may need to wait awhile for the Zyxel Device to finish applying the commands. This column displays the label that identifies a shell script file. This column displays the size (in KB) of a shell script file. This column displays the date and time that the individual shell script files were last changed or saved. The bottom part of the screen allows you to upload a new or previously saved shell script file from your computer to your Zyxel Device. Type in the location of the file you want to upload in this field or click Browse ... to find it. Click Browse... to find the .zysh file you want to upload. Click Upload to begin the upload process. This process may take up to several minutes. Apply File Name Size Last Modified Upload Shell Script File Path Browse... Upload ZyWALL ATP Series Users Guide 820 Chapter 41 Diagnostics CHAPTER 41 Diagnostics 41.1 Overview Use the diagnostics screens for troubleshooting. 41.1.1 What You Can Do in this Chapter Use the Diagnostics screens (see Section 41.2 on page 821) to generate a file containing the Zyxel Devices configuration and diagnostic information if you need to provide it to customer support during troubleshooting. Use the Packet Capture screens (see Section 41.3 on page 825) to capture packets going through the Zyxel Device. Use the CPU / Memory Status screens (see Section 41.4 on page 832) to view the CPU and memory performance of various applications on the Zyxel Device. Use the System Logs screen (see Section 41.5 on page 834) to see system logs stored on a connected USB storage device on the Zyxel Device. Use the Remote Assistance screens (see Section 41.6 on page 834) to configure and schedule external access to the Zyxel Device for troubleshooting. Use the Network Tool screen (see Section 41.7 on page 836) to ping an IP address or trace the route packets take to a host. Use the Routing Traces screens (see Section 41.8 on page 838) to configure traceroute to identify where packets are dropped for troubleshooting. Use the Wireless Frame Capture screens (see Section 41.9 on page 839) to capture network traffic going through the AP interfaces connected to your Zyxel Device. 41.2 The Diagnostics Screens The Diagnostics screens provide an easy way for you to generate a file containing the Zyxel Devices configuration and diagnostic information. You may need to send this file to customer support for troubleshooting. Click Maintenance > Diagnostics to open the Diagnostics screens. ZyWALL ATP Series Users Guide 821 Chapter 41 Diagnostics 41.2.1 The Diagnostics Collect Screen When you click Collect Now, a series of commands are run to display information about the Zyxel Device. This is an example of a default script with interface diagnostic commands. debug interface ifconfig debug interface show event_sink debug interface show interface_obj debug switch table debug switch port_groupping show ping-check status debug system netstat interface show interface all show port status You can also create your own script to display information about the Zyxel Device. This is an example of a customized Diagnostics > Collect script. show service-register status all show myzyxel-service get-cloud-timezone show cloud-helper firmware show cloud-helper remind Note: A script created in File Manager > Shell Script is used to run commands on the Zyxel Device. A script created in Diagnostics > Collect is used to display information about the Zyxel Device only. Both use a .zysh filename extension with a file name of up to 25 characters (including a-z, A-Z, 0-9 and ;~!@#$%^&()_+[]{},.=-). Spaces are allowed. Click Maintenance > Diagnostics > Collect to open the Collect screen. Figure 575 Maintenance > Diagnostics > Collect The following table describes the labels in this screen. Table 357 Maintenance > Diagnostics > Collect LABEL General Setting Filename Last modified DESCRIPTION Size Upload the cmd file as the customized script This is the name of the most recently created diagnostic file. This is the date and time that the last diagnostic file was created. The format is yyyy-

mm-dd hh:mm:ss. This is the size of the most recently created diagnostic file. Select this to upload a customized shell script to display information about the Zyxel Device. Use a text editor to create the shell script files. They must use a .zysh filename extension. Specify the new name for the shell script file. Use up to 25 characters (including a-z, A-Z, 0-9 and ;~!@#$%^&()_+[]{},.=-). Spaces are allowed. ZyWALL ATP Series Users Guide 822 Chapter 41 Diagnostics DESCRIPTION Select this to have the Zyxel Device create an extra copy of the diagnostic file to a connected USB storage device. Table 357 Maintenance > Diagnostics > Collect (continued) LABEL Copy the diagnostic file to USB storage (if ready) Select Upload the cmd file as the customized script to display the following fields. Shell Scripts Filename Upload Shell Script File Path This displays the names of the customized shell script you created. Click Browse to find the location of the file you want to upload in this field. Click Upload to begin the upload process. This process may take a few minutes. Click Apply to save your changes. Click this to have the Zyxel Device create a new diagnostic file. Apply Collect Now Wait while information is collected. 41.2.2 The Diagnostics Collect on AP Screen This screen provides an easy way for you to generate a file containing the selected managed APs configuration and diagnostic information. You may need to generate this file and send it to customer support during troubleshooting. Click Maintenance > Diagnostics > Collect on AP to open the Collect on AP screen. Figure 576 Maintenance > Diagnostics > Collect on AP ZyWALL ATP Series Users Guide 823 Chapter 41 Diagnostics The following table describes the labels in this screen. Table 358 Maintenance > Diagnostics > Collect on AP LABEL AP General Setting Available APs DESCRIPTION Collected APs Copy the diagnostic file to USB storage (if ready) Apply Collect Now This text box lists the managed APs that are connected and available. Select the managed APs that you want the Zyxel Device to generate a diagnostic file containing their configuration, and click the right arrow button to add them. This text box lists the managed APs that you allow the Zyxel Device to generate a diagnostic file containing their configuration. Select any managed APs that you want to prevent the Zyxel Device from generating a diagnostic file for them, and click the left arrow button to remove them. Select this to have the Zyxel Device create an extra copy of the diagnostic file to a connected USB storage device. Click Apply to save your changes. Click this to have the Zyxel Device create a new diagnostic file. 41.2.3 The Diagnostics Files Screen Click Maintenance > Diagnostics > Files to open the diagnostic files screen. This screen lists the files of diagnostic information the Zyxel Device has collected and stored on the Zyxel Device or in a connected USB storage device. You may need to send these files to customer support for troubleshooting. Figure 577 Maintenance > Diagnostics > Files The following table describes the labels in this screen. Table 359 Maintenance > Diagnostics > Files LABEL Diagnostic files Diagnostic files in USB storage Remove DESCRIPTION This lists the files of diagnostic information stored on the Zyxel Device. This lists the files of diagnostic information stored in a connected USB storage device. Select files and click Remove to delete them from the Zyxel Device or the USB storage device. Use the [Shift] and/or [Ctrl] key to select multiple files. A pop-up window asks you to confirm that you want to delete. Click a file to select it and click Download to save it to your computer. This column displays the number for each file entry. The total number of files that you can save depends on the file sizes and the available storage space. Download

#

ZyWALL ATP Series Users Guide 824 Chapter 41 Diagnostics Table 359 Maintenance > Diagnostics > Files (continued) LABEL File Name Size Last Modified This column displays the date and time that the individual files were saved. DESCRIPTION This column displays the label that identifies the file. This column displays the size (in bytes) of a file. 41.3 The Packet Capture Screen Use this screen to capture network traffic going through the Zyxel Devices interfaces. Studying these packet captures may help you identify network problems. Click Maintenance > Diagnostics > Packet Capture to open the packet capture screen. Note: New capture files overwrite existing files of the same name. Change the File Suffix fields setting to avoid this. ZyWALL ATP Series Users Guide 825 Chapter 41 Diagnostics Figure 578 Maintenance > Diagnostics > Packet Capture The following table describes the labels in this screen. Table 360 Maintenance > Diagnostics > Packet Capture LABEL Interfaces DESCRIPTION Enabled interfaces (except for virtual interfaces) appear under Available Interfaces. Select interfaces for which to capture packets and click the right arrow button to move them to the Capture Interfaces list. Use the [Shift] and/or [Ctrl] key to select multiple objects. Select the version of IP for which to capture packets. Select any to capture packets for all IP versions. Select the protocol of traffic for which to capture packets. Select any to capture packets for all types of traffic. IP Version Protocol Type ZyWALL ATP Series Users Guide 826 Chapter 41 Diagnostics Table 360 Maintenance > Diagnostics > Packet Capture (continued) LABEL Host IP Host Port Continuously capture and overwrite old ones Captured Packet Files Split threshold Duration File Suffix Number Of Bytes To Capture (Per Packet) Save data to onboard storage only Save data to USB storage DESCRIPTION Select a host IP address object for which to capture packets. Select any to capture packets for all hosts. Select User Defined to be able to enter an IP address. This field is configurable when you set the IP Type to any, tcp, or udp. Specify the port number of traffic to capture. Select this to have the Zyxel Device keep capturing traffic and overwriting old packet capture entries when the available storage space runs out. When saving packet captures only to the Zyxel Devices on board storage, specify a maximum limit in megabytes for the total combined size of all the capture files on the Zyxel Device. When saving packet captures to a connected USB storage device, specify a maximum limit in megabytes for each capture file. Note: If you have existing capture files and have not selected the Continuously capture and overwrite old ones option, you may need to set this size larger or delete existing capture files. The valid range depends on the available on board/USB storage size. The Zyxel Device stops the capture and generates the capture file when either the file reaches this size or the time period specified in the Duration field expires. Specify a maximum size limit in megabytes for individual packet capture files. After a packet capture file reaches this size, the Zyxel Device starts another packet capture file. Set a time limit in seconds for the capture. The Zyxel Device stops the capture and generates the capture file when either this period of time has passed or the file reaches the size specified in the File Size field. 0 means there is no time limit. Specify text to add to the end of the file name (before the dot and filename extension) to help you identify the packet capture files. Modifying the file suffix also avoids making new capture files that overwrite existing files of the same name. The file name format is interface name-file suffix.cap, for example vlan2-packet-

capture.cap. Specify the maximum number of bytes to capture per packet. The Zyxel Device automatically truncates packets that exceed this size. As a result, when you view the packet capture files in a packet analyzer, the actual size of the packets may be larger than the size of captured packets. Select this to have the Zyxel Device only store packet capture entries on the Zyxel Device. The available storage size is displayed as well. Note: The Zyxel Device reserves some on board storage space as a buffer. Select this to have the Zyxel Device store packet capture entries only on a USB storage device connected to the Zyxel Device if the Zyxel Device allows this. Status:

Unused - the connected USB storage device was manually unmounted by using the Remove Now button or for some reason the Zyxel Device cannot mount it. none - no USB storage device is connected. service deactivated - USB storage feature is disabled (in Configuration > System > USB Storage), so the Zyxel Device cannot use a connected USB device to store system logs and other diagnostic information. available - you can have the Zyxel Device use the USB storage device. The available storage capacity also displays. Note: The Zyxel Device reserves some USB storage space as a buffer. ZyWALL ATP Series Users Guide 827 Chapter 41 Diagnostics Table 360 Maintenance > Diagnostics > Packet Capture (continued) LABEL Save data to ftp server

(available: xx MB) Server Address Server Port Name Password DESCRIPTION Select this to have the Zyxel Device store packet capture entries on the defined FTP site. The available storage size is displayed as well. Type the IP address of the FTP server. Type the port this server uses for FTP traffic. The default FTP port is 21. Type the login username to access the FTP server. Type the associated login password to access the FTP server. Click this button to have the Zyxel Device capture packets according to the settings configured in this screen. You can configure the Zyxel Device while a packet capture is in progress although you cannot modify the packet capture settings. The Zyxel Devices throughput or performance may be affected while a packet capture is in progress. After the Zyxel Device finishes the capture it saves a separate capture file for each selected interface. The total number of packet capture files that you can save depends on the file sizes and the available flash storage space. Once the flash storage space is full, adding more packet captures will fail. Click this button to stop a currently running packet capture and generate a separate capture file for each selected interface. Click this button to return the screen to its last-saved settings. Capture Stop Reset 41.3.1 The Packet Capture on AP Screen Use this screen to capture network traffic going through the connected APs interfaces. Studying these packet captures may help you identify network problems. Click Maintenance > Diagnostics > Packet Capture > Capture on AP to open the packet capture screen. Note: New capture files overwrite existing files of the same name. Change the File Suffix fields setting to avoid this. ZyWALL ATP Series Users Guide 828 Figure 579 Maintenance > Diagnostics > Packet Capture > Capture on AP The following table describes the labels in this screen. Table 361 Maintenance > Diagnostics > Packet Capture > Capture on AP LABEL Select on AP DESCRIPTION This lists the managed APs that are connected and available. Select the managed AP that you want the Zyxel Device to capture network traffic going through it. After you select an AP, click this button to update and display the interfaces, filter configuration and storage size available for the selected AP in the screen. Query Capture Status Interfaces Note: You need to use the Query button before packet capturing on an AP if the AP has rebooted or the applied AP profile settings have been changed. This shows Standby when the Zyxel Device is ready to or have finished capturing network traffic going through the selected APs interface(s). This shows Preparing when the Zyxel Device is sending the capture command to the APs interface(s). This shows Capturing when the AP is capturing network traffic going through the selected APs interface(s). This shows File Receiving when the Zyxel Device starts to receive capture files from the APs interface(s) after you press the Stop button. Enabled interfaces (except for virtual interfaces) appear under Available Interfaces. Select interfaces for which to capture packets and click the right arrow button to move them to the Capture Interfaces list. Use the [Shift] and/or [Ctrl] key to select multiple objects. ZyWALL ATP Series Users Guide 829 Chapter 41 Diagnostics Table 361 Maintenance > Diagnostics > Packet Capture > Capture on AP (continued) LABEL IP Version Protocol Type Host IP Host Port Continuously capture and overwrite old ones Captured Packet Files Split threshold Duration File Suffix Number Of Bytes To Capture (Per Packet) Save data to onboard storage only DESCRIPTION Select the version of IP for which to capture packets. Select any to capture packets for all IP versions. Select the protocol of traffic for which to capture packets. Select any to capture packets for all types of traffic. Select a host IP address object for which to capture packets. Select any to capture packets for all hosts. Select User Defined to be able to enter an IP address. This field is configurable when you set the IP Type to any, tcp, or udp. Specify the port number of traffic to capture. Select this to have the Zyxel Device keep capturing traffic and overwriting old packet capture entries when the available storage space runs out. When saving packet captures only to the Zyxel Devices on board storage, specify a maximum limit in megabytes for the total combined size of all the capture files on the Zyxel Device. When saving packet captures to a connected USB storage device, specify a maximum limit in megabytes for each capture file. Note: If you have existing capture files and have not selected the Continuously capture and overwrite old ones option, you may need to set this size larger or delete existing capture files. The valid range depends on the available on board/USB storage size. The Zyxel Device stops the capture and generates the capture file when either the file reaches this size or the time period specified in the Duration field expires. Specify a maximum size limit in megabytes for individual packet capture files. After a packet capture file reaches this size, the Zyxel Device starts another packet capture file. Set a time limit in seconds for the capture. The Zyxel Device stops the capture and generates the capture file when either this period of time has passed or the file reaches the size specified in the File Size field. 0 means there is no time limit. Specify text to add to the end of the file name (before the dot and filename extension) to help you identify the packet capture files. Modifying the file suffix also avoids making new capture files that overwrite existing files of the same name. The file name format is interface name-file suffix.cap, for example vlan2-packet-

capture.cap. Specify the maximum number of bytes to capture per packet. The Zyxel Device automatically truncates packets that exceed this size. As a result, when you view the packet capture files in a packet analyzer, the actual size of the packets may be larger than the size of captured packets. Select this to have the Zyxel Device only store packet capture entries on the Zyxel Device. The available storage size is displayed as well. Note: The Zyxel Device reserves some on board storage space as a buffer. ZyWALL ATP Series Users Guide 830 Chapter 41 Diagnostics Table 361 Maintenance > Diagnostics > Packet Capture > Capture on AP (continued) LABEL Save data to USB storage DESCRIPTION Select this to have the Zyxel Device store packet capture entries only on a USB storage device connected to the Zyxel Device if the Zyxel Device allows this. Status:

Unused - the connected USB storage device was manually unmounted by using the Remove Now button or for some reason the Zyxel Device cannot mount it. none - no USB storage device is connected. service deactivated - USB storage feature is disabled (in Configuration > System > USB Storage), so the Zyxel Device cannot use a connected USB device to store system logs and other diagnostic information. available - you can have the Zyxel Device use the USB storage device. The available storage capacity also displays. Note: The Zyxel Device reserves some USB storage space as a buffer. Select this to have the Zyxel Device store packet capture entries on the defined FTP site. The available storage size is displayed as well. Type the IP address of the FTP server. Type the port this server uses for FTP traffic. The default FTP port is 21. Type the login username to access the FTP server. Type the associated login password to access the FTP server. Click this button to have the Zyxel Device capture packets according to the settings configured in this screen. You can configure the Zyxel Device while a packet capture is in progress although you cannot modify the packet capture settings. The Zyxel Devices throughput or performance may be affected while a packet capture is in progress. After the Zyxel Device finishes the capture it saves a separate capture file for each selected interface. The total number of packet capture files that you can save depends on the file sizes and the available flash storage space. Once the flash storage space is full, adding more packet captures will fail. Click this button to stop a currently running packet capture and generate a separate capture file for each selected interface. Click this button to return the screen to its last-saved settings. Save data to ftp server

(available: xx MB) Server Address Server Port Name Password Capture Stop Reset 41.3.2 The Packet Capture Files Screen Click Maintenance > Diagnostics > Packet Capture > Files to open the packet capture files screen. This screen lists the files of packet captures stored on the Zyxel Device or a connected USB storage device. You can download the files to your computer where you can study them using a packet analyzer (also known as a network or protocol analyzer) such as Wireshark. ZyWALL ATP Series Users Guide 831 Chapter 41 Diagnostics Figure 580 Maintenance > Diagnostics > Packet Capture > Files The following table describes the labels in this screen. Table 362 Maintenance > Diagnostics > Packet Capture > Files LABEL Remove DESCRIPTION Select files and click Remove to delete them from the Zyxel Device or the connected USB storage device. Use the [Shift] and/or [Ctrl] key to select multiple files. A pop-up window asks you to confirm that you want to delete. Click a file to select it and click Download to save it to your computer. This column displays the number for each packet capture file entry. The total number of packet capture files that you can save depends on the file sizes and the available flash storage space. This column displays the label that identifies the file. The file name format is interface name-file suffix.cap. This column displays the size (in bytes) of a configuration file. This column displays the date and time that the individual files were saved. Download

#

File Name Size Last Modified 41.4 The CPU / Memory Status Screen Click Maintenance > Diagnostics > CPU / Memory Status to open the CPU/Memory Status screen. Use this screen to view the CPU and memory performance of various applications on the Zyxel Device. ZyWALL ATP Series Users Guide 832 Chapter 41 Diagnostics Figure 581 Maintenance > Diagnostics > CPU / Memory Status The following table describes the labels in this screen. Table 363 Maintenance > Diagnostics > CPU / Memory Status LABEL CPU Status DESCRIPTION This table displays the applications that use the most Zyxel Device CPU processing. CPUn Usage CPU usage shows how much processing power the Zyxel Device is using. This field displays the current percentage usage of a CPU (where n is the number of the CPU) as a percentage of total processing power. This field displays the current percentage of network traffic through the Zyxel Device. This field is a sequential value, and it is not associated with any entry. This field displays the current CPU utilization percentage for each application used on the Zyxel Device. This field displays the name of the application consuming the related processing power on the Zyxel Device. This field displays the current DRAM memory utilization percentage for each application used on the Zyxel Device. This field displays each applications running time in hours - minutes - seconds. Network Traffic

#

CPU Application Memory Time Memory Status This table displays the applications that use the most Zyxel Device DRAM memory. Memory Usage Memory usage shows how much DRAM memory the Zyxel Device is using. This field displays the current percentage of memory utilization. This field is a sequential value, and it is not associated with any entry.

#

ZyWALL ATP Series Users Guide 833 Chapter 41 Diagnostics Table 363 Maintenance > Diagnostics > CPU / Memory Status LABEL Memory DESCRIPTION This field displays the current DRAM memory utilization percentage for each application used on the Zyxel Device. This field displays the name of the application consuming the related memory on the Zyxel Device. This field displays the current CPU utilization percentage for each application used on the Zyxel Device. This field displays each applications running time. Click this to update the information in this screen. Application CPU Time Refresh 41.5 The System Log Screen Click Maintenance > Diagnostics > System Log to open the System Log screen. This screen lists the files of Zyxel Device system logs stored on a connected USB storage device. The files are in comma separated value (csv) format. You can download them to your computer and open them in a tool like Microsofts Excel. Figure 582 Maintenance > Diagnostics > System Log The following table describes the labels in this screen. Table 364 Maintenance > Diagnostics > System Log LABEL Remove DESCRIPTION Select files and click Remove to delete them from the Zyxel Device. Use the [Shift] and/or [Ctrl]

key to select multiple files. A pop-up window asks you to confirm that you want to delete. Click a file to select it and click Download to save it to your computer. This column displays the number for each file entry. The total number of files that you can save depends on the file sizes and the available storage space. This column displays the label that identifies the file. This column displays the size (in bytes) of a file. This column displays the date and time that the individual files were saved. Download

#

File Name Size Last Modified 41.6 The Remote Assistance Screen Click Maintenance > Diagnostics > Remote Assistance to open the Remote Assistance screen. Use this screen to configure and schedule external access to the Zyxel Device for troubleshooting. You can also specify the port numbers the services must use to connect to the Zyxel Device. Remote assistance is disabled by default. ZyWALL ATP Series Users Guide 834 Chapter 41 Diagnostics Figure 583 Maintenance > Diagnostics > Remote Assistance - Random Figure 584 Maintenance > Diagnostics > Remote Assistance - Manual The following table describes the labels in this screen. DESCRIPTION Table 365 Maintenance > Diagnostics > Remote Assistance LABEL General Setting Enable Remote Assistance Remote Settings Generate User Name Select this to enable an external person, such as customer support to access the Zyxel Device from a network outside the Zyxel Device local network for troubleshooting. Select Use Random Settings to access the Zyxel Device remotely by using a randomly generated user name and password pair. Select Use Manual Settings to access the Zyxel Device remotely by using a previously configured specific user account. This button is displayed when you select Use Random Settings in the Remote Settings field. Click this button to generate a random user name and password pair. Select a previously created user/group object that identifies who can have external access to the Zyxel Device for troubleshooting. ZyWALL ATP Series Users Guide 835 Chapter 41 Diagnostics Table 365 Maintenance > Diagnostics > Remote Assistance (continued) LABEL Password SSH Port DESCRIPTION Type a password for the selected user/group to allow external access. This field displays the SSH port number for external access. It should be the same port number as the one configured in Configuration > System > SSH. This field displays the HTTPS port number for external access. It should be the same port number as the one configured in Configuration > System > WWW > Service Control. Enter the public IP address of the external user that is allowed to access the Zyxel Device remotely. Enter the public IP address of the external user that is allowed to access the Zyxel Device remotely. This field displays the name of the schedule for allowed external access. The schedule must be first configured in Object > Schedule. This field displays the date on which the schedule begins. This field displays the time at which the schedule begins. This field displays the date on which the schedule ends. This field displays the time at which the schedule ends. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. HTTPS Port IP Address1 IP Address2 Schedule Name Start Date Start Time Stop Date Stop Time Apply Reset 41.7 The Network Tool Screen Use this screen to perform various network tests. Click Maintenance > Diagnostics > Network Tool to display this screen. Figure 585 Maintenance > Diagnostics > Network Tool ZyWALL ATP Series Users Guide 836 Figure 586 Maintenance > Diagnostics > Network Tool - Test Email Server The following table describes the labels in this screen. Table 366 Maintenance > Diagnostics > Network Tool LABEL Network Tool DESCRIPTION Select a network tool:

Select NSLOOKUP IPv4 or NSLOOKUP IPv6 to perform name server lookup for querying the Domain Name System (DNS) to get the domain name or IP address mapping. Select PING IPv4 or PING IPv6 to ping the IP address that you entered. Select TRACEROUTE IPv4 or TRACEROUTE IPv6 to run the traceroute function. This determines the path a packet takes to the specified computer. Select Test Email Server to test access to an SMTP email server. Type the IP address that you want to use to for the selected network tool. Domain Name or IP Address Advance Click this to display the following fields. Query Server Interface Extension Option Enter the IP address of a server to which the Zyxel Device sends queries for NSLOOKUP. Select the interface through which the Zyxel Device sends queries for PING or TRACEROUTE. Enter the extended option if you want to use an extended ping or traceroute command. For example, enter -c count (where count is the number of ping requests) to set how many times the Zyxel Device pings the destination IP address, or enter -w waittime (where waittime is a time period in seconds) to set how long the Zyxel Device waits for a response to a probe before running another traceroute. The following fields display when you select Test Email Server in Network Tool. Mail Server Mail Subject Mail Server Port Type the name or IP address of the outgoing SMTP server. Type the subject line for the outgoing email. Select Append system name to add the Zyxel Device system name to the subject. Select Append date time to add the Zyxel Device date and time to the subject. Enter the same port number here as is on the mail server for mail traffic. ZyWALL ATP Series Users Guide 837 Chapter 41 Diagnostics Table 366 Maintenance > Diagnostics > Network Tool (continued) LABEL TLS Security STARTTLS Authenticate Server Mail From DESCRIPTION Select this option if the mail server uses Transport Layer Security (TLS) for encrypted communications between the mail server and the Zyxel Device. Select this option if the mail server uses SSL or TLS for encrypted communications between the mail server and the Zyxel Device. Select this if the Zyxel Device authenticates the mail server in the TLS handshake. Type the email address from which the outgoing email is delivered. This address is used in replies. Type the email address to which the outgoing email is delivered. Mail To SMTP Authentication Select this check box if it is necessary to provide a user name and password to the SMTP User Name Password Retype to Confirm Test Stop Reset server. This box is effective when you select the SMTP Authentication check box. Type the user name to provide to the SMTP server when the log is emailed. This box is effective when you select the SMTP Authentication check box. Type a password of up to 63 characters to provide to the SMTP server when the log is emailed. Retype your new password for confirmation. Click this button to start the test. Click this button to stop the test. Click this button to return the screen to its last-saved settings. 41.8 The Routing Traces Screen Click Maintenance > Diagnostics > Routing Traces to display this screen. Use this screen to configure a traceroute to identify where packets are dropped for troubleshooting. Figure 587 Maintenance > Diagnostics > Routing Traces The following table describes the labels in this screen. Table 367 Maintenance > Diagnostics > Routing Traces LABEL IP Address DESCRIPTION You can trace traffic through the Zyxel Device from a specific source-to-destination stream or just from/to a specific host (source or destination). Enter the source IP address of traffic that you want to trace. Enter the source port number of traffic that you want to trace. Enter the destination IP address of traffic that you want to trace. Source Port Destination ZyWALL ATP Series Users Guide 838 Chapter 41 Diagnostics Table 367 Maintenance > Diagnostics > Routing Traces (continued) LABEL Port DESCRIPTION Enter the destination port number of traffic that you want to trace. Enter the IP address of a specific source or destination host whose traffic you want to trace. Enter the port number for particular source traffic on the host that you want to trace. Select the protocol of traffic that you want to trace. any means any protocol. Enter a time interval in seconds for renewing a route trace. The default time interval is 5 seconds. Click this button to have the Zyxel Device capture frames according to the settings configured in this screen. Host Port Protocol Interval Capture Flush Data Session ID Protocol from VPN ID to VPN ID Incoming Interface Message You can configure the Zyxel Device while a frame capture is in progress although you cannot modify the frame capture settings. Click this to clear all data on the screen. This field displays established sessions that passed through the Zyxel Device which matched the capture criteria. This field displays the packet ID for each active session. This field displays the protocol used in each active session. This field displays the tagged VLAN ID in ingress packets coming into the Zyxel Device. This field displays the tagged VLAN ID in egress packets going out from the Zyxel Device. This is the source interface of packets to which this active session applies. This field displays traceroute information. 41.9 The Wireless Frame Capture Screen Use this screen to capture wireless network traffic going through the AP interfaces connected to your Zyxel Device. Studying these frame captures may help you identify network problems. Click Maintenance > Diagnostics > Wireless Frame Capture to display this screen. Note: New capture files overwrite existing files of the same name. Change the File Prefix fields setting to avoid this. Figure 588 Maintenance > Diagnostics > Wireless Frame Capture > Capture ZyWALL ATP Series Users Guide 839 Chapter 41 Diagnostics The following table describes the labels in this screen. Table 368 Maintenance > Diagnostics > Wireless Frame Capture > Capture LABEL MON Mode APs DESCRIPTION Configure AP to MON Mode Available MON Mode APs Capture MON Mode APs Misc Setting File Size File Prefix Capture Stop Reset Click this to go the Configuration > Wireless > AP Management screen, where you can set one or more APs to monitor mode. This column displays which APs on your wireless network are currently configured for monitor mode. Use the arrow buttons to move APs off this list and onto the Captured MON Mode APs list. This column displays the monitor-mode configured APs selected to for wireless frame capture. Specify a maximum size limit in kilobytes for the total combined size of all the capture files on the Zyxel Device, including any existing capture files and any new capture files you generate. Note: If you have existing capture files you may need to set this size larger or delete existing capture files. The valid range is 1 to 50000. The Zyxel Device stops the capture and generates the capture file when either the file reaches this size. Specify text to add to the front of the file name in order to help you identify frame capture files. You can modify the prefix to also create new frame capture files each time you perform a frame capture operation. Doing this does no overwrite existing frame capture files. The file format is: [file prefix].cap. For example, monitor.cap. Click this button to have the Zyxel Device capture frames according to the settings configured in this screen. You can configure the Zyxel Device while a frame capture is in progress although you cannot modify the frame capture settings. The Zyxel Devices throughput or performance may be affected while a frame capture is in progress. After the Zyxel Device finishes the capture it saves a combined capture file for all APs. The total number of frame capture files that you can save depends on the file sizes and the available flash storage space. Once the flash storage space is full, adding more frame captures will fail. Click this button to stop a currently running frame capture and generate a combined capture file for all APs. Click this button to return the screen to its last-saved settings. ZyWALL ATP Series Users Guide 840 Chapter 41 Diagnostics 41.9.1 The Wireless Frame Capture Files Screen Click Maintenance > Diagnostics > Wireless Frame Capture > Files to open this screen. This screen lists the files of wireless frame captures the Zyxel Device has performed. You can download the files to your computer where you can study them using a packet analyzer (also known as a network or protocol analyzer) such as Wireshark. Figure 589 Maintenance > Diagnostics > Wireless Frame Capture > Files The following table describes the labels in this screen. Table 369 Maintenance > Diagnostics > Wireless Frame Capture > Files LABEL Remove DESCRIPTION Select files and click Remove to delete them from the Zyxel Device. Use the [Shift] and/or [Ctrl] key to select multiple files. A pop-up window asks you to confirm that you want to delete. Click a file to select it and click Download to save it to your computer. This column displays the number for each packet capture file entry. The total number of packet capture files that you can save depends on the file sizes and the available flash storage space. This column displays the label that identifies the file. The file name format is interface name-file suffix.cap. This column displays the size (in bytes) of a configuration file. Size Last Modified This column displays the date and time that the individual files were saved. Download

#

File Name ZyWALL ATP Series Users Guide 841 Chapter 42 Packet Flow Explore CHAPTER 42 Packet Flow Explore 42.1 Overview Use this to get a clear picture on how the Zyxel Device determines where to forward a packet and how to change the source IP address of the packet according to your current settings. This function provides you a summary of all your routing and SNAT settings and helps troubleshoot any related problems. 42.1.1 What You Can Do in this Chapter Use the Routing Status screen (see Section 42.2 on page 842) to view the overall routing flow and each routing functions settings. Use the SNAT Status screen (see Section 42.3 on page 846) to view the overall source IP address conversion (SNAT) flow and each SNAT functions settings. 42.2 The Routing Status Screen The Routing Status screen allows you to view the current routing flow and quickly link to specific routing settings. Click a function box in the Routing Flow section, the related routes (activated) will display in the Routing Table section. To access this screen, click Maintenance > Packet Flow Explore > Routing Status. The order of the routing flow may vary depending on whether you:

Select use policy route to override direct route in the CONFIGURATION > Network > Routing > Policy Route screen. Use policy routes to control 1-1 NAT by using the policy control-virtual-server-rules activate command. Select use policy routes to control dynamic IPSec rules in the CONFIGURATION > VPN > IPSec VPN >

VPN Connection screen. Note: Once a packet matches the criteria of a routing rule, the Zyxel Device takes the corresponding action and does not perform any further flow checking. ZyWALL ATP Series Users Guide 842 Chapter 42 Packet Flow Explore Figure 590 Maintenance > Packet Flow Explore > Routing Status (Direct Route) Figure 591 Maintenance > Packet Flow Explore > Routing Status (Dynamic VPN) Figure 592 Maintenance > Packet Flow Explore > Routing Status (Policy Route) Figure 593 Maintenance > Packet Flow Explore > Routing Status (1-1 SNAT) ZyWALL ATP Series Users Guide 843 Chapter 42 Packet Flow Explore Figure 594 Maintenance > Packet Flow Explore > Routing Status (SiteToSite VPN) Figure 595 Maintenance > Packet Flow Explore > Routing Status (Static-Dynamic Route) Figure 596 Maintenance > Packet Flow Explore > Routing Status (Default WAN Trunk) Figure 597 Maintenance > Packet Flow Explore > Routing Status (Main Route) ZyWALL ATP Series Users Guide 844 Chapter 42 Packet Flow Explore The following table describes the labels in this screen. Table 370 Maintenance > Packet Flow Explore > Routing Status LABEL Routing Flow DESCRIPTION This section shows you the flow of how the Zyxel Device determines where to route a packet. Click a function box to display the related settings in the Routing Table section. This section shows the corresponding settings according to the function box you click in the Routing Flow section. Routing Table The following fields are available if you click Direct Route, Static-Dynamic Route, or Main Route in the Routing Flow section.

#

Destination Gateway This field is a sequential value, and it is not associated with any entry. This is the destination IP address of a route. This is the IP address of the next-hop gateway or the interface through which the traffic is routed. This is the name of an interface associated with the route. This is the routes priority among the displayed routes. This indicates additional information for the route. The possible flags are:

A - this route is currently activated. S - this is a static route. C - this is a direct connected route. O - this is a dynamic route learned through OSPF. R - this is a dynamic route learned through RIP. B - this is a dynamic route learned through BGP. G - the route is to a gateway (router) in the same network.

! - this is a route which forces a route lookup to fail. B - this is a route which discards packets. L - this is a recursive route. This is the remaining time of a dynamically learned route. The Zyxel Device removes the route after this time period is counted down to zero. Interface Metric Flags Persist The following fields are available if you click Policy Route in the Routing Flow section.

#

Incoming Source Destination Service Source Port DSCP Code This field is a sequential value, and it is not associated with any entry. This is the interface on which the packets are received. This is the source IP address(es) from which the packets are sent. This is the destination IP address(es) to which the packets are transmitted. This is the name of the service object. any means all services. This is the source port(s) from which the packets are sent. This is the DSCP value of incoming packets to which this policy route applies. See Section 10.2 on page 312 for more information. This is the type of the next hop to which packets are directed. This is the main route if the next hop type is Auto. This is the interface name and gateway IP address if the next hop type is Interface /GW. This is the tunnel name if the next hop type is VPN Tunnel. This is the trunk name if the next hop type is Trunk. Next Hop Type Next Hop Info The following fields are available if you click 1-1 SNAT in the Routing Flow section.

#

NAT Rule Source Protocol Source Port This field is a sequential value, and it is not associated with any entry. This is the name of an activated 1:1 or Many 1:1 NAT rule in the NAT table. This is the external source IP address(es). This is the transport layer protocol. This is the source port number. ZyWALL ATP Series Users Guide 845 Chapter 42 Packet Flow Explore Table 370 Maintenance > Packet Flow Explore > Routing Status (continued) LABEL DESCRIPTION This is the external destination IP address(es). Destination Outgoing This is the outgoing interface that the SNAT rule uses to transmit packets. Gateway This is the IP address of the gateway in the same network of the outgoing interface. The following fields are available if you click Dynamic VPN or SiteToSite VPN in the Routing Flow section.

#

Source Destination VPN Tunnel The following fields are available if you click Default WAN Trunk in the Routing Flow section.

#

Source Destination This field is a sequential value, and it is not associated with any entry. This is the IP address(es) of the local VPN network. This is the IP address(es) for the remote VPN network. This is the name of the VPN tunnel. This field is a sequential value, and it is not associated with any entry. This is the source IP address(es) from which the packets are sent. any means any IP address. This is the destination IP address(es) to which the packets are transmitted. any means any IP address. This is the name of the WAN trunk through which the matched packets are transmitted. Trunk 42.3 The SNAT Status Screen The SNAT Status screen allows you to view and quickly link to specific source NAT (SNAT) settings. Click a function box in the SNAT Flow section, the related SNAT rules (activated) will display in the SNAT Table section. To access this screen, click Maintenance > Packet Flow Explore > SNAT Status. The order of the SNAT flow may vary depending on whether you:

select use default SNAT in the CONFIGURATION > Network > Interface > Trunk screen. use policy routes to control 1-1 NAT by using the policy control-virtual-server-rules activate command. Note: Once a packet matches the criteria of an SNAT rule, the Zyxel Device takes the corresponding action and does not perform any further flow checking. Figure 598 Maintenance > Packet Flow Explore > SNAT Status (Policy Route SNAT) ZyWALL ATP Series Users Guide 846 Chapter 42 Packet Flow Explore Figure 599 Maintenance > Packet Flow Explore > SNAT Status (1-1 SNAT) Figure 600 Maintenance > Packet Flow Explore > SNAT Status (Loopback SNAT) Figure 601 Maintenance > Packet Flow Explore > SNAT Status (Default SNAT) The following table describes the labels in this screen. Table 371 Maintenance > Packet Flow Explore > SNAT Status LABEL SNAT Flow DESCRIPTION This section shows you the flow of how the Zyxel Device changes the source IP address for a packet according to the rules you have configured in the Zyxel Device. Click a function box to display the related settings in the SNAT Table section. The table fields in this section vary depending on the function box you select in the SNAT Flow section. SNAT Table The following fields are available if you click Policy Route SNAT in the SNAT Flow section.

#

This field is a sequential value, and it is not associated with any entry. ZyWALL ATP Series Users Guide 847 Chapter 42 Packet Flow Explore DESCRIPTION This is the outgoing interface that the route uses to transmit packets. This is the source IP address(es) that the SNAT rule uses finally. Table 371 Maintenance > Packet Flow Explore > SNAT Status (continued) LABEL Outgoing SNAT The following fields are available if you click 1-1 SNAT in the SNAT Flow section.

#

NAT Rule Source Protocol Source Port Destination Outgoing SNAT The following fields are available if you click Loopback SNAT in the SNAT Flow section.

#

NAT Rule Source Destination SNAT This field is a sequential value, and it is not associated with any entry. This is the name of an activated NAT rule which uses SNAT. This is the external source IP address(es). This is the transport layer protocol. This is the source port number. This is the external destination IP address(es). This is the outgoing interface that the SNAT rule uses to transmit packets. This is the source IP address(es) that the SNAT rule uses finally. This field is a sequential value, and it is not associated with any entry. This is the name of an activated NAT rule which uses SNAT and enables NAT loopback. This is the original source IP address(es). any means any IP address. This is the original destination IP address(es). any means any IP address. This indicates which source IP address the SNAT rule uses finally. For example, Outgoing Interface IP means that the Zyxel Device uses the IP address of the outgoing interface as the source IP address for the matched packets it sends out through this rule. The following fields are available if you click Default SNAT in the SNAT Flow section.

#

Incoming Outgoing SNAT This field is a sequential value, and it is not associated with any entry. This indicates internal interface(s) on which the packets are received. This indicates external interface(s) from which the packets are transmitted. This indicates which source IP address the SNAT rule uses finally. For example, Outgoing Interface IP means that the Zyxel Device uses the IP address of the outgoing interface as the source IP address for the matched packets it sends out through this rule. ZyWALL ATP Series Users Guide 848 Chapter 43 Shutdown CHAPTER 43 Shutdown 43.1 Overview Use this to shutdown the device in preparation for disconnecting the power. Always use the Maintenance > Shutdown > Shutdown screen or the shutdown command before you turn off the Zyxel Device or remove the power. Not doing so can cause the firmware to become corrupt. 43.1.1 What You Need To Know Shutdown writes all cached data to the local storage and stops the system processes. 43.2 The Shutdown Screen To access this screen, click Maintenance > Shutdown. Figure 602 Maintenance > Shutdown Click the Shutdown button to shut down the Zyxel Device. Wait for the device to shut down before you manually turn off or remove the power. It does not turn off the power. You can also use the CLI command shutdown to shutdown the Zyxel Device. ZyWALL ATP Series Users Guide 849 PART III Appendices and Troubleshooting 850 CHAPTER 44 Troubleshooting This chapter offers some suggestions to solve problems you might encounter. You can also refer to the logs (see Section 6.36 on page 181). For the order in which the Zyxel Device applies its features and checks, see Chapter 42 on page 842. None of the LEDs turn on. Make sure that you have the power cord connected to the Zyxel Device and plugged in to an appropriate power source. Make sure you have the Zyxel Device turned on. Check all cable connections. If the LEDs still do not turn on, you may have a hardware problem. In this case, you should contact your local vendor. Cannot access the Zyxel Device from the LAN. Check the cable connection between the Zyxel Device and your computer or switch. Ping the Zyxel Device from a LAN computer. Make sure your computers Ethernet card is installed and functioning properly. Also make sure that its IP address is in the same subnet as the Zyxel Devices. In the computer, click Start, (All) Programs, Accessories and then Command Prompt. In the Command Prompt window, type ping followed by the Zyxel Devices LAN IP address (192.168.1.1 is the default) and then press [ENTER]. The Zyxel Device should reply. If youve forgotten the Zyxel Devices password, use the RESET button. Press the button in for about 5 seconds (or until the SYS LED starts to blink), then release it. It returns the Zyxel Device to the factory defaults (password is 1234, LAN IP address 192.168.1.1, etc). If youve forgotten the Zyxel Devices IP address, you can use the commands through the CONSOLE port to check it. Connect your computer to the CONSOLE port using a console cable. Your computer should have a terminal emulation communications program (such as HyperTerminal) set to VT100 terminal emulation, no parity, 8 data bits, 1 stop bit, no flow control and 115200 bps port speed. I cannot access the Internet. Check the Zyxel Devices connection to the Ethernet jack with Internet access. Make sure the Internet gateway device (such as a DSL modem) is working properly. Check the WAN interface's status in the Dashboard. Use the installation setup wizard again and make sure that you enter the correct settings. Use the same case as provided by your ISP. ZyWALL ATP Series Users Guide 851 Chapter 44 Troubleshooting I cannot update the anti-malware/IDP/application patrol/botnet filter/IP reputation signatures. Make sure your Zyxel Device has the anti-malware/IDP/application patrol service registered and that the license is not expired. Purchase a new license if the license is expired. Make sure your Zyxel Device is connected to the Internet. I cannot update the threat intelligence machine learning (TIML) signatures. Make sure your Zyxel Device has the anti-malware service registered and that the gold security pack license is not expired. Purchase a new license if the license is expired. Make sure your Zyxel Device is connected to the Internet. I downloaded updated anti-malware/IDP/application patrol/botnet filter/IP reputation signatures. Why has the Zyxel Device not re-booted yet?

The Zyxel Device does not have to reboot when you upload new signatures. The content filter category service is not working. Make sure your Zyxel Device has the content filter category service registered and that the license is not expired. Purchase a new license if the license is expired. Make sure your Zyxel Device is connected to the Internet. Make sure you select Enable Content Filter Category Service when you add a filter profile in the Configuration > Security Service > Content Filter > Profile > Add or Edit screen. I configured security settings but the Zyxel Device is not applying them for certain interfaces. Many security settings are usually applied to zones. Make sure you assign the interfaces to the appropriate zones. When you create an interface, there is no security applied on it until you assign it to a zone. The Zyxel Device is not applying the custom policy route I configured. The Zyxel Device checks the policy routes in the order that they are listed. So make sure that your custom policy route comes before any other routes that the traffic would also match. ZyWALL ATP Series Users Guide 852 Chapter 44 Troubleshooting The Zyxel Device is not applying the custom security policy I configured. The Zyxel Device checks the security policies in the order that they are listed. So make sure that your custom security policy comes before any other rules that the traffic would also match. I cannot enter the interface name I want. The format of interface names other than the Ethernet interface names is very strict. Each name consists of 2-4 letters (interface type), followed by a number (x, limited by the maximum number of each type of interface). For example, VLAN interfaces are vlan0, vlan1, vlan2,...; and so on. The names of virtual interfaces are derived from the interfaces on which they are created. For example, virtual interfaces created on Ethernet interface wan1 are called wan1:1, wan1:2, and so on. Virtual interfaces created on VLAN interface vlan2 are called vlan2:1, vlan2:2, and so on. You cannot specify the number after the colon(:) in the Web Configurator; it is a sequential number. You can specify the number after the colon if you use the CLI to set up a virtual interface. I cannot set up a PPP interface, virtual Ethernet interface or virtual VLAN interface on an Ethernet interface. You cannot set up a PPP interface, virtual Ethernet interface or virtual VLAN interface if the underlying interface is a member of a bridge. You also cannot add an Ethernet interface or VLAN interface to a bridge if the member interface has a virtual interface or PPP interface on top of it. My rules and settings that apply to a particular interface no longer work. The interfaces IP address may have changed. To avoid this, create an IP address object based on the interface. This way the Zyxel Device automatically updates every rule or setting that uses the object whenever the interfaces IP address settings change. For example, if you change LAN1s IP address, the Zyxel Device automatically updates the corresponding interface-based, LAN1 subnet address object. I cannot set up a PPP interface. You have to set up an ISP account before you create a PPPoE or PPTP interface. The data rates through my cellular connection are no-where near the rates I expected. ZyWALL ATP Series Users Guide 853 Chapter 44 Troubleshooting The actual cellular data rate you obtain varies depending on the cellular device you use, the signal strength to the service providers base station, and so on. I created a cellular interface but cannot connect through it. Make sure you have a compatible mobile broadband device installed or connected. See www.zyxel.com for details. Make sure you have the cellular interface enabled. Make sure the cellular interface has the correct user name, password, and PIN code configured with the correct casing. If the Zyxel Device has multiple WAN interfaces, make sure their IP addresses are on different subnets. Hackers have accessed my WEP-encrypted wireless LAN. WEP is extremely insecure. Its encryption can be broken by an attacker, using widely-available software. It is strongly recommended that you use a more effective security mechanism. Use the strongest security mechanism that all the wireless devices in your network support. WPA2 or WPA2-PSK is recommended. The wireless security is not following the re-authentication timer setting I specified. If a RADIUS server authenticates wireless stations, the re-authentication timer on the RADIUS server has priority. Change the RADIUS servers configuration if you need to use a different re-authentication timer setting. I cannot configure a particular VLAN interface on top of an Ethernet interface even though I have it configured it on top of another Ethernet interface. Each VLAN interface is created on top of only one Ethernet interface. The Zyxel Device is not applying an interfaces configured ingress bandwidth limit. At the time of writing, the Zyxel Device does not support ingress bandwidth management. The Zyxel Device is not applying my application patrol bandwidth management settings. Bandwidth management in policy routes has priority over application patrol bandwidth management. ZyWALL ATP Series Users Guide 854 Chapter 44 Troubleshooting The Zyxel Devices performance slowed down after I configured many new application patrol entries. The Zyxel Device checks the ports and conditions configured in application patrol entries in the order they appear in the list. While this sequence does not affect the functionality, you might improve the performance of the Zyxel Device by putting more commonly used ports at the top of the list. The Zyxel Devices anti-malware scanner cleaned an infected file but now I cannot use the file. The scanning engine checks the contents of the packets for malware. If a malware pattern is matched, the Zyxel Device removes a portion of the file, while the rest goes through. Since the Zyxel Device erases a portion of the file before sending it, you may not be able to open the file. The Zyxel Device sent an alert that a malware-infected file has been found, but the file was still forwarded to the user and could still be executed. Make sure you enable Destroy Infected File in the Configuration > Security Service > Anti-Malware screen to modify infected files before forwarding the files to the user, preventing them from being executed. I added a file pattern in the anti-malware white list, but the Zyxel Device still checks and modifies files that match this pattern. Make sure you select the Check White List check box above the white list table. If it is already selected, make sure that the white list entry corresponding to this file pattern is activated. The Zyxel Device is not scanning some zipped files. The Zyxel Device cannot unzip password protected ZIP files or a ZIP file within another ZIP file. There are also limits to the number of ZIP files that the Zyxel Device can concurrently unzip. The Zyxel Device is deleting some zipped files. The anti-malware policy may be set to delete zipped files that the Zyxel Device cannot unzip. The Zyxel Device cannot unzip password protected ZIP files or a ZIP file within another ZIP file. There are also limits to the number of ZIP files that the Zyxel Device can concurrently unzip. ZyWALL ATP Series Users Guide 855 Chapter 44 Troubleshooting The threat intelligence machine learning (TIML) feature is not working. 1 Make sure you purchase the gold security pack. Make sure youve registered the Zyxel Device and activated the anti-malware service on portal.myZyxel.com. Go to the screen, and select the Enable check box in the Configuration > Security Service > Anti-

Malware to activate the TIML feature. 2 Make sure the gold security pack is not expired. If it is, renew the license. The Zyxel Device wont scan the TIML signatures that were downloaded when the gold security pack expired. The Zyxel Devices performance seems slower after configuring IDP. Depending on your network topology and traffic load, binding every packet direction to an IDP profile may affect the Zyxel Devices performance. You may want to focus IDP scanning on certain traffic directions such as incoming traffic. IDP is dropping traffic that matches a rule that says no action should be taken. The Zyxel Device checks all signatures and continues searching even after a match is found. If two or more rules have conflicting actions for the same packet, then the Zyxel Device applies the more restrictive action (reject-both, reject-receiver or reject-sender, drop, none in this order). If a packet matches a rule for reject-receiver and it also matches a rule for reject-sender, then the Zyxel Device will reject-both. I uploaded a custom signature file and now all of my earlier custom signatures are gone. The name of the complete custom signature file on the Zyxel Device is custom.rules. If you import a file named custom.rules, then all custom signatures on the Zyxel Device are overwritten with the new file. If this is not your intention, make sure that the files you import are not named custom.rules. I cannot configure some items in IDP that I can configure in Snort. Not all Snort functionality is supported in the Zyxel Device. ZyWALL ATP Series Users Guide 856 Chapter 44 Troubleshooting The Zyxel Devices performance seems slower after configuring ADP. Depending on your network topology and traffic load, applying an anomaly profile to each and every packet direction may affect the Zyxel Devices performance. Some of the files I download dont go through Sandboxing even though it is enabled. The Sandboxing feature only applies to certain file types. Check the list in File Submission Options to see if the file types you use are included. If they are, make sure you select their corresponding check box. The Zyxel Device detected a malicious file from Sandboxing, but the file still went through the Zyxel Device and is still usable. Make sure you set your Sandboxing settings to destroy malicious files in the Configuration > Security Service > Sandboxing: Action For Malicious File drop-down list box. The Zyxel Device destroyed/dropped a file/email without notifying me. Make sure you enable logs for your security features, such as in the following screens:

Configuration > Security Service > IDP Configuration > Security Service > Anti-Malware Configuration > Security Service > Sandboxing Configuration > Security Service > Email Security The Zyxel Device routes and applies SNAT for traffic from some interfaces but not from others. The Zyxel Device automatically uses SNAT for traffic it routes from internal interfaces to external interfaces. For example LAN to WAN traffic. You must manually configure a policy route to add routing and SNAT settings for an interface with the Interface Type set to General. You can also configure a policy route to override the default routing and SNAT behavior for an interface with the Interface Type set to Internal or External. I cannot get Dynamic DNS to work. You must have a public WAN IP address to use Dynamic DNS. ZyWALL ATP Series Users Guide 857 Chapter 44 Troubleshooting Make sure you recorded your DDNS accounts user name, password, and domain name and have entered them properly in the Zyxel Device. You may need to configure the DDNS entrys IP Address setting to Auto if the interface has a dynamic IP address or there are one or more NAT routers between the Zyxel Device and the DDNS server. The Zyxel Device may not determine the proper IP address if there is an HTTP proxy server between the Zyxel Device and the DDNS server. I cannot create a second HTTP redirect rule for an incoming interface. You can configure up to one HTTP redirect rule for each (incoming) interface. I cannot get the application patrol to manage SIP traffic. Make sure you have the SIP ALG enabled. I cannot get the application patrol to manage H.323 traffic. Make sure you have the H.323 ALG enabled. I cannot get the application patrol to manage FTP traffic. Make sure you have the FTP ALG enabled. The Zyxel Device keeps resetting the connection. If an alternate gateway on the LAN has an IP address in the same subnet as the Zyxel Devices LAN IP address, return traffic may not go through the Zyxel Device. This is called an asymmetrical or triangle route. This causes the Zyxel Device to reset the connection, as the connection has not been acknowledged. You can set the Zyxel Devices security policy to permit the use of asymmetrical route topology on the network (so it does not reset the connection) although this is not recommended since allowing asymmetrical routes may let traffic from the WAN go directly to the LAN without passing through the Zyxel Device. A better solution is to use virtual interfaces to put the Zyxel Device and the backup gateway on separate subnets. See Asymmetrical Routes on page 495 and the chapter about interfaces for more information. ZyWALL ATP Series Users Guide 858 Chapter 44 Troubleshooting I cannot set up an IPSec VPN tunnel to another device. If the IPSec tunnel does not build properly, the problem is likely a configuration error at one of the IPSec routers. Log into both Zyxel IPSec routers and check the settings in each field methodically and slowly. Make sure both the Zyxel Device and remote IPSec router have the same security settings for the VPN tunnel. It may help to display the settings for both routers side-by-side. Here are some general suggestions. See also Chapter 20 on page 396. The system log can often help to identify a configuration problem. If you enable NAT traversal, the remote IPSec device must also have NAT traversal enabled. The Zyxel Device and remote IPSec router must use the same authentication method to establish the IKE SA. Both routers must use the same negotiation mode. Both routers must use the same encryption algorithm, authentication algorithm, and DH key group. When using pre-shared keys, the Zyxel Device and the remote IPSec router must use the same pre-

shared key. The Zyxel Devices local and peer ID type and content must match the remote IPSec routers peer and local ID type and content, respectively. The Zyxel Device and remote IPSec router must use the same active protocol. The Zyxel Device and remote IPSec router must use the same encapsulation. The Zyxel Device and remote IPSec router must use the same SPI. If the sites are/were previously connected using a leased line or ISDN router, physically disconnect these devices from the network before testing your new VPN connection. The old route may have been learned by RIP and would take priority over the new VPN connection. To test whether or not a tunnel is working, ping from a computer at one site to a computer at the other. Before doing so, ensure that both computers have Internet access (via the IPSec routers). It is also helpful to have a way to look at the packets that are being sent and received by the Zyxel Device and remote IPSec router (for example, by using a packet sniffer). Check the configuration for the following Zyxel Device features. The Zyxel Device does not put IPSec SAs in the routing table. You must create a policy route for each VPN tunnel. See Chapter 10 on page 310. Make sure the To-Zyxel Device security policies allow IPSec VPN traffic to the Zyxel Device. IKE uses UDP port 500, AH uses IP protocol 51, and ESP uses IP protocol 50. The Zyxel Device supports UDP port 500 and UDP port 4500 for NAT traversal. If you enable this, make sure the To-Zyxel Device security policies allow UDP port 4500 too. Make sure regular security policies allow traffic between the VPN tunnel and the rest of the network. Regular security policies check packets the Zyxel Device sends before the Zyxel Device encrypts them and check packets the Zyxel Device receives after the Zyxel Device decrypts them. This depends on the zone to which you assign the VPN tunnel and the zone from which and to which traffic may be routed. If you set up a VPN tunnel across the Internet, make sure your ISP supports AH or ESP (whichever you are using). ZyWALL ATP Series Users Guide 859 Chapter 44 Troubleshooting If you have the Zyxel Device and remote IPSec router use certificates to authenticate each other, You must set up the certificates for the Zyxel Device and remote IPSec router first and make sure they trust each others certificates. If the Zyxel Devices certificate is self-signed, import it into the remote IPSec router. If it is signed by a CA, make sure the remote IPSec router trusts that CA. The Zyxel Device uses one of its Trusted Certificates to authenticate the remote IPSec routers certificate. The trusted certificate can be the remote IPSec routers self-signed certificate or that of a trusted CA that signed the remote IPSec routers certificate. Multiple SAs connecting through a secure gateway must have the same negotiation mode. The VPN connection is up but VPN traffic cannot be transmitted through the VPN tunnel. If you have the Configuration > VPN > IPSec VPN > VPN Connection screens Use Policy Route to control dynamic IPSec rules option enabled, check the routing policies to see if they are sending traffic elsewhere instead of through the VPN tunnels. I uploaded a logo to show in the SSL VPN user screens but it does not display properly. The logo graphic must be GIF, JPG, or PNG format. The graphic should use a resolution of 103 x 29 pixels to avoid distortion when displayed. The Zyxel Device automatically resizes a graphic of a different resolution to 103 x 29 pixels. The file size must be 100 kilobytes or less. Transparent background is recommended. I logged into the SSL VPN but cannot see some of the resource links. Available resource links vary depending on the SSL application objects configuration. I cannot download the Zyxel Devices firmware package. The Zyxel Devices firmware package cannot go through the Zyxel Device when you enable the anti-

malware Destroy compressed files that could not be decompressed option. The Zyxel Device classifies the firmware package as not being able to be decompressed and deletes it. You can upload the firmware package to the Zyxel Device with the option enabled, so you only need to clear the Destroy compressed files that could not be decompressed option while you download the firmware package. See Section 28.2 on page 548 for more on the anti-malware Destroy compressed files that could not be decompressed option. I changed the LAN IP address and can no longer access the Internet. ZyWALL ATP Series Users Guide 860 Chapter 44 Troubleshooting The Zyxel Device automatically updates address objects based on an interfaces IP address, subnet, or gateway if the interfaces IP address settings change. However, you need to manually edit any address objects for your LAN that are not based on the interface. I configured application patrol to allow and manage access to a specific service but access is blocked. If you want to use a service, make sure the security policy allows Security Service application patrol to go through the Zyxel Device. I configured policy routes to manage the bandwidth of TCP and UDP traffic but the bandwidth management is not being applied properly. It is recommended to use application patrol instead of policy routes to manage the bandwidth of TCP and UDP traffic. I cannot get the RADIUS server to authenticate the Zyxel Devices default admin account. The default admin account is always authenticated locally, regardless of the authentication method setting. The Zyxel Device fails to authentication the ext-user user accounts I configured. An external server such as AD, LDAP or RADIUS must authenticate the ext-user accounts. If the Zyxel Device tries to use the local database to authenticate an ext-user, the authentication attempt will always fail. (This is related to AAA servers and authentication methods, which are discussed in other chapters in this guide.) I cannot add the admin users to a user group with access users. You cannot put access users and admin users in the same user group. I cannot add the default admin account to a user group. You cannot put the default admin account into any user group. ZyWALL ATP Series Users Guide 861 Chapter 44 Troubleshooting The schedule I configured is not being applied at the configured times. Make sure the Zyxel Devices current date and time are correct. I cannot get a certificate to import into the Zyxel Device. 1 2 For My Certificates, you can import a certificate that matches a corresponding certification request that was generated by the Zyxel Device. You can also import a certificate in PKCS#12 format, including the certificates public and private keys. You must remove any spaces from the certificates filename before you can import the certificate. 3 Any certificate that you want to import has to be in one of these file formats:

Binary X.509: This is an ITU-T recommendation that defines the formats for X.509 certificates. PEM (Base-64) encoded X.509: This Privacy Enhanced Mail format uses lowercase letters, uppercase letters and numerals to convert a binary X.509 certificate into a printable form. Binary PKCS#7: This is a standard that defines the general syntax for data (including digital signatures) that may be encrypted. A PKCS #7 file is used to transfer a public key certificate. The private key is not included. The Zyxel Device currently allows the importation of a PKS#7 file that contains a single certificate. PEM (Base-64) encoded PKCS#7: This Privacy Enhanced Mail (PEM) format uses lowercase letters, uppercase letters and numerals to convert a binary PKCS#7 certificate into a printable form. Binary PKCS#12: This is a format for transferring public key and private key certificates.The private key in a PKCS #12 file is within a password-encrypted envelope. The files password is not connected to your certificates public or private passwords. Exporting a PKCS #12 file creates this and you must provide it to decrypt the contents when you import the file into the Zyxel Device. Note: Be careful not to convert a binary file to text during the transfer process. It is easy for this to occur since many programs use text files by default. I cannot access the Zyxel Device from a computer connected to the Internet. Check the service control rules and to-Zyxel Device security policies. I uploaded a logo to display on the upper left corner of the Web Configurator login screen and access page but it does not display properly. Make sure the logo file is a GIF, JPG, or PNG of 100 kilobytes or less. ZyWALL ATP Series Users Guide 862 Chapter 44 Troubleshooting I uploaded a logo to use as the screen or window background but it does not display properly. Make sure the logo file is a GIF, JPG, or PNG of 100 kilobytes or less. The Zyxel Devices traffic throughput rate decreased after I started collecting traffic statistics. Data collection may decrease the Zyxel Devices traffic throughput rate. I can only see newer logs. Older logs are missing. When a log reaches the maximum number of log messages, new log messages automatically overwrite existing log messages, starting with the oldest existing log message first. The commands in my configuration file or shell script are not working properly. In a configuration file or shell script, use # or ! as the first character of a command line to have the Zyxel Device treat the line as a comment. Your configuration files or shell scripts can use exit or a command line consisting of a single ! to have the Zyxel Device exit sub command mode. Include write commands in your scripts. Otherwise the changes will be lost when the Zyxel Device restarts. You could use multiple write commands in a long script. Note: exit or !' must follow sub commands if it is to make the Zyxel Device exit sub command mode. See Chapter 40 on page 806 for more on configuration files and shell scripts. I cannot get the firmware uploaded using the commands. The Web Configurator is the recommended method for uploading firmware. You only need to use the command line interface if you need to recover the firmware. See the CLI Reference Guide for how to determine if you need to recover the firmware and how to recover it. My packet capture captured less than I wanted or failed. The packet capture screens File Size sets a maximum size limit for the total combined size of all the capture files on the Zyxel Device, including any existing capture files and any new capture files you ZyWALL ATP Series Users Guide 863 Chapter 44 Troubleshooting generate. If you have existing capture files you may need to set this size larger or delete existing capture files. The Zyxel Device stops the capture and generates the capture file when either the capture files reach the File Size or the time period specified in the Duration field expires. My earlier packet capture files are missing. New capture files overwrite existing files of the same name. Change the File Suffix fields setting to avoid this. IP reputation doesnt work on IPv6 addresses. At the time of writing, IP reputation is only for IPv4 addresses. See Chapter 29 on page 556 for more information. The SecuReporter banner keeps showing up. See SecuReporter Banner on page 729 for more information. 44.1 Resetting the Zyxel Device If you cannot access the Zyxel Device by any method, try restarting it by turning the power off and then on again. If you still cannot access the Zyxel Device by any method or you forget the administrator password(s), you can reset the Zyxel Device to its factory-default settings. Any configuration files or shell scripts that you saved on the Zyxel Device should still be available afterwards. Use the following procedure to reset the Zyxel Device to its factory-default settings. This overwrites the settings in the startup-config.conf file with the settings in the system-default.conf file. Note: This procedure removes the current configuration. 1 Make sure the SYS LED is on and not blinking. 2 3 Press the RESET button and hold it until the SYS LED begins to blink. (This usually takes about five seconds.) Release the RESET button, and wait for the Zyxel Device to restart. You should be able to access the Zyxel Device using the default settings. ZyWALL ATP Series Users Guide 864 Chapter 44 Troubleshooting 44.2 Getting More Troubleshooting Help Search for support information for your model at www.zyxel.com for more troubleshooting suggestions. ZyWALL ATP Series Users Guide 865 APPENDIX A Customer Support In the event of problems that cannot be solved by using this manual, you should contact your vendor. If you cannot contact your vendor, then contact a Zyxel office for the region in which you bought the device. See http://www.zyxel.com/homepage.shtml and also http://www.zyxel.com/about_zyxel/zyxel_worldwide.shtml for the latest information. Please have the following information ready when you contact an office. Required Information Product model and serial number. Warranty Information. Date that you received your device. Brief description of the problem and the steps you took to solve it. Corporate Headquarters (Worldwide) Taiwan Zyxel Communications Corporation http://www.zyxel.com Asia China Zyxel Communications (Shanghai) Corp. Zyxel Communications (Beijing) Corp. Zyxel Communications (Tianjin) Corp. http://www.zyxel.cn India Zyxel Technology India Pvt Ltd http://www.zyxel.in Kazakhstan Zyxel Kazakhstan http://www.zyxel.kz ZyWALL ATP Series Users Guide 866 Appendix A Customer Support Korea Zyxel Korea Corp. http://www.zyxel.kr Malaysia Zyxel Malaysia Sdn Bhd. http://www.zyxel.com.my Pakistan Zyxel Pakistan (Pvt.) Ltd. http://www.zyxel.com.pk Philippines Zyxel Philippines http://www.zyxel.com.ph Singapore Zyxel Singapore Pte Ltd. http://www.zyxel.com.sg Taiwan Zyxel Communications Corporation http://www.zyxel.com/tw/zh/

Thailand Zyxel Thailand Co., Ltd http://www.zyxel.co.th Vietnam Zyxel Communications Corporation-Vietnam Office http://www.zyxel.com/vn/vi Europe Austria Zyxel Deutschland GmbH http://www.zyxel.de Belarus Zyxel BY http://www.zyxel.by ZyWALL ATP Series Users Guide 867 Appendix A Customer Support Belgium Zyxel Communications B.V. http://www.zyxel.com/be/nl/

http://www.zyxel.com/be/fr/

Bulgaria Zyxel http://www.zyxel.com/bg/bg/

Czech Republic Zyxel Communications Czech s.r.o http://www.zyxel.cz Denmark Zyxel Communications A/S http://www.zyxel.dk Estonia Zyxel Estonia http://www.zyxel.com/ee/et/

Finland Zyxel Communications http://www.zyxel.fi France Zyxel France http://www.zyxel.fr Germany Zyxel Deutschland GmbH http://www.zyxel.de Hungary Zyxel Hungary & SEE http://www.zyxel.hu Italy Zyxel Communications Italy http://www.zyxel.it/

ZyWALL ATP Series Users Guide 868 Appendix A Customer Support Latvia Zyxel Latvia http://www.zyxel.com/lv/lv/homepage.shtml Lithuania Zyxel Lithuania http://www.zyxel.com/lt/lt/homepage.shtml Netherlands Zyxel Benelux http://www.zyxel.nl Norway Zyxel Communications http://www.zyxel.no Poland Zyxel Communications Poland http://www.zyxel.pl Romania Zyxel Romania http://www.zyxel.com/ro/ro Russia Zyxel Russia http://www.zyxel.ru Slovakia Zyxel Communications Czech s.r.o. organizacna zlozka http://www.zyxel.sk Spain Zyxel Communications ES Ltd http://www.zyxel.es Sweden Zyxel Communications http://www.zyxel.se Switzerland Studerus AG ZyWALL ATP Series Users Guide 869 Appendix A Customer Support http://www.zyxel.ch/

Turkey Zyxel Turkey A.S. http://www.zyxel.com.tr UK Zyxel Communications UK Ltd. http://www.zyxel.co.uk Ukraine Zyxel Ukraine http://www.ua.zyxel.com Latin America Argentina Zyxel Communication Corporation http://www.zyxel.com/ec/es/

Brazil Zyxel Communications Brasil Ltda. https://www.zyxel.com/br/pt/

Ecuador Zyxel Communication Corporation http://www.zyxel.com/ec/es/

Middle East Israel Zyxel Communication Corporation http://il.zyxel.com/homepage.shtml Middle East Zyxel Communication Corporation http://www.zyxel.com/me/en/

ZyWALL ATP Series Users Guide 870 Appendix A Customer Support North America USA Zyxel Communications, Inc. - North America Headquarters http://www.zyxel.com/us/en/

Oceania Africa Australia Zyxel Communications Corporation http://www.zyxel.com/au/en/

South Africa Nology (Pty) Ltd. http://www.zyxel.co.za ZyWALL ATP Series Users Guide 871 APPENDIX B Product Features Please refer to the product datasheet for the latest product features. Version Model Name

# Of MAC Interface VLAN Virtual (Alias) PPP (System Default) PPP (User Created) Bridge Tunnel (GRE/IPv6 Transition) Routing Static Route Policy Route Reserved Sessions For Managed Devices Max OSPF Areas Max. BGP Neighbor BGP Max. Network Sessions Max. TCP Concurrent Sessions

(Forwarding, NAT/Firewall) Session Rate NAT Max. Virtual Server Number Firewall (Secure Policy) Max Firewall ACL Rule Number = Secure Policy Number Max Session Limit per Host Rules ADP Max. ADP Profile Number Max. ADP Rule Number Application Patrol Max. App Patrol Number Max. Application Object In Each Profile

(Object + Object Group) User Profile Max. Local User Max. Admin User Max. User Group Max User In One User Group Default Concurrent Device Login Max. Concurrent Device Upgrade

(License) HTTPd Max HTTPd Number Objects Address Object Address Group Max. Address Object In One Group 4.35 ATP100 6 4.35 ATP200 7 4.35 ATP500 7 4.35 ATP800 14 8 16 64 128 4 per interface 4 per interface 4 per interface 4 per interface 8 16 16 4 256 500 500 10 5 16 8 32 16 4 512 1000 500 10 5 16 1,000,000 12,000 2,000,000 15,000 1024 2000 1000 32 32 64 64 128 5 32 128 200 200 512 1000 200 128 1024 5000 1000 32 32 96 96 512 10 128 512 800 800 512 2000 400 256 2 2 2 4 64 100 500 10 5 16 300,000 4,000 128 500 1000 8 32 32 32 64 5 16 64 64 64 128 300 25 64 3 4 8 4 128 500 500 10 5 16 600,000 8,000 256 500 1000 32 32 32 32 128 5 32 128 100 128 256 300 50 128 ZyWALL ATP Series Users Guide 872 Service Object Service Group Max. Service Object In One Group Schedule Object Schedule Group Max. Schedule Object In One Group Application Object Application Group Max. Application Object In One Group ISP Account Max. LDAP Server Object #

Max. RADIUS Server Object #

Max. Ad Server Object #

Max. Zone Number (System Default) Max. Zone Number (User Defined) Trunk Max. Trunk Number (System Default) Max. Trunk Number (User Defined) Max. Member Number Per Trunk VPN Max. VPN Tunnels Number Max. VPN Concentrator Number Max. VPN Configuration Provision Rule Number Certificate Certificate Buffer Size Built-In Service A Record NS Record (DNS Domain Zone Forward) MX Record Max Service Control Entries Max. DHCP Network Pool Max. DHCP Host Pool (Static DHCP) Max. DHCP Extended Options Max DDNS Profiles DHCP Relay USB Storage Device Number Centralized Log Log Entries Debug Log Entries Admin E-Mail Address Syslog Server IDP Max. IDP Profile Number Max. Custom Signatures SSL Inspection Max. SSL Inspection Profile Max. Exclude List Content Filtering Max. Number Of Content Filter Policies Appendix B Product Features 200 50 64 32 16 24 500 100 128 500 100 128 32 16 24 500 100 128 1000 200 128 32 16 24 1000 200 128 16 (PPP+3G) 16(PPP+3G) 32(PPP+3G) 2 2 4 8 8 1 4 4+8 40 2 40 128k 64 8 8 8 8 8 9 16 1 8 4+8 40 2 40 256k 64 16 8 16 16 16 9 16 1 16 16+8 300 16 300 512k 128 16 16 1000 200 256 32 16 24 1000 200 256 32 16 16 16 8 32 1 32 32+8 1000 32 1000 512k 128 16 16 16 per service 16 per service 32 per service 32 per service vlan+brg+ethernet vlan+brg+ethernet vlan+brg+ethernet vlan+brg+ethernet 96 10 10 256 15 10 512 30 10 1024 30 10 2 per interface 2 per interface 2 per interface 2 per interface 1 512 1024 2 4 1 32 6 128 16 1 1024 1024 2 4 1 32 8 256 16 1 1024 1024 2 4 1 256 16 256 32 1 2048 1024 2 4 16 512 16 256 64 Forbidden Domain Entry Number Trusted Domain Entry Number Keyword Blocking Number 256 per profiles 256 per profiles 128 per profiles 256 per profiles 256 per profiles 128 per profiles 512 per profiles 512 per profiles 256 per profiles 512 per profiles 512 per profiles 256 per profiles ZyWALL ATP Series Users Guide 873 Common Forbidden Domain Entry Number Common Trusted Domain Entry Number Email Security Maximum AS Rule Number (Profile) Maximum White List Rule Support Maximum Black List Rule Support Maximum DNSBL Domain Support Concurrent Mail Session Scanning Max. Statistics Number Max. Statistics Ranking Anti-Malware Max. AV Rule (Profile) Max. Statistics Number Max. Statistics Ranking SandBoxing Support protocol Concurrent File Collect Capability upload file size SSL VPN Default SSL VPN Connections Maximum SSL VPN Connections Max. SSL VPN Network List SSL VPN Max Policy AP Controller Default # Of Control AP Max. # Of Control AP Max Radio Profile Max SSID Profile Max Security Profile Max MAC Filter Profile MAX MAC Entry Per MAC Filter Profile Zymesh BWM Maximum BWM Rule Number BWM Per Source IP (Max.) SIP Maximum SIP Concurrent Call Custom Web Portal Page Max Internal Web Portal Customize File Appendix B Product Features 1024 1024 1 128 128 5 200 500 10 1 500 10 1024 1024 1 128 128 5 200 500 10 1 500 10 1024 1024 1 128 128 5 200 500 10 1 500 10 1024 1024 1 256 256 10 200 500 10 1 500 10 HTTP/SMTP/POP3/FTP HTTP/SMTP/POP3/FTP HTTP/SMTP/POP3/FTP HTTP/SMTP/POP3/FTP 64 Up to10MB 64 Up to10MB 64 Up to10MB N/A Up to10MB 10 10 8 16 2 10 32 32 32 32 512 32 128 256 50 4 10 10 8 16 2 18 32 128 128 32 512 32 256 1024 100 4 50 50 8 16 2 34 64 128 128 32 512 32 512 1024 100 4 100 100 8 16 2 130 128 1024 1024 32 512 32 1024 2048 100 4 Upload Zip File Size Unzip File Size Up to 2MB Up to 5MB Up to 2MB Up to 5MB Up to 2MB Up to 5MB Up to 2MB Up to 5MB ZyWALL ATP Series Users Guide 874 APPENDIX C Legal Information Copyright Disclaimer Copyright 2019 by Zyxel Communications Corporation. The contents of this publication may not be reproduced in any part or as a whole, transcribed, stored in a retrieval system, translated into any language, or transmitted in any form or by any means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the prior written permission of Zyxel Communications Corporation. Published by Zyxel Communications Corporation. All rights reserved. Zyxel does not assume any liability arising out of the application or use of any products, or software described herein. Neither does it convey any license under its patent rights nor the patent rights of others. Zyxel further reserves the right to make changes in any products described herein without notice. This publication is subject to change without notice. Regulatory Notice and Statement (Class B) Model List: ATP100, ATP100W, ATP200 UNITED STATES of AMERICA The following information applies if you use the product within USA area. FCC EMC Statement The device complies with Part 15 of FCC rules. Operation is subject to the following two conditions:

(1) This device may not cause harmful interference, and

(2) This device must accept any interference received, including interference that may cause undesired operation. Changes or modifications not expressly approved by the party responsible for compliance could void the users authority to operate the device. This product has been tested and complies with the specifications for a Class B digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This device generates, uses, and can radiate radio frequency energy and, if not installed and used according to the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this device does cause harmful interference to radio or television reception, which is found by turning the device off and on, the user is encouraged to try to correct the interference by one or more of the following measures:

Reorient or relocate the receiving antenna Increase the separation between the devices Connect the equipment to an outlet other than the receivers Consult a dealer or an experienced radio/TV technician for assistance FCC Radiation Exposure Statement This device complies with FCC RF radiation exposure limits set forth for an uncontrolled environment. This transmitter must be at least 22 cm from the user and must not be co-located or operating in conjunction with any other antenna or Operation of this device is restricted to indoor use only, except for relevant user's manual mention that this device can be installed into the transmitter. external environment. CANADA The following information applies if you use the product within Canada area Innovation, Science and Economic Development Canada ICES Statement CAN ICES-3 (B)/NMB-3(B) ZyWALL ATP Series Users Guide 875 Appendix C Legal Information EUROPEAN UNION The following information applies if you use the product within the European Union. Declaration of Conformity with Regard to EU Directive 2014/53/EU (Radio Equipment Directive, RED) Model List: ATP100W Compliance information for 2.4GHz and/or 5GHz wireless products relevant to the EU and other Countries following the EU Directive 2014/53/

EU (RED). And this product may be used in all EU countries (and other countries following the EU Directive 2014/53/EU) without any limitation except for the countries mentioned below table:

In the majority of the EU and other European countries, the 5GHz bands have been made available for the use of wireless local area networks (LANs). Later in this document you will find an overview of countries in which additional restrictions or requirements or both are applicable. The requirements for any country may evolve. Zyxel recommends that you check with the local authorities for the latest status of their national regulations for the 5GHz wireless LANs. If this device for operation in the band 5150-5350 MHz, it is for indoor use only. This equipment should be installed and operated with a minimum distance of 20 cm between the radio equipment and your body. List of national codes COUNTRY ISO 3166 2 LETTER CODE COUNTRY ISO 3166 2 LETTER CODE Austria Belgium Bulgaria Croatia Cyprus Czech Republic Denmark Estonia Finland France Germany Greece Hungary Iceland Ireland Italy Latvia AT BE BG HR CY CZ DK EE FI FR DE GR HU IS IE IT LV Safety Warnings Liechtenstein Lithuania Luxembourg Malta Netherlands Norway Poland Portugal Romania Serbia Slovakia Slovenia Spain Switzerland Sweden Turkey United Kingdom LI LT LU MT NL NO PL PT RO RS SK SI ES CH SE TR GB Do not use this product near water, for example, in a wet basement or near a swimming pool. Do not expose your device to dampness, dust or corrosive liquids. Do not store things on the device. Do not obstruct the device ventilation slots as insufficient airflow may harm your device. For example, do not place the device in an enclosed space such as a box or on a very soft surface such as a bed or sofa. Do not install, use, or service this device during a thunderstorm. There is a remote risk of electric shock from lightning. Connect ONLY suitable accessories to the device. Do not open the device or unit. Opening or removing covers can expose you to dangerous high voltage points or other risks. Only qualified service personnel should service or disassemble this device. Please contact your vendor for further information. Make sure to connect the cables to the correct ports. Place connecting cables carefully so that no one will step on them or stumble over them. Always disconnect all cables from this device before servicing or disassembling. Do not remove the plug and connect it to a power outlet by itself; always attach the plug to the power adaptor first before connecting it to Do not allow anything to rest on the power adaptor or cord and do NOT place the product where anyone can walk on the power adaptor a power outlet. or cord. ZyWALL ATP Series Users Guide 876 Appendix C Legal Information Please use the provided or designated connection cables/power cables/ adaptors. Connect it to the right supply voltage (for example, 110V AC in North America or 230V AC in Europe). If the power adaptor or cord is damaged, it might cause electrocution. Remove it from the device and the power source, repairing the power adapter or cord is prohibited. Contact your local vendor to order a new one. Do not use the device outside, and make sure all the connections are indoors. There is a remote risk of electric shock from lightning. CAUTION: Risk of explosion if battery is replaced by an incorrect type, dispose of used batteries according to the instruction. Dispose them at the applicable collection point for the recycling of electrical and electronic devices. For detailed information about recycling of this product, please contact your local city office, your household waste disposal service or the store where you purchased the product. The following warning statements apply, where the disconnect device is not incorporated in the device or where the plug on the power supply cord is intended to serve as the disconnect device,

- For permanently connected devices, a readily accessible disconnect device shall be incorporated external to the device;

- For pluggable devices, the socket-outlet shall be installed near the device and shall be easily accessible. CLASS 1 LASER PRODUCT APPAREIL LASER DE CLASS 1 PRODUCT COMPLIES WITH 21 CFR 1040.10 AND 1040.11. PRODUIT CONFORME SELON 21 CFR 1040.10 ET 1040.11. Environment Statement ErP (Energy-related Products) Zyxel products put on the EU market in compliance with the requirement of the European Parliament and the Council published Directive 2009/

125/EC establishing a framework for the setting of ecodesign requirements for energy-related products (recast), so called as "ErP Directive

(Energy-related Products directive) as well as ecodesign requirement laid down in applicable implementing measures, power consumption has satisfied regulation requirements which are:

Network standby power consumption < 8W, and/or Off mode power consumption < 0.5W, and/or Standby mode power consumption < 0.5W. European Union - Disposal and Recycling Information The symbol below means that according to local regulations your product and/or its battery shall be disposed of separately from domestic waste. If this product is end of life, take it to a recycling station designated by local authorities. At the time of disposal, the separate collection of your product and/or its battery will help save natural resources and ensure that the environment is sustainable development. Die folgende Symbol bedeutet, dass Ihr Produkt und/oder seine Batterie gem den rtlichen Bestimmungen getrennt vom Hausmll entsorgt werden muss. Wenden Sie sich an eine Recyclingstation, wenn dieses Produkt das Ende seiner Lebensdauer erreicht hat. Zum Zeitpunkt der Entsorgung wird die getrennte Sammlung von Produkt und/oder seiner Batterie dazu beitragen, natrliche Ressourcen zu sparen und die Umwelt und die menschliche Gesundheit zu schtzen. El smbolo de abajo indica que segn las regulaciones locales, su producto y/o su batera debern depositarse como basura separada de la domstica. Cuando este producto alcance el final de su vida til, llvelo a un punto limpio. Cuando llegue el momento de desechar el producto, la recogida por separado ste y/o su batera ayudar a salvar los recursos naturales y a proteger la salud humana y medioambiental. Le symbole ci-dessous signifie que selon les rglementations locales votre produit et/ou sa batterie doivent tre limins sparment des ordures mnagres. Lorsque ce produit atteint sa fin de vie, amenez-le un centre de recyclage. Au moment de la mise au rebut, la collecte spare de votre produit et/ou de sa batterie aidera conomiser les ressources naturelles et protger l'environnement et la sant humaine. Il simbolo sotto significa che secondo i regolamenti locali il vostro prodotto e/o batteria deve essere smaltito separatamente dai rifiuti domestici. Quando questo prodotto raggiunge la fine della vita di servizio portarlo a una stazione di riciclaggio. Al momento dello smaltimento, la raccolta separata del vostro prodotto e/o della sua batteria aiuta a risparmiare risorse naturali e a proteggere l'ambiente e la salute umana. Symbolen innebr att enligt lokal lagstiftning ska produkten och/eller dess batteri kastas separat frn hushllsavfallet. Nr den hr produkten nr slutet av sin livslngd ska du ta den till en tervinningsstation. Vid tiden fr kasseringen bidrar du till en bttre milj och mnsklig hlsa genom att gra dig av med den p ett tervinningsstlle.

- :

- -

- -

ZyWALL ATP Series Users Guide 877 Appendix C Legal Information

( : / 110V AC 230V AC)

:

-

-

(ATP100W) About the Symbols Various symbols are used in this product to ensure correct usage, to prevent danger to the user and others, and to prevent property damage. The meaning of these symbols are described below. It is important that you read these descriptions thoroughly and fully understand the contents. Explanation of the Symbols SYMBOL EXPLANATION Alternating current (AC):

AC is an electric current in which the flow of electric charge periodically reverses direction. Direct current (DC):

DC if the unidirectional flow or movement of electric charge carriers. Earth; ground:

A wiring terminal intended for connection of a Protective Earthing Conductor. Class II equipment:

The method of protection against electric shock in the case of class II equipment is either double insulation or reinforced insulation. Viewing Certifications Go to http://www.zyxel.com to view this products documentation and certifications. Zyxel Limited Warranty Zyxel warrants to the original end user (purchaser) that this product is free from any defects in material or workmanship for a specific period (the Warranty Period) from the date of purchase. The Warranty Period varies by region. Check with your vendor and/or the authorized Zyxel local distributor for details about the Warranty Period of this product. During the warranty period, and upon proof of purchase, should the product have indications of failure due to faulty workmanship and/or materials, Zyxel will, at its discretion, repair or replace the defective products or components without charge for either parts or labor, and to whatever extent it shall deem necessary to restore the product or components to proper operating condition. Any replacement will consist of a new or re-manufactured functionally equivalent product of equal or higher value, and will be solely at the discretion of Zyxel. This warranty shall not apply if the product has been modified, misused, tampered with, damaged by an act of God, or subjected to abnormal working conditions. ZyWALL ATP Series Users Guide 878 Appendix C Legal Information Note Repair or replacement, as provided under this warranty, is the exclusive remedy of the purchaser. This warranty is in lieu of all other warranties, express or implied, including any implied warranty of merchantability or fitness for a particular use or purpose. Zyxel shall in no event be held liable for indirect or consequential damages of any kind to the purchaser. To obtain the services of this warranty, contact your vendor. You may also refer to the warranty policy for the region in which you bought the device at http://www.zyxel.com/web/support_warranty_info.php. Registration Register your product online to receive e-mail notices of firmware upgrades and information at www.zyxel.com for global products, or at www.us.zyxel.com for North American products. Trademarks ZyNOS (Zyxel Network Operating System) and ZON (Zyxel One Network) are registered trademarks of Zyxel Communications, Inc. Other trademarks mentioned in this publication are used for identification purposes only and may be properties of their respective owners. Open Source Licenses This product contains in part some free software distributed under GPL license terms and/or GPL like licenses. Open source licenses are provided with the firmware package. You can download the latest firmware at www.zyxel.com. To obtain the source code covered under those Licenses, please contact support@zyxel.com.tw to get it. Regulatory Notice and Statement (Class A) Model List: ATP500, ATP700, ATP800 United States of America The following information applies if you use the product within USA area. FCC EMC Statement This device complies with part 15 of the FCC Rules. Operation is subject to the following two conditions:

(1) This device may not cause harmful interference, and

(2) This device must accept any interference received, including interference that may cause undesired operation. Changes or modifications not expressly approved by the party responsible for compliance could void the users authority to operate the equipment. This device has been tested and found to comply with the limits for a Class A digital device, pursuant to part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This equipment generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference in which case the user will be required to correct the interference at his own expense. Canada The following information applies if you use the product within Canada area Innovation, Science and Economic Development Canada Industry ICES Statement CAN ICES-3 (A)/NMB-3(A) European Union The following information applies if you use the product within the European Union. CE EMC statement WARNING: This equipment is compliant with Class A of EN55032. In a residential environment this equipment may cause radio interference. ZyWALL ATP Series Users Guide 879 Appendix C Legal Information List of National Codes COUNTRY ISO 3166 2 LETTER CODE COUNTRY ISO 3166 2 LETTER CODE Austria Belgium Bulgaria Croatia Cyprus Czech Republic Denmark Estonia Finland France Germany Greece Hungary Iceland Ireland Italy Latvia AT BE BG HR CY CR DK EE FI FR DE GR HU IS IE IT LV Safety Warnings Liechtenstein Lithuania Luxembourg Malta Netherlands Norway Poland Portugal Romania Serbia Slovakia Slovenia Spain Sweden Switzerland Turkey United Kingdom LI LT LU MT NL NO PL PT RO RS SK SI ES SE CH TR GB Do not use this product near water, for example, in a wet basement or near a swimming pool. Do not expose your device to dampness, dust or corrosive liquids. Do not store things on the device. Do not obstruct the device ventilation slots as insufficient airflow may harm your device. For example, do not place the device in an enclosed space such as a box or on a very soft surface such as a bed or sofa. Do not install, use, or service this device during a thunderstorm. There is a remote risk of electric shock from lightning. Connect ONLY suitable accessories to the device. Do not open the device or unit. Opening or removing covers can expose you to dangerous high voltage points or other risks. Only qualified service personnel should service or disassemble this device. Please contact your vendor for further information. Make sure to connect the cables to the correct ports. Place connecting cables carefully so that no one will step on them or stumble over them. Always disconnect all cables from this device before servicing or disassembling. Do not remove the plug and connect it to a power outlet by itself; always attach the plug to the power adaptor first before connecting it to Do not allow anything to rest on the power adaptor or cord and do NOT place the product where anyone can walk on the power adaptor a power outlet. or cord. Please use the provided or designated connection cables/power cables/ adaptors. Connect it to the right supply voltage (for example, 110V AC in North America or 230V AC in Europe). If the power adaptor or cord is damaged, it might cause electrocution. Remove it from the device and the power source, repairing the power adapter or cord is prohibited. Contact your local vendor to order a new one. Do not use the device outside, and make sure all the connections are indoors. There is a remote risk of electric shock from lightning. Caution: Risk of explosion if battery is replaced by an incorrect type, dispose of used batteries according to the instruction. Dispose them at the applicable collection point for the recycling of electrical and electronic device. For detailed information about recycling of this product, please contact your local city office, your household waste disposal service or the store where you purchased the product. Use ONLY power wires of the appropriate wire gauge for your device. Connect it to a power supply of the correct voltage. Fuse Warning! Replace a fuse only with a fuse of the same type and rating. The POE (Power over Ethernet) devices that supply or receive power and their connected Ethernet cables must all be completely indoors. The following warning statements apply, where the disconnect device is not incorporated in the device or where the plug on the power supply cord is intended to serve as the disconnect device,

- For permanently connected devices, a readily accessible disconnect device shall be incorporated external to the device;

- For pluggable devices, the socket-outlet shall be installed near the device and shall be easily accessible. This equipment must be grounded by qualified service personnel. Never defeat the ground conductor or operate the device in the absence of a suitably installed ground conductor. Contact the appropriate electrical inspection authority or an electrician if you are uncertain that suitable grounding is available. When connecting or disconnecting power to hot-pluggable power supplies, if offered with your system, observe the following guidelines:

- Install the power supply before connecting the power cable to the power supply.

- Unplug the power cable before removing the power supply.

- If the system has multiple sources of power, disconnect power from the system by unplugging all power cables from the power supply. CLASS 1 LASER PRODUCT APPAREIL LASER DE CLASS 1 PRODUCT COMPLIES WITH 21 CFR 1040.10 AND 1040.11. PRODUIT CONFORME SELON 21 CFR 1040.10 ET 1040.11. ZyWALL ATP Series Users Guide 880 Appendix C Legal Information Environment Statement European Union - Disposal and Recycling Information The symbol below means that according to local regulations your product and/or its battery shall be disposed of separately from domestic waste. If this product is end of life, take it to a recycling station designated by local authorities. At the time of disposal, the separate collection of your product and/or its battery will help save natural resources and ensure that the environment is sustainable development. Die folgende Symbol bedeutet, dass Ihr Produkt und/oder seine Batterie gem den rtlichen Bestimmungen getrennt vom Hausmll entsorgt werden muss. Wenden Sie sich an eine Recyclingstation, wenn dieses Produkt das Ende seiner Lebensdauer erreicht hat. Zum Zeitpunkt der Entsorgung wird die getrennte Sammlung von Produkt und/oder seiner Batterie dazu beitragen, natrliche Ressourcen zu sparen und die Umwelt und die menschliche Gesundheit zu schtzen. El smbolo de abajo indica que segn las regulaciones locales, su producto y/o su batera debern depositarse como basura separada de la domstica. Cuando este producto alcance el final de su vida til, llvelo a un punto limpio. Cuando llegue el momento de desechar el producto, la recogida por separado ste y/o su batera ayudar a salvar los recursos naturales y a proteger la salud humana y medioambiental. Le symbole ci-dessous signifie que selon les rglementations locales votre produit et/ou sa batterie doivent tre limins sparment des ordures mnagres. Lorsque ce produit atteint sa fin de vie, amenez-le un centre de recyclage. Au moment de la mise au rebut, la collecte spare de votre produit et/ou de sa batterie aidera conomiser les ressources naturelles et protger l'environnement et la sant humaine. Il simbolo sotto significa che secondo i regolamenti locali il vostro prodotto e/o batteria deve essere smaltito separatamente dai rifiuti domestici. Quando questo prodotto raggiunge la fine della vita di servizio portarlo a una stazione di riciclaggio. Al momento dello smaltimento, la raccolta separata del vostro prodotto e/o della sua batteria aiuta a risparmiare risorse naturali e a proteggere l'ambiente e la salute umana. Symbolen innebr att enligt lokal lagstiftning ska produkten och/eller dess batteri kastas separat frn hushllsavfallet. Nr den hr produkten nr slutet av sin livslngd ska du ta den till en tervinningsstation. Vid tiden fr kasseringen bidrar du till en bttre milj och mnsklig hlsa genom att gra dig av med den p ett tervinningsstlle.

- :

:

- -

- -

( : / 110V AC 230V AC) ZyWALL ATP Series Users Guide 881 Appendix C Legal Information

:

-

-

About the Symbols Various symbols are used in this product to ensure correct usage, to prevent danger to the user and others, and to prevent property damage. The meaning of these symbols are described below. It is important that you read these descriptions thoroughly and fully understand the contents. Explanation of the Symbols SYMBOL EXPLANATION Alternating current (AC):

AC is an electric current in which the flow of electric charge periodically reverses direction. Direct current (DC):

DC if the unidirectional flow or movement of electric charge carriers. Earth; ground:

A wiring terminal intended for connection of a Protective Earthing Conductor. Class II equipment:

The method of protection against electric shock in the case of class II equipment is either double insulation or reinforced insulation. Viewing Certifications Go to http://www.zyxel.com to view this products documentation and certifications. Zyxel Limited Warranty Zyxel warrants to the original end user (purchaser) that this product is free from any defects in material or workmanship for a specific period (the Warranty Period) from the date of purchase. The Warranty Period varies by region. Check with your vendor and/or the authorized Zyxel local distributor for details about the Warranty Period of this product. During the warranty period, and upon proof of purchase, should the product have indications of failure due to faulty workmanship and/or materials, Zyxel will, at its discretion, repair or replace the defective products or components without charge for either parts or labor, and to whatever extent it shall deem necessary to restore the product or components to proper operating condition. Any replacement will consist of a new or re-manufactured functionally equivalent product of equal or higher value, and will be solely at the discretion of Zyxel. This warranty shall not apply if the product has been modified, misused, tampered with, damaged by an act of God, or subjected to abnormal working conditions. Note Repair or replacement, as provided under this warranty, is the exclusive remedy of the purchaser. This warranty is in lieu of all other warranties, express or implied, including any implied warranty of merchantability or fitness for a particular use or purpose. Zyxel shall in no event be held liable for indirect or consequential damages of any kind to the purchaser. To obtain the services of this warranty, contact your vendor. You may also refer to the warranty policy for the region in which you bought the device at http://www.zyxel.com/web/support_warranty_info.php. Registration Register your product online to receive e-mail notices of firmware upgrades and information at www.zyxel.com for global products, or at www.us.zyxel.com for North American products. Open Source Licenses This product contains in part some free software distributed under GPL license terms and/or GPL like licenses. Open source licenses are provided with the firmware package. You can download the latest firmware at www.zyxel.com. To obtain the source code covered under those Licenses, please contact support@zyxel.com.tw to get it. ZyWALL ATP Series Users Guide 882 Index Index logging in 461 multiple logins 628 see also users 617 Web Configurator 629 access users, see also force user authentication policies account user 617, 713 accounting server 675 Active Directory, see AD active protocol 428 AH 428 and encapsulation 428 ESP 428 active sessions 114, 129 ActiveX 538 AD 676, 678, 679, 681 directory structure 677 Distinguished Name, see DN password 681 port 681, 683 search time limit 681 SSL 681 address groups 655 and content filtering 524, 525 and FTP 774 and security policy 465 and SNMP 779 and SSH 769 and Telnet 772 and WWW 754 address objects 655 and content filtering 524, 525 and FTP 774 and NAT 318, 347 and policy routes 317 and security policy 465 and SNMP 779 and SSH 769 and Telnet 772 and VPN connections 401 and WWW 754 HOST 656 ZyWALL ATP Series Users Guide 883 Symbols Numbers 3322 Dynamic DNS 337 3DES 424 6in4 tunneling 260 6to4 tunneling 260 A AAA Base DN 678 Bind DN 678, 681 directory structure 677 Distinguished Name, see DN DN 678, 679, 681 password 681 port 681, 683 search time limit 681 SSL 681 AAA server 675 AD 677 and users 618 directory service 676 LDAP 676, 677 local user database 677 RADIUS 676, 677, 682 RADIUS group 682 see also RADIUS access 29 access control attacks 569 Access Point Name, see APN access users 617, 619 custom page 754 forcing login 461 idle timeout 627 RANGE 656 SUBNET 656 types of 656, 662 address record 743 admin user troubleshooting 861 admin users 617 multiple logins 628 see also users 617 ADP 501 false negatives 503 false positives 503 inline profile 503 monitor profile 503 Advanced Encryption Standard, see AES AES 424 AF 321 AH 407, 428 and transport mode 429 alerts 798, 799, 801, 802, 803, 804 IDP 604, 605 ALG 357, 363 and NAT 357, 359 and policy routes 359, 363 and security policy 357, 359 and trunks 363 FTP 357, 358 H.323 357, 358, 363 peer-to-peer calls 359 RTP 363 see also VoIP pass through 357 SIP 357, 358 Anomaly Detection and Prevention, see ADP Anonymizer 563 Anonymous Proxies 558 anti-malware 543 boot sector virus 554 file decompression 551 file infector virus 554 firmware package blocking 551 macro virus 554 malware types 554 packet scan 543 packet types 544 scanner types 555 signatures 553 virus 543 worm 543 Index anti-spam 588, 591, 593 action for spam mails 592 black list 588, 591, 593 concurrent e-mail sessions 176 DNSBL 589, 591 e-mail header buffer 589 e-mail headers 589 general settings 590 identifying legitimate e-mail 588 identifying spam 588 POP2 589 POP3 589 regular expressions 595 SMTP 589 status 177 white list 588, 591, 594 anti-virus EICAR 550 e-mail virus 554 polymorphic virus 554 statistics 168, 170, 178 troubleshooting 852, 855 troubleshooting signatures update 852 updating signatures 190 AP group 150, 196, 198 APN 255 Application Layer Gateway, see ALG application patrol 515 actions 515 and HTTP redirect 352 and security policy 515 classification 515 exceptions 515 port-less 515 ports 516 service ports 516 troubleshooting 852, 858, 861 ASAS (Authenex Strong Authentication System) 676 asymmetrical routes 495 allowing through the security policy 498 vs virtual interfaces 495 attacks access control 569 backdoor 569 buffer overflow 570 Denial of Service (DoS) 405 DoS/DDoS 570 IM 570 ZyWALL ATP Series Users Guide 884 Index P2P 570 scan 570 spam 570 trapdoor 569 trojan 569 virus 543, 571 worm 571 Authenex Strong Authentication System (ASAS) 676 authentication in IPSec 408 LDAP/AD 677 server 675 authentication algorithms 423, 424 and active protocol 423 MD5 424 SHA1 424 Authentication Header, see AH authentication method objects 685 and users 618 and WWW 753 create 686 example 685 authentication policy exceptional services 463 Authentication server RADIUS client 783 authentication server 781, 783 authentication type 80, 712 Authentication, Authorization, Accounting servers, see AAA server authorization server 675 Autonomous Systems (AS) 331 auxiliary interfaces 214 B backdoor attacks 569 backing up configuration files 808 bandwidth egress 256, 265 ingress 256, 265 bandwidth limit troubleshooting 854 see also application patrol 515 troubleshooting 854 Base DN 678 Batch import 725 BGP 336 Bind DN 678, 681 BitTorrent 570 black list 591, 593 anti-spam 588 Blaster 582 boot sector virus 554 Botnet 559 Botnet Filtering 556 bridge interfaces 214, 280 and virtual interfaces of members 281 basic characteristics 214 effect on routing table 281 member interfaces 281 virtual 239 bridges 280 Brute Force Attack 559 buffer overflow 570 buffer overflow attacks 570 C C&C Server 556 CA and certificates 694 CA (Certificate Authority), see certificates Calling Station ID 646 capturing packets 825, 828 card SIM 256 CEF (Common Event Format) 796, 802 cellular 250 APN 255 interfaces 214 signal quality 138, 139 SIM card 256 status 140 system 138, 139 troubleshooting 853, 854 bandwidth management 515 maximize bandwidth usage 321, 448 certificate troubleshooting 862 ZyWALL ATP Series Users Guide 885 Certificate Authority (CA) see certificates Certificate Revocation List (CRL) 694 vs OCSP 710 certificates 693 advantages of 694 and CA 694 and FTP 774 and HTTPS 750 and IKE SA 428 and SSH 769 and VPN gateways 401 and WWW 752 certification path 694, 702, 708 expired 694 factory-default 694 file formats 694 fingerprints 703, 709 importing 699 in IPSec 414 not used for encryption 694 revoked 694 self-signed 694, 701 serial number 703, 708 storage space 696, 705 thumbprint algorithms 695 thumbprints 695 used for authentication 694 verifying fingerprints 695 certification requests 701 certifications 876 viewing 878, 882 Challenge Handshake Authentication Protocol

(CHAP) 712 CHAP (Challenge Handshake Authentication Protocol) 712 CHAP/PAP 712 CLI 28, 36 button 36 messages 36 popup window 36 Reference Guide 2 commands 28 sent by Web Configurator 36 Common Event Format (CEF) 796, 802 compression (stac) 713 computer names 235, 277, 290, 308, 441 computer virus 543 Index see also virus concurrent e-mail sessions 176 configuration information 821 configuration file troubleshooting 863 configuration files 806 at restart 809 backing up 808 downloading 810, 841 downloading with FTP 773 editing 806 how applied 807 lastgood.conf 809, 811 managing 808 startup-config.conf 811 startup-config-bad.conf 809 syntax 807 system-default.conf 811 uploading 812 uploading with FTP 773 use without restart 806 connection troubleshooting 858 connection monitor (in SSL) 164 connectivity check 234, 249, 256, 265, 276, 292, 296, 408 console port speed 738 contact information 866, 872 content (pattern) 577 content filter troubleshooting 852 content filtering 524, 525 and address groups 524, 525 and address objects 524, 525 and schedules 524, 525 and user groups 524 and users 524 by category 524, 525, 532 by keyword (in URL) 525, 539 by URL 525, 538, 540, 541 by web feature 525, 538 cache 542 categories 532 category service 531 default policy 525 external web filtering service 531, 542 ZyWALL ATP Series Users Guide 886 filter list 525 managed web pages 531 policies 524, 525 registration status 189 statistics 165 testing 532 uncategorized pages 531 URL for blocked access 527 cookies 29, 538 copyright 875 CPU usage 114 Cross Site Scripting 559 current date/time 112, 734 and schedules 670 daylight savings 736 setting manually 737 time server 738 current user list 164 custom access user page 754 login page 754 custom signatures 569, 572, 856 applying 579 example 577 verifying 580 custom.rules file 569, 856 customer support 866, 872 D Data Encryption Standard, see DES date 734 daylight savings 736 DDNS 337 backup mail exchanger 342 mail exchanger 342 service providers 337 troubleshooting 857 DDoS attacks 570 Dead Peer Detection, see DPD decompression of files (in anti-malware) 551 default security policy behavior 494 Default_L2TP_VPN_GW 439 Denial of Service (DoS) attacks 570 Index Denial of Service (Dos) attacks 405 DES 423 device access troubleshooting 851 Device HA 717 device HA virtual router 719 device High Availability see Device HA 717 DHCP 307, 733 and DNS servers 308 and domain name 733 and interfaces 307 pool 308 static DHCP 308 DHCP Unique IDentifier 218 DHCPv6 713 DHCP Unique IDentifier 218 DHCPv6 Request 713 diagnostics 821 Differentiated Services Code Point (DSCP) 573 Diffie-Hellman key group 424 DiffServ 321 Digital Signature Algorithm public-key algorithm, see DSA direct routes 313 directory 676 directory service 676 file structure 677 disclaimer 875 Distinguished Name (DN) 678, 679, 681 Distributed Denial of Service (DDoS) attacks 570 DN 678, 679, 681 DNS 739 address records 743 domain name forwarders 745 domain name to IP address 743 IP address to domain name 743 L2TP VPN 441 Mail eXchange (MX) records 746 pointer (PTR) records 743 DNS Blacklist see DNSBL 589 DNS inbound LB 388 DNS servers 81, 739, 745 and interfaces 308 DNSBL 589, 591 see also anti-spam 589 ZyWALL ATP Series Users Guide 887 Index domain name 733 Domain Name System, see DNS DoS 558 DoS (Denial of Service) attacks 570 DPD 416 DSA 701 DSCP 314, 317, 451, 845 DUID 218 Dynamic Domain Name System, see DDNS dynamic guest account 618 Dynamic Host Configuration Protocol, see DHCP. dynamic peers in IPSec 406 DynDNS 337 DynDNS see also DDNS 337 Dynu 337 E eBGP (exterior Border Gate Protocol) 331 e-Donkey 570 egress bandwidth 256, 265 EICAR 550 Ekahau RTLS 209 e-mail 588 daily statistics report 793 header buffer 589 headers 589 virus 554 e-Mule 570 Encapsulating Security Payload, see ESP encapsulation and active protocol 428 IPSec 407 transport mode 428 tunnel mode 428 VPN 428 encryption and anti-malware 551 IPSec 408 RSA 703 encryption algorithms 423 3DES 424 AES 424 and active protocol 423 DES 423 encryption method 712 end of IP list 573 enforcing policies in IPSec 406 ESP 407, 428 and transport mode 429 Ethernet interfaces 214 and OSPF 222 and RIP 222 and routing protocols 220 basic characteristics 214 virtual 239 exceptional services 463 Exploits 558 extended authentication and VPN gateways 401 IKE SA 427 Extended Service Set IDentification 633 ext-user troubleshooting 861 F false negatives 503 false positives 503, 506 file decompression (in anti-malware) 551 file extensions configuration files 806 shell scripts 806 file infector 554 file manager 806 Firefox 29 firewall and SMTP redirect 353 firmware and restart 812 current version 111, 816 getting updated 812 uploading 815 uploading with FTP 773 firmware package troubleshooting 860 firmware upload troubleshooting 863 flags 573 ZyWALL ATP Series Users Guide 888 flash usage 114 forcing login 461 FQDN 743 fragmentation flag 575 fragmentation offset 575 FTP 773 additional signaling port 362 ALG 357 and address groups 774 and address objects 774 and certificates 774 and zones 774 signaling port 362 troubleshooting 858 with Transport Layer Security (TLS) 774 full tunnel mode 432, 436 Fully-Qualified Domain Name, see FQDN G Generic Routing Encapsulation, see GRE. global SSL setting 436 Grace Period 25 GRE 309 GSM 256 Guide CLI Reference 2 Quick Start 2 H H.323 363 additional signaling port 362 ALG 357, 363 and RTP 363 and security policy 358 signaling port 362 troubleshooting 858 header checksum 573 host-based intrusions 581 HSDPA 256 HTTP over SSL, see HTTPS redirect to HTTPS 752 Index vs HTTPS 750 HTTP redirect and application patrol 352 and interfaces 356 and policy routes 352, 353 and security policy 352 packet flow 352 troubleshooting 858 HTTPS 750 and certificates 750 authenticating clients 750 avoiding warning messages 760 example 759 vs HTTP 750 with Internet Explorer 759 with Netscape Navigator 759 hub-and-spoke VPN, see VPN concentrator HyperText Transfer Protocol over Secure Socket Layer, see HTTPS I ICMP 666 code 576 sequence number 576 type 576 identification (IP) 575 identifying legitimate e-mail 588 spam 588 IDP 566 action 509 alerts 604, 605 applying custom signatures 579 custom signature example 577 custom signatures 572 log options 506, 510, 604, 605 reject sender 509 reject-both 509 reject-receiver 509 service group 571 signatures 566 Snort signatures 582 statistics 172 troubleshooting 852, 856 verifying custom signatures 580 IEEE 802.1q VLAN ZyWALL ATP Series Users Guide 889 IEEE 802.1q. See VLAN. IEEE 802.1x 633 Iframe Injection 559 IHL (IP Header Length) 573 IKE SA aggressive mode 422, 426 and certificates 428 and RADIUS 427 and to-ZyWALL security policy 859 authentication algorithms 423, 424 content 425 Dead Peer Detection (DPD) 416 Diffie-Hellman key group 424 encryption algorithms 423 extended authentication 427 ID type 425 IP address, remote IPSec router 423 IP address, Zyxel device 423 local identity 425 main mode 422, 426 NAT traversal 427 negotiation mode 422 password 427 peer identity 425 pre-shared key 425 proposal 423 see also VPN user name 427 IM (Instant Messenger) 570 IMAP 589 iMesh 570 inbound LB algorithm least connection 390 least load 390 weighted round robin 390 inbound load balancing 388 time to live 391 incoming bandwidth 256, 265 ingress bandwidth 256, 265 inline profile 503 Instant Messenger (IM) 515, 570 managing 515 interface status 124 troubleshooting 853 interfaces 213 and DNS servers 308 Index and HTTP redirect 356 and layer-3 virtualization 214 and NAT 347 and physical ports 214 and policy routes 317 and static routes 320 and VPN gateways 401 and zones 214 as DHCP relays 307 as DHCP servers 307, 733 auxiliary, see also auxiliary interfaces. backup, see trunks bandwidth management 304, 305, 307 bridge, see also bridge interfaces. cellular 214 DHCP clients 306 Ethernet, see also Ethernet interfaces. gateway 306 general characteristics 213 IP address 306 metric 306 MTU 307 overlapping IP address and subnet mask 306 port groups, see also port groups. PPPoE/PPTP, see also PPPoE/PPTP interfaces. prerequisites 215 relationships between 215 static DHCP 308 subnet mask 306 trunks, see also trunks. Tunnel, see also Tunnel interfaces. types 214 virtual, see also virtual interfaces. VLAN, see also VLAN interfaces. WLAN, see also WLAN interfaces. Internet access troubleshooting 851, 860 Internet Control Message Protocol, see ICMP Internet Explorer 29 Internet Message Access Protocol, see IMAP 589 Internet Protocol (IP) 572 Internet Protocol Security, see IPSec Internet Protocol version 6, see IPv6 Intrusion, Detection and Prevention see IDP 566 intrusions host 581 network 582 IP (Internet Protocol) 572 ZyWALL ATP Series Users Guide 890 IP options 573, 576 IP policy routing, see policy routes IP pool 436 IP protocols 665 and service objects 666 ICMP, see ICMP TCP, see TCP UDP, see UDP IP Reputation 556 IP security option 573 IP static routes, see static routes IP stream identifier 573 IP v4 packet headers 573 IP/MAC binding 379 exempt list 383 monitor 134 static DHCP 382 IPSec 396, 493 active protocol 407 AH 407 and certificates 401 authentication 408 basic troubleshooting 859 certificates 414 connections 401 connectivity check 408 Default_L2TP_VPN_GW 439 encapsulation 407 encryption 408 ESP 407 established in two phases 398 L2TP VPN 439 local network 396 local policy 406 NetBIOS 405 peer 396 Perfect Forward Secrecy 408 PFS 408 phase 2 settings 407 policy enforcement 406 remote access 406 remote IPSec router 396 remote network 396 remote policy 406 replay detection 405 SA life time 407 SA monitor 162 SA see also IPSec SA 428 Index see also VPN site-to-site with dynamic peer 406 static site-to-site 406 transport encapsulation 407 tunnel encapsulation 407 VPN gateway 401 IPSec SA active protocol 428 and security policy 859 and to-ZyWALL security policy 859 authentication algorithms 423, 424 destination NAT for inbound traffic 431 encapsulation 428 encryption algorithms 423 local policy 428 NAT for inbound traffic 430 NAT for outbound traffic 430 Perfect Forward Secrecy (PFS) 429 proposal 429 remote policy 428 search by name 163 search by policy 163 Security Parameter Index (SPI) (manual keys) 429 see also IPSec see also VPN source NAT for inbound traffic 430 source NAT for outbound traffic 430 status 162 transport mode 428 tunnel mode 428 when IKE SA is disconnected 428 IPSec VPN troubleshooting 859 IPv6 216 link-local address 217 prefix 216 prefix delegation 217 prefix length 216 stateless autoconfiguration 217 IPv6 tunnelings 6in4 tunneling 260 6to4 tunneling 260 IPv6-in-IPv4 tunneling 260 ISP account CHAP 712 CHAP/PAP 712 MPPE 712 MSCHAP 712 MSCHAP-V2 712 ZyWALL ATP Series Users Guide 891 Index PAP 712 ISP accounts 710 and PPPoE/PPTP interfaces 244, 710 authentication type 712 encryption method 712 stac compression 713 J Java 538 permissions 29 JavaScripts 29 K key pairs 693 L L2TP VPN 438 Default_L2TP_VPN_GW 439 DNS 441 IPSec configuration 439 policy routes 439 session monitor 164 WINS 441 lastgood.conf 809, 811 Layer 2 Tunneling Protocol Virtual Private Network, see L2TP VPN 438 layer-2 isolation 384 example 384 IP 385 LDAP 676 and users 618 Base DN 678 Bind DN 678, 681 directory 676 directory structure 677 Distinguished Name, see DN DN 678, 679, 681 password 681 port 681, 683 search time limit 681 SSL 681 user attributes 632 least connection algorithm 390 least load algorithm 390 least load first load balancing 299 LED suppression mode 197 LED troubleshooting 851 legitimate e-mail 588 level-4 inspection 516 level-7 inspection 515 licensing 186 Lightweight Directory Access Protocol, see LDAP Link Layer Discovery Protocol (LLDP ) 141 LLDP (Link Layer Discovery Protocol) 141 load balancing 203, 298 algorithms 299, 303, 305 DNS inbound 388 least load first 299 round robin 299 see also trunks 298 session-oriented 299 spillover 300 weighted round robin 300 local user database 677 log troubleshooting 863 log messages categories 799, 801, 802, 803, 804 debugging 181 regular 181 types of 181 log options

(IDP) 506, 510, 604, 605 login custom page 754 logo troubleshooting 862 logout Web Configurator 34 logs and security policy 501 e-mail profiles 795 e-mailing log messages 185, 798 formats 796 log consolidation 799 settings 795 ZyWALL ATP Series Users Guide 892 syslog servers 795 system 795 types of 795 loose source routing 573 M MAC address 630 and VLAN 266 Ethernet interface 230 range 111 MAC authentication 645 Calling Station ID 646 case 646 delimiter 645, 646 mac role 630 macro virus 554 malware infection and prevention 555 life cycle 555 managed web pages 531 management access troubleshooting 862 Management Information Base (MIB) 776, 777 managing the device using SNMP. See SNMP. MD5 424 memory usage 114 Message Digest 5, see MD5 messages CLI 36 metrics, see reports Microsoft Challenge-Handshake Authentication Protocol

(MSCHAP) 712 Challenge-Handshake Authentication Protocol Version 2 (MSCHAP-V2) 712 Point-to-Point Encryption (MPPE) 712 mobile broadband see also cellular 250 Monitor 725 monitor 164 SA 162 monitor profile ADP 503 mounting Index rack 28, 70 wall 71 MPPE (Microsoft Point-to-Point Encryption) 712 MSCHAP (Microsoft Challenge-Handshake Authentication Protocol) 712 MSCHAP-V2 (Microsoft Challenge-Handshake Authentication Protocol Version 2) 712 MTU 256, 265 multicast 638 multicast rate 638 mutation virus 554 My Certificates, see also certificates 696 MyDoom 582 myZyXEL 24 accounts, creating 24 N NAT 321, 343 ALG, see ALG and address objects 318 and address objects (HOST) 347 and ALG 357, 359 and interfaces 347 and policy routes 311, 318 and security policy 496 and to-ZyWALL security policy 348 and VoIP pass through 359 and VPN 426 loopback 349 port forwarding, see NAT port translation, see NAT traversal 427 NAT Port Mapping Protocol 364 NAT Traversal 364 NAT-PMP 364 NBNS 235, 277, 290, 308, 436 NetBIOS Broadcast over IPSec 405 Name Server, see NBNS. NetBIOS Name Server, see NBNS NetMeeting 363 see also H.323 Netscape Navigator 29 network access mode 26 ZyWALL ATP Series Users Guide 893 full tunnel 432 Network Address Translation, see NAT network list, see SSL 436 Network Time Protocol (NTP) 737 network-based intrusions 582 Nimda 582 no IP options 573 No-IP 337 NSSA 324 O objects 433 AAA server 675 addresses and address groups 655 authentication method 685 certificates 693 schedules 670 services and service groups 665 users, user groups 617, 713 offset (patterns) 577 ommon 554 One-Time Password (OTP) 676 Online Certificate Status Protocol (OCSP) 710 vs CRL 710 Open Shortest Path First, see OSPF operating mode 201 OSI (Open System Interconnection) 566 OSI level-4 516 OSI level-7 515 OSPF 324 and Ethernet interfaces 222 and RIP 325 and static routes 325 and to-ZyWALL security policy 324 area 0 325 areas, see OSPF areas authentication method 222 autonomous system (AS) 324 backbone 325 configuration steps 326 direction 222 link cost 222 priority 222 redistribute 325 Index redistribute type (cost) 327 routers, see OSPF routers virtual links 326 vs RIP 322, 324 OSPF areas 324 and Ethernet interfaces 222 backbone 324 Not So Stubby Area (NSSA) 324 stub areas 324 types of 324 OSPF routers 325 area border (ABR) 325 autonomous system boundary (ASBR) 325 backbone (BR) 325 backup designated (BDR) 326 designated (DR) 326 internal (IR) 325 link state advertisements priority 326 types of 325 OTP (One-Time Password) 676 outgoing bandwidth 256, 265 P P2P (Peer-to-peer) 570 attacks 570 see also Peer-to-peer packet inspection signatures 566 scan 543 statistics 121, 122, 146 packet capture 825, 828 files 824, 831, 832, 834 troubleshooting 863 packet captures downloading files 824, 832, 834 padding 573 PAP (Password Authentication Protocol) 712 Password Authentication Protocol (PAP) 712 payload option 576 size 577 Peanut Hull 337 Peer-to-peer (P2P) 570 calls 359 ZyWALL ATP Series Users Guide 894 Index managing 515 Perfect Forward Secrecy (PFS) 408 Diffie-Hellman key group 429 performance troubleshooting 855, 856, 857 Personal Identification Number code, see PIN code PFS (Perfect Forward Secrecy) 408, 429 Phishing 559 physical ports packet statistics 121, 122, 146 PIN code 256 PIN generator 676 pointer record 743 Point-to-Point Protocol over Ethernet, see PPPoE. Point-to-Point Tunneling Protocol, see PPTP policy enforcement in IPSec 406 policy route troubleshooting 852, 861 policy routes 311 actions 312 and address objects 317 and ALG 359, 363 and HTTP redirect 352, 353 and interfaces 317 and NAT 311 and schedules 317, 450, 454 and service objects 666 and SMTP redirect 353 and trunks 298, 317 and user groups 316, 450, 454 and users 316, 450, 454 and VoIP pass through 359 and VPN connections 317, 859 benefits 311 criteria 312 L2TP VPN 439 overriding direct routes 313 polymorphic virus 554 POP POP2 589 POP3 589 pop-up windows 29 port forwarding, see NAT port groups 214, 219 port roles 218 and Ethernet interfaces 218 and physical ports 218 port translation, see NAT Post Office Protocol, see POP 589 power off 849 PPP 308 troubleshooting 853 PPP interfaces subnet mask 306 PPPoE 308 and RADIUS 308 TCP port 1723 309 PPPoE/PPTP interfaces 214, 243 and ISP accounts 244, 710 basic characteristics 214 gateway 244 subnet mask 244 PPTP 308 and GRE 309 as VPN 309 prefix delegation 217 problems 851 product registration 879 proxy servers 352 web, see web proxy servers PTR record 743 Public-Key Infrastructure (PKI) 694 public-private key pairs 693 Q QoS 311, 445 Quick Start Guide 2 R rack-mounting 28, 70 RADIUS 676, 677 advantages 676 and IKE SA 427 and PPPoE 308 and users 618 user attributes 632 RADIUS server 781, 783 troubleshooting 861 ZyWALL ATP Series Users Guide 895 Real-time Transport Protocol, see RTP record route 573 Reference Guide, CLI 2 registration 186 product 879 reject (IDP) both 509 receiver 509 sender 509 Relative Distinguished Name (RDN) 678, 679, 681 remote access IPSec 406 Remote Authentication Dial-In User Service, see RADIUS remote management FTP, see FTP see also service control 749 Telnet 771 to-Device security policy 494 WWW, see WWW remote network 396 replay detection 405 reports anti-virus 168, 170, 178 collecting data 127 content filtering 165 daily 793 daily e-mail 793 IDP 172 specifications 129 traffic statistics 127 reset 864 RESET button 864 RFC 1058 (RIP) 322 1389 (RIP) 322 1587 (OSPF areas) 324 1631 (NAT) 321 1889 (RTP) 363 2131 (DHCP) 307 2132 (DHCP) 307 2328 (OSPF) 324 2402 (AH) 407, 428 2406 (ESP) 407, 428 2516 (PPPoE) 308 2637 (PPTP) 308 2890 (GRE) 309 3261 (SIP) 363 RIP 322 Index and Ethernet interfaces 222 and OSPF 322 and static routes 322 and to-ZyWALL security policyl 322 authentication 322 direction 222 redistribute 322 RIP-2 broadcasting methods 222 versions 222 vs OSPF 322 Rivest, Shamir and Adleman public-key algorithm

(RSA) 701 round robin 299 routing troubleshooting 857 Routing Information Protocol, see RIP routing protocols 321 and Ethernet interfaces 220 RSA 701, 703, 709 RSSI threshold 638 RTLS 209 RTP 363 see also ALG 363 S same IP 576 sandboxing 584 scan attacks 570 scanner types 555 Scanners 558 schedule troubleshooting 862 schedules 670 and content filtering 524, 525 and current date/time 670 and policy routes 317, 450, 454 and security policy 450, 454, 465, 501 one-time 670 recurring 670 types of 670 screen resolution 29 Secure Hash Algorithm, see SHA1 Secure Socket Layer, see SSL security associations, see IPSec ZyWALL ATP Series Users Guide 896 security policy 493 actions 501 and address groups 465 and address objects 465 and ALG 357, 359 and application patrol 515 and H.323 (ALG) 358 and HTTP redirect 352 and IPSec VPN 859 and logs 501 and NAT 496 and schedules 450, 454, 465, 501 and service groups 500 and service objects 666 and services 500 and SIP (ALG) 358 and user groups 501, 512 and users 501, 512 and VoIP pass through 359 and zones 493, 499, 519, 529, 603 asymmetrical routes 495, 498 global rules 494 priority 499, 519, 529, 603 rule criteria 494 see also to-Device security policy 493 session limits 495, 510 triangle routes 495, 498 troubleshooting 853 security settings troubleshooting 852 sensitivity level 506 serial number 111 service control 749 and to-ZyWALL security policy 749 and users 749 limitations 749 timeouts 749 service groups 666 and security policy 500 in IDP 571 service objects 665 and IP protocols 666 and policy routes 666 and security policy 666 Service Set 633 service subscription status 189 services 665 and security policy 500 Index Session Initiation Protocol, see SIP session limits 495, 510 session monitor (L2TP VPN) 164 sessions 129 sessions usage 114 SHA1 424 shell script troubleshooting 863 shell scripts 806 and users 632 downloading 819 editing 818 how applied 807 managing 818 syntax 807 uploading 820 Short Message Service 785 shutdown 849 signal quality 138, 139 signature categories access control 569 backdoor/Trojan 569 buffer overflow 570 DoS/DDoS 570 IM 570 P2P 570 scan 570 spam 570 virus/worm 571 Web attack 571 signature ID 569, 575 signatures anti-malware 553 IDP 566 updating 189 SIM card 256 Simple Mail Transfer Protocol, see SMTP 589 Simple Network Management Protocol, see SNMP Simple Traversal of UDP through NAT, see STUN SIP 358, 363 ALG 357 and RTP 363 and security policy 358 media inactivity timeout 361 signaling inactivity timeout 362 signaling port 362 troubleshooting 858 ZyWALL ATP Series Users Guide 897 SMS 785 send account information 785 ViaNett account 785 SMS gateway 785 SMTP 589 SMTP redirect and firewall 353 and policy routes 353 packet flow 353 SNAT 321 troubleshooting 857 SNMP 28, 775, 776 agents 776 and address groups 779 and address objects 779 and zones 779 authentication 780 Get 776 GetNext 776 Manager 776 managers 776 MIB 776, 777 network components 776 Set 776 Trap 776 traps 777 version 3 and security 776 versions 775 Snort equivalent terms 582 rule header 582 rule options 582 signatures 582 Source Network Address Translation, see SNAT spam 570, 588 Spam Sources 558 spillover (for load balancing) 300 SQL Injection 559 SQL slammer 582 SSH 766 and address groups 769 and address objects 769 and certificates 769 and zones 769 client requirements 768 encryption methods 768 for secure Telnet 770 how connection is established 767 Index versions 768 with Linux 770 with Microsoft Windows 770 SSL 432, 436, 750 access policy 432 and AAA 681 and AD 681 and LDAP 681 computer names 436 connection monitor 164 full tunnel mode 436 global setting 436 IP pool 436 network list 436 see also SSL VPN 432 troubleshooting 860 WINS 436 SSL policy add 434 edit 434 objects used 433 SSL VPN 432 access policy 432 full tunnel mode 432 network access mode 26 see also SSL 432 troubleshooting 860 stac compression 713 startup-config.conf 811 if errors 809 missing at restart 809 present at restart 809 startup-config-bad.conf 809 static DHCP 382 static routes 311 and interfaces 320 and OSPF 325 and RIP 322 metric 320 statistics anti-virus 168, 170, 178 content filtering 165 daily e-mail report 793 IDP 172 traffic 127 status 109 streaming protocols management 515 strict source routing 573 ZyWALL ATP Series Users Guide 898 stub area 324 STUN 359 and ALG 359 subscription services status 189 supported browsers 29 syslog 796, 802 syslog servers, see also logs system log, see logs system name 111, 733 system reports, see reports system uptime 112 system-default.conf 811 T TCP 666 ACK number 576 attack packet 509 connections 666 flag bits 576 port numbers 666 window size 576 Telnet 771 and address groups 772 and address objects 772 and zones 772 with SSH 770 throughput rate troubleshooting 863 time 734 time servers (default) 737 time to live 573 timestamp 573 to-Device security policy and remote management 494 global rules 494 see also security policy 493 token 676 Tor 558 to-ZyWALL security policy and NAT 348 and NAT traversal (VPN) 859 and OSPF 324 and RIP 322 Index and service control 749 and VPN 859 TR-069 protocol 724 trademarks 879 traffic statistics 127 Transmission Control Protocol, see TCP transport encapsulation 407 Transport Layer Security (TLS) 774 trapdoor attacks 569 triangle routes 495 allowing through the security policy 498 vs virtual interfaces 495 Triple Data Encryption Standard, see 3DES trojan attacks 569 troubleshooting 821, 851 admin user 861 anti-virus 852, 855 anti-virus signatures update 852 application patrol 852, 858, 861 bandwidth limit 854 bandwidth management 854 cellular 853, 854 certificate 862 configuration file 863 connection resets 858 content filter 852 DDNS 857 device access 851 ext-user 861 firmware package 860 firmware upload 863 FTP 858 H.323 858 HTTP redirect 858 IDP 852, 856 interface 853 Internet access 851, 860 IPSec VPN 859 LEDs 851 logo 862 logs 863 management access 862 packet capture 863 performance 855, 856, 857 policy route 852, 861 PPP 853 RADIUS server 861 routing 857 ZyWALL ATP Series Users Guide 899 schedules 862 security policy 853 security settings 852 shell scripts 863 SIP 858 SNAT 857 SSL 860 SSL VPN 860 throughput rate 863 VLAN 854 VPN 860 WLAN 854 zipped files 855 trunks 214, 298 and ALG 363 and policy routes 298, 317 member interface mode 303, 305 member interfaces 303, 305 see also load balancing 298 Trusted Certificates, see also certificates 705 tunnel encapsulation 407 Tunnel interfaces 214 U UDP 666 attack packet 509 messages 666 port numbers 666 Universal Plug and Play 364 Application 364 security issues 365 unsolicited commercial e-mail 588 updating anti-virus signatures 190 signatures 189 upgrading firmware 815 uploading configuration files 812 firmware 815 shell scripts 818 UPnP 364 UPnP-enabled Network Device auto-discover 372 URI (Uniform Resource Identifier) 577 Index usage CPU 114 flash 114 memory 114 onboard flash 114 sessions 114 user accounts for WLAN 619 user authentication 617 external 618 local user database 677 user awareness 619 User Datagram Protocol, see UDP user group objects 617, 713 user groups 617, 619, 713 and content filtering 524 and policy routes 316, 450, 454 and security policy 501, 512 user name rules 620 user objects 617, 713 user sessions, see sessions user-aware 466 users 617, 713 access, see also access users admin (type) 617 admin, see also admin users and AAA servers 618 and authentication method objects 618 and content filtering 524 and LDAP 618 and policy routes 316, 450, 454 and RADIUS 618 and security policy 501, 512 and service control 749 and shell scripts 632 attributes for Ext-User 618 attributes for LDAP 632 attributes for RADIUS 632 attributes in AAA servers 632 default lease time 627, 629 default reauthentication time 627, 629 default type for Ext-User 618 ext-group-user (type) 618 Ext-User (type) 618 ext-user (type) 617 groups, see user groups Guest (type) 617 ZyWALL ATP Series Users Guide 900 guest-manager (type) 618 lease time 623 limited-admin (type) 617 lockout 628 reauthentication time 623 types of 617 user (type) 617 user names 620 V Vantage Report (VRPT) 796, 802 virtual interfaces 214, 239 basic characteristics 214 not DHCP clients 306 types of 239 vs asymmetrical routes 495 vs triangle routes 495 Virtual Local Area Network, see VLAN. Virtual Local Area Network. See VLAN. Virtual Private Network, see VPN virtual router 719 virus 571 attack 543, 571 boot sector 554 e-mail 554 file infector 554 macro 554 mutation 554 polymorphic 554 VLAN 259, 266 advantages 266 and MAC address 266 ID 266 troubleshooting 854 VLAN interfaces 214, 267 and Ethernet interfaces 267, 854 basic characteristics 214 virtual 239 VoIP pass through 363 and NAT 359 and policy routes 359 and security policy 359 see also ALG 357 VPN 396 active protocol 428 Index and NAT 426 basic troubleshooting 859 hub-and-spoke, see VPN concentrator IKE SA, see IKE SA IPSec 396, 493 IPSec SA proposal 423 security associations (SA) 398 see also IKE SA see also IPSec 396, 493 see also IPSec SA troubleshooting 860 VPN concentrator 418 advantages 418 and IPSec SA policy enforcement 420 disadvantages 418 VPN connections and address objects 401 and policy routes 317, 859 VPN gateways and certificates 401 and extended authentication 401 and interfaces 401 and to-ZyWALL security policy 859 VRPT (Vantage Report) 796, 802 W wall-mounting 71 warranty 878, 882 note 879, 882 Web attack 571 Web Configurator 28 access 29 access users 629 requirements 29 supported browsers 29 web features ActiveX 538 cookies 538 Java 538 web proxy servers 538 web proxy servers 352, 538 weighted round robin (for load balancing) 300 weighted round robin algorithm 390 WEP (Wired Equivalent Privacy) 633 ZyWALL ATP Series Users Guide 901 Index bridge loops 653 hop 653 profile 654 Repeater 653 repeater 652 Root AP 653 root AP 652 security 655 SSID 655 WDS 652 ZyMesh profiles 654 white list (anti-spam) 588, 591, 594 Wi-Fi Protected Access 633 Windows Internet Naming Service, see WINS Windows Internet Naming Service, see WINS. WINS 235, 277, 290, 308, 436 in L2TP VPN 441 WINS server 235, 441 Wireshark 578 Wizard Setup 48, 75 WLAN troubleshooting 854 user accounts 619 WLAN interfaces 214 worm 543, 571 attacks 571 WPA 633 WPA2 633 WWW 750 and address groups 754 and address objects 754 and authentication method objects 753 and certificates 752 and zones 754 see also HTTP, HTTPS 750 Z zipped files troubleshooting 855 ZON Utility 787 zones 614 and FTP 774 and interfaces 614 and security policy 493, 499, 519, 529, 603 and SNMP 779 and SSH 769 and Telnet 772 and VPN 614 and WWW 754 extra-zone traffic 615 inter-zone traffic 615 intra-zone traffic 615 types of traffic 614 ZyMesh 652 auto provision 652 ZyWALL ATP Series Users Guide 902

 

 

Users Guide ZyWALL ATP Series Default Login Details LAN Port IP Address User Name Password https://192.168.1.1 admin 1234 Version 4.35 Edition 4, 11/2019 Copyright 2019 Zyxel Communications Corporation IMPORTANT!

READ CAREFULLY BEFORE USE. KEEP THIS GUIDE FOR FUTURE REFERENCE. This is a Users Guide for a series of products. Not all products support all firmware features. Screenshots and graphics in this book may differ slightly from your product due to differences in product features or web configurator brand style. Every effort has been made to ensure that the information in this manual is accurate. Note: The version number on the cover page refers to the Zyxel Devices latest firmware version to which this Users Guide applies. Related Documentation Quick Start Guide The Quick Start Guide shows how to connect the Zyxel Device and access the Web Configurator wizards. (See the wizard real time help for information on configuring each screen.) It also contains a connection diagram and package contents list. CLI Reference Guide The CLI Reference Guide explains how to use the Command-Line Interface (CLI) to configure the Zyxel Device. Note: It is recommended you use the Web Configurator to configure the Zyxel Device. Web Configurator Online Help Click the help icon in any screen for help in configuring that screen and supplementary information. More Information Go to support.zyxel.com to find other information on Zyxel Device. ZyWALL ATP Series Users Guide 2 Document Conventions Warnings and Notes These are how warnings and notes are shown in this guide. Warnings tell you about things that could harm you or your device. Note: Notes tell you other important information (for example, other things you may need to configure or helpful tips) or recommendations. Syntax Conventions All models in this series may be referred to as the Zyxel Device in this guide. Product labels, screen names, field labels and field choices are all in bold font. A right angle bracket ( > ) within a screen name denotes a mouse click. For example, Configuration >

Network > Interface > Ethernet means you first click Configuration in the navigation panel, then Network, then the Interface sub menu and finally the Ethernet tab to get to that screen. Icons Used in Figures Figures in this user guide may use the following generic icons. The Zyxel Device icon is not an exact representation of your device. Zyxel Device Generic Router Wireless Router / Access Point Switch Firewall Server Internet Network Cloud Smartphone USB Dongle ZyWALL ATP Series Users Guide 3 Contents Overview Contents Overview Introduction ........................................................................................................................................... 24 Initial Setup Wizard ............................................................................................................................... 48 Hardware, Interfaces and Zones ........................................................................................................ 67 Quick Setup Wizards ............................................................................................................................. 75 Dashboard .......................................................................................................................................... 109 Monitor ................................................................................................................................................. 119 Licensing .............................................................................................................................................. 186 Wireless ................................................................................................................................................. 192 Interfaces ............................................................................................................................................. 213 Routing ................................................................................................................................................. 310 DDNS ................................................................................................................................................... 337 NAT ....................................................................................................................................................... 343 Redirect Service .................................................................................................................................. 351 ALG ....................................................................................................................................................... 357 UPnP ..................................................................................................................................................... 364 IP/MAC Binding ................................................................................................................................... 379 Layer 2 Isolation .................................................................................................................................. 384 DNS Inbound LB .................................................................................................................................. 388 IPnP ....................................................................................................................................................... 394 IPSec VPN ............................................................................................................................................ 396 SSL VPN ................................................................................................................................................ 432 L2TP VPN .............................................................................................................................................. 438 BWM (Bandwidth Management) .................................................................................................. 444 Web Authentication .......................................................................................................................... 460 Security Policy ..................................................................................................................................... 489 Application Patrol ............................................................................................................................... 515 Content Filter ....................................................................................................................................... 524 Anti-Malware ....................................................................................................................................... 543 Reputation Filter .................................................................................................................................. 556 IDP ........................................................................................................................................................ 566 Sandboxing ......................................................................................................................................... 584 Email Security ...................................................................................................................................... 588 SSL Inspection ...................................................................................................................................... 599 IP Exception ......................................................................................................................................... 611 Object .................................................................................................................................................. 614 Device HA ........................................................................................................................................... 717 Cloud CNM ........................................................................................................................................ 724 System .................................................................................................................................................. 732 Log and Report ................................................................................................................................... 793 ZyWALL ATP Series Users Guide 4 Contents Overview File Manager ....................................................................................................................................... 806 Diagnostics ......................................................................................................................................... 821 Packet Flow Explore ........................................................................................................................... 842 Shutdown ............................................................................................................................................. 849 Troubleshooting .................................................................................................................................. 851 ZyWALL ATP Series Users Guide 5 Table of Contents Table of Contents Document Conventions ......................................................................................................................3 Contents Overview .............................................................................................................................4 Table of Contents.................................................................................................................................6 Part I: Users Guide.......................................................................................... 23 Chapter 1 Introduction ........................................................................................................................................24 1.1 Overview ......................................................................................................................................... 24 1.2 Registration at myZyxel .................................................................................................................. 24 1.2.1 Grace Period ......................................................................................................................... 25 1.2.2 Applications ........................................................................................................................... 25 1.3 Management Overview ................................................................................................................ 28 1.4 Web Configurator ........................................................................................................................... 29 1.4.1 Web Configurator Access .................................................................................................... 29 1.4.2 Web Configurator Screens Overview ................................................................................. 32 1.4.3 Navigation Panel .................................................................................................................. 37 1.4.4 Tables and Lists ...................................................................................................................... 44 Chapter 2 Initial Setup Wizard.............................................................................................................................48 2.1 Initial Setup Wizard Screens .......................................................................................................... 48 2.1.1 Internet Access Setup - WAN Interface ............................................................................. 48 2.1.2 Internet Access: Ethernet .................................................................................................... 49 2.1.3 Internet Access: PPPoE ......................................................................................................... 50 2.1.4 Internet Access: PPTP ........................................................................................................... 52 2.1.5 Internet Access: L2TP ............................................................................................................ 54 2.1.6 Internet Access Setup - Second WAN Interface ............................................................... 56 2.1.7 Internet Access: Congratulations ....................................................................................... 57 2.1.8 Date and Time Settings ........................................................................................................ 58 2.1.9 Register Device ..................................................................................................................... 58 2.1.10 Activate Service .................................................................................................................. 60 2.1.11 Service Settings .................................................................................................................... 61 2.1.12 Service Settings: SecuReporter .......................................................................................... 62 2.1.13 Wireless Settings: AP Controller ......................................................................................... 64 2.1.14 Wireless Settings: SSID & Security ...................................................................................... 64 ZyWALL ATP Series Users Guide 6 Table of Contents 2.1.15 Remote Management ...................................................................................................... 65 Chapter 3 Hardware, Interfaces and Zones......................................................................................................67 3.1 Hardware Overview ....................................................................................................................... 67 3.1.1 Front Panels ............................................................................................................................ 67 3.1.2 Rear Panels ............................................................................................................................ 69 3.2 Mounting ......................................................................................................................................... 70 3.2.1 Rack-mounting ...................................................................................................................... 70 3.2.2 Wall-mounting ....................................................................................................................... 71 3.3 Default Zones, Interfaces, and Ports ............................................................................................ 73 3.4 Stopping the Zyxel Device ............................................................................................................ 74 Chapter 4 Quick Setup Wizards..........................................................................................................................75 4.1 Quick Setup Overview ................................................................................................................... 75 4.2 WAN Interface Quick Setup .......................................................................................................... 76 4.2.1 Choose an Ethernet Interface ............................................................................................. 76 4.2.2 Select WAN Type ................................................................................................................... 77 4.2.3 Configure WAN IP Settings ................................................................................................... 77 4.2.4 ISP and WAN and ISP Connection Settings ........................................................................ 78 4.2.5 Quick Setup Interface Wizard: Summary ........................................................................... 81 4.3 VPN Setup Wizard ........................................................................................................................... 82 4.3.1 Welcome ................................................................................................................................ 82 4.3.2 VPN Setup Wizard: Wizard Type .......................................................................................... 83 4.3.3 VPN Express Wizard - Scenario ............................................................................................ 84 4.3.4 VPN Express Wizard - Configuration ................................................................................... 85 4.3.5 VPN Express Wizard - Summary ........................................................................................... 85 4.3.6 VPN Express Wizard - Finish .................................................................................................. 86 4.3.7 VPN Advanced Wizard - Scenario ..................................................................................... 87 4.3.8 VPN Advanced Wizard - Phase 1 Settings ........................................................................ 88 4.3.9 VPN Advanced Wizard - Phase 2 ....................................................................................... 90 4.3.10 VPN Advanced Wizard - Summary .................................................................................. 91 4.3.11 VPN Advanced Wizard - Finish ......................................................................................... 93 4.4 VPN Settings for Configuration Provisioning Wizard: Wizard Type ............................................. 94 4.4.1 Configuration Provisioning Express Wizard - VPN Settings ............................................... 94 4.4.2 Configuration Provisioning VPN Express Wizard - Configuration .................................... 95 4.4.3 VPN Settings for Configuration Provisioning Express Wizard - Summary ........................ 96 4.4.4 VPN Settings for Configuration Provisioning Express Wizard - Finish ................................ 97 4.4.5 VPN Settings for Configuration Provisioning Advanced Wizard - Scenario ................... 98 4.4.6 VPN Settings for Configuration Provisioning Advanced Wizard - Phase 1 Settings ...... 99 4.4.7 VPN Settings for Configuration Provisioning Advanced Wizard - Phase 2 .................. 101 4.4.8 VPN Settings for Configuration Provisioning Advanced Wizard - Summary ................ 101 ZyWALL ATP Series Users Guide 7 Table of Contents 4.4.9 VPN Settings for Configuration Provisioning Advanced Wizard- Finish ........................ 104 4.5 VPN Settings for L2TP VPN Settings Wizard ................................................................................. 104 4.5.1 L2TP VPN Settings ................................................................................................................ 105 4.5.2 L2TP VPN Settings ................................................................................................................ 106 4.5.3 VPN Settings for L2TP VPN Setting Wizard - Summary .................................................... 106 4.5.4 VPN Settings for L2TP VPN Setting Wizard Completed ................................................... 108 Chapter 5 Dashboard........................................................................................................................................109 5.1 Overview ....................................................................................................................................... 109 5.1.1 What You Can Do in this Chapter ..................................................................................... 109 5.2 The General Screen ..................................................................................................................... 109 5.2.1 Device Information Screen ................................................................................................ 111 5.2.2 System Status Screen .......................................................................................................... 112 5.2.3 Tx/Rx Statistics ...................................................................................................................... 112 5.2.4 The Latest Logs Screen ....................................................................................................... 113 5.2.5 System Resources Screen ................................................................................................... 113 5.2.6 DHCP Table Screen ............................................................................................................. 114 5.2.7 Number of Login Users Screen ........................................................................................... 115 5.2.8 Current Login User ............................................................................................................... 116 5.2.9 VPN Status ............................................................................................................................ 116 5.2.10 SSL VPN Status .................................................................................................................... 116 5.3 The Advanced Threat Protection Screen .................................................................................. 117 Part II: Technical Reference......................................................................... 118 Chapter 6 Monitor..............................................................................................................................................119 6.1 Overview ....................................................................................................................................... 119 6.1.1 What You Can Do in this Chapter ..................................................................................... 119 6.2 The Port Statistics Screen ............................................................................................................ 121 6.2.1 The Port Statistics Graph Screen ....................................................................................... 122 6.3 Interface Status Screen ................................................................................................................ 123 6.4 The Traffic Statistics Screen .......................................................................................................... 127 6.5 The Session Monitor Screen ........................................................................................................ 129 6.6 The Login Users Screen ................................................................................................................ 131 6.7 IGMP Statistics ............................................................................................................................... 133 6.8 The DDNS Status Screen ............................................................................................................... 134 6.9 IP/MAC Binding ............................................................................................................................. 134 6.10 Cellular Status Screen ................................................................................................................ 135 6.10.1 More Information .............................................................................................................. 138 ZyWALL ATP Series Users Guide 8 Table of Contents 6.11 The UPnP Port Status Screen ..................................................................................................... 139 6.12 USB Storage Screen .................................................................................................................... 140 6.13 Ethernet Neighbor Screen ........................................................................................................ 141 6.14 FQDN Object Screen ................................................................................................................ 142 6.15 AP Information: AP List ............................................................................................................... 144 6.15.1 AP List: More Information ................................................................................................ 146 6.15.2 AP List: Config AP ............................................................................................................. 149 6.16 AP Information: Radio List .......................................................................................................... 151 6.16.1 Radio List: More Information ............................................................................................ 153 6.17 AP Information: Top N APs ........................................................................................................ 154 6.18 AP Information: Single AP .......................................................................................................... 156 6.19 ZyMesh ......................................................................................................................................... 157 6.20 SSID Info ....................................................................................................................................... 158 6.21 Station Info: Station List .............................................................................................................. 158 6.22 Station Info: Top N Stations ........................................................................................................ 159 6.23 Station Info: Single Station ......................................................................................................... 160 6.24 Detected Device ....................................................................................................................... 161 6.25 The IPSec Screen ........................................................................................................................ 162 6.26 The SSL Screen ............................................................................................................................. 164 6.27 The L2TP over IPSec Screen ....................................................................................................... 164 6.28 The Content Filter Screen .......................................................................................................... 165 6.29 The App Patrol Screen ............................................................................................................... 167 6.30 The Anti-Malware Screen .......................................................................................................... 168 6.31 The Reputation Filter Screen ...................................................................................................... 170 6.32 The IDP Screen ............................................................................................................................ 172 6.33 The Email Security Screens ......................................................................................................... 174 6.33.1 Email Security Summary ................................................................................................... 174 6.33.2 The Email Security Status Screen ..................................................................................... 176 6.34 The Sandboxing Screen ............................................................................................................. 178 6.35 The SSL Inspection Screens ........................................................................................................ 179 6.35.1 Certificate Cache List ....................................................................................................... 180 6.36 Log Screens ................................................................................................................................. 181 6.36.1 View Log ............................................................................................................................ 181 6.36.2 View AP Log ....................................................................................................................... 183 Chapter 7 Licensing...........................................................................................................................................186 7.1 Registration Overview .................................................................................................................. 186 7.1.1 What you Need to Know .................................................................................................... 186 7.1.2 Registration Screen ............................................................................................................. 187 7.1.3 Service Screen ..................................................................................................................... 187 7.2 Signature Update ......................................................................................................................... 189 7.2.1 What you Need to Know .................................................................................................... 189 ZyWALL ATP Series Users Guide 9 Table of Contents 7.2.2 The Signature Screen .......................................................................................................... 190 7.2.3 Auto Update ........................................................................................................................ 190 Chapter 8 Wireless .............................................................................................................................................192 8.1 Overview ....................................................................................................................................... 192 8.1.1 What You Can Do in this Chapter ..................................................................................... 192 8.2 Controller Screen ......................................................................................................................... 192 8.3 AP Management Screens ........................................................................................................... 193 8.3.1 Mgnt. AP List ....................................................................................................................... 193 8.3.2 AP Policy .............................................................................................................................. 197 8.3.3 AP Group ............................................................................................................................. 198 8.3.4 Firmware ............................................................................................................................... 204 8.4 Rogue AP ....................................................................................................................................... 205 8.4.1 Add/Edit Rogue/Friendly List .............................................................................................. 207 8.5 Auto Healing ................................................................................................................................. 208 8.6 RTLS Overview ............................................................................................................................... 209 8.6.1 What You Can Do in this Chapter ..................................................................................... 209 8.6.2 Before You Begin ................................................................................................................. 209 8.6.3 Configuring RTLS .................................................................................................................. 210 8.7 Technical Reference .................................................................................................................... 211 8.7.1 Dynamic Channel Selection .............................................................................................. 211 8.7.2 Load Balancing ................................................................................................................... 212 Chapter 9 Interfaces..........................................................................................................................................213 9.1 Interface Overview ...................................................................................................................... 213 9.1.1 What You Can Do in this Chapter ..................................................................................... 213 9.1.2 What You Need to Know ................................................................................................... 213 9.1.3 What You Need to Do First ................................................................................................. 218 9.2 Port Role ......................................................................................................................................... 218 9.3 Port Configuration ........................................................................................................................ 219 9.4 Ethernet Summary Screen ........................................................................................................... 220 9.4.1 Ethernet Edit ........................................................................................................................ 222 9.4.2 Proxy ARP ............................................................................................................................. 238 9.4.3 Virtual Interfaces ................................................................................................................ 239 9.4.4 References ........................................................................................................................... 240 9.4.5 Add/Edit DHCPv6 Request/Release Options ................................................................... 241 9.4.6 Add/Edit DHCP Extended Options ................................................................................... 242 9.5 PPP Interfaces ............................................................................................................................... 243 9.5.1 PPP Interface Summary ...................................................................................................... 244 9.5.2 PPP Interface Add or Edit .................................................................................................. 245 9.6 Cellular Configuration Screen ..................................................................................................... 250 ZyWALL ATP Series Users Guide 10 Table of Contents 9.6.1 Cellular Choose Slot ........................................................................................................... 253 9.6.2 Add / Edit Cellular Configuration ...................................................................................... 253 9.7 Tunnel Interfaces .......................................................................................................................... 259 9.7.1 Configuring a Tunnel .......................................................................................................... 261 9.7.2 Tunnel Add or Edit Screen .................................................................................................. 262 9.8 VLAN Interfaces ........................................................................................................................... 266 9.8.1 VLAN Summary Screen ....................................................................................................... 267 9.8.2 VLAN Add/Edit ................................................................................................................... 268 9.9 Bridge Interfaces .......................................................................................................................... 279 9.9.1 Bridge Summary .................................................................................................................. 281 9.9.2 Bridge Add/Edit .................................................................................................................. 282 9.10 VTI ................................................................................................................................................. 293 9.10.1 Restrictions for IPSec Virtual Tunnel Interface ................................................................ 293 9.10.2 VTI Screen .......................................................................................................................... 294 9.10.3 VTI Add/Edit ....................................................................................................................... 294 9.11 Trunk Overview ........................................................................................................................... 298 9.11.1 What You Need to Know ................................................................................................. 298 9.12 The Trunk Summary Screen ........................................................................................................ 301 9.12.1 Configuring a User-Defined Trunk ................................................................................... 302 9.12.2 Configuring the System Default Trunk ............................................................................ 304 9.13 Interface Technical Reference ................................................................................................. 305 Chapter 10 Routing ..............................................................................................................................................310 10.1 Policy and Static Routes Overview ........................................................................................... 310 10.1.1 What You Can Do in this Chapter ................................................................................... 310 10.1.2 What You Need to Know ................................................................................................ 311 10.2 Policy Route Screen ................................................................................................................... 312 10.2.1 Policy Route Edit Screen .................................................................................................. 314 10.3 IP Static Route Screen ................................................................................................................ 319 10.3.1 Static Route Add/Edit Screen .......................................................................................... 319 10.4 Policy Routing Technical Reference ........................................................................................ 321 10.5 Routing Protocols Overview ..................................................................................................... 321 10.5.1 What You Need to Know ................................................................................................. 322 10.6 The RIP Screen ............................................................................................................................. 322 10.7 The OSPF Screen ......................................................................................................................... 324 10.7.1 Configuring the OSPF Screen .......................................................................................... 327 10.7.2 OSPF Area Add/Edit Screen ........................................................................................... 328 10.7.3 Virtual Link Add/Edit Screen ........................................................................................... 330 10.8 BGP (Border Gateway Protocol) .............................................................................................. 331 10.8.1 Allow BGP Packets to Enter the Zyxel Device ................................................................ 332 10.8.2 Configuring the BGP Screen ............................................................................................ 332 10.8.3 The BGP Neighbors Screen .............................................................................................. 334 ZyWALL ATP Series Users Guide 11 Table of Contents 10.8.4 Example Scenario ............................................................................................................. 335 Chapter 11 DDNS ................................................................................................................................................337 11.1 DDNS Overview ........................................................................................................................... 337 11.1.1 What You Can Do in this Chapter ................................................................................... 337 11.1.2 What You Need to Know ................................................................................................. 337 11.2 The DDNS Screen ........................................................................................................................ 338 11.2.1 The Dynamic DNS Add/Edit Screen ................................................................................ 339 Chapter 12 NAT ....................................................................................................................................................343 12.1 NAT Overview ............................................................................................................................. 343 12.1.1 What You Can Do in this Chapter ................................................................................... 343 12.1.2 What You Need to Know ................................................................................................. 343 12.2 The NAT Screen ........................................................................................................................... 344 12.2.1 The NAT Add/Edit Screen ................................................................................................. 346 12.3 NAT Technical Reference .......................................................................................................... 349 Chapter 13 Redirect Service...............................................................................................................................351 13.1 Overview ..................................................................................................................................... 351 13.1.1 HTTP Redirect ..................................................................................................................... 351 13.1.2 SMTP Redirect .................................................................................................................... 351 13.1.3 What You Can Do in this Chapter ................................................................................... 352 13.1.4 What You Need to Know ................................................................................................. 352 13.2 The Redirect Service Screen ..................................................................................................... 354 13.2.1 The Redirect Service Edit Screen ..................................................................................... 355 Chapter 14 ALG....................................................................................................................................................357 14.1 ALG Overview ............................................................................................................................. 357 14.1.1 What You Need to Know ................................................................................................. 357 14.1.2 Before You Begin ............................................................................................................... 360 14.2 The ALG Screen .......................................................................................................................... 360 14.3 ALG Technical Reference ......................................................................................................... 362 Chapter 15 UPnP...................................................................................................................................................364 15.1 UPnP and NAT-PMP Overview ................................................................................................... 364 15.2 What You Need to Know ........................................................................................................... 364 15.2.1 NAT Traversal ..................................................................................................................... 364 15.2.2 Cautions with UPnP and NAT-PMP .................................................................................. 365 ZyWALL ATP Series Users Guide 12 Table of Contents 15.3 UPnP Screen ................................................................................................................................ 365 15.4 Technical Reference .................................................................................................................. 366 15.4.1 Turning on UPnP in Windows 7 Example ......................................................................... 366 15.4.2 Turn on UPnP in Windows 10 Example ............................................................................ 370 15.4.3 Auto-discover Your UPnP-enabled Network Device .................................................... 372 15.4.4 Web Configurator Easy Access in Windows 7 ............................................................... 375 15.4.5 Web Configurator Easy Access in Windows 10 ............................................................. 377 Chapter 16 IP/MAC Binding................................................................................................................................379 16.1 IP/MAC Binding Overview ......................................................................................................... 379 16.1.1 What You Can Do in this Chapter ................................................................................... 379 16.1.2 What You Need to Know ................................................................................................. 379 16.2 IP/MAC Binding Summary ......................................................................................................... 380 16.2.1 IP/MAC Binding Edit .......................................................................................................... 381 16.2.2 Static DHCP Edit ................................................................................................................ 382 16.3 IP/MAC Binding Exempt List ....................................................................................................... 383 Chapter 17 Layer 2 Isolation ...............................................................................................................................384 17.1 Overview ..................................................................................................................................... 384 17.1.1 What You Can Do in this Chapter ................................................................................... 384 17.2 Layer-2 Isolation General Screen ............................................................................................. 384 17.3 White List Screen ......................................................................................................................... 385 17.3.1 Add/Edit White List Rule ................................................................................................... 386 Chapter 18 DNS Inbound LB................................................................................................................................388 18.1 DNS Inbound Load Balancing Overview ................................................................................. 388 18.1.1 What You Can Do in this Chapter ................................................................................... 388 18.2 The DNS Inbound LB Screen ...................................................................................................... 389 18.2.1 The DNS Inbound LB Add/Edit Screen ............................................................................ 390 18.2.2 The DNS Inbound LB Add/Edit Member Screen ............................................................ 392 Chapter 19 IPnP....................................................................................................................................................394 19.1 IPnP Overview ............................................................................................................................ 394 19.1.1 What You Can Do in this Chapter ................................................................................... 394 19.2 IPnP Screen .................................................................................................................................. 395 Chapter 20 IPSec VPN .........................................................................................................................................396 20.1 Virtual Private Networks (VPN) Overview ................................................................................. 396 ZyWALL ATP Series Users Guide 13 Table of Contents 20.1.1 What You Can Do in this Chapter ................................................................................... 398 20.1.2 What You Need to Know ................................................................................................. 398 20.1.3 Before You Begin ............................................................................................................... 401 20.2 The VPN Connection Screen ..................................................................................................... 401 20.2.1 The VPN Connection Add/Edit Screen .......................................................................... 403 20.3 The VPN Gateway Screen ......................................................................................................... 410 20.3.1 The VPN Gateway Add/Edit Screen ............................................................................... 411 20.4 VPN Concentrator ..................................................................................................................... 418 20.4.1 VPN Concentrator Requirements and Suggestions ...................................................... 418 20.4.2 VPN Concentrator Screen ............................................................................................... 419 20.4.3 The VPN Concentrator Add/Edit Screen ........................................................................ 419 20.5 Zyxel Device IPSec VPN Client Configuration Provisioning .................................................... 420 20.6 IPSec VPN Background Information ......................................................................................... 422 Chapter 21 SSL VPN..............................................................................................................................................432 21.1 Overview ..................................................................................................................................... 432 21.1.1 What You Can Do in this Chapter ................................................................................... 432 21.1.2 What You Need to Know ................................................................................................. 432 21.2 The SSL Access Privilege Screen ................................................................................................ 433 21.2.1 The SSL Access Privilege Policy Add/Edit Screen ......................................................... 434 21.3 The SSL Global Setting Screen ................................................................................................... 436 Chapter 22 L2TP VPN............................................................................................................................................438 22.1 Overview ..................................................................................................................................... 438 22.1.1 What You Can Do in this Chapter ................................................................................... 438 22.1.2 What You Need to Know ................................................................................................. 438 22.2 L2TP VPN Screen ......................................................................................................................... 439 22.2.1 Example: L2TP and Zyxel Device Behind a NAT Router ................................................ 441 Chapter 23 BWM (Bandwidth Management) .................................................................................................444 23.1 Overview ..................................................................................................................................... 444 23.1.1 What You Can Do in this Chapter ................................................................................... 444 23.1.2 What You Need to Know ................................................................................................ 444 23.2 The Bandwidth Management Configuration .......................................................................... 448 23.2.1 The Bandwidth Management Add/Edit Screen ............................................................ 451 Chapter 24 Web Authentication ........................................................................................................................460 24.1 Web Auth Overview ................................................................................................................... 460 24.1.1 What You Can Do in this Chapter ................................................................................... 460 ZyWALL ATP Series Users Guide 14 Table of Contents 24.1.2 What You Need to Know ................................................................................................. 461 24.2 Web Authentication General Screen ...................................................................................... 461 24.2.1 User-aware Access Control Example ............................................................................. 466 24.2.2 Authentication Type Screen ............................................................................................ 472 24.2.3 Custom Web Portal / User Agreement File Screen ....................................................... 476 24.3 SSO Overview .............................................................................................................................. 477 24.4 SSO - Zyxel Device Configuration ............................................................................................. 479 24.4.1 Configuration Overview ................................................................................................... 479 24.4.2 Configure the Zyxel Device to Communicate with SSO .............................................. 479 24.4.3 Enable Web Authentication ............................................................................................ 480 24.4.4 Create a Security Policy ................................................................................................... 482 24.4.5 Configure User Information .............................................................................................. 483 24.4.6 Configure an Authentication Method ........................................................................... 484 24.4.7 Configure Active Directory .............................................................................................. 485 24.5 SSO Agent Configuration .......................................................................................................... 486 Chapter 25 Security Policy..................................................................................................................................489 25.1 Overview ..................................................................................................................................... 489 25.2 One Security ................................................................................................................................ 490 25.3 What You Can Do in this Chapter ............................................................................................ 493 25.3.1 What You Need to Know ................................................................................................. 493 25.4 The Security Policy Screen ......................................................................................................... 495 25.4.1 Configuring the Security Policy Control Screen ............................................................ 496 25.4.2 The Security Policy Control Add/Edit Screen ................................................................. 500 25.5 Anomaly Detection and Prevention Overview ...................................................................... 501 25.5.1 The Anomaly Detection and Prevention General Screen ........................................... 502 25.5.2 Creating New ADP Profiles .............................................................................................. 503 25.5.3 Traffic Anomaly Profiles ................................................................................................... 504 25.5.4 Protocol Anomaly Profiles ................................................................................................ 507 25.6 The Session Control Screen ........................................................................................................ 510 25.6.1 The Session Control Add/Edit Screen .............................................................................. 511 25.7 Security Policy Example Applications ...................................................................................... 512 Chapter 26 Application Patrol ............................................................................................................................515 26.1 Overview ..................................................................................................................................... 515 26.1.1 What You Can Do in this Chapter ................................................................................... 515 26.1.2 What You Need to Know ................................................................................................ 515 26.2 Application Patrol Profile ........................................................................................................... 516 26.2.1 Apply to a Security Policy ................................................................................................ 517 26.2.2 The Application Patrol Profile Add/Edit Screen - My Application ............................... 520 26.2.3 The Application Patrol Profile Add/Edit Screen - Query Result .................................... 521 ZyWALL ATP Series Users Guide 15 Table of Contents Chapter 27 Content Filter ....................................................................................................................................524 27.1 Overview ..................................................................................................................................... 524 27.1.1 What You Can Do in this Chapter ................................................................................... 524 27.1.2 What You Need to Know ................................................................................................. 524 27.1.3 Before You Begin ............................................................................................................... 526 27.2 Content Filter Profile Screen ...................................................................................................... 526 27.2.1 Apply to a Security Policy ................................................................................................ 527 27.2.2 Content Filter Add Profile Category Service .................................................................. 530 27.2.3 Content Filter Add Filter Profile Custom Service ........................................................... 536 27.3 Content Filter Trusted Web Sites Screen ................................................................................. 539 27.4 Content Filter Forbidden Web Sites Screen ............................................................................ 540 27.5 Content Filter Technical Reference ......................................................................................... 541 Chapter 28 Anti-Malware....................................................................................................................................543 28.1 Overview ..................................................................................................................................... 543 28.1.1 What You Can Do in this Chapter ................................................................................... 547 28.2 Anti-Malware Screen ................................................................................................................. 548 28.3 The Black List Screen .................................................................................................................. 551 28.4 The White List Screen .................................................................................................................. 552 28.5 Anti-Malware Signature Searching ........................................................................................... 553 28.6 Anti-Malware Technical Reference ......................................................................................... 554 Chapter 29 Reputation Filter ...............................................................................................................................556 29.1 Overview ..................................................................................................................................... 556 29.1.1 What You Need to Know ................................................................................................. 556 29.1.2 What You Can Do in this Chapter ................................................................................... 556 29.2 IP Reputation Screen .................................................................................................................. 556 29.2.1 IP Reputation White List Screen ....................................................................................... 559 29.2.2 IP Reputation Black List Screen ........................................................................................ 560 29.3 Botnet Filter Screen ..................................................................................................................... 561 29.3.1 Botnet Filter White List Screen .......................................................................................... 564 29.3.2 Botnet Filter Black List Screen ........................................................................................... 565 Chapter 30 IDP .....................................................................................................................................................566 30.1 Overview ..................................................................................................................................... 566 30.1.1 What You Can Do in this Chapter ................................................................................... 566 30.1.2 What You Need To Know ................................................................................................. 566 30.1.3 Before You Begin ............................................................................................................... 566 30.2 The IDP Screen ............................................................................................................................ 566 ZyWALL ATP Series Users Guide 16 Table of Contents 30.2.1 Query Example .................................................................................................................. 571 30.3 IDP Custom Signatures .............................................................................................................. 572 30.3.1 Add / Edit Custom Signatures ......................................................................................... 573 30.3.2 Custom Signature Example ............................................................................................. 577 30.3.3 Applying Custom Signatures ............................................................................................ 579 30.3.4 Verifying Custom Signatures ............................................................................................ 580 30.4 The White List Screen ................................................................................................................. 580 30.5 IDP Technical Reference ........................................................................................................... 581 Chapter 31 Sandboxing ......................................................................................................................................584 31.1 Overview ..................................................................................................................................... 584 31.1.1 What You Need to Know ................................................................................................. 585 31.2 Sandboxing Screen .................................................................................................................... 585 Chapter 32 Email Security...................................................................................................................................588 32.1 Overview ..................................................................................................................................... 588 32.1.1 What You Can Do in this Chapter ................................................................................... 588 32.1.2 What You Need to Know ................................................................................................. 588 32.2 Before You Begin ........................................................................................................................ 589 32.3 The Email Security Screen .......................................................................................................... 590 32.4 The Black List / White List Screen ............................................................................................... 593 32.4.1 The Black or White List Add/Edit Screen ......................................................................... 594 32.4.2 Regular Expressions in Black or White List Entries ........................................................... 595 32.5 Email Security Technical Reference ......................................................................................... 595 Chapter 33 SSL Inspection...................................................................................................................................599 33.1 Overview ..................................................................................................................................... 599 33.1.1 What You Can Do in this Chapter ................................................................................... 599 33.1.2 What You Need To Know ................................................................................................. 599 33.1.3 Before You Begin ............................................................................................................... 600 33.2 The SSL Inspection Profile Screen .............................................................................................. 600 33.2.1 Apply to a Security Policy ................................................................................................ 601 33.2.2 Add / Edit SSL Inspection Profiles .................................................................................... 604 33.3 Exclude List Screen .................................................................................................................... 605 33.4 Certificate Update Screen ....................................................................................................... 607 33.5 Install a CA Certificate in a Browser ......................................................................................... 608 Chapter 34 IP Exception......................................................................................................................................611 34.1 Overview ..................................................................................................................................... 611 ZyWALL ATP Series Users Guide 17 Table of Contents 34.2 The IP Exception Screen ............................................................................................................ 611 34.2.1 The IP Exception Add/Edit Screen ................................................................................. 612 Chapter 35 Object ...............................................................................................................................................614 35.1 Zones Overview .......................................................................................................................... 614 35.1.1 What You Need to Know ................................................................................................. 614 35.1.2 The Zone Screen ................................................................................................................ 615 35.2 User/Group Overview ................................................................................................................ 617 35.2.1 What You Need To Know ................................................................................................. 617 35.2.2 User/Group User Summary Screen .................................................................................. 619 35.2.3 User/Group Group Summary Screen .............................................................................. 624 35.2.4 User/Group Setting Screen ............................................................................................. 625 35.2.5 User/Group MAC Address Summary Screen ................................................................ 630 35.2.6 User /Group Technical Reference .................................................................................. 632 35.3 AP Profile Overview .................................................................................................................... 632 35.3.1 Radio Screen ..................................................................................................................... 633 35.3.2 SSID Screen ....................................................................................................................... 639 35.4 MON Profile ................................................................................................................................ 648 35.4.1 Overview ............................................................................................................................ 648 35.4.2 Configuring MON Profile ................................................................................................. 649 35.4.3 Add/Edit MON Profile ....................................................................................................... 650 35.4.4 Technical Reference ........................................................................................................ 651 35.5 ZyMesh Overview ....................................................................................................................... 652 35.5.1 ZyMesh Profile .................................................................................................................... 654 35.5.2 Add/Edit ZyMesh Profile ................................................................................................... 655 35.6 Address/Geo IP Overview ......................................................................................................... 655 35.6.1 What You Need To Know ................................................................................................. 656 35.6.2 Address Summary Screen ................................................................................................ 656 35.6.3 Address Group Summary Screen .................................................................................... 660 35.6.4 Geo IP Summary Screen .................................................................................................. 662 35.7 Service Overview ........................................................................................................................ 665 35.7.1 What You Need to Know ................................................................................................. 665 35.7.2 The Service Summary Screen .......................................................................................... 666 35.7.3 The Service Group Summary Screen ............................................................................. 668 35.8 Schedule Overview ................................................................................................................... 670 35.8.1 What You Need to Know ................................................................................................. 670 35.8.2 The Schedule Screen ........................................................................................................ 670 35.8.3 The Schedule Group Screen ............................................................................................ 673 35.9 AAA Server Overview ............................................................................................................... 675 35.9.1 Directory Service (AD/LDAP) ........................................................................................... 676 35.9.2 RADIUS Server .................................................................................................................... 676 35.9.3 ASAS .................................................................................................................................... 676 ZyWALL ATP Series Users Guide 18 Table of Contents 35.9.4 What You Need To Know ................................................................................................. 677 35.9.5 Active Directory or LDAP Server Summary ..................................................................... 678 35.9.6 RADIUS Server Summary ................................................................................................... 682 35.10 Auth. Method Overview ........................................................................................................ 685 35.10.1 Before You Begin ............................................................................................................. 685 35.10.2 Example: Selecting a VPN Authentication Method ................................................... 685 35.10.3 Authentication Method Objects ................................................................................... 686 35.10.4 Two-Factor Authentication VPN Access ...................................................................... 688 35.10.5 Two-Factor Authentication Admin Access .................................................................. 691 35.11 Certificate Overview ............................................................................................................... 693 35.11.1 What You Need to Know ............................................................................................... 693 35.11.2 Verifying a Certificate .................................................................................................... 695 35.11.3 The My Certificates Screen ............................................................................................ 696 35.11.4 The Trusted Certificates Screen .................................................................................... 705 35.11.5 Certificates Technical Reference ................................................................................. 710 35.12 ISP Account Overview ............................................................................................................ 710 35.12.1 ISP Account Summary .................................................................................................... 710 35.13 DHCPv6 Overview .................................................................................................................... 713 35.13.1 The DHCPv6 Request Screen ......................................................................................... 713 35.13.2 The DHCPv6 Lease Screen ............................................................................................. 715 Chapter 36 Device HA.........................................................................................................................................717 36.1 Device HA Overview .................................................................................................................. 717 36.1.1 What You Can Do in These Screens ................................................................................ 717 36.2 Device HA Status ........................................................................................................................ 717 36.3 Device HA Pro ............................................................................................................................. 719 36.3.1 Deploying Device HA Pro ................................................................................................ 720 36.3.2 Configuring Device HA Pro .............................................................................................. 720 36.4 View Log ...................................................................................................................................... 722 Chapter 37 Cloud CNM......................................................................................................................................724 37.1 Cloud CNM Overview ................................................................................................................ 724 37.1.1 What You Can Do in this Chapter ................................................................................... 724 37.2 Cloud CNM SecuManager ....................................................................................................... 724 37.3 Cloud CNM SecuReporter ......................................................................................................... 727 Chapter 38 System...............................................................................................................................................732 38.1 Overview ..................................................................................................................................... 732 38.1.1 What You Can Do in this Chapter ................................................................................... 732 38.2 Host Name ................................................................................................................................... 733 ZyWALL ATP Series Users Guide 19 Table of Contents 38.3 USB Storage ................................................................................................................................. 733 38.4 Date and Time ............................................................................................................................ 734 38.4.1 Pre-defined NTP Time Servers List ..................................................................................... 737 38.4.2 Time Server Synchronization ............................................................................................ 737 38.5 Console Port Speed ................................................................................................................... 738 38.6 DNS Overview ............................................................................................................................. 739 38.6.1 DNS Server Address Assignment ...................................................................................... 739 38.6.2 Configuring the DNS Screen ............................................................................................ 739 38.6.3 (IPv6) Address Record ...................................................................................................... 743 38.6.4 PTR Record ......................................................................................................................... 743 38.6.5 Adding an (IPv6) Address/PTR Record .......................................................................... 743 38.6.6 CNAME Record ................................................................................................................. 744 38.6.7 Adding a CNAME Record ................................................................................................ 744 38.6.8 Domain Zone Forwarder ................................................................................................. 745 38.6.9 Adding a Domain Zone Forwarder ................................................................................. 745 38.6.10 MX Record ...................................................................................................................... 746 38.6.11 Adding a MX Record ...................................................................................................... 746 38.6.12 Security Option Control .................................................................................................. 747 38.6.13 Editing a Security Option Control .................................................................................. 747 38.6.14 Adding a DNS Service Control Rule .............................................................................. 748 38.7 WWW Overview .......................................................................................................................... 749 38.7.1 Service Access Limitations ............................................................................................... 749 38.7.2 System Timeout .................................................................................................................. 749 38.7.3 HTTPS ................................................................................................................................... 749 38.7.4 Configuring WWW Service Control ................................................................................. 750 38.7.5 Service Control Rules ........................................................................................................ 753 38.7.6 Customizing the WWW Login Page ................................................................................ 754 38.7.7 HTTPS Example ................................................................................................................... 759 38.8 SSH ............................................................................................................................................. 766 38.8.1 How SSH Works .................................................................................................................. 767 38.8.2 SSH Implementation on the Zyxel Device ...................................................................... 768 38.8.3 Requirements for Using SSH .............................................................................................. 768 38.8.4 Configuring SSH ................................................................................................................. 768 38.8.5 Service Control Rules ........................................................................................................ 769 38.8.6 Secure Telnet Using SSH Examples .................................................................................. 770 38.9 Telnet ........................................................................................................................................... 771 38.9.1 Configuring Telnet ............................................................................................................. 771 38.9.2 Service Control Rules ........................................................................................................ 773 38.10 FTP .............................................................................................................................................. 773 38.10.1 Configuring FTP ................................................................................................................ 773 38.10.2 Service Control Rules ...................................................................................................... 775 38.11 SNMP ......................................................................................................................................... 775 38.11.1 SNMPv3 and Security ...................................................................................................... 776 ZyWALL ATP Series Users Guide 20 Table of Contents 38.11.2 Supported MIBs ............................................................................................................... 777 38.11.3 SNMP Traps ....................................................................................................................... 777 38.11.4 Configuring SNMP ........................................................................................................... 777 38.11.5 Add SNMPv3 User ............................................................................................................ 780 38.11.6 Service Control Rules ...................................................................................................... 780 38.12 Authentication Server .............................................................................................................. 781 38.12.1 Add/Edit Trusted RADIUS Client .................................................................................... 783 38.13 Notification > Mail Server ......................................................................................................... 783 38.14 Notification > SMS ..................................................................................................................... 785 38.15 Language Screen ..................................................................................................................... 786 38.16 IPv6 Screen ................................................................................................................................ 787 38.17 Zyxel One Network (ZON) Utility ............................................................................................. 787 38.17.1 Requirements ................................................................................................................... 788 38.17.2 Run the ZON Utility ........................................................................................................... 788 38.17.3 Zyxel One Network (ZON) System Screen .................................................................... 792 Chapter 39 Log and Report.................................................................................................................................793 39.1 Overview ..................................................................................................................................... 793 39.1.1 What You Can Do In this Chapter .................................................................................. 793 39.2 Email Daily Report ....................................................................................................................... 793 39.3 Log Setting Screens ................................................................................................................... 795 39.3.1 Log Setting Summary ........................................................................................................ 795 39.3.2 Edit System Log Settings .................................................................................................. 796 39.3.3 Edit Log on USB Storage Setting ..................................................................................... 800 39.3.4 Edit Remote Server Log Settings ..................................................................................... 801 39.3.5 Log Category Settings Screen ......................................................................................... 803 Chapter 40 File Manager ....................................................................................................................................806 40.1 Overview ..................................................................................................................................... 806 40.1.1 What You Can Do in this Chapter ................................................................................... 806 40.1.2 What you Need to Know .................................................................................................. 806 40.2 The Configuration File Screen ................................................................................................... 808 40.3 Firmware Management ........................................................................................................... 812 40.3.1 Cloud Helper ..................................................................................................................... 812 40.3.2 The Firmware Management Screen ............................................................................... 815 40.3.3 Firmware Upgrade via USB Stick ...................................................................................... 818 40.4 The Shell Script Screen .............................................................................................................. 818 Chapter 41 Diagnostics ......................................................................................................................................821 41.1 Overview ..................................................................................................................................... 821 ZyWALL ATP Series Users Guide 21 Table of Contents 41.1.1 What You Can Do in this Chapter ................................................................................... 821 41.2 The Diagnostics Screens ............................................................................................................ 821 41.2.1 The Diagnostics Collect Screen ....................................................................................... 822 41.2.2 The Diagnostics Collect on AP Screen ........................................................................... 823 41.2.3 The Diagnostics Files Screen ............................................................................................ 824 41.3 The Packet Capture Screen ...................................................................................................... 825 41.3.1 The Packet Capture on AP Screen ................................................................................. 828 41.3.2 The Packet Capture Files Screen .................................................................................... 831 41.4 The CPU / Memory Status Screen ............................................................................................. 832 41.5 The System Log Screen .............................................................................................................. 834 41.6 The Remote Assistance Screen ................................................................................................. 834 41.7 The Network Tool Screen ........................................................................................................... 836 41.8 The Routing Traces Screen ........................................................................................................ 838 41.9 The Wireless Frame Capture Screen ........................................................................................ 839 41.9.1 The Wireless Frame Capture Files Screen ...................................................................... 841 Chapter 42 Packet Flow Explore ........................................................................................................................842 42.1 Overview ..................................................................................................................................... 842 42.1.1 What You Can Do in this Chapter ................................................................................... 842 42.2 The Routing Status Screen ......................................................................................................... 842 42.3 The SNAT Status Screen .............................................................................................................. 846 Chapter 43 Shutdown ..........................................................................................................................................849 43.1 Overview ..................................................................................................................................... 849 43.1.1 What You Need To Know ................................................................................................. 849 43.2 The Shutdown Screen ................................................................................................................ 849 Part III: Appendices and Troubleshooting.................................................. 850 Chapter 44 Troubleshooting................................................................................................................................851 44.1 Resetting the Zyxel Device ........................................................................................................ 864 44.2 Getting More Troubleshooting Help ......................................................................................... 865 Appendix A Customer Support ..................................................................................................... 866 Appendix B Product Features........................................................................................................ 872 Appendix C Legal Information ...................................................................................................... 875 Index .................................................................................................................................................883 ZyWALL ATP Series Users Guide 22 PART I Users Guide 23 CHAPTER 1 Introduction 1.1 Overview Zyxel Device refers to these models as outlined below. ATP100 ATP100W ATP200 ATP500 ATP700 ATP800 Most screen shots in this guide come from the ATP200. Note the following differences between the device models:

ATP500 and ATP800 support Device HA Pro. Some interface names vary by model - see Table 14 on page 73 and Table 15 on page 73 for default port / interface name mapping. See Table 17 on page 73 for default interface / zone mapping. See the products datasheet for detailed information on a specific model. 1.2 Registration at myZyxel myZyxel is Zyxels online services center where you can register your Zyxel Device and manage subscription services available for your Zyxel Device (see Configuration > Licensing > Registration >

Service for services available for your Zyxel Device). For Zyxel Devices that already have firmware version 4.25 or later, you have to register your Zyxel Device and activate the corresponding service at myZyxel (through your Zyxel Device). For Zyxel Devices upgrading to firmware version 4.25 or later, you may skip registering your Zyxel Device and activating the corresponding service at myZyxel (through your Zyxel Device). However, it is highly recommended to at least register your Zyxel Device. At the time of writing, the Firmware Upgrade license providing Cloud Helper new firmware notifications, is free when you register your Zyxel Device. Note: You need to create a myZyxel account at http://portal.myZyxel.com before you can register your device and activate the services at myZyxel. You may need your Zyxel Devices serial number and LAN MAC address to register it at myZyxel. See the label at the back of the Zyxel Devices for details. ZyWALL ATP Series Users Guide 24 Chapter 1 Introduction Figure 1 myZyxel Login 1.2.1 Grace Period SecuReporter and service licenses have a 15-day grace period after a license expires. Services will continue to work in this period during which you will receive notifications to renew your license(s). New license(s) are valid for 1 year from the date of purchase. 1.2.2 Applications These are some Zyxel Device application scenarios. Security Router Security includes a Stateful Packet Inspection (SPI) firewall. Figure 2 Applications: Security Router Applications: Security Router ZyWALL ATP Series Users Guide 25 Chapter 1 Introduction IPv6 Routing The Zyxel Device supports IPv6 Ethernet, PPP, VLAN, and bridge routing. You may also create IPv6 policy routes and IPv6 objects. The Zyxel Device can also route IPv6 packets through IPv4 networks using different tunneling methods. Figure 3 Applications: IPv6 Routing VPN Connectivity Set up VPN tunnels with other companies, branch offices, telecommuters, and business travelers to provide secure access to your network. AS is an Authentication Server in the below figure. Figure 4 Applications: VPN Connectivity SSL VPN Network Access SSL VPN lets remote users use their web browsers for a very easy-to-use VPN solution. A user just browses to the Zyxel Devices web address and enters his user name and password to securely connect to the Zyxel Devices network. Here full tunnel mode creates a virtual connection for a remote user and gives him a private IP address in the same subnet as the local network so he can access network resources in the same way as if he were part of the internal network. ZyWALL ATP Series Users Guide 26 Chapter 1 Introduction Figure 5 SSL VPN With Full Tunnel Mode LAN (192.168.1.X) https://

Web Mail File Share Non-Web Web-based Application Application Server User-Aware Access Control Set up security policies to restrict access to sensitive information and shared resources based on the user who is trying to access it. In the following figure user A can access both the Internet and an internal file server. User B has a lower level of access and can only access the Internet. User C is not even logged in, so and cannot access either the Internet or the file server. Figure 6 Applications: User-Aware Access Control Load Balancing Set up multiple connections to the Internet on the same port, or different ports, including cellular interfaces. In either case, you can balance the traffic loads between them. Figure 7 Applications: Multiple WAN Interfaces ZyWALL ATP Series Users Guide 27 Chapter 1 Introduction 1.3 Management Overview You can manage the Zyxel Device in the following ways. Web Configurator The Web Configurator allows easy Zyxel Device setup and management using an Internet browser. This Users Guide provides information about the Web Configurator. Figure 8 Managing the Zyxel Device: Web Configurator Command-Line Interface (CLI) The CLI allows you to use text-based commands to configure the Zyxel Device. Access it using remote management (for example, SSH or Telnet) or via the physical or Web Configurator console port. See the Command Reference Guide for CLI details. The default settings for the console port are:

Table 1 Console Port Default Settings SETTING Speed Data Bits Parity Stop Bit Flow Control VALUE 115200 bps 8 None 1 Off FTP Use File Transfer Protocol for firmware upgrades and configuration backup/restore. SNMP The device can be monitored and/or managed by an SNMP manager. See Section 38.11 on page 775. ZyWALL ATP Series Users Guide 28 Chapter 1 Introduction CloudCNM Use the CloudCNM screen (see Section 38.15 on page 786) to enable and configure management of the Zyxel Device by a Central Network Management system. Management Authentication Managers must be authenticated with a username and password, using one of:

Local Zyxel Device authentication An external RADIUS server An external LDAP server Certificates 1.4 Web Configurator In order to use the Web Configurator, you must:

Use one of the following web browser versions or later:

Internet Explorer 10.x, 11.x Chrome latest version (45 or above) Firefox latest version (45 or above) Safari latest version (9.0 or above) Allow pop-up windows (blocked by default in some browsers) Enable JavaScripts, Java permissions, and cookies The recommended screen resolution is 1024 x 768 pixels. Note: Screenshots and graphics in this book may differ slightly from your product due to differences in product features or web configurator brand style. Most screen shots in this guide come from the USG110 and USG60W. 1.4.1 Web Configurator Access 1 Make sure your Zyxel Device hardware is properly connected. See the Quick Start Guide. 2 In your browser go to http://192.168.1.1. By default, the Zyxel Device automatically routes this request to its HTTPS server, and it is recommended to keep this setting. The Login screen appears. ZyWALL ATP Series Users Guide 29 Chapter 1 Introduction 3 Type the user name (default: admin) and password (default: 1234). 4 Click Login. After you log in for the first time using the default user name and password, you must change the default admin password in the Update Admin Info screen. Enter a new password of from 1 to 64 characters. In Configuration > Object > User/Group > Setting, you can enable Password Complexity to require a new password to consist of at least 8 characters and at most 64, where at least 1 character must be a number, at least 1 a lower case letter, at least 1 an upper case letter and at least 1 a special character from the keyboard, such as !@#$%^&*()_+. You can also require periodic changing of the password in that screen by configuring Password must changed every (days). Make a note of your new password, enter it in the following screen, then click Apply. 5 A Terms of Use screen displays. Read the statement, then click Acknowledge to proceed. Note: If you are using an Internet Explorer browser, the Terms of Use will be downloaded automatically. ZyWALL ATP Series Users Guide 30 Chapter 1 Introduction 6 The Network Risk Warning screen displays any unregistered or disabled security services. If your Zyxel Device is not registered, you will see a prompt to register it. Select how often to display the screen and click OK. ZyWALL ATP Series Users Guide 31 Chapter 1 Introduction If you select Never and you later want to bring this screen back, use these commands (note the space before the underscore). Router> enable Router#

Router# configure terminal Router(config)#

Router(config)# service-register _setremind after-10-days after-180-days after-30-days every-time never Router(config)# service-register _setremind every-time Router(config)#

See the Command Line Interface (CLI) Reference Guide (RG) for details on all supported commands. 7 Follow the directions in the Update Admin Info screen. If you change the default password, the Login screen appears after you click Apply. If you click Ignore, the Installation Setup Wizard opens if the ZyWALL is using its default configuration; otherwise the dashboard appears. 1.4.2 Web Configurator Screens Overview The Web Configurator screen is divided into these parts:

A - title bar B - navigation panel C - main window ZyWALL ATP Series Users Guide 32 B Chapter 1 Introduction A C Title Bar Figure 9 Title Bar The title bar icons in the upper right corner provide the following functions. Table 2 Title Bar: Web Configurator Icons LABEL SecuReporter DESCRIPTION Click this to open the SecuReporter portal page. Web Console CLI Reference Site Map Forum Help This icon shows when the Zyxel Device is added to an organization. Click this to open one or multiple console windows from which you can run command line interface (CLI) commands. You will be prompted to enter your user name and password. See the Command Reference Guide for information about the commands. Logging in to the Zyxel Device with HTTPS, so you can open one or multiple console windows. Click this to open a popup window that displays the CLI commands sent by the Web Configurator to the Zyxel Device. Click this to check which configuration items reference an object. Click this to see an overview of links to the Web Configurator screens. Go to https://businessforum.zyxel.com for product discussions. Click this to open the help page for the current screen. ZyWALL ATP Series Users Guide 33 Chapter 1 Introduction Table 2 Title Bar: Web Configurator Icons (continued) LABEL About Logout DESCRIPTION Click this to display basic information about the Zyxel Device. Click this to log out of the Web Configurator. About Click About to display basic information about the Zyxel Device. Figure 10 About Table 3 About LABEL Current Version Released Date OK Site Map DESCRIPTION This shows the firmware version of the Zyxel Device. This shows the date (yyyy-mm-dd) and time (hh:mm:ss) when the firmware is released. Click this to close the screen. Click Site MAP to see an overview of links to the Web Configurator screens. Click a screens link to go to that screen. ZyWALL ATP Series Users Guide 34 Chapter 1 Introduction Figure 11 Site Map Web Console Click Web Console to open one or multiple console windows from which you can run CLI commands. You will be prompted to enter your user name and password. See the Command Reference Guide for information about the commands. Logging in to the Zyxel Device with HTTPS, so you can open one or multiple console windows. Figure 12 Web Console Window Reference Click Reference to open the Reference screen. Select the type of object and the individual object and click Refresh to show which configuration settings reference the object. ZyWALL ATP Series Users Guide 35 Chapter 1 Introduction Figure 13 Reference The fields vary with the type of object. This table describes labels that can appear in this screen. Table 4 Reference LABEL Type Name DESCRIPTION Select an object type to see the services. This identifies the object for which the configuration settings that use it are displayed. Click the objects name to display the objects configuration screen in the main window. This field is a sequential value, and it is not associated with any entry. This is the type of setting that references the selected object. Click a services name to display the services configuration screen in the main window. If it is applicable, this field lists the referencing configuration items position in its list, otherwise N/A displays. This field identifies the configuration item that references the object. If the referencing configuration item has a description configured, it displays here. Click this to update the information in this screen. Click Cancel to close the screen.

#

Service Priority Name Description Refresh Cancel CLI Messages Click CLI to look at the CLI commands sent by the Web Configurator. Open the pop-up window and then click some menus in the web configurator to display the corresponding commands. ZyWALL ATP Series Users Guide 36 Chapter 1 Introduction Figure 14 CLI Messages 1.4.3 Navigation Panel Use the navigation panel menu items to open status and configuration screens. Click the arrow in the middle of the right edge of the navigation panel to hide the panel or drag to resize it. The following sections introduce the Zyxel Devices navigation panel menus and their screens. Figure 15 Navigation Panel Dashboard The dashboard displays general device information, system status, system resource usage, licensed service status, and interface status in widgets that you can re-arrange to suit your needs. See the Web Help for details on the dashboard. ZyWALL ATP Series Users Guide 37 Chapter 1 Introduction Monitor Menu The monitor menu screens display status and statistics information. Table 5 Monitor Menu Screens Summary FOLDER OR LINK System Status TAB FUNCTION Port Statistics Interface Status Traffic Statistics Session Monitor Login Users IGMP Statistics Collect and display traffic statistics. Displays general interface information and packet statistics. Port Statistics Displays packet statistics for each physical port. Interface Summary Traffic Statistics Session Monitor Login Users IGMP Statistics DDNS Status Displays the status of the Zyxel Devices DDNS domain names. Lists the users currently logged into the Zyxel Device. Collect and display IGMP statistics. Displays the status of all current sessions. Lists the devices that have received an IP address from Zyxel Device interfaces using IP/MAC binding. Displays details about the Zyxel Devices mobile broadband connection status. UPnP Port Status Port Statistics Displays details about UPnP connections going through the Zyxel Device. USB Storage Displays details about USB device connected to the Zyxel Device. DDNS Status IP/MAC Binding IP/MAC Binding Cellular Status Cellular Status Ethernet Neighbor Storage Information Ethernet Neighbor FQDN Object FQDN Object Wireless AP Information ZyMesh SSID Info Station Info Detected Device VPN Monitor IPSec AP List Radio List Top N APs Single AP ZyMesh Link Info SSID Info Station List Top N Stations Single Station Detected Device View and manage the Zyxel Devices neighboring devices via Smart Connect (Layer Link Discovery Protocol (LLDP)). Use the Zyxel One Network

(ZON) utility to view and manage the Zyxel Devices neighboring devices via the Zyxel Discovery Protocol (ZDP). Displays FQDN (Fully Qualified Domain Name) object cache lists used in DNS queries. Lists APs managed by the Zyxel Device. Lists wireless details of APs managed by the Zyxel Device. Lists managed APs with the most wireless traffic usage and most associated wireless stations. Lists APs wireless traffic usage and associated wireless stations for a managed AP. Display statistics about ZyMesh wireless connections between managed APs. Display information about the SSIDs wireless clients. Lists wireless clients associated with the APs managed by the Zyxel Device. Lists wireless stations with the most wireless traffic usage. Lists wireless traffic usage for an associated wireless station. Display information about suspected rogue APs. IPSec Displays and manages the active IPSec SAs. ZyWALL ATP Series Users Guide 38 Chapter 1 Introduction Table 5 Monitor Menu Screens Summary (continued) FOLDER OR LINK SSL TAB SSL FUNCTION Lists users currently logged into the VPN SSL client portal. You can also log out individual users and delete related session information. Displays details about current L2TP sessions. L2TP over IPSec L2TP over IPSec Security Statistics Content Filter App Patrol Anti-Malware IDP Email Security Botnet Filter Sandboxing SSL Inspection Log Summary Summary Summary Summary Summary Status Collect and display content filter statistics Displays application patrol statistics. Collect and display statistics on the malware that the Zyxel Device has detected. Collect and display statistics on the intrusions that the Zyxel Device has detected. Collect and display spam statistics. Displays how many mail sessions the ZyWALL is currently checking and DNSBL

(Domain Name Service-based spam Black List) statistics. Displays the IP addresses and URLs that are blocked by the Zyxel Device. Displays the sandboxing statistics. Collect and display SSL Inspection statistics. Displays traffic to destination servers using certificates. Summary Summary Report Certificate Cache List View Log View AP Log Lists AP log entries. Lists log entries. Configuration Menu Use the configuration menu screens to configure the Zyxel Devices features. Table 6 Configuration Menu Screens Summary FOLDER OR LINK Quick Setup Licensing TAB FUNCTION Quickly configure WAN interfaces or VPN connections. Registration Signature Update Wireless Registration Service Signature Register the device and activate trial services. View the licensed service status and upgrade licensed services. Update signatures immediately or by a schedule. Controller AP Management Configuration Mgnt AP List AP Policy AP Group Firmware Rogue/Friendly AP List Rogue AP Configure manual or automatic controller registration. Edit or remove entries in the lists of APs managed by the Zyxel Device. Configure the AP controllers IP address on the managed APs and determine the action the managed APs take if the current AP controller fails. Create groups of APs, define their radio, VLAN, port and load balancing settings. Update the firmware on APs connected to your Zyxel Device. Configure how the Zyxel Device monitors rogue APs. ZyWALL ATP Series Users Guide 39 Chapter 1 Introduction Table 6 Configuration Menu Screens Summary (continued) FOLDER OR LINK Auto Healing TAB Auto Healing RTLS Network Real Time Location System Interface Port Role Ethernet PPP Cellular Tunnel VLAN Bridge VTI Trunk Policy Route Static Route RIP OSPF BGP Routing DDNS NAT Redirect Service DDNS NAT Redirect Service ALG UPnP IP/MAC Binding Summary ALG UPnP Exempt List Layer 2 Isolation General White List FUNCTION Enable auto healing to extend the wireless service coverage area of the managed APs when one of the APs fails. Use the managed APs as part of an Ekahau RTLS to track the location of Ekahau Wi-Fi tags. Use this screen to set the Zyxel Devices flexible ports such as LAN, OPT, WLAN, or DMZ. Manage Ethernet interfaces and virtual Ethernet interfaces. Create and manage PPPoE and PPTP interfaces. Configure a cellular Internet connection for an installed mobile broadband card. Configure tunneling between IPv4 and IPv6 networks. Create and manage VLAN interfaces and virtual VLAN interfaces. Create and manage bridges and virtual bridge interfaces. Configure IP address assignment and interface parameters for VTI

(Virtual Tunnel Interface). Create and manage trunks (groups of interfaces) for load balancing. Create and manage routing policies. Create and manage IP static routing information. Configure device-level RIP settings. Configure device-level OSPF settings, including areas and virtual links. Configure exchange of Border Gateway Protocol (BGP) information over an IPSec tunnel. Define and manage the Zyxel Devices DDNS domain names. Set up and manage port forwarding rules. Set up and manage HTTP and SMTP redirection rules. Configure SIP, H.323, and FTP pass-through settings. Configure interfaces that allow UPnP and NAT-PMP connections. Configure IP to MAC address bindings for devices connected to each supported interface. Configure ranges of IP addresses to which the Zyxel Device does not apply IP/MAC binding. Enable layer-2 isolation on the Zyxel Device and the internal interface(s). Enable and configure the white list. DNS Inbound LB DNS Load Balancing Configure DNS Load Balancing. IPnP IPnP Enable IPnP on the Zyxel Device and the internal interface(s). VPN IPSec VPN VPN Connection VPN Gateway Concentrator Configuration Provisioning Configure IPSec tunnels. Configure IKE tunnels. Combine IPSec VPN connections into a single secure network Set who can retrieve VPN rule settings from the Zyxel Device using the Zyxel Device IPSec VPN Client. ZyWALL ATP Series Users Guide 40 Chapter 1 Introduction Table 6 Configuration Menu Screens Summary (continued) FOLDER OR LINK SSL VPN L2TP VPN BWM Web Authentication TAB Access Privilege Global Setting L2TP VPN BWM Web Authentication General/

Authentication Type/Custom Web Portal File/Custom User Agreement File SSO Security Policy Policy Control Policy ADP Session Control Security Service General Profile Session Control AppPatrol Profile Content Filter Profile FUNCTION Configure SSL VPN access rights for users and groups. Configure the Zyxel Devices SSL VPN settings that apply to all connections. Configure L2TP over IPSec tunnels. Enable and configure bandwidth management rules. Define a web portal and exempt services from authentication. Configure the Zyxel Device to work with a Single Sign On agent. Create and manage level-3 traffic rules and apply Security Service profiles. Display and manage ADP bindings. Create and manage ADP profiles. Limit the number of concurrent client NAT/security policy sessions. Manage different types of traffic in this screen. Create App Patrol template(s) of settings to apply to a traffic flow using a security policy. Create and manage the detailed filtering rules for content filtering profiles and then apply to a traffic flow using a security policy. Create a list of allowed web sites that bypass content filtering policies. Trusted Web Sites Forbidden Web Sites Create a list of web sites to block regardless of content filtering Anti-Malware Anti-Malware Reputation Filter Signature IP Reputation General/White List/

Black List Botnet Filter General/White List/

Black List IDP IDP Sandboxing Sandboxing Botnet Filter Botnet Filter policies. Enable, specify actions to take when encountering malware or compressed files, and set up a black list to identify files with malware file patterns and a white list to identify files that should not be checked for malware. Search for particular signatures to get more information about them. Enable IP reputation and specify what action the Zyxel Device takes when any IP address with bad reputation is detected. You can also set up a white list to identify which IPv4 addresses should be allowed, and a black list to identify which IPv4 addresses should be blocked. Enable botnet filtering and specify what action the Zyxel Device takes when any suspicious activity is detected. You can also set up a white list to identify which IPv4 addresses and/or URLs should be allowed, and a black list to identify which IPv4 addresses and/or URLs should be blocked. Enable and configure IDP settings. Create, import, or export custom signatures. Enable sandboxing, and specify the actions the Zyxel Device takes when malicious or suspicious files are detected. Enable botnet filtering and specify the actions. ZyWALL ATP Series Users Guide 41 Chapter 1 Introduction Table 6 Configuration Menu Screens Summary (continued) FOLDER OR LINK Email Security TAB Email Security Black/White List SSL Inspection Profile Exclude List Certificate Update IP Exception IP Exception Object Zone User/Group Zone User Group Setting MAC Address AP Profile Radio SSID MON Profile MON Profile ZyMesh Profile ZyMesh Profile Address/Geo IP Address Address Group Geo IP Service Service Group Schedule Schedule Group Active Directory LDAP RADIUS Service Schedule AAA Server FUNCTION Turn email security on or off and manage email security policies. Create email security template(s) of settings to apply to a traffic flow using a security policy. Set up a black list to identify spam and a white list to identify legitimate email. Decrypt HTTPS traffic for Security Service inspection. Create SSL Inspection template(s) of settings to apply to a traffic flow using a security policy. Configure services to be excluded from SSL Inspection. Use this screen to update the latest certificates of servers using SSL connections to the Zyxel Device network. Use this screen to view the IP exception list for the anti-malware and IDP (Intrusion, Detection, and Prevention) features. The Zyxel Device wont intercept nor inspect the incoming packets that match the rules in the IP exception list for the anti-malware and/

or IDP (Intrusion, Detection, and Prevention) features. Configure zone template(s) used to define various policies. Create and manage users. Create and manage groups of users. Manage default settings for all users, general settings for user sessions, and rules to force user authentication. Configure the MAC addresses of wireless clients for MAC authentication using the local user database. Create template(s) of radio settings to apply to policies as an object. Create template(s) of wireless settings to apply to radio profiles or policies as an object. Create and manage rogue AP monitoring files that can be associated with different APs. Create and manage ZyMesh files that can be associated with different APs. Create and manage host, range, and network (subnet) addresses. Create and manage groups of addresses to apply to policies as a single objects. Update the database of country-to-IP address mappings and manually configure country-to-IP address mappings for geographic address objects that can be used in security policies. Create and manage TCP and UDP services. Create and manage groups of services to apply to policies as a single object. Create one-time and recurring schedules. Create and manage groups of schedules to apply to policies as a single object. Configure the Active Directory settings. Configure the LDAP settings. Configure the RADIUS settings. ZyWALL ATP Series Users Guide 42 Chapter 1 Introduction Table 6 Configuration Menu Screens Summary (continued) FOLDER OR LINK Auth. Method FUNCTION Create and manage ways of authenticating users. TAB Authentication Method My Certificates Trusted Certificates Request Lease SecuManager SecuReporter Certificate DHCPv6 Cloud CNM System Host Name Settings Date/Time Host Name USB Storage Date/Time Console Speed Console Speed DNS WWW DNS Service Control Login Page SSH TELNET FTP SNMP Auth. Server Mail Server Language IPv6 ZON SSH TELNET FTP SNMP Auth. Server Notification Language IPv6 ZON Create and manage the Zyxel Devices certificates. Import and manage certificates from trusted sources. Configure IPv6 DHCP request type and interface information. Configure IPv6 DHCP lease type and interface information. Enable and configure management of the Zyxel Device by a Central Network Management system. Enable SecuReporter logging and access the SecuReporter security analytics portal that collects and analyzes logs from your Zyxel Device in order to identify anomalies, alert on potential internal / external threats, and report on network usage. Configure the system and domain name for the Zyxel Device. Configure the settings for the connected USB devices. Configure the current date, time, and time zone in the Zyxel Device. Set the console speed. Configure the DNS server and address records for the Zyxel Device. Configure HTTP, HTTPS, and general authentication. Configure how the login and access user screens look. Configure SSH server and SSH service settings. Configure telnet server settings for the Zyxel Device. Configure FTP server settings. Configure SNMP communities and services. Configure the Zyxel Device to act as a RADIUS server. Configure a mail server with authentication to send reports and password expiration notification emails. Select the Web Configurator language. Enable IPv6 globally on the Zyxel Device here. Use the Zyxel One Network (ZON) utility to view and manage the Zyxel Devices neighboring devices via the Zyxel Discovery Protocol (ZDP). Log & Report Email Daily Report Email Daily Report Log Settings Log Settings Configure where and how to send daily reports and what reports to send. Configure the system log, email logs, and remote syslog servers. ZyWALL ATP Series Users Guide 43 Chapter 1 Introduction Maintenance Menu Use the maintenance menu screens to manage configuration and firmware files, run diagnostics, and reboot or shut down the Zyxel Device. Table 7 Maintenance Menu Screens Summary FOLDER OR LINK File Manager FUNCTION TAB Configuration File Manage and upload configuration files for the Zyxel Device. Firmware Management Shell Script Diagnostics Diagnostics View the current firmware version and upload firmware. Reboot with your choice of firmware. Manage and run shell script files for the Zyxel Device. Collect diagnostic information. Collect Collect on AP Files Packet Capture CPU/Memory Status System Log Capture packets for analysis. View CPU and memory usage statistics. Connect a USB device to the Zyxel Device and archive the Zyxel Device system logs to it here. Remote Assistance Configure and schedule external access to the Zyxel Device for Network Tool Routing Traces Wireless Frame Capture Routing Status SNAT Status Packet Flow Explore Shutdown Shutdown 1.4.4 Tables and Lists troubleshooting. Identify problems with the connections. You can use Ping or Traceroute to help you identify problems. Configure traceroute to identify where packets are dropped for troubleshooting. Capture wireless frames from APs for analysis. Check how the Zyxel Device determines where to route a packet. View a clear picture on how the Zyxel Device converts a packets source IP address and check the related settings. Turn off the Zyxel Device. Web Configurator tables and lists are flexible with several options for how to display their entries. Click a column heading to sort the tables entries according to that columns criteria. ZyWALL ATP Series Users Guide 44 Chapter 1 Introduction Figure 16 Sorting Table Entries by a Columns Criteria Click the down arrow next to a column heading for more options about how to display the entries. The options available vary depending on the type of fields in the column. Here are some examples of what you can do:

Sort in ascending or descending (reverse) alphabetical order Select which columns to display Group entries by field Show entries in groups Filter by mathematical operators (<, >, or =) or searching for text Figure 17 Common Table Column Options Select a column heading cells right border and drag to re-size the column. Figure 18 Resizing a Table Column Select a column heading and drag and drop it to change the column order. A green check mark displays next to the columns title when you drag the column to a valid new location. ZyWALL ATP Series Users Guide 45 Chapter 1 Introduction Figure 19 Moving Columns Use the icons and fields at the bottom of the table to navigate to different pages of entries and control how many entries display at a time. Figure 20 Navigating Pages of Table Entries The tables have icons for working with table entries. You can often use the [Shift] or [Ctrl] key to select multiple entries to remove, activate, or deactivate. Figure 21 Common Table Icons Here are descriptions for the most common table icons. Table 8 Common Table Icons LABEL Add DESCRIPTION Click this to create a new entry. For features where the entrys position in the numbered list is important (features where the Zyxel Device applies the tables entries in order like the security policy for example), you can select an entry and click Add to create a new entry after the selected entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. In some tables you can just click a table entry and edit it directly in the table. For those types of tables small red triangles display for table entries with changes that you have not yet applied. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. To connect an entry, select it and click Connect. To disconnect an entry, select it and click Disconnect. Select an entry and click References to check which settings use the entry. To change an entrys position in a numbered list, select it and click Move to display a field to type a number for where you want to put that entry and press [ENTER] to move the entry to the number that you typed. For example, if you type 6, the entry you are moving becomes number 6 and the previous entry 6 (if there is one) gets pushed up (or down) one. Edit Remove Activate Inactivate Connect Disconnect References Move ZyWALL ATP Series Users Guide 46 Chapter 1 Introduction Working with Lists When a list of available entries displays next to a list of selected entries, you can often just double-click an entry to move it from one list to the other. In some lists you can also use the [Shift] or [Ctrl] key to select multiple entries, and then use the arrow button to move them to the other list. Figure 22 Working with Lists ZyWALL ATP Series Users Guide 47 CHAPTER 2 Initial Setup Wizard 2.1 Initial Setup Wizard Screens When you log into the Web Configurator for the first time or when you reset the Zyxel Device to its default configuration, the Initial Setup Wizard screen displays. This wizard helps you configure Internet connection settings and activate subscription services. Note: For Zyxel Devices that already have firmware version 4.25 or later, you have to register your Zyxel Device and activate the corresponding service at myZyxel (through your Zyxel Device). This chapter provides information on configuring the Web Configurator's Initial Setup Wizard. See the feature-specific chapters in this Users Guide for background information. Click the double arrow in the upper right corner to display or hide the help. Click Logout to exit the Initial Setup Wizard or click Next to continue the wizard. Click Finish at the end of the wizard to complete the wizard. Figure 23 Initial Setup Wizard 2.1.1 Internet Access Setup - WAN Interface Use this screen to set how many WAN interfaces to configure and the first WAN interfaces type of encapsulation and method of IP address assignment. ZyWALL ATP Series Users Guide 48 Chapter 2 Initial Setup Wizard The screens vary depending on the encapsulation type. Refer to information provided by your ISP to know what to enter in each field. Note: Enter the Internet access information exactly as your ISP gave it to you. Leave a field blank if you dont have that information. I have two ISPs: Select this option to configure two Internet connections. Leave it cleared to configure just one. This option appears when you are configuring the first WAN interface. Encapsulation: Choose the Ethernet option when the WAN port is used as a regular Ethernet. Choose PPPoE, PPTP or L2TP for a dial-up connection according to the information from your ISP. WAN Interface: This is the interface you are configuring for Internet access. Zone: This is the security zone to which this interface and Internet connection belong. IP Address Assignment: Select Auto if your ISP did not assign you a fixed IP address. Select Static if the ISP assigned a fixed IP address. Figure 24 Internet Access 2.1.2 Internet Access: Ethernet This screen is read-only if you set the previous screens IP Address Assignment field to Auto. If you set the previous screens IP Address Assignment field to Static, use this screen to configure your IP address settings. Encapsulation: This displays the type of Internet connection you are configuring. First WAN Interface: This is the number of the interface that will connect with your ISP. Zone: This is the security zone to which this interface and Internet connection will belong. IP Address: Enter your (static) public IP address. Auto displays if you selected Auto as the IP Address Assignment in the previous screen. The following fields display if you selected static IP address assignment. IP Subnet Mask: Enter the subnet mask for this WAN connection's IP address. ZyWALL ATP Series Users Guide 49 Chapter 2 Initial Setup Wizard Gateway IP Address: Enter the IP address of the router through which this WAN connection will send traffic (the default gateway). First / Second DNS Server: These fields display if you selected static IP address assignment. The Domain Name System (DNS) maps a domain name to an IP address and vice versa. Enter a DNS server's IP address(es). The DNS server is extremely important because without it, you must know the IP address of a computer before you can access it. The Zyxel Device uses these (in the order you specify here) to resolve domain names for VPN, DDNS and the time server. Leave the field as 0.0.0.0 if you do not want to configure DNS servers. 2.1.2.1 Possible Errors Check that your cable connection is coming from the correct interface youre using for the WAN connection on the Zyxel Device. Check that the interface is connected to the device youre using for Internet access such as a broadband router and that the router is turned on. The LED of the interface youre using for the WAN connection on the Zyxel Device should be orange. If your Zyxel Device was not able to obtain an IP address, check that your Internet access information uses DHCP as the WAN connection type. If it fails again, check with your Internet service provider or administrator for correct WAN settings. If your Zyxel Device was not able to use the IP address entered, check that you were given an IP address, subnet mask and gateway address as part of your Internet access information. Re-enter your IP address, subnet mask and gateway IP address exactly as given. If it fails again, check with your Internet service provider or administrator for correct IP address, subnet mask and gateway address and other WAN settings. Figure 25 Internet Access: Ethernet Encapsulation 2.1.3 Internet Access: PPPoE 2.1.3.1 ISP Parameters Type the PPPoE Service Name from your service provider. PPPoE uses a service name to identify and reach the PPPoE server. You can use alphanumeric and -_@$./ characters, and it can be up to 64 characters long. Authentication Type - Select an authentication protocol for outgoing connection requests. Options are:

Chap/PAP - Your Zyxel Device accepts either CHAP or PAP when requested by the remote node. ZyWALL ATP Series Users Guide 50 Chapter 2 Initial Setup Wizard Chap - Your Zyxel Device accepts CHAP only. PAP - Your Zyxel Device accepts PAP only. MSCHAP - Your Zyxel Device accepts MSCHAP only. MSCHAP-V2 - Your Zyxel Device accepts MSCHAP-V2 only. Type the User Name given to you by your ISP. You can use alphanumeric and -_@$./ characters, and it can be up to 31 characters long. Type the Password associated with the user name. Use up to 64 ASCII characters except the [] and ?. This field can be blank. Select Nailed-Up if you do not want the connection to time out. Otherwise, type the Idle Timeout in seconds that elapses before the router automatically disconnects from the PPPoE server. 2.1.3.2 WAN IP Address Assignments WAN Interface: This is the name of the interface that will connect with your ISP. Zone: This is the security zone to which this interface and Internet connection will belong. IP Address: Enter your (static) public IP address. Auto displays if you selected Auto as the IP Address Assignment in the previous screen. First / Second DNS Server: These fields display if you selected static IP address assignment. The Domain Name System (DNS) maps a domain name to an IP address and vice versa. Enter a DNS server's IP address(es). The DNS server is extremely important because without it, you must know the IP address of a computer before you can access it. The Zyxel Device uses these (in the order you specify here) to resolve domain names for VPN, DDNS and the time server. Leave the field as 0.0.0.0 if you do not want to configure DNS servers. If you do not configure a DNS server, you must know the IP address of a machine in order to access it. 2.1.3.3 Possible Errors Check that youre using the correct PPPoE Service Name and Authentication Type. Make sure that your Internet access information uses PPPoE as the WAN connection type. Re-enter your PPPoE user name and password exactly as given. If it fails again, check with your Internet service provider or administrator for correct WAN settings and user credentials. If you were given an IP address and DNS server information as part of your Internet access information, re-enter them exactly as given. If it fails again, check with your Internet service provider or administrator for correct IP address, subnet mask and gateway address and other WAN settings. ZyWALL ATP Series Users Guide 51 Chapter 2 Initial Setup Wizard Figure 26 Internet Access: PPPoE Encapsulation 2.1.4 Internet Access: PPTP 2.1.4.1 ISP Parameters Authentication Type - Select an authentication protocol for outgoing calls. Options are:

Chap/PAP - Your Zyxel Device accepts either CHAP or PAP when requested by the remote node. Chap - Your Zyxel Device accepts CHAP only. PAP - Your Zyxel Device accepts PAP only. MSCHAP - Your Zyxel Device accepts MSCHAP only. MSCHAP-V2 - Your Zyxel Device accepts MSCHAP-V2 only. Type the User Name given to you by your ISP. You can use alphanumeric and -_@$./ characters, and it can be up to 31 characters long. Type the Password associated with the user name. Use up to 64 ASCII characters except the [] and ?. This field can be blank. Re-type your password in the next field to confirm it. Select Nailed-Up if you do not want the connection to time out. Otherwise, type the Idle Timeout in seconds that elapses before the router automatically disconnects from the PPTP server. 2.1.4.2 PPTP Configuration Base Interface: This identifies the Ethernet interface you configure to connect with a modem or router. Type a Base IP Address (static) assigned to you by your ISP. Type the IP Subnet Mask assigned to you by your ISP (if given). Gateway IP Address: Enter the IP address of the router through which this WAN connection will send traffic (the default gateway). Server IP: Type the IP address of the PPTP server. ZyWALL ATP Series Users Guide 52 Chapter 2 Initial Setup Wizard Type a Connection ID or connection name. It must follow the c:id and n:name format. For example, C:12 or N:My ISP. This field is optional and depends on the requirements of your broadband modem or router. You can use alphanumeric and -_: characters, and it can be up to 31 characters long. 2.1.4.3 WAN IP Address Assignments First WAN Interface: This is the connection type on the interface you are configuring to connect with your ISP. Zone This is the security zone to which this interface and Internet connection will belong. IP Address: Enter your (static) public IP address. Auto displays if you selected Auto as the IP Address Assignment in the previous screen. First / Second DNS Server: These fields display if you selected static IP address assignment. The Domain Name System (DNS) maps a domain name to an IP address and vice versa. Enter a DNS server's IP address(es). The DNS server is extremely important because without it, you must know the IP address of a computer before you can access it. The Zyxel Device uses these (in the order you specify here) to resolve domain names for VPN, DDNS and the time server. Leave the field as 0.0.0.0 if you do not want to configure DNS servers. 2.1.4.4 Possible Errors Check that youre using the correct PPPT Service IP, Base IP Address, IP Subnet Mask, Gateway IP Address, Connection ID and Authentication Type. Make sure that your Internet access information uses PPTP as the WAN connection type. Re-enter your PPTP user name and password exactly as given. If it fails again, check with your Internet service provider or administrator for correct WAN settings and user credentials. If you were given an IP address and DNS server information as part of your Internet access information, re-enter them exactly as given. If it fails again, check with your Internet service provider or administrator for correct IP address, subnet mask and gateway address and other WAN settings. ZyWALL ATP Series Users Guide 53 Chapter 2 Initial Setup Wizard Figure 27 Internet Access: PPTP Encapsulation 2.1.5 Internet Access: L2TP 2.1.5.1 ISP Parameters Authentication Type - Select an authentication protocol for outgoing connection requests. Options are:

Chap/PAP - Your Zyxel Device accepts either CHAP or PAP when requested by the remote node. Chap - Your Zyxel Device accepts CHAP only. PAP - Your Zyxel Device accepts PAP only. MSCHAP - Your Zyxel Device accepts MSCHAP only. MSCHAP-V2 - Your Zyxel Device accepts MSCHAP-V2 only. Type the User Name given to you by your ISP. You can use alphanumeric and -_@$./ characters, and it can be up to 31 characters long. Type the Password associated with the user name. Use up to 64 ASCII characters except the [] and ?. This field can be blank. Select Nailed-Up if you do not want the connection to time out. Otherwise, type the Idle Timeout in seconds that elapses before the router automatically disconnects from the PPPoE server. 2.1.5.2 L2TP Configuration Base Interface: This identifies the Ethernet interface you configure to connect with a modem or router. Type a Base IP Address (static) assigned to you by your ISP. ZyWALL ATP Series Users Guide 54 Chapter 2 Initial Setup Wizard IP Subnet Mask: Enter the subnet mask for this WAN connection's IP address. Gateway IP Address: Enter the IP address of the router through which this WAN connection will send traffic (the default gateway). Server IP: Type the IP address of the L2TP server. 2.1.5.3 WAN IP Address Assignments WAN Interface: This is the name of the interface that will connect with your ISP. Zone: This is the security zone to which this interface and Internet connection will belong. IP Address: Enter your (static) public IP address. Auto displays if you selected Auto as the IP Address Assignment in the previous screen. First / Second DNS Server: These fields display if you selected static IP address assignment. The Domain Name System (DNS) maps a domain name to an IP address and vice versa. Enter a DNS server's IP address(es). The DNS server is extremely important because without it, you must know the IP address of a computer before you can access it. The Zyxel Device uses these (in the order you specify here) to resolve domain names for VPN, DDNS and the time server. Leave the field as 0.0.0.0 if you do not want to configure DNS servers. 2.1.5.4 Possible Errors Check that youre using the correct L2PT Server IP, Subnet Mask, Gateway IP Address, IP Subnet Mask and Authentication Type. Make sure that your Internet access information uses L2TP as the WAN connection type. Re-enter your L2TP user name and password exactly as given. If it fails again, check with your Internet service provider or administrator for correct WAN settings and user credentials. If you were given an IP address and DNS server information as part of your Internet access information, re-enter them exactly as given. If it fails again, check with your Internet service provider or administrator for correct IP address, subnet mask and gateway address and other WAN settings. ZyWALL ATP Series Users Guide 55 Chapter 2 Initial Setup Wizard Figure 28 Internet Access: L2TP Encapsulation 2.1.6 Internet Access Setup - Second WAN Interface If you selected I have two ISPs, after you configure the First WAN Interface, you can configure the Second WAN Interface. The screens for configuring the second WAN interface are similar to the first (see Section 2.1.1 on page 48). ZyWALL ATP Series Users Guide 56 Chapter 2 Initial Setup Wizard Figure 29 Internet Access: Step 3: Second WAN Interface 2.1.7 Internet Access: Congratulations You have set up your Zyxel Device to access the Internet. A screen displays with your settings. Click Connection Test to check that you can access the Internet. If you cannot, click Back and confirm that you entered the settings correctly. If you have, check that you got the correct settings from your ISP or network administrator. Figure 30 Internet Access: Summary ZyWALL ATP Series Users Guide 57 Chapter 2 Initial Setup Wizard 2.1.8 Date and Time Settings Its important to have correct date and time values in the logs. The Zyxel Device can automatically update the time and date by detecting your time zone and whether Daylight Savings is in effect in that time zone. If your Zyxel Device cannot get the correct date and time, it may not able to connect to a time server. Check that the Zyxel Device has Internet access, then click Sync. Now. Figure 31 Date and Time Settings 2.1.9 Register Device Click the Register button in this screen to register your device at portal.myzyxel.com. Note: The Zyxel Device must be connected to the Internet in order to register. ZyWALL ATP Series Users Guide 58 Chapter 2 Initial Setup Wizard Figure 32 Register Device You may need the Zyxel Devices serial number and LAN MAC address to register it at myZyxel if you have not already done so. Refer to the label at the back of the Zyxel Devices for details. Figure 33 myZyxel Login Click Refresh or use the Configuration > Licensing > Registration screen to update your Zyxel Device registration status. ZyWALL ATP Series Users Guide 59 Chapter 2 Initial Setup Wizard Figure 34 Registered Device 2.1.10 Activate Service After you register your Zyxel Device, you can register for the services supported by your model. See Subscription Services Available on page 186 for more information on the subscription services for the two types of security packs. Here are the services available for the Zyxel Device:

Web Security (to access a database that can block websites by category) Application Security (to use signature for Application Patrol inspection and signatures to recognize unsolicited commercial or junk email suspected of being sent by spammers.) Malware Blocker (to detect malware patterns in files) Intrusion Prevention (to use signatures for Intrusion Detection and Prevention attacks) Geo Enforcer (to access a database of country-to-IP address mappings) Sandboxing (to specify the actions the Zyxel Device takes when malicious or suspicious files are detected) Reputation Filter (to recognize packets coming from IPv4 address with bad reputation) SecuReporter (to collect and analyze logs from your Zyxel Device in order to identify anomalies, alert on potential internal / external threats, and report on network usage) Managed AP Service (to manage more APs than the default for your Zyxel Device when the AP controller is enabled) Click Refresh and wait a few moments for the registration information to update in this screen. If the page does not refresh, make sure the Internet connection is working and click Refresh again. To check your Internet connection, try to access the Internet from a computer connected to a LAN port on the Zyxel Device. If you cannot, then check your Internet access settings on the Zyxel Device. ZyWALL ATP Series Users Guide 60 Chapter 2 Initial Setup Wizard Figure 35 Activate Service Figure 36 Activated Service 2.1.11 Service Settings You can enable or disable the following features in this screen. This screen varies depending on the security pack that you purchase. See Subscription Services Available on page 186 for more information on the subscription services for the two types of security packs. Botnet Filter: Use this feature to detect and block connection attempts to or from the C&C server or known botnet IP addresses. Anti-Malware: Use this feature to protect your connected network from malware infection. ZyWALL ATP Series Users Guide 61 Chapter 2 Initial Setup Wizard IDP: Use this feature to detect malicious or suspicious packets and respond instantaneously. IP Reputation: Use this feature to recognize and filter packets coming from IPv4 address with bad reputation. Sandboxing: Use this feature to provide a safe environment to separate running programs from your network and host devices. Content Filter: Use this feature to control access to specific web sites or web content. App Patrol: Use this feature to manage the use of various applications on the network. Email Security: Use this feature to mark or discard spam (unsolicited commercial or junk email). SecuReporter: Use this feature to collect and analyze logs from your Zyxel Device in order to identify anomalies, alert on potential internal / external threats, and report on network usage. Select the I have read SecuReporter GDPR and agree policy check box to have SecuReporter collect and analyze logs from this Zyxel Device. This check box wont appear again if you have already selected this before. Figure 37 Service Settings 2.1.12 Service Settings: SecuReporter Use this screen to add the Zyxel Device to a new or existing organization, and choose the level of data protection for traffic going through this Zyxel Device. Server Status: This is the connection status between the Zyxel Device and the SecuReporter server. This field shows Connected when the Zyxel Device can synchronize with the SecuReporter server. This field shows Timeout when the Zyxel Device cant synchronize with the SecuReporter server. This field shows Fail when the connection between the Zyxel Device and the SecuReporter server is down. Device Name: Enter the name of the Zyxel Device. This Zyxel Device will be added to a new or existing organization. Organization: This field appears if you havent created an organization in the SecuReporter server. Type a name of up to 255 characters and description to create a new organization. Select from existing organization: Select an existing organization from the drop-down list box to add the Zyxel Device to the selected organization. ZyWALL ATP Series Users Guide 62 Chapter 2 Initial Setup Wizard Create new organization: Type a name of up to 255 characters and description to create a new organization. Partially Anonymous: Select this and personal data, such as user names, MAC addresses, email addresses, and host names, will be replaced with artificial identifiers in downloaded logs. Fully Anonymous: Select this and personal data, such as user names, MAC addresses, email addresses, and host names, will be replaced with anonymized information in downloaded logs. Non-Anonymous: Select this and personal data, such as user names, MAC addresses, email addresses, and host names, will be identifiable in downloaded logs. Figure 38 SecuReporter Settings The following screen appears when the Zyxel Device is already added in an organization. Figure 39 SecuReporter Settings ZyWALL ATP Series Users Guide 63 Chapter 2 Initial Setup Wizard 2.1.13 Wireless Settings: AP Controller The Zyxel Device can act as an AP Controller that can manage APs in the same network as the Zyxel Device. Select Yes if you want your Zyxel Device to manage APs in your network; otherwise select No. Figure 40 Wireless Settings: AP Controller 2.1.14 Wireless Settings: SSID & Security Configure SSID and wireless security in this screen. SSID Setting SSID - Enter a descriptive name of up to 32 printable characters for the wireless LAN. Security Mode - Select Pre-Shared Key to add security on this wireless network. Otherwise, select None to allow any wireless client to associate this network without authentication. Pre-Shared Key - Enter a pre-shared key of between 8 and 63 case-sensitive ASCII characters

(including spaces and symbols) or 64 hexadecimal characters. Hidden SSID - Select this option if you want to hide the SSID in the outgoing beacon frame. A wireless client then cannot obtain the SSID through scanning using a site survey tool. Enable Intra-BSS Traffic Blocking - Select this option if you want to prevent crossover traffic from within the same SSID. Wireless clients can still access the wired network but cannot communicate with each other. For Built-in Wireless AP Only Bridged to: Zyxel Devices with W in the model name have a built-in AP. Select an interface to bridge with the built-in AP wireless network. Devices connected to this interface will then be in the same broadcast domain as devices in the AP wireless network. ZyWALL ATP Series Users Guide 64 Chapter 2 Initial Setup Wizard Figure 41 Wireless Settings: SSID & Security 2.1.15 Remote Management Select this to allow access to the Zyxel Device using HTTP or HTTPS from the Internet. Figure 42 Remote Management HTTPS is added to the Default_Allow_WAN_to_ZyWALL rule in Object > Service > Service Group screen when you enable Remote Management. ZyWALL ATP Series Users Guide 65 Chapter 2 Initial Setup Wizard Figure 43 Object > Service > Service Group - HTTPS ZyWALL ATP Series Users Guide 66 CHAPTER 3 Hardware, Interfaces and Zones 3.1 Hardware Overview This section describes the front and rear panels for each model. The following table summarizes the port features of the Zyxel Device by model. Table 9 ATP Series Comparison Table ATP MODELS USB 3.0 Ports 1 Gbps SFP interface 10/100/1000 Mbps Ethernet WAN Ports 10/100/1000 Mbps Ethernet Ports Console Port 3.1.1 Front Panels ATP100/ATP100W ATP200 ATP500 ATP700/ATP800 1 1 1 4 1 2 1 2 4 1 2 1

-

7 1 2 2

-

12 1 The LED indicators are located on the front panel. Figure 44 ATP100 Front Panel Figure 45 ATP100W Front Panel Figure 46 ATP200 Front Panel ZyWALL ATP Series Users Guide 67 Chapter 3 Hardware, Interfaces and Zones Figure 47 ATP500 Front Panel Figure 48 ATP700 / ATP800 Front Panel The following table describes the front panel LEDs. Table 10 LED Descriptions LED COLOR STATUS PWR Green Red SYS Green Red Green 2.4G 5G Green P1 (SFP) LINK Yellow Green ACT Green P2, P3...

(WAN/

LAN/

DMZ) Yellow Green Off On On Off On Blinking On Off On Blinking Off On Blinking Off On Off On Off Blinking Off On Blinking Off On Blinking DESCRIPTION The Zyxel Device is turned off. The Zyxel Device is turned on. There is a hardware component failure. Shut down the device, wait for a few minutes and then restart the device. If the LED turns red again, then please contact your vendor. The Zyxel Device is not ready or has failed. The Zyxel Device is ready and running. The Zyxel Device is booting. The Zyxel Device has an error or has failed. The 2.4G wireless interface is off. The 2.4G wireless interface is ready. The 2.4G wireless connection is active. The 5G wireless interface is off. The 5G wireless interface is ready. The 5G wireless connection is active. There is no connection on this port. This port has a successful 1000 Mbps link. There is no connection on this port. This port has a successful 100 Mbps link. There is no traffic on this port. The Zyxel Device is sending or receiving packets on this port at 100/1000 Mbps. There is no connection on this port. This port has a successful 1000 Mbps link. The Zyxel Device is sending or receiving packets on this port at 1000 Mbps. There is no connection on this port. This port has a successful 10/100 Mbps link. The Zyxel Device is sending or receiving packets on this port at 10/100 Mbps. ZyWALL ATP Series Users Guide 68 Chapter 3 Hardware, Interfaces and Zones The following table describes the ports on the front panel. Table 11 Front Panel Ports LABEL RESET DESCRIPTION Press the button in for about 5 seconds (or until the SYS LED starts to blink), then release it to return the Zyxel Device to the factory defaults (password is 1234, LAN IP address 192.168.1.1 etc.) You can use the console port to manage the Zyxel Device using CLI commands. You will be prompted to enter your user name and password. See the Command Reference Guide for more information about the CLI. When configuring using the console port, you need a computer equipped with communications software configured to the following parameters:

Speed 115200 bps Data Bits 8 Parity None Stop Bit 1 Flow Control Off Connect a storage device for system logs (see Maintenance > Diagnostics > System Log) and storage (see Configuration > System > USB Storage). These are 1G RJ-45 Ethernet ports. CONSOLE USB P2-P7 (ATP200) P2-P8 (ATP500) P1-P12 (ATP700/

ATP800) 3.1.2 Rear Panels The connection ports are located on the rear panel. Figure 49 ATP100 Rear Panel Figure 50 ATP100W Rear Panel Figure 51 ATP200 Rear Panel ZyWALL ATP Series Users Guide 69 Chapter 3 Hardware, Interfaces and Zones Figure 52 ATP500 Rear Panel Figure 53 ATP700 / ATP800 Rear Panel Note: Make sure you connect the Zyxel Device's power cord to a socket-outlet with an earthing connection or its equivalent. The following table describes the items on the rear panel. Table 12 Rear Panel Items LABEL Console DESCRIPTION You can use the console port to manage the Zyxel Device using CLI commands. You will be prompted to enter your user name and password. See the Command Reference Guide for more information about the CLI. When configuring using the console port, you need a computer equipped with communications software configured to the following parameters:

Speed 115200 bps Data Bits 8 Parity None Stop Bit 1 Flow Control Off Use the included power cord to connect the power socket to a power outlet. Turn the power switch on if your Zyxel Device has a power switch. Attach a lock-and-cable from the Kensington lock (the small, metal-reinforced, oval hole) to a permanent object, such as a pole, to secure the Zyxel Device in place. The fans are for cooling the Zyxel Device. Make sure they are not obstructed to allow maximum ventilation. Power Lock Fan Note: Use an 8-wire Ethernet cable to run your Gigabit Ethernet connection at 1000 Mbps. Using a 4-wire Ethernet cable limits your connection to 100 Mbps. Note that the connection speed also depends on what the Ethernet device at the other end can support. 3.2 Mounting The Zyxel Device can be mounted in a rack. 3.2.1 Rack-mounting Use the following steps to mount the Zyxel Device on an EIA standard size, 19-inch rack or in a wiring closet with other equipment using a rack-mounting kit. Make sure the rack will safely support the combined weight of all the equipment it contains and that the position of the ZyWALL does not make ZyWALL ATP Series Users Guide 70 Chapter 3 Hardware, Interfaces and Zones the rack unstable or top-heavy. Take all necessary precautions to anchor the rack securely before installing the unit. Note: Leave 10 cm of clearance at the sides and 20 cm in the rear. Use a #2 Phillips screwdriver to install the screws. Note: Failure to use the proper screws may damage the unit. 1 Align one bracket with the holes on one side of the Zyxel Device and secure it with the included bracket screws (smaller than the rack-mounting screws). 2 Attach the other bracket in a similar fashion. 3 After attaching both mounting brackets, position the Zyxel Device in the rack and match up the bracket holes with the rack holes. Secure the Zyxel Device to the rack with the rack-mounting screws. 3.2.2 Wall-mounting Do the following to attach your Zyxel Device to a wall. Only the devices listed in Table 13 on page 71 can be wall mounted. The following table lists the distance X between mounting holes for each model:

Table 13 Distance X between mounting holes MODEL NAME ATP100 ATP100W ATP200 DISTANCE X 174mm (6.85) 174mm (6.85) 206mm (8.11) ZyWALL ATP Series Users Guide 71 Chapter 3 Hardware, Interfaces and Zones 1 Drill into a wall two holes 3 mm ~ 4 mm (0.12" ~ 0.16") wide, 20 mm ~ 30 mm (0.79 ~ 1.18) deep and a distance X (see the preceding table) apart. Place two screw anchors in the holes. Figure 54 Wall mounting screw specifications 2 Screw two screws with 6 mm ~ 8 mm (0.24" ~ 0.31") wide heads into the screw anchors. Do not screw the screws all the way in to the wall; leave a small gap between the head of the screw and the wall. The gap must be big enough for the screw heads to slide into the screw slots and the connection cables to run down the back of the Zyxel Device. Note: Make sure the screws are securely fixed to the wall and strong enough to hold the weight of the Zyxel Device with the connection cables. 3 Use the holes on the bottom of the Zyxel Device to hang the Zyxel Device on the screws. Wall-mount the Zyxel Device horizontally. The Zyxel Device's side panels with ventilation slots should not be facing up or down as this position is less safe. Figure 55 Wall Mounting ZyWALL ATP Series Users Guide 72 Chapter 3 Hardware, Interfaces and Zones 3.3 Default Zones, Interfaces, and Ports The default configurations for zones, interfaces, and ports are as follows. References to interfaces may be generic rather than the specific name used in your model. For example, this guide may use the WAN interface rather than wan1 or wan2, ge2 or ge3. An OPT (optional) Ethernet port can be configured as an additional WAN port, LAN, WLAN, or DMZ port. The following table shows the default physical port and interface mapping for each model at the time of writing. Table 14 Default Physical Port - Interface Mapping PORT / INTERFACE ATP100/ATP100W ATP200 ATP500 P1 sfp sfp ge1 P2 wan wan ge2 P3 P4 lan1 wan ge3 lan1 lan1 ge4 P5 lan1 lan1 ge5 P6 P7 P8 opt lan1 ge6 lan1 ge7 ge8 Table 15 Default Physical Port - Interface Mapping - ATP700 / ATP800 PORT /

INTERFACE P3 P5 P6 P7 P8 P9 P1 P2 P4 P10 P11 P12 P13 P14 ATP800 ge1 ge2 ge3 ge4 ge5 ge6 ge7 ge8 ge9 ge10 ge11 ge12 ge13 ge14 The following table shows the default interface and zone mapping for each model at the time of writing. Table 16 Default Zone - Interface Mapping ZONE / INTERFACE ATP100/ATP100W SFP sfp_ppp WAN WAN1_PPP Table 17 Default Zone - Interface Mapping LAN1 LAN2 DMZ LAN1 LAN2 DMZ OPT opt_ppp ZONE / INTERFACE WAN LAN1 LAN2 DMZ OPT ATP200 WAN1 WAN1_PPP WAN2 WAN2_PPP LAN1 LAN2 DMZ SFP SFP_PPP NO DEFAULT ZONE GE7 GE7_PPP GE8 GE8_PPP Table 18 Default Zone - Interface Mapping ZONE / INTERFACE WAN LAN DMZ OPT NO DEFAULT ZONE ATP500 ATP700 ATP800 GE4 GE5 GE3 GE4 GE2 GE2_PPP GE3 GE3_PPP GE1 GE1_PPP GE2 GE2_PPP GE6 GE5 GE7 GE7_PPP GE8 GE8_PPP GE6~GE12 GE6_PPP~GE12_PPP GE1 GE1_PPP GE13 GE13_PPP GE14 GE14_PPP ZyWALL ATP Series Users Guide 73 Chapter 3 Hardware, Interfaces and Zones 3.4 Stopping the Zyxel Device Always use Maintenance > Shutdown > Shutdown or the shutdown command before you turn off the Zyxel Device or remove the power. Not doing so can cause the firmware to become corrupt. ZyWALL ATP Series Users Guide 74 CHAPTER 4 Quick Setup Wizards 4.1 Quick Setup Overview The Web Configurator's quick setup wizards help you configure Internet and VPN connection settings. This chapter provides information on configuring the quick setup screens in the Web Configurator. See the feature-specific chapters in this Users Guide for background information. In the Web Configurator, click Quick Setup to open the first Quick Setup screen. Figure 56 Quick Setup WAN Interface Click this link to open a wizard to set up a WAN (Internet) connection. This wizard creates matching ISP account settings in the Zyxel Device if you use PPPoE or PPTP. See Section 4.2 on page 76. VPN Setup Use VPN Setup to configure a VPN (Virtual Private Network) rule for a secure connection to another computer or network. Use VPN Settings for Configuration Provisioning to set up a VPN rule that can be retrieved with the Zyxel Device IPSec VPN Client. You only need to enter a user name, password and the IP address of the Zyxel Device in the IPSec VPN Client to get all VPN settings automatically from the Zyxel Device. See Section 4.3 on page 82.Use VPN Settings for L2TP VPN Settings to configure the L2TP VPN for clients. ZyWALL ATP Series Users Guide 75 Chapter 4 Quick Setup Wizards Wizard Help If the help does not automatically display when you run the wizard, click the arrow to display it. 4.2 WAN Interface Quick Setup Click WAN Interface in the main Quick Setup screen to open the WAN Interface Quick Setup Wizard Welcome screen. Use these screens to configure an interface to connect to the Internet. Click Next. Figure 57 WAN Interface Quick Setup Wizard 4.2.1 Choose an Ethernet Interface Select a WAN interface (names vary by model) that you want to configure for a WAN connection and click Next. ZyWALL ATP Series Users Guide 76 Chapter 4 Quick Setup Wizards Figure 58 Choose an Ethernet Interface 4.2.2 Select WAN Type WAN Type Selection: Select the type of encapsulation this connection is to use. Choose Ethernet when the WAN port is used as a regular Ethernet. Otherwise, choose PPPoE, PPTP or L2TP for a dial-up connection according to the information from your ISP. Figure 59 WAN Interface Setup: Step 2 The screens vary depending on what encapsulation type you use. Refer to information provided by your ISP to know what to enter in each field. Leave a field blank if you dont have that information. Note: Enter the Internet access information exactly as your ISP gave it to you. 4.2.3 Configure WAN IP Settings Use this screen to select whether the interface should use a fixed or dynamic IP address. ZyWALL ATP Series Users Guide 77 Chapter 4 Quick Setup Wizards Figure 60 WAN Interface Setup: Step 2 Ethernet Dynamic IP Figure 61 WAN Interface Setup: Step 2 Ethernet Static IP WAN Interface: This is the interface you are configuring for Internet access. Zone: This is the security zone to which this interface and Internet connection belong. IP Address Assignment: Select Auto If your ISP did not assign you a fixed IP address. Select Static if you have a fixed IP address and enter the IP address, subnet mask, gateway IP address

(optional) and DNS server IP address(es). 4.2.4 ISP and WAN and ISP Connection Settings Use this screen to configure the ISP and WAN interface settings. This screen is read-only if you select Ethernet and set the IP Address Assignment to Auto. If you set the IP Address Assignment to static and/or select PPTP or PPPoE, enter the Internet access information exactly as your ISP gave it to you. Note: Enter the Internet access information exactly as your ISP gave it to you. ZyWALL ATP Series Users Guide 78 Chapter 4 Quick Setup Wizards Figure 62 WAN and ISP Connection Settings: (PPTP) Figure 63 WAN and ISP Connection Settings: (PPPoE) ZyWALL ATP Series Users Guide 79 Chapter 4 Quick Setup Wizards Figure 64 WAN and ISP Connection Settings: (L2TP) ISP Parameter: This section appears if the interface uses a PPPoE or PPTP Internet connection. Encapsulation: This displays the type of Internet connection you are configuring. Service Name: Type the PPPoE service name if you were given one by your ISP. Authentication Type: Use the drop-down list box to select an authentication protocol for outgoing calls. Options are:

CHAP/PAP - Your Zyxel Device accepts either CHAP or PAP when requested by this remote node. CHAP - Your Zyxel Device accepts CHAP only. PAP - Your Zyxel Device accepts PAP only. MSCHAP - Your Zyxel Device accepts MSCHAP only. MSCHAP-V2 - Your Zyxel Device accepts MSCHAP-V2 only. User Name: Type the user name given to you by your ISP. You can use alphanumeric and -_@$./

characters, and it can be up to 31 characters long. Password: Type the password associated with the user name above. Use up to 64 ASCII characters except the [] and ?. This field can be blank. Retype to Confirm: Type your password again for confirmation. Nailed-Up: Select Nailed-Up if you do not want the connection to time out. Idle Timeout: Type the time in seconds that elapses before the router automatically disconnects from the PPPoE server. 0 means no timeout. PPTP Configuration: This section only appears if the interface uses a PPTP Internet connection. Base Interface: This displays the identity of the Ethernet interface you configure to connect with a modem or router. Base IP Address: Type the (static) IP address assigned to you by your ISP. ZyWALL ATP Series Users Guide 80 Chapter 4 Quick Setup Wizards IP Subnet Mask: Type the subnet mask assigned to you by your ISP (if given). Gateway IP Address: For PPTP or L2TP, type the gateway IP address if you were given one by your ISP. Server IP: Type the IP address of the PPTP server. Connection ID: Enter the connection ID or connection name in this field. It must follow the "c:id" and

"n:name" format. For example, C:12 or N:My ISP. This field is optional and depends on the requirements of your DSL modem. You can use alphanumeric and -_: characters, and it can be up to 31 characters long. IP Address Assignment WAN Interface: This displays the identity of the interface you configure to connect with your ISP. Zone: This field displays to which security zone this interface and Internet connection will belong. IP Address: This field is read-only when the WAN interface uses a dynamic IP address. If your WAN interface uses a static IP address, enter it in this field. IP Subnet Mask: If your WAN interface uses Ethernet encapsulation with a static IP address, enter the subnet mask in this field. Gateway IP Address: Type the IP address of the Ethernet device connected to this WAN port. First DNS Server / Second DNS Server: These fields only display for an interface with a static IP address. Enter the DNS server IP address(es) in the field(s) to the right. Leave the field as 0.0.0.0 if you do not want to configure DNS servers. If you do not configure a DNS server, you must know the IP address of a machine in order to access it. 4.2.5 Quick Setup Interface Wizard: Summary This screen displays an example WAN interfaces settings. Figure 65 Interface Wizard: Summary WAN Encapsulation: This displays what encapsulation this interface uses to connect to the Internet. ZyWALL ATP Series Users Guide 81 Chapter 4 Quick Setup Wizards Service Name: This field only appears for a PPPoE interface. It displays the PPPoE service name specified in the ISP account. Server IP: This field only appears for a PPTP interface. It displays the IP address of the PPTP server. User Name: This is the user name given to you by your ISP. Nailed-Up: If No displays the connection will not time out. Yes means the Zyxel Device uses the idle timeout. Idle Timeout: This is how many seconds the connection can be idle before the router automatically disconnects from the PPPoE server. 0 means no timeout. Connection ID: If you specified a connection ID, it displays here. WAN Interface: This identifies the interface you configure to connect with your ISP. Zone: This field displays to which security zone this interface and Internet connection will belong. IP Address Assignment: This field displays whether the WAN IP address is static or dynamic (Auto). IP Address: This field displays the current IP address of the Zyxel Device WAN interface selected in this wizard. IP Subnet Mask: This field displays the subnet mask of the Zyxel Device WAN interface selected in this wizard. Gateway IP Address: This field displays the IP address of the Ethernet device connected to this WAN port. First DNS Server /Second DNS Server: If the IP Address Assignment is Static, these fields display the DNS server IP address(es). 4.3 VPN Setup Wizard Click VPN Setup in the main Quick Setup screen to open the VPN Setup Wizard Welcome screen. Figure 66 VPN Setup Wizard 4.3.1 Welcome Use wizards to create Virtual Private Network (VPN) rules. After you complete the wizard, the Phase 1 rule settings appear in the Configuration > VPN > IPSec VPN > VPN Gateway screen and the Phase 2 rule settings appear in the Configuration > VPN > IPSec VPN > VPN Connection screen. VPN Settings configures a VPN tunnel for a secure connection to another computer or network. ZyWALL ATP Series Users Guide 82 Chapter 4 Quick Setup Wizards VPN Settings for Configuration Provisioning sets up a VPN rule the Zyxel Device IPSec VPN Client can retrieve. Just enter a user name, password and the IP address of the Zyxel Device in the IPSec VPN Client to get the VPN settings automatically from the Zyxel Device. VPN Settings for L2TP VPN Settings sets up a L2TP VPN rule that the Zyxel Device IPSec L2TP VPN client can retrieve. Figure 67 VPN Setup Wizard Welcome 4.3.2 VPN Setup Wizard: Wizard Type Choose Express to create a VPN rule with the default phase 1 and phase 2 settings to connect to another ZLD-based Zyxel Device using a pre-shared key. Choose Advanced to change the default settings and/or use certificates instead of a pre-shared key to create a VPN rule to connect to another IPSec device. Figure 68 VPN Setup Wizard: Wizard Type ZyWALL ATP Series Users Guide 83 Chapter 4 Quick Setup Wizards 4.3.3 VPN Express Wizard - Scenario Click the Express radio button as shown in Figure 68 on page 83 to display the following screen. Figure 69 VPN Express Wizard: Scenario IKE (Internet Key Exchange) Version: IKEv1 and IKEv2 IKE (Internet Key Exchange) is a protocol used in security associations to send data securely. IKE uses certificates or pre-shared keys for authentication and a DiffieHellman key exchange to set up a shared session secret from which encryption keys are derived. IKEv2 supports Extended Authentication Protocol (EAP) authentication, and IKEv1 supports X-Auth. EAP is important when connecting to existing enterprise authentication systems. Scenario Rule Name: Type the name used to identify this VPN connection (and VPN gateway). You may use 1-31 alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Select the scenario that best describes your intended VPN connection. The figure on the left of the screen changes to match the scenario you select. Site-to-site - The remote IPSec device has a static IP address or a domain name. This Zyxel Device can initiate the VPN tunnel. Site-to-site with Dynamic Peer - The remote IPSec device has a dynamic IP address. Only the remote IPSec device can initiate the VPN tunnel. Remote Access (Server Role) - Allow incoming connections from IPSec VPN clients. The clients have dynamic IP addresses and are also known as dial-in users. Only the clients can initiate the VPN tunnel. ZyWALL ATP Series Users Guide 84 Chapter 4 Quick Setup Wizards Remote Access (Client Role) - Connect to an IPSec server. This Zyxel Device is the client (dial-in user) and can initiate the VPN tunnel. 4.3.4 VPN Express Wizard - Configuration Figure 70 VPN Express Wizard: Configuration My Address (interface): Select an interface from the drop-down list box to use on your Zyxel Device. Secure Gateway: Any displays in this field if it is not configurable for the chosen scenario. Otherwise, enter the WAN IP address or domain name of the remote IPSec device (secure gateway) to identify the remote IPSec router by its IP address or a domain name. Use 0.0.0.0 if the remote IPSec router has a dynamic WAN IP address. Pre-Shared Key: Type the password. Both ends of the VPN tunnel must use the same password. Use 8 to 31 case-sensitive ASCII characters or 8 to 31 pairs of hexadecimal (0-9, A-F) characters. Proceed a hexadecimal key with 0x. You will receive a PYLD_MALFORMED (payload malformed) packet if the same pre-shared key is not used on both ends. Local Policy (IP/Mask): Type the IP address of a computer on your network that can use the tunnel. You can also specify a subnet. This must match the remote IP address configured on the remote IPSec device. Remote Policy (IP/Mask): Any displays in this field if it is not configurable for the chosen scenario. Otherwise, type the IP address of a computer behind the remote IPSec device. You can also specify a subnet. This must match the local IP address configured on the remote IPSec device. 4.3.5 VPN Express Wizard - Summary This screen provides a read-only summary of the VPN tunnels configuration and commands that you can copy and paste into another ZLD-based Zyxel Devices command line interface to configure it. ZyWALL ATP Series Users Guide 85 Chapter 4 Quick Setup Wizards Figure 71 VPN Express Wizard: Summary Rule Name: Identifies the VPN gateway policy. Secure Gateway: IP address or domain name of the remote IPSec device. If this field displays Any, only the remote IPSec device can initiate the VPN connection. Pre-Shared Key: VPN tunnel password. It identifies a communicating party during a phase 1 IKE negotiation. Local Policy: IP address and subnet mask of the computers on the network behind your Zyxel Device that can use the tunnel. Remote Policy: IP address and subnet mask of the computers on the network behind the remote IPSec device that can use the tunnel. If this field displays Any, only the remote IPSec device can initiate the VPN connection. Copy and paste the Configuration for Secure Gateway commands into another ZLD-based Zyxel Devices command line interface to configure it to serve as the other end of this VPN tunnel. You can also use a text editor to save these commands as a shell script file with a .zysh filename extension. Use the file manager to run the script in order to configure the VPN connection. See the commands reference guide for details on the commands displayed in this list. 4.3.6 VPN Express Wizard - Finish Now the rule is configured on the Zyxel Device. The Phase 1 rule settings appear in the VPN > IPSec VPN

> VPN Gateway screen and the Phase 2 rule settings appear in the VPN > IPSec VPN > VPN Connection screen. ZyWALL ATP Series Users Guide 86 Chapter 4 Quick Setup Wizards Figure 72 VPN Express Wizard: Finish Click Close to exit the wizard. 4.3.7 VPN Advanced Wizard - Scenario Click the Advanced radio button as shown in Figure 68 on page 83 to display the following screen. Figure 73 VPN Advanced Wizard: Scenario ZyWALL ATP Series Users Guide 87 Chapter 4 Quick Setup Wizards IKE (Internet Key Exchange) Version: IKEv1 and IKEv2 IKE (Internet Key Exchange) is a protocol used in security associations to send data securely. IKE uses certificates or pre-shared keys for authentication and a DiffieHellman key exchange to set up a shared session secret from which encryption keys are derived. IKEv2 supports Extended Authentication Protocol (EAP) authentication, and IKEv1 supports X-Auth. EAP is important when connecting to existing enterprise authentication systems. Scenario Rule Name: Type the name used to identify this VPN connection (and VPN gateway). You may use 1-31 alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Select the scenario that best describes your intended VPN connection. The figure on the left of the screen changes to match the scenario you select. Site-to-site - The remote IPSec device has a static IP address or a domain name. This Zyxel Device can initiate the VPN tunnel. Site-to-site with Dynamic Peer - The remote IPSec device has a dynamic IP address. Only the remote IPSec device can initiate the VPN tunnel. Remote Access (Server Role) - Allow incoming connections from IPSec VPN clients. The clients have dynamic IP addresses and are also known as dial-in users. Only the clients can initiate the VPN tunnel. Remote Access (Client Role) - Connect to an IPSec server. This Zyxel Device is the client (dial-in user) and can initiate the VPN tunnel. 4.3.8 VPN Advanced Wizard - Phase 1 Settings There are two phases to every IKE (Internet Key Exchange) negotiation phase 1 (Authentication) and phase 2 (Key Exchange). A phase 1 exchange establishes an IKE SA (Security Association). ZyWALL ATP Series Users Guide 88 Chapter 4 Quick Setup Wizards Figure 74 VPN Advanced Wizard: Phase 1 Settings Secure Gateway: Any displays in this field if it is not configurable for the chosen scenario. Otherwise, enter the WAN IP address or domain name of the remote IPSec device (secure gateway) to identify the remote IPSec device by its IP address or a domain name. Use 0.0.0.0 if the remote IPSec device has a dynamic WAN IP address. My Address (interface): Select an interface from the drop-down list box to use on your Zyxel Device. Negotiation Mode: This displays Main or Aggressive:

Main encrypts the ZyWALL/USGs and remote IPSec routers identities but takes more time to establish the IKE SA Aggressive is faster but does not encrypt the identities. The ZyWALL/USG and the remote IPSec router must use the same negotiation mode. Multiple SAs connecting through a secure gateway must have the same negotiation mode. Encryption Algorithm: 3DES and AES use encryption. The longer the key, the higher the security (this may affect throughput). Both sender and receiver must use the same secret key, which can be used to encrypt and decrypt the message or to generate and verify a message authentication code. The DES encryption algorithm uses a 56-bit key. Triple DES (3DES) is a variation on DES that uses a 168-bit key. As a result, 3DES is more secure than DES. It also requires more processing power, resulting in increased latency and decreased throughput. AES128 uses a 128-bit key and is faster than 3DES. AES192 uses a 192-bit key, and AES256 uses a 256-bit key. Authentication Algorithm: MD5 gives minimal security and SHA512 gives the highest security. MD5

(Message Digest 5) and SHA (Secure Hash Algorithm) are hash algorithms used to authenticate packet data. The stronger the algorithm the slower it is. Key Group: DH5 is more secure than DH1 or DH2 (although it may affect throughput). DH1 (default) refers to Diffie-Hellman Group 1 a 768 bit random number. DH2 refers to Diffie-Hellman Group 2 a 1024 bit (1Kb) random number. DH5 refers to Diffie-Hellman Group 5 a 1536 bit random number. SA Life Time: Set how often the Zyxel Device renegotiates the IKE SA. A short SA life time increases security, but renegotiation temporarily disconnects the VPN tunnel. NAT Traversal: Select this if the VPN tunnel must pass through NAT (there is a NAT router between the IPSec devices). ZyWALL ATP Series Users Guide 89 Chapter 4 Quick Setup Wizards Note: The remote IPSec device must also have NAT traversal enabled. See the help in the main IPSec VPN screens for more information. Dead Peer Detection (DPD) has the Zyxel Device make sure the remote IPSec device is there before transmitting data through the IKE SA. If there has been no traffic for at least 15 seconds, the Zyxel Device sends a message to the remote IPSec device. If it responds, the Zyxel Device transmits the data. If it does not respond, the Zyxel Device shuts down the IKE SA. Authentication Method: Select Pre-Shared Key to use a password or Certificate to use one of the Zyxel Devices certificates. 4.3.9 VPN Advanced Wizard - Phase 2 Phase 2 in an IKE uses the SA that was established in phase 1 to negotiate SAs for IPSec. Figure 75 VPN Advanced Wizard: Phase 2 Settings Active Protocol: ESP is compatible with NAT, AH is not. Encapsulation: Tunnel is compatible with NAT, Transport is not. Encryption Algorithm: 3DES and AES use encryption. The longer the AES key, the higher the security

(this may affect throughput). Null uses no encryption. Authentication Algorithm: MD5 gives minimal security and SHA512 gives the highest security. MD5

(Message Digest 5) and SHA (Secure Hash Algorithm) are hash algorithms used to authenticate packet data. The stronger the algorithm the slower it is. SA Life Time: Set how often the Zyxel Device renegotiates the IKE SA. A short SA life time increases security, but renegotiation temporarily disconnects the VPN tunnel. Perfect Forward Secrecy (PFS): Disabling PFS allows faster IPSec setup, but is less secure. Select DH1, DH2 or DH5 to enable PFS. DH5 is more secure than DH1 or DH2 (although it may affect throughput). DH1 refers to Diffie-Hellman Group 1 a 768 bit random number. DH2 refers to Diffie-Hellman Group 2 a 1024 bit (1Kb) random number. DH5 refers to Diffie-Hellman Group 5 a 1536 bit random number (more secure, yet slower). Local Policy (IP/Mask): Type the IP address of a computer on your network. You can also specify a subnet. This must match the remote IP address configured on the remote IPSec device. ZyWALL ATP Series Users Guide 90 Chapter 4 Quick Setup Wizards Remote Policy (IP/Mask): Type the IP address of a computer behind the remote IPSec device. You can also specify a subnet. This must match the local IP address configured on the remote IPSec device. Nailed-Up: This displays for the site-to-site and remote access client role scenarios. Select this to have the Zyxel Device automatically renegotiate the IPSec SA when the SA life time expires. 4.3.10 VPN Advanced Wizard - Summary This is a read-only summary of the VPN tunnel settings. Figure 76 VPN Advanced Wizard: Summary Rule Name: Identifies the VPN connection (and the VPN gateway). Secure Gateway: IP address or domain name of the remote IPSec device. Pre-Shared Key: VPN tunnel password. Certificate: The certificate the Zyxel Device uses to identify itself when setting up the VPN tunnel. Local Policy: IP address and subnet mask of the computers on the network behind your Zyxel Device that can use the tunnel. Remote Policy: IP address and subnet mask of the computers on the network behind the remote IPSec device that can use the tunnel. ZyWALL ATP Series Users Guide 91 Chapter 4 Quick Setup Wizards Phase 1 Negotiation Mode: This displays Main or Aggressive:

Main encrypts the ZyWALL/USGs and remote IPSec routers identities but takes more time to establish the IKE SA Aggressive is faster but does not encrypt the identities. The ZyWALL/USG and the remote IPSec router must use the same negotiation mode. Multiple SAs connecting through a secure gateway must have the same negotiation mode. Encryption Algorithm: This displays the encryption method used. The longer the key, the higher the security, the lower the throughput (possibly). DES uses a 56-bit key. 3DES uses a 168-bit key. AES128 uses a 128-bit key AES192 uses a 192-bit key AES256 uses a 256-bit key. Authentication Algorithm: This displays the authentication algorithm used. The stronger the algorithm, the slower it is. MD5 gives minimal security. SHA1 gives higher security SHA256 gives the highest security. Key Group: This displays the Diffie-Hellman (DH) key group used. DH5 is more secure than DH1 or DH2

(although it may affect throughput). DH1 uses a 768 bit random number. DH2 uses a 1024 bit (1Kb) random number. DH5 uses a 1536 bit random number. Phase 2 Active Protocol: This displays ESP (compatible with NAT) or AH. Encapsulation: This displays Tunnel (compatible with NAT) or Transport. Encryption Algorithm: This displays the encryption method used. The longer the key, the higher the security, the lower the throughput (possibly). DES uses a 56-bit key. 3DES uses a 168-bit key. AES128 uses a 128-bit key AES192 uses a 192-bit key AES256 uses a 256-bit key. Null uses no encryption. Authentication Algorithm: This displays the authentication algorithm used. The stronger the algorithm, the slower it is. MD5 gives minimal security. SHA1 gives higher security SHA256 gives the highest security. ZyWALL ATP Series Users Guide 92 Chapter 4 Quick Setup Wizards Copy and paste the Configuration for Remote Gateway commands into another ZLD-based Zyxel Devices command line interface. Click Save to save the VPN rule. 4.3.11 VPN Advanced Wizard - Finish Now the rule is configured on the Zyxel Device. The Phase 1 rule settings appear in the VPN > IPSec VPN

> VPN Gateway screen and the Phase 2 rule settings appear in the VPN > IPSec VPN > VPN Connection screen. Figure 77 VPN Wizard: Finish Click Close to exit the wizard. ZyWALL ATP Series Users Guide 93 Chapter 4 Quick Setup Wizards 4.4 VPN Settings for Configuration Provisioning Wizard:

Wizard Type Use VPN Settings for Configuration Provisioning to set up a VPN rule that can be retrieved with the Zyxel Device IPSec VPN Client. VPN rules for the Zyxel Device IPSec VPN Client have certain restrictions. They must not contain the following settings:

AH active protocol NULL encryption SHA512 authentication A subnet or range remote policy Choose Express to create a VPN rule with the default phase 1 and phase 2 settings and to use a pre-

shared key. Choose Advanced to change the default settings and/or use certificates instead of a pre-shared key in the VPN rule. Figure 78 VPN Settings for Configuration Provisioning Express Wizard: Wizard Type 4.4.1 Configuration Provisioning Express Wizard - VPN Settings Click the Express radio button as shown in the previous screen to display the following screen. ZyWALL ATP Series Users Guide 94 Chapter 4 Quick Setup Wizards Figure 79 VPN for Configuration Provisioning Express Wizard: Settings Scenario IKE (Internet Key Exchange) is a protocol used in security associations to send data securely. IKE uses certificates or pre-shared keys for authentication and a DiffieHellman key exchange to set up a shared session secret from which encryption keys are derived. IKEv2 supports Extended Authentication Protocol (EAP) authentication, and IKEv1 supports X-Auth. EAP is important when connecting to existing enterprise authentication systems. Rule Name: Type the name used to identify this VPN connection (and VPN gateway). You may use 1-

31 alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Application Scenario: Only the Remote Access (Server Role) is allowed in this wizard. It allows incoming connections from the Zyxel Device IPSec VPN Client. 4.4.2 Configuration Provisioning VPN Express Wizard - Configuration Click Next to continue the wizard. ZyWALL ATP Series Users Guide 95 Chapter 4 Quick Setup Wizards Figure 80 VPN for Configuration Provisioning Express Wizard: Configuration My Address (interface): Select an interface from the drop-down list box to use on your Zyxel Device. Secure Gateway: Any displays in this field because it is not configurable in this wizard. It allows incoming connections from the Zyxel Device IPSec VPN Client. Pre-Shared Key: Type the password. Both ends of the VPN tunnel must use the same password. Use 8 to 31 case-sensitive ASCII characters or 8 to 31 pairs of hexadecimal (0-9, A-F) characters. Proceed a hexadecimal key with 0x. You will receive a PYLD_MALFORMED (payload malformed) packet if the same pre-shared key is not used on both ends. Local Policy (IP/Mask): Type the IP address of a computer on your network. You can also specify a subnet. This must match the remote IP address configured on the remote IPSec device. Remote Policy (IP/Mask): Any displays in this field because it is not configurable in this wizard. 4.4.3 VPN Settings for Configuration Provisioning Express Wizard - Summary This screen has a read-only summary of the VPN tunnels configuration and commands you can copy and paste into another ZLD-based Zyxel Devices command line interface to configure it. ZyWALL ATP Series Users Guide 96 Chapter 4 Quick Setup Wizards Figure 81 VPN for Configuration Provisioning Express Wizard: Summary Rule Name: Identifies the VPN gateway policy. Secure Gateway: Any displays in this field because it is not configurable in this wizard. It allows incoming connections from the Zyxel Device IPSec VPN Client. Pre-Shared Key: VPN tunnel password. It identifies a communicating party during a phase 1 IKE negotiation. Local Policy: (Static) IP address and subnet mask of the computers on the network behind your Zyxel Device that can be accessed using the tunnel. Remote Policy: Any displays in this field because it is not configurable in this wizard. The Configuration for Secure Gateway displays the configuration that the Zyxel Device IPSec VPN Client will get from the Zyxel Device. Click Save to save the VPN rule. 4.4.4 VPN Settings for Configuration Provisioning Express Wizard - Finish Now the rule is configured on the Zyxel Device. The Phase 1 rule settings appear in the Configuration >

VPN > IPSec VPN > VPN Gateway screen and the Phase 2 rule settings appear in the Configuration > VPN

> IPSec VPN > VPN Connection screen. Enter the IP address of the Zyxel Device in the Zyxel Device IPSec VPN Client to get all these VPN settings automatically from the Zyxel Device. ZyWALL ATP Series Users Guide 97 Chapter 4 Quick Setup Wizards Figure 82 VPN for Configuration Provisioning Express Wizard: Finish Click Close to exit the wizard. 4.4.5 VPN Settings for Configuration Provisioning Advanced Wizard -

Scenario Click the Advanced radio button as shown in the screen shown in Figure 78 on page 94 to display the following screen. ZyWALL ATP Series Users Guide 98 Chapter 4 Quick Setup Wizards Figure 83 VPN for Configuration Provisioning Advanced Wizard: Scenario Settings IKE (Internet Key Exchange) is a protocol used in security associations to send data securely. IKE uses certificates or pre-shared keys for authentication and a DiffieHellman key exchange to set up a shared session secret from which encryption keys are derived. IKEv2 supports Extended Authentication Protocol (EAP) authentication, and IKEv1 supports X-Auth. EAP is important when connecting to existing enterprise authentication systems. Rule Name: Type the name used to identify this VPN connection (and VPN gateway). You may use 1-

31 alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Application Scenario: Only the Remote Access (Server Role) is allowed in this wizard. It allows incoming connections from the Zyxel Device IPSec VPN Client. Click Next to continue the wizard. 4.4.6 VPN Settings for Configuration Provisioning Advanced Wizard - Phase 1 Settings There are two phases to every IKE (Internet Key Exchange) negotiation phase 1 (Authentication) and phase 2 (Key Exchange). A phase 1 exchange establishes an IKE SA (Security Association). ZyWALL ATP Series Users Guide 99 Chapter 4 Quick Setup Wizards Figure 84 VPN for Configuration Provisioning Advanced Wizard: Phase 1 Settings Secure Gateway: Any displays in this field because it is not configurable in this wizard. It allows incoming connections from the Zyxel Device IPSec VPN Client. My Address (interface): Select an interface from the drop-down list box to use on your Zyxel Device. Negotiation Mode: This displays Main or Aggressive:

Main encrypts the ZyWALL/USGs and remote IPSec routers identities but takes more time to establish the IKE SA Aggressive is faster but does not encrypt the identities. The ZyWALL/USG and the remote IPSec router must use the same negotiation mode. Multiple SAs connecting through a secure gateway must have the same negotiation mode. Encryption Algorithm: 3DES and AES use encryption. The longer the key, the higher the security (this may affect throughput). Both sender and receiver must know the same secret key, which can be used to encrypt and decrypt the message or to generate and verify a message authentication code. The DES encryption algorithm uses a 56-bit key. Triple DES (3DES) is a variation on DES that uses a 168-

bit key. As a result, 3DES is more secure than DES. It also requires more processing power, resulting in increased latency and decreased throughput. AES128 uses a 128-bit key and is faster than 3DES. AES192 uses a 192-bit key and AES256 uses a 256-bit key. Authentication Algorithm: MD5 (Message Digest 5) and SHA (Secure Hash Algorithm) are hash algorithms used to authenticate packet data. MD5 gives minimal security. SHA1 gives higher security and SHA256 gives the highest security. The stronger the algorithm, the slower it is. Key Group: DH5 is more secure than DH1 or DH2 (although it may affect throughput). DH1 (default) refers to Diffie-Hellman Group 1 a 768 bit random number. DH2 refers to Diffie-Hellman Group 2 a 1024 bit (1Kb) random number. DH5 refers to Diffie-Hellman Group 5 a 1536 bit random number. SA Life Time: Set how often the Zyxel Device renegotiates the IKE SA. A short SA life time increases security, but renegotiation temporarily disconnects the VPN tunnel. Authentication Method: Select Pre-Shared Key to use a password or Certificate to use one of the Zyxel Devices certificates. ZyWALL ATP Series Users Guide 100 Chapter 4 Quick Setup Wizards 4.4.7 VPN Settings for Configuration Provisioning Advanced Wizard - Phase 2 Phase 2 in an IKE uses the SA that was established in phase 1 to negotiate SAs for IPSec. Figure 85 VPN for Configuration Provisioning Advanced Wizard: Phase 2 Settings Active Protocol: ESP is compatible with NAT. AH is not available in this wizard. Encapsulation: Tunnel is compatible with NAT, Transport is not. Encryption Algorithm: 3DES and AES use encryption. The longer the AES key, the higher the security

(this may affect throughput). Null uses no encryption. Authentication Algorithm: MD5 (Message Digest 5) and SHA (Secure Hash Algorithm) are hash algorithms used to authenticate packet data. MD5 gives minimal security. SHA1 gives higher security and SHA256 gives the highest security. The stronger the algorithm, the slower it is. SA Life Time: Set how often the Zyxel Device renegotiates the IKE SA. A short SA life time increases security, but renegotiation temporarily disconnects the VPN tunnel. Perfect Forward Secrecy (PFS): Disabling PFS allows faster IPSec setup, but is less secure. Select DH1, DH2 or DH5 to enable PFS. DH5 is more secure than DH1 or DH2 (although it may affect throughput). DH1 refers to Diffie-Hellman Group 1 a 768 bit random number. DH2 refers to Diffie-Hellman Group 2 a 1024 bit (1Kb) random number. DH5 refers to Diffie-Hellman Group 5 a 1536 bit random number (more secure, yet slower). Local Policy (IP/Mask): Type the IP address of a computer on your network. You can also specify a subnet. This must match the remote IP address configured on the remote IPSec device. Remote Policy (IP/Mask): Any displays in this field because it is not configurable in this wizard. Nailed-Up: This displays for the site-to-site and remote access client role scenarios. Select this to have the Zyxel Device automatically renegotiate the IPSec SA when the SA life time expires. 4.4.8 VPN Settings for Configuration Provisioning Advanced Wizard -

Summary This is a read-only summary of the VPN tunnel settings. ZyWALL ATP Series Users Guide 101 Chapter 4 Quick Setup Wizards Figure 86 VPN for Configuration Provisioning Advanced Wizard: Summary Summary Rule Name: Identifies the VPN connection (and the VPN gateway). Secure Gateway: Any displays in this field because it is not configurable in this wizard. It allows incoming connections from the Zyxel Device IPSec VPN Client. Pre-Shared Key: VPN tunnel password. Local Policy: IP address and subnet mask of the computers on the network behind your Zyxel Device that can use the tunnel. Remote Policy: Any displays in this field because it is not configurable in this wizard. Phase 1 Negotiation Mode: This displays Main or Aggressive:

Main encrypts the ZyWALL/USGs and remote IPSec routers identities but takes more time to establish the IKE SA ZyWALL ATP Series Users Guide 102 Chapter 4 Quick Setup Wizards Aggressive is faster but does not encrypt the identities. The ZyWALL/USG and the remote IPSec router must use the same negotiation mode. Multiple SAs connecting through a secure gateway must have the same negotiation mode. Encryption Algorithm: This displays the encryption method used. The longer the key, the higher the security, the lower the throughput (possibly). DES uses a 56-bit key. 3DES uses a 168-bit key. AES128 uses a 128-bit key AES192 uses a 192-bit key AES256 uses a 256-bit key. Authentication Algorithm: This displays the authentication algorithm used. The stronger the algorithm, the slower it is. MD5 gives minimal security. SHA1 gives higher security SHA256 gives the highest security. Key Group: This displays the Diffie-Hellman (DH) key group used. DH5 is more secure than DH1 or DH2

(although it may affect throughput). DH1 uses a 768 bit random number. DH2 uses a 1024 bit (1Kb) random number. DH5 uses a 1536 bit random number. Phase 2 Active Protocol: This displays ESP (compatible with NAT) or AH. Encapsulation: This displays Tunnel (compatible with NAT) or Transport. Encryption Algorithm: This displays the encryption method used. The longer the key, the higher the security, the lower the throughput (possibly). DES uses a 56-bit key. 3DES uses a 168-bit key. AES128 uses a 128-bit key AES192 uses a 192-bit key AES256 uses a 256-bit key. Null uses no encryption. Authentication Algorithm: This displays the authentication algorithm used. The stronger the algorithm, the slower it is. MD5 gives minimal security. SHA1 gives higher security SHA256 gives the highest security. The Configuration for Secure Gateway displays the configuration that the Zyxel Device IPSec VPN Client will get from the Zyxel Device. Click Save to save the VPN rule. ZyWALL ATP Series Users Guide 103 Chapter 4 Quick Setup Wizards 4.4.9 VPN Settings for Configuration Provisioning Advanced Wizard- Finish Now the rule is configured on the Zyxel Device. The Phase 1 rule settings appear in the VPN > IPSec VPN

> VPN Gateway screen and the Phase 2 rule settings appear in the VPN > IPSec VPN > VPN Connection screen. Enter the IP address of the Zyxel Device in the Zyxel Device IPSec VPN Client to get all these VPN settings automatically from the Zyxel Device. Figure 87 VPN for Configuration Provisioning Advanced Wizard: Finish Click Close to exit the wizard. 4.5 VPN Settings for L2TP VPN Settings Wizard Use VPN Settings for L2TP VPN Settings to set up an L2TP VPN rule. Click Configuration > Quick Setup >

VPN Setup and select VPN Settings for L2TP VPN Settings to see the following screen. ZyWALL ATP Series Users Guide 104 Chapter 4 Quick Setup Wizards Figure 88 VPN Settings for L2TP VPN Settings Wizard: L2TP VPN Settings Click Next to continue the wizard. 4.5.1 L2TP VPN Settings Figure 89 VPN Settings for L2TP VPN Settings Wizard: L2TP VPN Settings Rule Name: Type the name used to identify this L2TP VPN connection (and L2TP VPN gateway). You may use 1-31 alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. My Address (interface): Select one of the interfaces from the pull down menu to apply the L2TP VPN rule. ZyWALL ATP Series Users Guide 105 Chapter 4 Quick Setup Wizards Pre-Shared Key: Type the password. Both ends of the VPN tunnel must use the same password. Use 8 to 31 case-sensitive ASCII characters or 8 to 31 pairs of hexadecimal (0-9, A-F) characters. Proceed a hexadecimal key with 0x. You will receive a PYLD_MALFORMED (payload malformed) packet if the same pre-shared key is not used on both ends. Click Next to continue the wizard. 4.5.2 L2TP VPN Settings Figure 90 VPN Settings for L2TP VPN Settings Wizard: L2TP VPN Settings IP Address Pool: Select Range or Subnet from the pull down menu. This IP address pool is used to assign to the L2TP VPN clients. Starting IP Address: Enter the starting IP address in the field. End IP Address: Enter the ending IP address in the field. Network: Enter the IPv4 IP address in this field if you selected SUBNET. Netmask: Enter the associated subnet mask of the subnet in this field. First DNS Server (Optional): Enter the first DNS server IP address in the field. Leave the filed as 0.0.0.0 if you do not want to configure DNS servers. If you do not configure a DNS server you must know the IP address of a machine in order to access it. Second DNS Server (Optional): Enter the second DNS server IP address in the field. Leave the filed as 0.0.0.0 if you do not want to configure DNS servers. If you do not configure a DNS server you must know the IP address of a machine in order to access it. Allow L2TP traffic Through WAN: Select this check box to allow traffic from L2TP clients to go to the Internet. Click Next to continue the wizard. Note: DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa. The DNS server is extremely important because without it, you must know the IP address of a computer before you can access it. The Zyxel Device uses a system DNS server (in the order you specify here) to resolve domain names for VPN, DDNS and the time server. 4.5.3 VPN Settings for L2TP VPN Setting Wizard - Summary This is a read-only summary of the L2TP VPN settings. ZyWALL ATP Series Users Guide 106 Chapter 4 Quick Setup Wizards Figure 91 VPN Settings for L2TP VPN Settings Advanced Settings Wizard: Summary Rule Name: Identifies the L2TP VPN connection (and the L2TP VPN gateway). Secure Gateway Any displays in this field because it is not configurable in this wizard. It allows incoming connections from the L2TP VPN Client. Pre-Shared Key: L2TP VPN tunnel password. My Address (Interface): This displays the interface to use on your Zyxel Device for the L2TP tunnel. IP Address Pool: This displays the IP address pool used to assign to the L2TP VPN clients. Click Save to complete the L2TP VPN Setting and the following screen will show. ZyWALL ATP Series Users Guide 107 Chapter 4 Quick Setup Wizards 4.5.4 VPN Settings for L2TP VPN Setting Wizard Completed Figure 92 VPN Settings for L2TP VPN Settings Wizard: Finish Now the rule is configured on the Zyxel Device. The L2TP VPN rule settings appear in the Configuration >

VPN > L2TP VPN screen and also in the Configuration > VPN > IPSec VPN > VPN Connection and VPN Gateway screen. ZyWALL ATP Series Users Guide 108 CHAPTER 5 Dashboard 5.1 Overview Use the Dashboard screens to check status information about the Zyxel Device. 5.1.1 What You Can Do in this Chapter Use the main Dashboard screen to see the Zyxel Devices general device information, system status, and system resource usage. You can also display other status screens for more information. Use the Dashboard screens to view the following. Device Information Screen on page 111 System Status Screen on page 112 Tx/Rx Statistics on page 112 The Latest Logs Screen on page 113 System Resources Screen on page 113 DHCP Table Screen on page 114 Number of Login Users Screen on page 115 Current Login User on page 116 VPN Status on page 116 SSL VPN Status on page 116 The Advanced Threat Protection Screen on page 117 5.2 The General Screen The Dashboard screen displays when you log into the Zyxel Device or click Dashboard in the navigation panel. The dashboard displays general device information, system status, system resource usage, licensed service status, and interface status in widgets that you can re-arrange to suit your needs. You can also collapse, refresh, and close individual widgets. Click on the icon to go to the OneSecurity website where there is guidance on configuration walkthroughs, troubleshooting, and other information. The following screen is an example of a Brand 2.0 web configurator web style. ZyWALL ATP Series Users Guide 109 Chapter 5 Dashboard Figure 93 Dashboard The following table describes the labels in this screen. Table 19 Dashboard LABEL Refresh Now Virtual Device Rear Panel Front Panel Name Status DESCRIPTION Click this to update the widgets information immediately. Click this to view details about the Zyxel Devices rear panel. Hover your cursor over a connected interface or slot to display status details. Click this to view details about the status of the Zyxel Devices front panel LEDs and connections. See Section 3.1.1 on page 67 for LED descriptions. An unconnected interface or slot appears grayed out. The following front and rear panel labels display when you hover your cursor over a connected interface or slot. This field displays the name of each interface. This field displays the current status of each interface or device installed in a slot. The possible values depend on what type of interface it is. Inactive - The Ethernet interface is disabled. Down - The Ethernet interface does not have any physical ports associated with it or the Ethernet interface is enabled but not connected. Speed / Duplex - The Ethernet interface is enabled and connected. This field displays the port speed and duplex setting (Full or Half). The status for a WLAN card is none. For cellular (mobile broadband) interfaces, see Section 9.6 on page 250 for the status that can appear. For the auxiliary interface:

Inactive - The auxiliary interface is disabled. Connected - The auxiliary interface is enabled and connected. Disconnected - The auxiliary interface is not connected. ZyWALL ATP Series Users Guide 110 Chapter 5 Dashboard Table 19 Dashboard (continued) LABEL Zone IP Address/

Mask DESCRIPTION This field displays the zone to which the interface is currently assigned. This field displays the current IP address and subnet mask assigned to the interface. If the interface is a member of an active virtual router, this field displays the IP address it is currently using. This is either the static IP address of the interface (if it is the master) or the management IP address (if it is a backup). 5.2.1 Device Information Screen The Device Information screen displays Zyxel Devices system and model name, serial number, MAC address and firmware version shown in the below screen. Figure 94 Dashboard > Device Information (Example) This table describes the fields in the above screen. System Name Serial Number Table 20 Dashboard > Device Information DESCRIPTION LABEL This field displays the name used to identify the Zyxel Device on any network. Click the link and open the Host Name screen where you can edit and make changes to the system and domain name. This field displays the serial number of this Zyxel Device. The serial number is used for device tracking and control. This field displays the MAC addresses used by the Zyxel Device. Each physical port has one MAC address. The first MAC address is assigned to physical port 1, the second MAC address is assigned to physical port 2, and so on. This field displays the version number and date of the firmware the Zyxel Device is currently running. Click the link to open the Firmware Package screen where you can upload firmware. MAC Address Range Firmware Version ZyWALL ATP Series Users Guide 111 Chapter 5 Dashboard 5.2.2 System Status Screen Figure 95 Dashboard > System Status (Example) This table describes the fields in the above screen. Table 21 Dashboard > System Status LABEL Boot Status System Uptime Current Date/Time 5.2.3 Tx/Rx Statistics DESCRIPTION This field displays details about the Zyxel Devices startup state. OK - The Zyxel Device started up successfully. Firmware update OK - A firmware update was successful. Problematic configuration after firmware update - The application of the configuration failed after a firmware upgrade. System default configuration - The Zyxel Device successfully applied the system default configuration. This occurs when the Zyxel Device starts for the first time or you intentionally reset the Zyxel Device to the system default settings. Fallback to lastgood configuration - The Zyxel Device was unable to apply the startup-config.conf configuration file and fell back to the lastgood.conf configuration file. Fallback to system default configuration - The Zyxel Device was unable to apply the lastgood.conf configuration file and fell back to the system default configuration file

(system-default.conf). Booting in progress - The Zyxel Device is still applying the system configuration. This field displays how long the Zyxel Device has been running since it last restarted or was turned on. This field displays the current date and time in the Zyxel Device. The format is yyyy-

mm-dd hh:mm:ss. Click on the link to see the Date/Time screen where you can make edits and changes to the date, time and time zone information. This screen displays a line graph of packet statistics for each physical port. Figure 96 Dashboard > Tx/Rx Statistics ZyWALL ATP Series Users Guide 112 Chapter 5 Dashboard This table describes the fields in the above screen. Table 22 Dashboard > The Lastest Logs LABEL Mbps Time DESCRIPTION The y-axis represents the speed of transmission or reception. The x-axis shows the time period over which the transmission or reception occurred. 5.2.4 The Latest Logs Screen Figure 97 Dashboard > The Lastest Logs This table describes the fields in the above screen. Table 23 Dashboard > The Lastest Logs LABEL

#

Time Priority Category Message Source Destination DESCRIPTION This is the entrys rank in the list of alert logs. This field displays the date and time the log was created. This field displays the severity of the log. This field displays the type of log generated. This field displays the actual log message. This field displays the source address (if any) in the packet that generated the log. This field displays the destination address (if any) in the packet that generated the log. 5.2.5 System Resources Screen Click the bar to see a graphic on that resource. Figure 98 Dashboard > System Resources ZyWALL ATP Series Users Guide 113 Chapter 5 Dashboard This table describes the fields in the above screen. CPU Usage Memory Usage Table 24 Dashboard > System Resources DESCRIPTION LABEL This field displays what percentage of the Zyxel Devices processing capability is currently being used. Hover your cursor over this field to display the Show CPU Usage icon that takes you to a chart of the Zyxel Devices recent CPU usage. This field displays what percentage of the Zyxel Devices RAM is currently being used. Hover your cursor over this field to display the Show Memory Usage icon that takes you to a chart of the Zyxel Devices recent memory usage. This field displays what percentage of the Zyxel Devices onboard flash memory is currently being used. This field shows how much storage in the USB device connected to the Zyxel Device is in use. This field shows how many sessions, established and non-established, that pass through/from/to/within the ZyWALL. Hover your cursor over this field to display icons. Click the Detail icon to go to the Session Monitor screen to see details about the active sessions. Click the Show Active Sessions icon to display a chart of Zyxel Devices recent session usage. USB Storage Usage Active Sessions Flash Usage 5.2.6 DHCP Table Screen Click on the number to look at the IP addresses currently assigned to DHCP clients and the IP addresses reserved for specific MAC addresses. The following screen will show. Figure 99 Dashboard > DHCP Table This table describes the fields in the above screen. Table 25 Dashboard > DHCP Table LABEL Refresh Interval Refresh Now

#

Interface DESCRIPTION Select how often you want this window to be updated automatically. Click this to update the information in the window right away. This field is a sequential value, and it is not associated with a specific entry. This field identifies the interface that assigned an IP address to a DHCP client. ZyWALL ATP Series Users Guide 114 Chapter 5 Dashboard Table 25 Dashboard > DHCP Table (continued) LABEL IP Address DESCRIPTION This field displays the IP address currently assigned to a DHCP client or reserved for a specific MAC address. Click the columns heading cell to sort the table entries by IP address. Click the heading cell again to reverse the sort order. This field displays the name used to identify this device on the network (the computer name). The Zyxel Device learns these from the DHCP client requests. None shows here for a static DHCP entry. This field displays the MAC address to which the IP address is currently assigned or for which the IP address is reserved. Click the columns heading cell to sort the table entries by MAC address. Click the heading cell again to reverse the sort order. This is the period of time DHCP-assigned addresses is used. For a static DHCP entry, the host name or the description you configured shows here. This field is blank for dynamic DHCP entries. If this field is selected, this entry is a static DHCP entry. The IP address is reserved for the MAC address. Host Name MAC Address Expiration Time Description Reserve If this field is clear, this entry is a dynamic DHCP entry. The IP address is assigned to a DHCP client. To create a static DHCP entry using an existing dynamic DHCP entry, select this field, and then click Apply. To remove a static DHCP entry, clear this field, and then click Apply. 5.2.7 Number of Login Users Screen Click the Number of Login Users link to see the following screen. Figure 100 Dashboard > Number of Login Users This table describes the fields in the above screen. Table 26 Dashboard > Number of Login Users LABEL

#

User ID Reauth/Lease Time Session Timeout DESCRIPTION This field is a sequential value and is not associated with any entry. This field displays the user name of each user who is currently logged in to the Zyxel Device. This field displays the amount of reauthentication time remaining and the amount of lease time remaining for each user. This field displays the total account of time the account (authenticated by an external server) can use to log into the UAG or access the Internet through the Zyxel Device. Type IP address This shows unlimited for an administrator account. This field displays the way the user logged in to the Zyxel Device. This field displays the IP address of the computer used to log in to the Zyxel Device. ZyWALL ATP Series Users Guide 115 Chapter 5 Dashboard Table 26 Dashboard > Number of Login Users LABEL User Info DESCRIPTION This field displays the types of user accounts the Zyxel Device uses. If the user type is ext-user (external user), this field will show its external-group information when you move your mouse over it. Force Logout If the external user matches two external-group objects, both external-group object names will be shown. Click this icon to end a users session. 5.2.8 Current Login User This field displays the user name used to log in to the current session, the amount of reauthentication time remaining, and the amount of lease time remaining. Figure 101 Dashboard > Current Login User 5.2.9 VPN Status Click on the link to look at the VPN tunnels that are currently established. Figure 102 Dashboard > VPN Status This table describes the fields in the above screen. Table 27 Dashboard > VPN Status LABEL

#

Name Encapsulation Algorithm DESCRIPTION This field is a sequential value and is not associated with any entry. This field displays the name of the VPN tunnel. This field displays the type of encapsulation the VPN tunnel uses. This field displays the hash algorithm that the VPN tunnel uses to authenticate packet data. Select how often you want this window to be updated automatically. Click this to update the information in the window right away. Refresh Interval Refresh Now 5.2.10 SSL VPN Status The first number is the actual number of VPN tunnels up and the second number is the maximum number of SSL VPN tunnels allowed. Figure 103 Dashboard > SSL VPN Status ZyWALL ATP Series Users Guide 116 Chapter 5 Dashboard 5.3 The Advanced Threat Protection Screen Use the Advanced Threat Protection screen to check security status information about the Zyxel Device. Figure 104 Dashboard > Advanced Threat Protection This screen gives the following information:

The number of scanned traffic The number of the scanned connections for botnet filtering The number of the scanned files for sandboxing The number of the scanned files for anti-malware The number of the scanned connections for IDP The number of the scanned emails for email security The number of the scanned sites for content filtering Top 5 applications that are used the most Top 5 URLs that are detected the most IP reputation reports Botnet filtering reports Sandboxing reports Threat statistics Click the Refresh icon to update the information in the window right away. ZyWALL ATP Series Users Guide 117 PART II Technical Reference 118 CHAPTER 6 Monitor 6.1 Overview Use the Monitor screens to check status and statistics information. 6.1.1 What You Can Do in this Chapter Use the Monitor screens for the following. Use the System Status > Port Statistics screen (see Section 6.2 on page 121) to look at packet statistics for each physical port. Use the System Status > Port Statistics > Graph View screen (see Section 6.2 on page 121) to look at a line graph of packet statistics for each physical port. Use the System Status > Interface Status screen (Section 6.3 on page 123) to see all of the Zyxel Devices interfaces and their packet statistics. Use the System Status > Traffic Statistics screen (see Section 6.4 on page 127) to start or stop data collection and view statistics. Use the System Status > Session Monitor screen (see Section 6.5 on page 129) to view sessions by user or service. Use the System Status > IGMP Statistics screen (see Section 6.7 on page 133) to view multicasting details. Use the System Status > DDNS Status screen (see Section 6.8 on page 134) to view the status of the Zyxel Devices DDNS domain names. Use the System Status > IP/MAC Binding screen (Section 6.9 on page 134) to view a list of devices that have received an IP address from Zyxel Device interfaces with IP/MAC binding enabled. Use the System Status > Login Users screen (Section 6.6 on page 131) to look at a list of the users currently logged into the Zyxel Device. Use the System Status > Cellular Status screen (Section 6.10 on page 135) to check your mobile broadband connection status. Use the System Status > UPnP Port Status screen (see Section 6.11 on page 139) to look at a list of the NAT port mapping rules that UPnP creates on the Zyxel Device. Use the System Status > USB Storage screen (Section 6.12 on page 140) to view information about a connected USB storage device. Use the System Status > Ethernet Neighbor screen (Section 6.13 on page 141) to view and manage the Zyxel Devices neighboring devices via Layer Link Discovery Protocol (LLDP). Use the System Status > FQDN Object screen (Section 6.14 on page 142) to display fully qualified domain name (FQDN) object cache lists used in DNS queries. Use the Wireless > AP Information > AP List screen (Section 6.15 on page 144) to display which APs are currently connected to the Zyxel Device. Use the Wireless > AP Information > Radio List screen (Section 6.16 on page 151) to display statistics about the wireless radio transmitters in each of the APs connected to the Zyxel Device. ZyWALL ATP Series Users Guide 119 Chapter 6 Monitor Use the Wireless > AP Information > Top N APs screen (Section 6.17 on page 154) to view managed APs with the most wireless traffic usage and most associated wireless stations. Use the Wireless > AP Information > Single AP screen (Section 6.18 on page 156) to view APs wireless traffic usage and associated wireless stations for a managed AP. Use the Wireless > ZyMesh screen (Section 6.19 on page 157) to display statistics about the ZyMesh wireless connections between the managed APs. Use the Wireless > SSID Info screen (Section 6.20 on page 158) to display the number of wireless clients that are currently connected to an SSID and the SSIDs security mode. Use the Wireless > Station Info > Station List screen (Section 6.22 on page 159) to view information on connected wireless stations. Use the Wireless > Station Info > Top N Stations screen (Section 6.22 on page 159) to view wireless stations with the most wireless traffic usage. Use the Wireless > Station Info > Single Station screen (Section 6.23 on page 160) to view wireless traffic usage for an associated wireless station. Use the Wireless > Detected Device screen (Section 6.22 on page 159) to view information about suspected rogue APs. Use the VPN Monitor > IPSec screen (Section 6.25 on page 162) to display and manage active IPSec SAs. Use the VPN Monitor > SSL screen (see Section 6.26 on page 164) to list the users currently logged into the VPN SSL client portal. You can also log out individual users and delete related session information. Use the VPN Monitor > L2TP over IPSec screen (see Section 6.27 on page 164) to display and manage the Zyxel Devices connected L2TP VPN sessions. Use the Security Statistics > Content Filter screen (Section 6.28 on page 165) to start or stop data collection and view content filter statistics. Use the Security Statistics > App Patrol screen (see Section 6.29 on page 167) to start or stop data collection and view application statistics Use the Security Statistics > Anti-Malware screen (see Section 6.30 on page 168) to start or stop data collection and view malware statistics. Use the Security Statistics > Reputation Filter screen (see Section 6.31 on page 170) to view statistics of IP reputation and botnet filtering. Use the Security Statistics > IDP screen (Section 6.32 on page 172) to start or stop data collection and view IDP statistics. Use the Security Statistics > Email Security > Summary screen (Section 6.33 on page 174) to start or stop data collection and view spam statistics. Use the Security Statistics > Email Security > Status screen (Section 6.33.2 on page 176) to see how many mail sessions the Zyxel Device is currently checking and DNSBL statistics. Use the Security Statistics > Sandboxing screen (Section 6.34 on page 178) to start or stop data collection and view sandboxing statistics. Use the Security Statistics > SSL Inspection screen (Section 6.35 on page 179) to see a report on SSL Inspection and a certificate cache list. Use the Log > View Log screen (see Section 6.36.1 on page 181) to view the Zyxel Devices current log messages. You can change the way the log is displayed, you can email the log, and you can also clear the log in this screen. Use the Log > View AP Log screen (see Section 6.36.2 on page 183) to view the Zyxel Devices current wireless AP log messages. ZyWALL ATP Series Users Guide 120 Chapter 6 Monitor 6.2 The Port Statistics Screen Use this screen to look at packet statistics for each Gigabit Ethernet port. To access this screen, click Monitor > System Status > Port Statistics. Figure 105 Monitor > System Status > Port Statistics The following table describes the labels in this screen. Table 28 Monitor > System Status > Port Statistics LABEL Poll Interval Set Interval Stop DESCRIPTION Enter how often you want this window to be updated automatically, and click Set Interval. Click this to set the Poll Interval the screen uses. Click this to stop the window from updating automatically. You can start it again by setting the Poll Interval and clicking Set Interval. Click this to display the port statistics as a line graph. Switch to Graphic View

#

Port Status TxPkts RxPkts Collisions Tx B/s Rx B/s Up Time System Up Time This field is a sequential value, and it is not associated with a specific port. This field displays the physical port number. This field displays the current status of the physical port. Down - The physical port is not connected. Speed / Duplex - The physical port is connected. This field displays the port speed and duplex setting (Full or Half). This field displays the number of packets transmitted from the Zyxel Device on the physical port since it was last connected. This field displays the number of packets received by the Zyxel Device on the physical port since it was last connected. This field displays the number of collisions on the physical port since it was last connected. This field displays the transmission speed, in bytes per second, on the physical port in the one-

second interval before the screen updated. This field displays the reception speed, in bytes per second, on the physical port in the one-

second interval before the screen updated. This field displays how long the physical port has been connected. This field displays how long the Zyxel Device has been running since it last restarted or was turned on. ZyWALL ATP Series Users Guide 121 Chapter 6 Monitor 6.2.1 The Port Statistics Graph Screen Use this screen to look at a line graph of packet statistics for each physical port. To access this screen, click Port Statistics in the Status screen and then the Switch to Graphic View Button. Figure 106 Monitor > System Status > Port Statistics > Switch to Graphic View The following table describes the labels in this screen. DESCRIPTION Enter how often you want this window to be automatically updated. Click this to update the information in the window right away. Select the number of the physical port for which you want to display graphics. Click this to display the port statistics as a table. Table 29 Monitor > System Status > Port Statistics > Switch to Graphic View LABEL Refresh Interval Refresh Now Port Selection Switch to Grid View bps time TX The y-axis represents the speed of transmission or reception. The x-axis shows the time period over which the transmission or reception occurred This line represents traffic transmitted from the Zyxel Device on the physical port since it was last connected. This line represents the traffic received by the Zyxel Device on the physical port since it was last connected. This field displays the date and time the information in the window was last updated. RX Last Update ZyWALL ATP Series Users Guide 122 Chapter 6 Monitor 6.3 Interface Status Screen This screen lists all of the Zyxel Devices interfaces and gives packet statistics for them. Click Monitor >

System Status > Interface Summary to access this screen. Figure 107 Monitor > System Status > Interface Summary ZyWALL ATP Series Users Guide 123 Chapter 6 Monitor Each field is described in the following table. Table 30 Monitor > System Status > Interface Summary LABEL Interface Status DESCRIPTION If an Ethernet interface does not have any physical ports associated with it, its entry is displayed in light gray text. This field displays the name of each interface. If there is an Expand icon (plus-sign) next to the Name name, click this to look at the status of virtual interfaces on top of this interface. This field displays the physical port number. This field displays the current status of each interface. The possible values depend on what type of interface it is. Port/Binding Status For Ethernet interfaces:

Inactive - The Ethernet interface is disabled. Down - The Ethernet interface does not have any physical ports associated with it or the Ethernet interface is enabled but not connected. Speed / Duplex - The Ethernet interface is enabled and connected. This field displays the port speed and duplex setting (Full or Half). For cellular (mobile broadband) interfaces, see Section 6.12 on page 140 the Web Help for the status that can appear. For the auxiliary interface:

Inactive - The auxiliary interface is disabled. Connected - The auxiliary interface is enabled and connected. Disconnected - The auxiliary interface is not connected. For virtual interfaces, this field always displays Up. If the virtual interface is disabled, it does not appear in the list. For VLAN and bridge interfaces, this field always displays Up. If the VLAN or bridge interface is disabled, it does not appear in the list. For PPP interfaces:

Connected - The PPP interface is connected. Disconnected - The PPP interface is not connected. If the PPP interface is disabled, it does not appear in the list. Zone IP Addr/Netmask IP Assignment Services For WLAN interfaces:

Up - The WLAN interface is enabled. Down - The WLAN interface is disabled. This field displays the zone to which the interface is assigned. This field displays the current IP address and subnet mask assigned to the interface. If the IP address and subnet mask are 0.0.0.0, the interface is disabled or did not receive an IP address and subnet mask via DHCP. If this interface is a member of an active virtual router, this field displays the IP address it is currently using. This is either the static IP address of the interface (if it is the master) or the management IP address (if it is a backup). This field displays how the interface gets its IP address. Static - This interface has a static IP address. DHCP Client - This interface gets its IP address from a DHCP server. This field lists which services the interface provides to the network. Examples include DHCP relay, DHCP server, DDNS, RIP, and OSPF. This field displays n/a if the interface does not provide any services to the network. ZyWALL ATP Series Users Guide 124 Chapter 6 Monitor Table 30 Monitor > System Status > Interface Summary LABEL Action DESCRIPTION Use this field to get or to update the IP address for the interface. Click Renew to send a new DHCP request to a DHCP server. Click Connect to try to connect a PPPoE/PPTP interface. If the interface cannot use one of these ways to get or to update its IP address, this field displays n/a. Tunnel Interface Status This displays the details of the Zyxel Devices configured tunnel interfaces. Name Status This field displays the name of the interface. The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. This field displays the zone to which the interface is assigned. This is the IP address of the interface. If the interface is active (and connected), the Zyxel Device tunnels local traffic sent to this IP address to the Remote Gateway Address. This is the interface or IP address uses to identify itself to the remote gateway. The Zyxel Device uses this as the source for the packets it tunnels to the remote gateway. This is the IP address or domain name of the remote gateway to which this interface tunnels traffic. Zone IP Address My Address Remote Gateway Address Mode IPv6 Interface Status This field displays the tunnel mode that you are using. If an Ethernet interface does not have any physical ports associated with it, its entry is displayed in light gray text. This field displays the name of each interface. If there is an Expand icon (plus-sign) next to the Name name, click this to look at the status of virtual interfaces on top of this interface. This field displays the physical port number. Port ZyWALL ATP Series Users Guide 125 Chapter 6 Monitor Table 30 Monitor > System Status > Interface Summary LABEL Status DESCRIPTION This field displays the current status of each interface. The possible values depend on what type of interface it is. For Ethernet interfaces:

Inactive - The Ethernet interface is disabled. Down - The Ethernet interface does not have any physical ports associated with it or the Ethernet interface is enabled but not connected. Speed / Duplex - The Ethernet interface is enabled and connected. This field displays the port speed and duplex setting (Full or Half). For cellular (mobile broadband) interfaces, see Section 6.12 on page 140 the Web Help for the status that can appear. For the auxiliary interface:

Inactive - The auxiliary interface is disabled. Connected - The auxiliary interface is enabled and connected. Disconnected - The auxiliary interface is not connected. For virtual interfaces, this field always displays Up. If the virtual interface is disabled, it does not appear in the list. For VLAN and bridge interfaces, this field always displays Up. If the VLAN or bridge interface is disabled, it does not appear in the list. For PPP interfaces:

Connected - The PPP interface is connected. Disconnected - The PPP interface is not connected. If the PPP interface is disabled, it does not appear in the list. For WLAN interfaces:

Up - The WLAN interface is enabled. Down - The WLAN interface is disabled. This field displays the zone to which the interface is assigned. This field displays the current IPv6 address assigned to the interface. If the IPv6 address is ::, the interface is disabled or did not receive an IPv6 address via DHCP. If this interface is a member of an active virtual router, this field displays the IPv6 address it is currently using. This is either the static IPv6 address of the interface (if it is the master) or the management IPv6 address (if it is a backup). This field lists which services the interface provides to the network. Examples include DHCP relay, DHCP server, DDNS, RIP, and OSPF. This field displays n/a if the interface does not provide any services to the network. Use this field to get or to update the IP address for the interface. Click Renew to send a new DHCP request to a DHCP server. Click Connect to try to connect a PPPoE/PPTP interface. If the interface cannot use one of these ways to get or to update its IP address, this field displays n/a. Zone IP Address Services Action Interface Statistics This table provides packet statistics for each interface. Refresh Name Click this button to update the information in the screen. This field displays the name of each interface. If there is a Expand icon (plus-sign) next to the name, click this to look at the statistics for virtual interfaces on top of this interface. ZyWALL ATP Series Users Guide 126 Chapter 6 Monitor Table 30 Monitor > System Status > Interface Summary LABEL Status DESCRIPTION This field displays the current status of the interface. Down - The interface is not connected. Speed / Duplex - The interface is connected. This field displays the port speed and duplex setting (Full or Half). TxPkts RxPkts Tx B/s Rx B/s This field displays Connected and the accumulated connection time (hh:mm:ss) when the PPP interface is connected. This field displays the number of packets transmitted from the Zyxel Device on the interface since it was last connected. This field displays the number of packets received by the Zyxel Device on the interface since it was last connected. This field displays the transmission speed, in bytes per second, on the interface in the one-

second interval before the screen updated. This field displays the reception speed, in bytes per second, on the interface in the one-second interval before the screen updated. 6.4 The Traffic Statistics Screen Click Monitor > System Status > Traffic Statistics to display the Traffic Statistics screen. This screen provides basic information about the following for example:

Most-visited Web sites and the number of times each one was visited. This count may not be accurate in some cases because the Zyxel Device counts HTTP GET packets. Please see Table 31 on page 128 for more information. Most-used protocols or service ports and the amount of traffic on each one LAN IP with heaviest traffic and how much traffic has been sent to and from each one You use the Traffic Statistics screen to tell the Zyxel Device when to start and when to stop collecting information for these reports. You cannot schedule data collection; you have to start and stop it manually in the Traffic Statistics screen. Figure 108 Monitor > System Status > Traffic Statistics ZyWALL ATP Series Users Guide 127 Chapter 6 Monitor There is a limit on the number of records shown in the report. Please see Table 32 on page 129 for more information. The following table describes the labels in this screen. Table 31 Monitor > System Status > Traffic Statistics LABEL Data Collection Collect Statistics DESCRIPTION Apply Reset Statistics Interface Sort By Refresh Flush Data

#

Direction IP Address/

User Amount

#

Service/Port Protocol Direction Select this to have the Zyxel Device collect data for the report. If the Zyxel Device has already been collecting data, the collection period displays to the right. The progress is not tracked here real-time, but you can click the Refresh button to update it. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Select the interface from which to collect information. You can collect information from Ethernet, VLAN, bridge and PPPoE/PPTP interfaces. Select the type of report to display. Choices are:

Host IP Address/User - displays the IP addresses or users with the most traffic and how much traffic has been sent to and from each one. Service/Port - displays the most-used protocols or service ports and the amount of traffic for Web Site Hits - displays the most-visited Web sites and how many times each one has been Country - displays the countries with the most traffic and the amount of traffic for each each one. visited. one. Each type of report has different information in the report (below). Click this button to update the report display. Click this button to discard all of the screens statistics and update the report display. These fields are available when the Traffic Type is Host IP Address/User. This field is the rank of each record. The IP addresses and users are sorted by the amount of traffic. This field indicates whether the IP address or user is sending or receiving traffic. Ingress- traffic is coming from the IP address or user to the Zyxel Device. Egress - traffic is going from the Zyxel Device to the IP address or user. This field displays the IP address or user in this record. The maximum number of IP addresses or users in this report is indicated in Table 32 on page 129. This field displays how much traffic was sent or received from the indicated IP address or user. If the Direction is Ingress, a red bar is displayed; if the Direction is Egress, a blue bar is displayed. The unit of measure is bytes, Kbytes, Mbytes or Gbytes, depending on the amount of traffic for the particular IP address or user. The count starts over at zero if the number of bytes passes the byte count limit. See Table 32 on page 129. These fields are available when the Traffic Type is Service/Port. This field is the rank of each record. The protocols and service ports are sorted by the amount of traffic. This field displays the service and port in this record. The maximum number of services and service ports in this report is indicated in Table 32 on page 129. This field indicates what protocol the service was using. This field indicates whether the indicated protocol or service port is sending or receiving traffic. Ingress - traffic is coming into the Zyxel Devicethrough the interface Egress - traffic is going out from the Zyxel Device through the interface ZyWALL ATP Series Users Guide 128 Chapter 6 Monitor Table 31 Monitor > System Status > Traffic Statistics (continued) LABEL Amount

#

Web Site Hits

#

Direction Country Name Country Amount DESCRIPTION This field displays how much traffic was sent or received from the indicated service / port. If the Direction is Ingress, a red bar is displayed; if the Direction is Egress, a blue bar is displayed. The unit of measure is bytes, Kbytes, Mbytes, Gbytes, or Tbytes, depending on the amount of traffic for the particular protocol or service port. The count starts over at zero if the number of bytes passes the byte count limit. See Table 32 on page 129. These fields are available when the Traffic Type is Web Site Hits. This field is the rank of each record. The domain names are sorted by the number of hits. This field displays the domain names most often visited. The Zyxel Device counts each page viewed on a Web site as another hit. The maximum number of domain names in this report is indicated in Table 32 on page 129. This field displays how many hits the Web site received. The Zyxel Device counts hits by counting HTTP GET packets. Many Web sites have HTTP GET references to other Web sites, and the Zyxel Device counts these as hits too. The count starts over at zero if the number of hits passes the hit count limit. See Table 32 on page 129. These fields are available when the Traffic Type is Country. This field is the rank of each record. The country name is sorted by the amount of traffic. This field indicates whether the indicated protocol or service port is sending or receiving traffic. Ingress - traffic is coming into the Zyxel Devicethrough the interface Egress - traffic is going out from the Zyxel Device through the interface This field displays the name of the country. This field displays the country code. This field displays how much traffic was sent or received from the indicated country. If the Direction is Ingress, a red bar is displayed; if the Direction is Egress, a blue bar is displayed. The unit of measure is bytes, Kbytes, Mbytes, Gbytes, or Tbytes, depending on the amount of traffic for the particular protocol or service port. The count starts over at zero if the number of bytes passes the byte count limit. See Table 32 on page 129. Ingress - traffic is coming into the Zyxel Device from the country. Egress - traffic is going from the Zyxel Device to the country. The following table displays the maximum number of records shown in the report, the byte count limit, and the hit count limit. Table 32 Maximum Values for Reports LABEL Maximum Number of Records Byte Count Limit Hit Count Limit DESCRIPTION 20 264 bytes; this is just less than 17 million terabytes. 264 hits; this is over 1.8 x 1019 hits. 6.5 The Session Monitor Screen The Session Monitor screen displays all established sessions that pass through the Zyxel Device for debugging or statistical analysis. It is not possible to manage sessions in this screen. The following information is displayed. User who started the session Protocol or service port used ZyWALL ATP Series Users Guide 129 Chapter 6 Monitor Source address Destination address Number of bytes received (so far) Number of bytes transmitted (so far) Duration (so far) You can look at all established sessions that passed through the Zyxel Device by user, service, source IP address, or destination IP address. You can also filter the information by user, protocol / service or service group, source address, and/or destination address and view it by user. Click Monitor > System Status > Session Monitor to display the following screen. Figure 109 Monitor > System Status > Session Monitor The following table describes the labels in this screen. Table 33 Monitor > System Status > Session Monitor LABEL View DESCRIPTION Select how you want the established sessions that passed through the Zyxel Device to be displayed. Choices are:

sessions by users - display all active sessions grouped by user sessions by services - display all active sessions grouped by service or protocol sessions by source IP - display all active sessions grouped by source IP address session by source region - display all active sessions grouped by where the traffic is coming from by country going to by country sessions by destination IP - display all active sessions grouped by destination IP address sessions by destination region - display all active sessions grouped by where the traffic is all sessions - filter the active sessions by the User, Service, Source Address, and Destination Address, and display each session individually (sorted by user). Refresh User Service Click this button to update the information on the screen. The screen also refreshes automatically when you open and close the screen. The User, Service, Source Address, Destination Address, Source Country and Destination Country fields display if you view all sessions. Select your desired filter criteria and click the Refresh button to filter the list of sessions. This field displays when View is set to all sessions. Type the user whose sessions you want to view. It is not possible to type part of the user name or use wildcards in this field; you must enter the whole user name. This field displays when View is set to all sessions. Select the service or service group whose sessions you want to view. The Zyxel Device identifies the service by comparing the protocol and destination port of each packet to the protocol and port of each services that is defined. ZyWALL ATP Series Users Guide 130 Chapter 6 Monitor Table 33 Monitor > System Status > Session Monitor (continued) LABEL Source Address Source Country Destination Address Destination Country Search Clear Clear All

#

User Service Source Source Country Destination Destination Country Rx Tx Duration DESCRIPTION This field displays when View is set to all sessions. Type the source IP address whose sessions you want to view. You cannot include the source port. This field displays when View is set to all sessions. Select the country where the traffic is coming from. This field displays when View is set to all sessions. Type the destination IP address whose sessions you want to view. You cannot include the destination port. This field displays when View is set to all sessions. Select the country where the traffic is going to. Click this to display all sessions in the table below according to the criteria you defined above. Administrators can use these buttons to forcibly terminate selected TCP/UDP connections. Select one or multiple connections and then click Clear; click Clear All to terminate all connections displayed. Cleared sessions display in the Log > View Log screen. This field is the rank of each record. The names are sorted by the name of user in active session. You can use the pull down menu on the right to choose sorting method. This field displays the user in each active session. If you are looking at the sessions by users (or all sessions) report, click + or - to display or hide details about a users sessions. This field displays the protocol used in each active session. If you are looking at the sessions by services report, click + or - to display or hide details about a protocols sessions. This field displays the source IP address and port in each active session. If you are looking at the sessions by source IP report, click + or - to display or hide details about a source IP addresss sessions. This field displays the source country in each active session. This field displays the destination IP address and port in each active session. If you are looking at the sessions by destination IP report, click + or - to display or hide details about a destination IP addresss sessions. This field displays the destination country in each active session. This field displays the amount of information received by the source in the active session. This field displays the amount of information transmitted by the source in the active session. This field displays the length of the active session in seconds. 6.6 The Login Users Screen Use this screen to look at a list of the users currently logged into the Zyxel Device. To access this screen, click Monitor > System Status > Login Users. ZyWALL ATP Series Users Guide 131 Chapter 6 Monitor Figure 110 Monitor > System Status > Login Users The following table describes the labels in this screen. Table 34 Monitor > System Status > Login Users LABEL Force Logout

#

User ID Reauth/Lease Time Session Timeout Type IP Address Country MAC User Info Acct. Status DESCRIPTION Select a user ID and click this icon to end a users session. This field is a sequential value and is not associated with any entry. This field displays the user name of each user who is currently logged in to the Zyxel Device. This field displays the amount of reauthentication time remaining and the amount of lease time remaining for each user. This field displays the total account of time the account (authenticated by an external server) can use to log into the Zyxel Device or access the Internet through the Zyxel Device. This shows unlimited for an administrator account. This field displays the way the user logged in to the Zyxel Device. This field displays the IP address of the computer used to log in to the Zyxel Device. The Internet Assigned Numbers Authority (IANA) has reserved the following blocks of Private IP addresses specifically for private networks:

10.0.0.0-10.255.255.255 172.16.0.0-172.31.255.255 192.168.0.0-192.168.255.255 224.0.0.0-239.255.255.255 This field displays the MAC address of the computer used to log in to the Zyxel Device. This field displays the types of user accounts the Zyxel Device uses. If the user type is ext-

user (external user), this field will show its external-group information when you move your mouse over it. If the external user matches two external-group objects, both external-group object names will be shown. For a captive portal login, this field displays the accounting status of the account used to log into the Zyxel Device. Accounting-on means accounting is being performed for the user login. Accounting-off means accounting has stopped for this user login. A - displays if accounting is not enabled for this login. ZyWALL ATP Series Users Guide 132 Chapter 6 Monitor Table 34 Monitor > System Status > Login Users (continued) LABEL RADIUS Profile Name DESCRIPTION This field displays the name of the RADIUS profile used to authenticate the login through the captive portal. N/A displays for logins that do not use the captive portal and RADIUS server authentication. Click this button to update the information in the screen. Refresh 6.7 IGMP Statistics The Internet Group Management Protocol (IGMP) Statistics is used by Zyxel Device IP hosts to inform adjacent router about multicast group memberships. It can also be used for one-to-many networking applications such as online streaming video and gaming, distribution of company newsletters, updating address book of mobile computer users in the field allowing more efficient use of resources when supporting these types of applications. Click Monitor > System Status > IGMP Statistics to open the following screen. Figure 111 Monitor > System Status > IGMP Statistics The following table describes the labels in this screen. Table 35 Monitor > System Status > IGMP Statistics LABEL

#

Group Source IP Incoming Interface Packet Count Bytes Outgoing Interface Refresh DESCRIPTION This field is a sequential value, and it is not associated with a specific I GMP Statistics. This field displays the group of devices in the IGMP. This field displays the host source IP information of the IGMP. This field displays the incoming interface thats connected on the IGMP. This field displays the packet size of the data being transferred. This field displays the size of the data being transferred in Byes. This field displays the outgoing interface thats connected on the IGMP. Click this button to update the information in the screen. ZyWALL ATP Series Users Guide 133 Chapter 6 Monitor 6.8 The DDNS Status Screen The DDNS Status screen shows the status of the Zyxel Devices DDNS domain names. Click Monitor >

System Status > DDNS Status to open the following screen. Figure 112 Monitor > System Status > DDNS Status The following table describes the labels in this screen. Table 36 Monitor > System Status > DDNS Status LABEL Update DESCRIPTION Click this to have the Zyxel Device update the profile to the DDNS server. The Zyxel Device attempts to resolve the IP address for the domain name. This field is a sequential value, and it is not associated with a specific DDNS server. This field displays the descriptive profile name for this entry. This field displays each domain name the Zyxel Device can route. This is the (resolved) IP address of the domain name. This shows whether the last attempt to resolve the IP address for the domain name was successful or not. Updating means the Zyxel Device is currently attempting to resolve the IP address for the domain name. This shows when the last attempt to resolve the IP address for the domain name occurred (in year-month-day hour:minute:second format). Click this button to update the information in the screen.

#

Profile Name Domain Name Effective IP Last Update Last Update Time Refresh 6.9 IP/MAC Binding Click Monitor > System Status > IP/MAC Binding to open the IP/MAC Binding screen. This screen lists the devices that have received an IP address from Zyxel Device interfaces with IP/MAC binding enabled and have ever established a session with the Zyxel Device. Devices that have never established a session with the Zyxel Device do not display in the list. ZyWALL ATP Series Users Guide 134 Chapter 6 Monitor Figure 113 Monitor > System Status > IP/MAC Binding The following table describes the labels in this screen. Table 37 Monitor > System Status > IP/MAC Binding LABEL Interface DESCRIPTION Select a Zyxel Device interface that has IP/MAC binding enabled to show to which devices it has assigned an IP address. This field is a sequential value, and it is not associated with a specific IP/MAC binding entry. This is the IP address that the Zyxel Device assigned to a device. This field displays the name used to identify this device on the network (the computer name). The Zyxel Device learns these from the DHCP client requests. This field displays the MAC address to which the IP address is currently assigned. This is when the device last established a session with the Zyxel Device through this interface. This field displays the description of the IP/MAC binding. Click this button to update the information in the screen.

#

IP Address Host Name MAC Address Last Access Description Refresh 6.10 Cellular Status Screen This screen displays your mobile broadband connection status. Click Monitor > System Status > Cellular Status to display this screen. Figure 114 Monitor > System Status > Cellular Status ZyWALL ATP Series Users Guide 135 Chapter 6 Monitor The following table describes the labels in this screen. Table 38 Monitor > System Status > Cellular Status LABEL Refresh More Information DESCRIPTION Click this button to update the information in the screen. Click this to display more information on your mobile broadband, such as the signal strength, IMEA/ESN and IMSI. This is only available when the mobile broadband device attached and activated on your Zyxel Device. Refer to Section 6.10.1 on page 138. This field is a sequential value, and it is not associated with any interface. This field displays where the entrys cellular card is located. This field displays the model name of the cellular card.

#

Extension Slot Connected Device ZyWALL ATP Series Users Guide 136 Chapter 6 Monitor Table 38 Monitor > System Status > Cellular Status (continued) LABEL Status DESCRIPTION No device - no mobile broadband device is connected to the Zyxel Device. No Service - no mobile broadband network is available in the area; you cannot connect to the Internet. Limited Service - returned by the service provider in cases where the SIM card is expired, the user failed to pay for the service and so on; you cannot connect to the Internet. Device detected - displays when you connect a mobile broadband device. Device error - a mobile broadband device is connected but there is an error. Probe device fail - the Zyxel Devices test of the mobile broadband device failed. Probe device ok - the Zyxel Devices test of the mobile broadband device Init device fail - the Zyxel Device was not able to initialize the mobile broadband succeeded. device. Init device ok - the Zyxel Device initialized the mobile broadband card. Check lock fail - the Zyxel Devices check of whether or not the mobile broadband device is locked failed. Device locked - the mobile broadband device is locked. SIM error - there is a SIM card error on the mobile broadband device. SIM locked-PUK - the PUK is locked on the mobile broadband devices SIM card. SIM locked-PIN - the PIN is locked on the mobile broadband devices SIM card. Unlock PUK fail - Your attempt to unlock a WCDMA mobile broadband devices PUK failed because you entered an incorrect PUK. Unlock PIN fail - Your attempt to unlock a WCDMA mobile broadband devices PIN failed because you entered an incorrect PIN. Unlock device fail - Your attempt to unlock a CDMA2000 mobile broadband device failed because you entered an incorrect device code. Device unlocked - You entered the correct device code and unlocked a CDMA2000 mobile broadband device. Get dev-info fail - The Zyxel Device cannot get cellular device information. Get dev-info ok - The Zyxel Device succeeded in retrieving mobile broadband device information. Searching network - The mobile broadband device is searching for a network. Get signal fail - The mobile broadband device cannot get a signal from a network. Network found - The mobile broadband device found a network. Apply config - The Zyxel Device is applying your configuration to the mobile broadband device. Inactive - The mobile broadband interface is disabled. Active - The mobile broadband interface is enabled. Incorrect device - The connected mobile broadband device is not compatible with the Zyxel Device. device. Correct device - The Zyxel Device detected a compatible mobile broadband Set band fail - Applying your band selection was not successful. Set band ok - The Zyxel Device successfully applied your band selection. Set profile fail - Applying your ISP settings was not successful. Set profile ok - The Zyxel Device successfully applied your ISP settings. PPP fail - The Zyxel Device failed to create a PPP connection for the cellular interface. Need auth-password - You need to enter the password for the mobile broadband card in the cellular edit screen. Device ready - The Zyxel Device successfully applied all of your configuration and you can use the mobile broadband connection. Service Provider This displays the name of your network service provider. This shows Limited Service if the service provider has stopped service to the mobile broadband card. For example if the bill has not been paid or the account has expired. ZyWALL ATP Series Users Guide 137 Chapter 6 Monitor Table 38 Monitor > System Status > Cellular Status (continued) LABEL Cellular System DESCRIPTION This field displays what type of cellular network the mobile broadband connection is using. The network type varies depending on the mobile broadband card you inserted and could be UMTS, UMTS/HSDPA, GPRS or EDGE when you insert a GSM mobile broadband card, or 1xRTT, EVDO Rev.0 or EVDO Rev.A when you insert a CDMA mobile broadband card. This displays the strength of the signal. The signal strength mainly depends on the antenna output power and the distance between your Zyxel Device and the service providers base station. Signal Quality 6.10.1 More Information This screen displays more information on your mobile broadband, such as the signal strength, IMEA/ESN and IMSI that helps identify your mobile broadband device and SIM card. Click Monitor > System Status

> Cellular Status > More Information to display this screen. Note: This screen is only available when the mobile broadband device is attached to and activated on the Zyxel Device. Figure 115 Monitor > System Status > Cellular Status > More Information The following table describes the labels in this screen. Table 39 Monitor > System Status > Cellular Status > More Information LABEL Extension Slot Service Provider DESCRIPTION This field displays where the entrys cellular card is located. This displays the name of your network service provider. This shows Limited Service if the service provider has stopped service to the mobile broadband card. For example if the bill has not been paid or the account has expired. ZyWALL ATP Series Users Guide 138 Chapter 6 Monitor Table 39 Monitor > System Status > Cellular Status > More Information (continued) LABEL Cellular System DESCRIPTION This field displays what type of cellular network the mobile broadband connection is using. The network type varies depending on the mobile broadband card you inserted and could be UMTS, UMTS/HSDPA, GPRS or EDGE when you insert a GSM mobile broadband card, or 1xRTT, EVDO Rev.0 or EVDO Rev.A when you insert a CDMA mobile broadband card. This is the Signal Quality measured in dBm. This displays the strength of the signal. The signal strength mainly depends on the antenna output power and the distance between your Zyxel Device and the service providers base station. This shows the name of the company that produced the mobile broadband device. This field displays the model name of the cellular card. This shows the software version of the mobile broadband device. IMEI (International Mobile Equipment Identity) is a 15-digit code in decimal format that identifies the mobile broadband device. ESN (Electronic Serial Number) is an 8-digit code in hexadecimal format that identifies the mobile broadband device. IMSI (International Mobile Subscriber Identity) is a 15-digit code that identifies the SIM card. Signal Strength Signal Quality Device Manufacturer Device Model Device Firmware Device IMEI/ESN SIM Card IMSI 6.11 The UPnP Port Status Screen Use this screen to look at the NAT port mapping rules that UPnP creates on the Zyxel Device. To access this screen, click Monitor > System Status > UPnP Port Status. Figure 116 Monitor > System Status > UPnP Port Status The following table describes the labels in this screen. Table 40 Monitor > System Status > UPnP Port Status LABEL Remove

#

DESCRIPTION Select an entry and click this button to remove it from the list. This is the index number of the UPnP-created NAT mapping rule entry. ZyWALL ATP Series Users Guide 139 Chapter 6 Monitor Table 40 Monitor > System Status > UPnP Port Status (continued) LABEL Remote Host DESCRIPTION This field displays the source IP address (on the WAN) of inbound IP packets. Since this is often a wild-card, the field may be blank. When the field is blank, the Zyxel Device forwards all traffic sent to the External Port on the WAN interface to the Internal Client on the Internal Port. External Port Protocol Internal Port Internal Client When this field displays an external IP address, the NAT rule has the Zyxel Device forward inbound packets to the Internal Client from that IP address only. This field displays the port number that the Zyxel Device listens non the WAN port) for connection requests destined for the NAT rules Internal Port and Internal Client. The Zyxel Device forwards incoming packets (from the WAN) with this port number to the Internal Client on the Internal Port (on the LAN). If the field displays 0, the Zyxel Device ignores the Internal Port value and forwards requests on all external port numbers (that are otherwise unmapped) to the Internal Client. This field displays the protocol of the NAT mapping rule (TCP or UDP). This field displays the port number on the Internal Client to which the Zyxel Device should forward incoming connection requests. This field displays the DNS host name or IP address of a client on the LAN. Multiple NAT clients can use a single port simultaneously if the internal client field is set to 255.255.255.255 for UDP mappings. Internal Client Type This field displays the type of the client application on the LAN. Description Delete All Refresh This field displays a text explanation of the NAT mapping rule. Click this to remove all mapping rules from the NAT table. Click this button to update the information in the screen. 6.12 USB Storage Screen This screen displays information about a connected USB storage device. Click Monitor > System Status >

USB Storage to display this screen. Figure 117 Monitor > System Status > USB Storage The following table describes the labels in this screen. Table 41 Monitor > System Status > USB Storage LABEL Device description Usage DESCRIPTION This is a basic description of the type of USB device. This field displays how much of the USB storage devices capacity is currently being used out of its total capacity and what percentage that makes. ZyWALL ATP Series Users Guide 140 Chapter 6 Monitor Table 41 Monitor > System Status > USB Storage (continued) LABEL Filesystem Speed Status Detail DESCRIPTION This field displays what file system the USB storage device is formatted with. This field displays Unknown if the file system of the USB storage device is not supported by the Zyxel Device, such as NTFS. This field displays the connection speed the USB storage device supports. Ready - you can have the Zyxel Device use the USB storage device. Click Remove Now to stop the Zyxel Device from using the USB storage device so you can remove it. Unused - the connected USB storage device was manually unmounted by using the Remove Now button or for some reason the Zyxel Device cannot mount it. Click Use It to have the Zyxel Device mount a connected USB storage device. This button is grayed out if the file system is not supported (unknown) by the Zyxel Device. none - no USB storage device is connected. This field displays any other information the Zyxel Device retrieves from the USB storage device. Deactivated - the use of a USB storage device is disabled (turned off) on the Zyxel Device. OutofSpace - the available disk space is less than the disk space full threshold. Mounting - the Zyxel Device is mounting the USB storage device. Removing - the Zyxel Device is unmounting the USB storage device. none - the USB device is operating normally or not connected. 6.13 Ethernet Neighbor Screen The Ethernet Neighbor screen allows you to view the Zyxel Devices neighboring devices in one place. It uses Smart Connect, that is Link Layer Discovery Protocol (LLDP) for discovering and configuring LLDP-

aware devices in the same broadcast domain as the Zyxel Device that youre logged into using the web configurator. LLDP is a layer-2 protocol that allows a network device to advertise its identity and capabilities on the local network. It also allows the device to maintain and store information from adjacent devices which are directly connected to the network device. This helps you discover network changes and perform necessary network reconfiguration and management. Note: Enable Smart Connect in the System > ZON screen. See also System > ZON for more information on the Zyxel One Network (ZON) utility that uses the Zyxel Discovery Protocol (ZDP) for discovering and configuring ZDP-aware Zyxel devices in the same network as the computer on which the ZON utility is installed. Click Monitor > System Status > Ethernet Neighbor to see the following screen ZyWALL ATP Series Users Guide 141 Chapter 6 Monitor Figure 118 Monitor > System Status > Ethernet Neighbor The following table describes the fields in the previous screen. Table 42 Monitor > System Status > Ethernet Neighbor LABEL Local Port (Description) DESCRIPTION This field displays the port of the Zyxel Device, on which the neighboring device is discovered. For Zyxel Devices that support Port Role, if ports 3 to 5 are grouped together and there is a connection to P5 only, the Zyxel Device will display P3 as the interface port number (even though there is no connection to that port). This field displays the model name of the discovered device. This field displays the system name of the discovered device. This field displays the firmware version of the discovered device. This field displays the first internal port on the discovered device. Internal is an interface type displayed in the Network > Interface > Ethernet > Edit screen. For example, if P1 and P2 are WAN, P3 to P5 are LAN, and P6 is DMZ, then Zyxel Device will display P3 as the first internal interface port number. For Zyxel Devices that support Port Role, if ports 3 to 5 are grouped together and there is a connection to P5 only, the Zyxel Device will display P3 as the first internal interface port number (even though there is no connection to that port). This field displays the IP address of the discovered device. This field displays the MAC address of the discovered device. Click this button to update the information in the screen. Model Name System Name Firmware Version Port (Description) IP Address MAC Address Refresh 6.14 FQDN Object Screen Click Monitor > System Status > FQDN Object to open the FQDN Object screen. View FQDN-to-IP address mappings cached in this screen. An FQDN is resolved to its IP address using the DNS server configured on the Zyxel Device. If the Zyxel Device receives a DNS query for an FQDN and the Zyxel Device has an FQDN cache entry, the Zyxel Device can map the IP address in a DNS response without having to query a DNS name server. The Zyxel Device updates FQDN-to-IP address mappings when the TTL (Time To Live) setting expires. You can configure FQDN objects in Configuration > Object > Address/Geo IP > Address or Configuration

> Object > Address/Geo IP > Address Group. ZyWALL ATP Series Users Guide 142 Chapter 6 Monitor FQDN can be used in Security Policy, Policy Route, BWM and Web Authentication profiles as source and destination criteria. FQDN with a wildcard (for example, *.zyxel.com) can be used in these profiles as destination criteria only. Suppose you want to block certain users from going to a website with a dynamically updated IP address using DDNS. Create an FQDN object for the website in Object > Address, and then create a Security Policy in Security Policy > Policy Control > Add. Use the FQDN object to identify the website as a destination, and configure specific users to block. When a user tries to connect to the forbidden website, the Zyxel Device first checks the IP address - website mapping in response to the DNS query and then finds the FQDN object match. The Security Policy that has this FQDN object match can then block the configured users from accessing the website. Figure 119 Monitor > System Status > FQDN Object The following table describes the fields in the previous screen. DESCRIPTION Table 43 Monitor > System Status > FQDN Object LABEL IPv4 FQDN Object Cache List You must first configure IPv4 FQDN objects in Configuration > Object > Address/Geo IP in the IPv4 Address Configuration field. FQDN Object Select a previously created object from the drop-down list box to display related FQDN object caches used in DNS queries. This is the index number of the FQDN entry. This field displays the name of the selected FQDN object used in DNS queries. This field displays a hosts fully qualified domain name. This field displays the mapping of the FQDN to an IP address. This is the IP address of a host. This field displays the number of seconds the Zyxel Device holds IP address - FQDN object mapping in its cache. The mapping is updated when the TTL (Time To Live) setting expires.

#

Name FQDN IP Address TTL IPv6 FQDN Object Cache List You must first configure IPv6 FQDN objects in Configuration > Object > Address/Geo IP in the IPv6 Address Configuration field. ZyWALL ATP Series Users Guide 143 Chapter 6 Monitor Table 43 Monitor > System Status > FQDN Object LABEL FQDN Object DESCRIPTION Select an object from the drop-down list box to display related IPv6 FQDN object caches used in DNS queries. This is the index number of the IPv6 FQDN entry. This field displays the name of the selected IPv6 FQDN object used in DNS queries. This field displays a hosts fully qualified domain name. This field displays the mapping of the FQDN to an IPv6 address. This is the IPv6 address of a host. This field displays the number of seconds the Zyxel Device holds IP address - FQDN object mapping in its cache. The mapping is updated when the TTL (Time To Live) setting expires. Click this button to update the information in the screen.

#

Name FQDN IP Address TTL Refresh 6.15 AP Information: AP List The AP Information menu contains AP List, Radio List, Top N APs and Single AP screens. Click Monitor >

Wireless > AP Information to display the AP List screen. Figure 120 Monitor > Wireless > AP Information > AP List The following table describes the labels in this screen. Table 44 Monitor > Wireless > AP Information > AP List LABEL Config AP Add to Mgnt AP List More Information Reboot DCS Now DESCRIPTION Select an AP and click this to change the selected APs group, radio, VLAN and port settings. Click this to add new Access Points Click this icon to see AP Information and Station count. Select an AP and click this button to force it to restart. Select one or multiple APs and click this button to use DCS (Dynamic Channel Selection) to allow the AP to automatically find a less-used channel in an environment where there are many APs and there may be interference. Note: You should have enabled DCS in the applied AP radio profile before the APs can use DCS. Note: DCS is not supported on the radio which is working in repeater AP mode. ZyWALL ATP Series Users Guide 144 Chapter 6 Monitor Table 44 Monitor > Wireless > AP Information > AP List (continued) LABEL Log DESCRIPTION Select an AP and click this button to go to the Monitor > Log > View AP Log screen to view the selected APs current log messages. Click this button to turn suppression on. Click this button to turn suppression off. This field is a sequential value, and it is not associated with a specific AP. This field displays the on-line or off-line status of the AP, move the cursor to the AP icon and a status pop up message will appear. This field displays the APs description, which you can configure by selecting the APs entry and clicking the Edit button. This field displays what percentage of the APs processing capability is currently being used. This field displays the IP address of the AP. This field displays the APs hardware model information. It displays N/A (not applicable) only when the AP disconnects from the Zyxel Device and the information is unavailable as a result. This displays the name of the AP group to which the AP belongs. This field displays the station count information. This field displays the latest date and time that the AP was logged on. This field displays the registration information of the AP. You can set the APs registration at Configuration > Wireless > Controller screen. APs must be connected to the Zyxel Device by a wired connection or network. This field displays the MAC address of the AP. This displays the Access Controller (the Zyxel Device) and runtime management VLAN ID setting for the AP. VLAN Conflict displays if the APs management VLAN ID does not match the Mgmnt. VLAN ID(AC). This field displays n/a if the Zyxel Device cannot get VLAN information from the AP. This field displays the date and time that the AP was last logged out. Suppression On Suppression Off

#

Status Description CPU Usage IP Address Model Group Station Recent On-line Time Registration MAC Address Mgnt. VLAN ID (AC/AP) Last Off-line Time ZyWALL ATP Series Users Guide 145 Chapter 6 Monitor Table 44 Monitor > Wireless > AP Information > AP List (continued) LABEL LED Status DESCRIPTION This field displays the AP LED status. N/A displays if the AP does not support LED suppression mode and/or have a locator LED to show the actual location of the AP. Power Mode A gray LED icon signifies that the AP LED suppression mode is enabled. All the LEDs of the AP will turn off after the AP is ready. A green LED icon signifies that the AP LED suppression mode is disabled and the AP LEDs stay lit after the AP is ready. A sun icon signifies that the APs locator LED is blinking. A circle signifies that the APs locator LED is extinguished. This field displays the APs power status. Full - the AP receives power using a power adapter and/or through a PoE switch/

injector using IEEE 802.3at PoE plus. The PoE device that supports IEEE 802.3at PoE Plus can supply power of up to 30W per Ethernet port. Limited - the AP receives power through a PoE switch/injector using IEEE 802.3af PoE even when it is also connected to a power source using a power adaptor. The PoE device that supports IEEE 802.3af PoE can supply power of up to 15.4W per Ethernet port. When the AP is in limited power mode, the AP throughput decreases and has just one transmitting radio chain. It always shows Full if the AP does not support power detection. The following table describes the icons in this screen. Table 45 Monitor > Wireless > AP Information > AP List Icons LABEL DESCRIPTION This AP is not on the management list. This AP is on the management list and online. This AP is in the process of having its firmware updated. This AP is on the management list but offline. This indicates one of the following cases:

This AP has a runtime management VLAN ID setting that conflicts with the VLAN ID setting on the Access Controller (the Zyxel Device). A setting the Zyxel Device assigns to this AP does not match the APs capability. 6.15.1 AP List: More Information Use this screen to look at station statistics for the connected AP. To access this screen, select an entry and click the More Information button in the AP List screen. Use this screen to look at configuration ZyWALL ATP Series Users Guide 146 Chapter 6 Monitor information, port status and station statistics for the connected AP. To access this screen, select an entry and click the More Information button in the AP List screen. Figure 121 Monitor > Wireless > AP Information > AP List > More Information The following table describes the labels in this screen. Table 46 Monitor > Wireless > AP Information > AP List > More Information LABEL Configuration Status Non Support DESCRIPTION This displays whether or not any of the APs configuration is in conflict with the Zyxel Devices settings for the AP. If any of the APs configuration conflicts with the Zyxel Devices settings for the AP, this field displays which configuration conflicts. It displays n/a if none of the APs configuration conflicts with the Zyxel Devices settings for the AP. Port Status Port This shows the name of the physical Ethernet port on the Zyxel Device. ZyWALL ATP Series Users Guide 147 Chapter 6 Monitor Table 46 Monitor > Wireless > AP Information > AP List > More Information (continued) LABEL Status PVID Up Time VLAN Configuration Name Status VID Member Ethernet Neighbor Local Port

(Description) Model Name System Name Firmware Version Port

(Description) IP Address MAC Address Station Count Last Update OK Cancel DESCRIPTION This field displays the current status of each physical port on the AP. Down - The port is not connected. Speed / Duplex - The port is connected. This field displays the port speed and duplex setting

(Full or Half). This shows the ports PVID. A PVID (Port VLAN ID) is a tag that adds to incoming untagged frames received on a port so that the frames are forwarded to the VLAN group that the tag defines. This field displays how long the physical port has been connected. This shows the name of the VLAN. This displays whether or not the VLAN is activated. This shows the VLAN ID number. This field displays the Ethernet port(s) that is a member of this VLAN. This field displays the port of the Zyxel Device, on which the neighboring device is discovered. For Zyxel Devices that support Port Role, if ports 3 to 5 are grouped together and there is a connection to P5 only, the Zyxel Device will display P3 as the interface port number (even though there is no connection to that port). This field displays the model name of the discovered device. This field displays the system name of the discovered device. This field displays the firmware version of the discovered device. This field displays the first internal port on the discovered device. Internal is an interface type displayed in the Network > Interface > Ethernet > Edit screen. For example, if P1 and P2 are WAN, P3 to P5 are LAN, and P6 is DMZ, then Zyxel Device will display P3 as the first internal interface port number. For Zyxel Devices that support Port Role, if ports 3 to 5 are grouped together and there is a connection to P5 only, the Zyxel Device will display P3 as the first internal interface port number (even though there is no connection to that port). This field displays the IP address of the discovered device. This field displays the MAC address of the discovered device. The y-axis represents the number of connected stations. The x-axis shows the time over which a station was connected. This field displays the date and time the information in the window was last updated. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. ZyWALL ATP Series Users Guide 148 Chapter 6 Monitor 6.15.2 AP List: Config AP Select an AP and click the Config AP button in the Monitor > Wireless > AP Information > AP List table to display this screen. Figure 122 Monitor > Wireless > AP Information > AP List > Config AP ZyWALL ATP Series Users Guide 149 Chapter 6 Monitor Each field is described in the following table. Table 47 Monitor > Wireless > AP Information > AP List > Config AP LABEL Create new Object MAC Model DESCRIPTION Use this menu to create a new Radio Profile object to associate with this AP. This displays the MAC address of the selected AP. This field displays the APs hardware model information. It displays N/A (not applicable) only when the AP disconnects from the Zyxel Device and the information is unavailable as a result. Enter a description for this AP. You can use up to 31 characters, spaces and underscores allowed. Select an AP group to which you want this AP to belong. Description Group Setting Radio 1/2 Setting Override Group Radio Setting Radio 1/2 OP Mode Radio 1/2 Profile Override Group Output Power Setting Output Power Override Group SSID Setting Edit

#

SSID Profile Override Group VLAN Setting Force Overwrite VLAN Config Management VLAN ID As Native VLAN Suppression On Select this option to overwrite the AP radio settings with the settings you configure here. Select the operating mode for radio 1 or radio 2. AP Mode means the AP can receive connections from wireless clients and pass their data traffic through to the Zyxel Device to be managed (or subsequently passed on to an upstream gateway for managing). MON Mode means the AP monitors the broadcast area for other APs, then passes their information on to the Zyxel Device where it can be determined if those APs are friendly or rogue. If an AP is set to this mode it cannot receive connections from wireless clients. Select a profile from the list. If no profile exists, you can create a new one through the Create new Object menu. Select this option to overwrite the AP output power setting with the setting you configure here. Set the output power of the AP. Select this option to overwrite the AP SSID profile setting with the setting you configure here. This section allows you to associate an SSID profile with the radio. Select an SSID and click this button to reassign it. The selected SSID becomes editable immediately upon clicking. This is the index number of the SSID profile. You can associate up to eight SSID profiles with an AP radio. Indicates which SSID profile is associated with this radio profile. Select this option to overwrite the AP VLAN setting with the setting you configure here. Select this to have the Zyxel Device change the APs management VLAN to match the configuration in this screen. Enter a VLAN ID for this AP. Select this option to treat this VLAN ID as a VLAN created on the Zyxel Device and not one assigned to it from outside the network. Select this option to enable the AP's LED suppression mode. All the LEDs of the AP will turn off after the AP is ready. OK Cancel If the check box is unchecked, it means the LEDs will stay lit after the AP is ready. Click OK to save your changes back to the Zyxel Device. Click Cancel to close the window with changes unsaved. ZyWALL ATP Series Users Guide 150 Chapter 6 Monitor 6.16 AP Information: Radio List Click Monitor > Wireless > AP Information > Radio List to display the Radio List screen. Figure 123 Monitor > Wireless > AP Information > Radio List The following table describes the labels in this screen. Table 48 Monitor > Wireless > AP Information > Radio List LABEL More Information

#

Loading AP Description Frequency Band Channel ID Tx Power Station Rx Tx Model MAC Address Radio OP Mode DESCRIPTION Click this icon to see the traffic statistics, station count, SSID, Security Mode and VLAN ID information on the AP. This field is a sequential value, and it is not associated with a specific radio. This indicates the APs load balance status (UnderLoad or OverLoad) when load balancing is enabled on the AP. Otherwise, it shows - when load balancing is disabled or the radio is in monitor mode. Enter a description for this AP. You can use up to 31 characters, spaces and underscores allowed. This field displays the WLAN frequency band using the IEEE 802.11 a/b/g/n standard of 2.4 or 5 GHz. This field displays the WLAN channels using the IEEE 802.11 protocols. This shows the radios output power (in dBm). This field displays the station count information. This field displays the total number of bytes received by the radio. This field displays the total number of bytes transmitted by the radio. This field displays the APs hardware model information. It displays N/A (not applicable) only when the AP disconnects from the Zyxel Device and the information is unavailable as a result. This field displays the MAC address of the AP. This field displays the Radio number. For example 1. This field displays the operating mode of the AP. It displays n/a for the profile for a radio not using an AP profile. AP Mode means the AP can receive connections from wireless clients and pass their data traffic through to the Zyxel Device to be managed (or subsequently passed on to an upstream gateway for managing). ZyWALL ATP Series Users Guide 151 Chapter 6 Monitor Table 48 Monitor > Wireless > AP Information > Radio List LABEL AP / ZyMesh Profile Antenna DESCRIPTION This indicates the AP radio and ZyMesh profile names to which the radio belongs. This indicates the antenna orientation for the radio (Wall or Ceiling). This shows N/A if the AP does not allow you to adjust coverage depending on the orientation of the antenna for each radio using the web configurator or a physical switch. ZyWALL ATP Series Users Guide 152 Chapter 6 Monitor 6.16.1 Radio List: More Information This screen allows you to view detailed information about a selected radios SSID(s), wireless traffic and wireless clients for the preceding 24 hours. To access this window, select an entry and click the More Information button in the Radio List screen. Figure 124 Monitor > Wireless > AP Information > Radio List > More Information ZyWALL ATP Series Users Guide 153 Chapter 6 Monitor The following table describes the labels in this screen. Table 49 Monitor > Wireless > AP Information > Radio List > More Information LABEL MBSSID Detail DESCRIPTION This list shows information about the SSID(s) that is associated with the radio over the preceding 24 hours. This is the items sequential number in the list. It has no bearing on the actual data in this list. This displays an SSID associated with this radio. There can be up to eight maximum. This displays the MAC address associated with the SSID. This displays the security mode in which the SSID is operating. This field indicates the forwarding mode (Local Bridge or Tunnel) associated with the SSID profile. This displays the VLAN ID associated with the SSID. This graph displays the overall traffic information about the radio over the preceding 24 hours. This axis represents the amount of data moved across this radio in megabytes per second. This axis represents the amount of time over which the data moved across this radio. This graph displays information about all the wireless clients that have connected to the radio over the preceding 24 hours. The y-axis represents the number of connected wireless clients. The x-axis shows the time over which a wireless client was connected. This field displays the date and time the information in the window was last updated. Click this to close this window. Click this to close this window.

#

SSID Name BSSID Security Mode Forwarding Mode VLAN Traffic Statistics y-axis x-axis Station Count y-axis x-axis Last Update OK Cancel 6.17 AP Information: Top N APs Use this screen to view the top five or top ten wireless traffic usage and associated wireless stations for the preceding 24 hours. Click Monitor > Wireless > AP Information > Top N APs to display the Top N APs screen. ZyWALL ATP Series Users Guide 154 Chapter 6 Monitor Figure 125 Monitor > Wireless > AP Information > Top N APs The following table describes the labels in this screen. Table 50 Monitor > Wireless > AP Information > Top N APs LABEL View DESCRIPTION Select this to view the top five or top ten wireless traffic usage and associated wireless stations for the preceding 24 hours. If you view the data usage by Usage, select the frequency band and the measure unit in GB or MB to display the graph. If you view the date usage by Station Number, select the measure unit in GB or MB to display the graph. This graph displays the overall traffic information about the top five or top ten wireless traffic for the preceding 24 hours. The y-axis represents the amount of traffic in megabytes/gigabytes. The x-axis represents the time over which wireless traffic flows transmitting from/to the AP. This graph displays information about all the wireless stations that have connected to the AP for the preceding 24 hours. The y-axis represents the number of connected wireless stations. The x-axis represents the time over which a wireless client was connected. Click Refresh to update this screen. Usage by Traffic Usage y-axis x-axis Station Count y-axis x-axis Refresh ZyWALL ATP Series Users Guide 155 Chapter 6 Monitor 6.18 AP Information: Single AP Use this screen to view wireless traffic usage and wireless stations for a managed AP. Click Monitor >

Wireless > AP Information > Single AP to display the Single AP screen. Figure 126 Monitor > Wireless > AP Information > Single AP The following table describes the labels in this screen. Table 51 Monitor > Wireless > AP Information > Single AP LABEL AP Selection DESCRIPTION Select a managed AP from the drop-down list box to view its wireless traffic usage and wireless stations. Select the measure unit in GB or MB to display the graph. This graph displays the overall traffic information about the AP you specified for the preceding 24 hours. The y-axis represents the amount of traffic in megabytes/gigabytes. The x-axis represents the time over which wireless traffic flows transmitting from/to the AP. This graph displays information about all the wireless stations that have connected to the AP for the preceding 24 hours. The y-axis represents the number of connected wireless stations. The x-axis represents the time over which a wireless client was connected. Click Refresh to update this screen. Usage by Traffic Usage y-axis x-axis Station Count y-axis x-axis Refresh ZyWALL ATP Series Users Guide 156 Chapter 6 Monitor 6.19 ZyMesh Use this screen to view the ZyMesh traffic statistics between the managed APs. Click Monitor > Wireless >

ZyMesh to display this screen. Figure 127 Monitor > Wireless > ZyMesh The following table describes the labels in this screen. Table 52 Monitor > Wireless > ZyMesh LABEL

#

Description IP Address Channel ID Hop Uplink AP Info SSID Name Signal Strength Link Up Time MAC Address Tx Power Root AP Tx Rate Rx Rate Refresh DESCRIPTION This field displays the index number of the managed AP (in repeater mode) in this list. This field displays the descriptive name of the managed AP (in repeater mode). This field displays the IP address of the managed AP (in repeater mode). This field displays the number of the channel used by the managed AP (in repeater mode). This is the hop count of the managed AP. For example, 1 means the managed AP is connected to a root AP directly. 2 means there is another repeater AP between the managed AP and the root AP. This shows the role and descriptive name of the managed AP to which this managed AP is connected wirelessly. This indicates the name of the wireless network (SSID) the managed AP uses to associated with another managed AP. Before the slash, this shows the signal strength the uplink AP (a root AP or a repeater) receives from this managed AP (in repeater mode). After the slash, this shows the signal strength this managed AP (in repeater mode) receives from the uplink AP. This field displays the time the managed AP first associated with the root AP or repeater. This field displays the MAC address of the managed AP (in repeater mode). This field displays the output power of the managed AP (in repeater mode). This field displays the descriptive name of the root AP to which the managed AP is connected wirelessly. This field displays the maximum transmission rate of the root AP or repeater to which the managed AP is connected. This field displays the maximum reception rate of the root AP or repeater to which the managed AP is connected. Click Refresh to update this screen. ZyWALL ATP Series Users Guide 157 Chapter 6 Monitor 6.20 SSID Info Use this screen to view the number of wireless clients currently connected to an SSID and the security type used by the SSID. Click Monitor > Wireless > SSID Info to display this screen. Figure 128 Monitor > Wireless > SSID Info The following table describes the labels in this screen. Table 53 Monitor > Wireless > SSID Info LABEL

#

SSID DESCRIPTION This is the SSIDs index number in this list. This indicates the name of the wireless network to which the client is connected. A single AP can have multiple SSIDs or networks. This shows the number of wireless clients which are currently connected to the SSID using the 2.4 GHz frequency band, Click the number to go to the Station Info >

Station List screen. See Section 6.22 on page 159. This shows the number of wireless clients which are currently connected to the SSID using the 5 GHz frequency band, Click the number to go to the Station Info > Station List screen. See Section 6.22 on page 159. This indicates the name of the SSID profile in which the SSID is defined, This indicates which secure encryption methods is being used by the SSID. Click Refresh to update this screen. 2.4GHz 5GHz SSID Profile Name Security Mode Refresh 6.21 Station Info: Station List The Station Info menu contains Station List, Top N Stations and Single Station screens. This screen displays information about connected wireless stations. Click Monitor > Wireless > Station Info > Station List to display this screen. ZyWALL ATP Series Users Guide 158 Chapter 6 Monitor Figure 129 Monitor > Wireless > Station Info > Station List The following table describes the labels in this screen. Table 54 Monitor > Wireless > Station Info > Station List LABEL

#

MAC Address Associated AP SSID Name Security Mode Signal Strength Channel DESCRIPTION This field is a sequential value, and it is not associated with a specific station. This field displays the MAC address of the station. This field displays the APs that are associated with the station. This field displays the SSID names of the station. This field displays the security mode the station is using. This field displays the signal strength of the station. This field displays the number of the channel used by the station to connect to the network. This field displays the frequency band which is currently being used by the station. This field displays the IP address of the station. This field displays the transmit data rate of the station. This field displays the receive data rate of the station. This field displays the number of bytes transmitted from the station. This field displays the number of bytes received by the station. This field displays the time duration the station was online and offline. Click Refresh to update this screen. Band IP Address Tx Rate Rx Rate Tx Rx Association Time Refresh 6.22 Station Info: Top N Stations Use this screen to view the top five or top ten traffic statistics of the wireless stations. Click Monitor >

Wireless > Station Info > Top N Stations to display this screen. ZyWALL ATP Series Users Guide 159 Chapter 6 Monitor Figure 130 Monitor > Wireless > Station Info > Top N Stations The following table describes the labels in this screen. Table 55 Monitor > Wireless > Station Info > Top N Stations LABEL View Usage by Traffic Usage DESCRIPTION Select this to view the top five or top ten traffic statistics of the wireless stations. Select the measure unit in GB or MB to display the graph. This graph displays the overall traffic information about the stations for the preceding 24 hours. This axis represents the amount of data moved across stations in megabytes per second. Click Refresh to update this screen. y-axis Refresh 6.23 Station Info: Single Station Use this screen to view traffic statistics of the wireless station you specified. Click Monitor > Wireless >

Station Info > Single Station to display this screen. ZyWALL ATP Series Users Guide 160 Chapter 6 Monitor Figure 131 Monitor > Wireless > Station Info > Single Station The following table describes the labels in this screen. Table 56 Monitor > Wireless > Station Info > Single Station LABEL Station Selection Usage by Traffic Usage DESCRIPTION Select this to view the traffic statistics of the wireless station. Select the measure unit in GB or MB to display the graph. This graph displays the overall traffic information about the station over the preceding 24 hours. This axis represents the amount of data moved across this station in megabytes per second. Click Refresh to update this screen. y-axis Refresh 6.24 Detected Device Use this screen to view information about wireless devices detected by the AP. Click Monitor > Wireless >

Detected Device to access this screen. Note: At least one radio of the APs connected to the Zyxel Device must be set to monitor mode (in the Configuration > Wireless > AP Management screen) in order to detect other wireless devices in its vicinity. Figure 132 Monitor > Wireless > Detected Device ZyWALL ATP Series Users Guide 161 Chapter 6 Monitor The following table describes the labels in this screen. Table 57 Monitor > Wireless > Detected Device LABEL Mark as Rogue AP Mark as Friendly AP

#

Status Device Role MAC Address SSID Name Channel ID 802.11 Mode Security Description DESCRIPTION Click this button to mark the selected AP as a rogue AP. A rogue AP can be contained in the Configuration > Wireless > MON Mode screen. Click this button to mark the selected AP as a friendly AP. For more on managing friendly APs, see the Configuration > Wireless > MON Mode screen. This is the stations index number in this list. This indicates the detected devices status. This indicates the detected devices network type (such as infrastructure or ad-hoc). This indicates the detected devices role (such as friendly or rogue). This indicates the detected devices MAC address. This indicates the detected devices SSID. This indicates the detected devices channel ID. This indicates the 802.11 mode (a/b/g/n) transmitted by the detected device. This indicates the encryption method (if any) used by the detected device. This displays the detected devices description. For more on managing friendly and rogue APs, see the Configuration > Wireless > MON Mode screen. This indicates the last time the device was detected by the Zyxel Device. Click this to refresh the items displayed on this page. Last Seen Refresh 6.25 The IPSec Screen You can use the IPSec Monitor screen to display and to manage active IPSec SAs. To access this screen, click Monitor > VPN Monitor > IPSec. The following screen appears. Click a columns heading cell to sort the table entries by that columns criteria. Click the heading cell again to reverse the sort order. Figure 133 Monitor > VPN Monitor > IPSec ZyWALL ATP Series Users Guide 162 Chapter 6 Monitor Each field is described in the following table. Policy Search Disconnect Connection Check

#

Serial Number System Name Name Policy Table 58 Monitor > VPN Monitor > IPSec DESCRIPTION LABEL Type the name of a IPSec SA here and click Search to find it (if it is associated). You Name can use a keyword or regular expression. Use up to 30 alphanumeric and _+-

.()!$*^:?|{}[]<>/ characters. See Section on page 163 for more details. Type the IP address(es) or names of the local and remote policies for an IPSec SA and click Search to find it. You can use a keyword or regular expression. Use up to 30 alphanumeric and _+-.()!$*^:?|{}[]<>/ characters. See Section on page 163 for more details. Click this button to search for an IPSec SA that matches the information you specified above. Select an IPSec SA and click this button to disconnect it. Select an IPSec SA and click this button to check the connection. This field is a sequential value, and it is not associated with a specific SA. This field displays the serial number of this Zyxel Device. This field displays the name used to identify the Zyxel Device. This field displays the name of the IPSec SA. This field displays the content of the local and remote policies for this IPSec SA. The IP addresses, not the address objects, are displayed. This field displays the IP address of local computer. This field displays the secure gateway information. This field displays how many seconds the IPSec SA has been active. This field displays N/A if the IPSec SA uses manual keys. This field displays how many seconds remain in the SA life time, before the Zyxel Device automatically disconnects the IPSec SA. This field displays N/A if the IPSec SA uses manual keys. This field displays the amount of traffic that has gone through the IPSec SA from the remote IPSec router to the Zyxel Device since the IPSec SA was established. This field displays the amount of traffic that has gone through the IPSec SA from the Zyxel Device to the remote IPSec router since the IPSec SA was established. My Address Secure Gateway Up Time Outbound (Bytes) Inbound (Bytes) Timeout Regular Expressions in Searching IPSec SAs A question mark (?) lets a single character in the VPN connection or policy name vary. For example, use a?c (without the quotation marks) to specify abc, acc and so on. Wildcards (*) let multiple VPN connection or policy names match the pattern. For example, use *abc

(without the quotation marks) to specify any VPN connection or policy name that ends with abc. A VPN connection named testabc would match. There could be any number (of any type) of characters in front of the abc at the end and the VPN connection or policy name would still match. A VPN connection or policy name named testacc for example would not match. A * in the middle of a VPN connection or policy name has the Zyxel Device check the beginning and end and ignore the middle. For example, with abc*123, any VPN connection or policy name starting with abc and ending in 123 matches, no matter how many characters are in between. The whole VPN connection or policy name has to match if you do not use a question mark or asterisk. ZyWALL ATP Series Users Guide 163 Chapter 6 Monitor 6.26 The SSL Screen The Zyxel Device keeps track of the users who are currently logged into the VPN SSL client. Click Monitor

> VPN Monitor > SSL to display the user list. Use this screen to do the following:

View a list of active SSL VPN connections. Log out individual users and delete related session information. Once a user logs out, the corresponding entry is removed from the screen. Figure 134 Monitor > VPN Monitor > SSL The following table describes the labels in this screen. Table 59 Monitor > VPN Monitor > SSL DESCRIPTION LABEL Disconnect Select a connection and click this button to terminate the users connection and delete corresponding session information from the Zyxel Device. Click Refresh to update this screen. This field is a sequential value, and it is not associated with a specific SSL. This field displays the account user name used to establish this SSL VPN connection. This field displays the name of the SSL VPN application the user is accessing. This field displays the IP address the user used to establish this SSL VPN connection. This field displays the time this connection was established. This field displays the number of bytes received by the Zyxel Device on this connection. This field displays the number of bytes transmitted by the Zyxel Device on this connection. Refresh

#

User Access Login Address Connected Time Inbound (Bytes) Outbound (Bytes) 6.27 The L2TP over IPSec Screen Click Monitor > VPN Monitor > L2TP over IPSec to open the following screen. Use this screen to display and manage the Zyxel Devices connected L2TP VPN sessions. ZyWALL ATP Series Users Guide 164 Chapter 6 Monitor Figure 135 Monitor > VPN Monitor > L2TP over IPSec The following table describes the fields in this screen. Table 60 Monitor > VPN Monitor > L2TP over IPSec LABEL Disconnect Refresh

#

User Name Hostname DESCRIPTION Select a connection and click this button to disconnect it. Click Refresh to update this screen. This field is a sequential value, and it is not associated with a specific L2TP VPN session. This field displays the remote users user name. This field displays the name of the computer that has this L2TP VPN connection with the Zyxel Device. This field displays the IP address that the Zyxel Device assigned for the remote users computer to use within the L2TP VPN tunnel. This field displays the public IP address that the remote user is using to connect to the Internet. Assigned IP Public IP 6.28 The Content Filter Screen Click Monitor > Security Statistics > Content Filter to display the following screen. This screen displays content filter statistics. ZyWALL ATP Series Users Guide 165 Chapter 6 Monitor Figure 136 Monitor > Security Statistics > Content Filter The following table describes the labels in this screen. Table 61 Monitor > Security Statistics > Content Filter LABEL General Settings Collect Statistics DESCRIPTION Apply Reset Refresh Flush Data Web Request Statistics Total Submit File Blocked Warned Passed Category Hit Summary Managed Web Pages Block Hit Summary Select this check box to have the Zyxel Device collect content filtering statistics. The collection starting time displays after you click Apply. All of the statistics in this screen are for the time period starting at the time displayed here. The format is year, month, day and hour, minute, second. All of the statistics are erased if you restart the Zyxel Device or click Flush Data. Collecting starts over and a new collection start time displays. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Click this button to update the report display. Click this button to discard all of the screens statistics and update the report display. This field displays the number of web pages that the Zyxel Devices content filter feature has checked. This is the number of web pages that the Zyxel Device blocked access. This is the number of web pages for which the Zyxel Device displayed a warning message to the access requesters. This is the number of web pages to which the Zyxel Device allowed access. This is the number of requested web pages that the Zyxel Devices content filtering service identified as belonging to a category that was selected to be managed. ZyWALL ATP Series Users Guide 166 Chapter 6 Monitor Table 61 Monitor > Security Statistics > Content Filter (continued) LABEL Web Pages Warned by Category Service Web Pages Blocked by Custom Service Restricted Web Features Forbidden Web Sites URL Keywords DESCRIPTION This is the number of web pages that matched an external database content filtering category selected in the Zyxel Device and for which the Zyxel Device displayed a warning before allowing users access. This is the number of web pages to which the Zyxel Device did not allow access due to the content filtering custom service configuration. This is the number of web pages to which the ZyWALL limited access or removed cookies due to the content filtering custom service's restricted web features configuration. This is the number of web pages to which the Zyxel Device did not allow access because they matched the content filtering custom services forbidden web sites list. This is the number of web pages to which the Zyxel Device did not allow access because they contained one of the content filtering custom services list of forbidden keywords. 6.29 The App Patrol Screen Application patrol provides a convenient way to manage the use of various applications on the network. It manages general protocols (for example, HTTP and FTP) and instant messenger (IM), peer-to-

peer (P2P), Voice over IP (VoIP), and streaming (RSTP) applications. You can even control the use of a particular applications individual features (like text messaging, voice, video conferencing, and file transfers). Click Monitor > Security Statistics > App Patrol > Summary to display the following screen. This screen displays Application Patrol statistics based on the App Patrol profiles bound to Security Policy profiles. Figure 137 Monitor > Security Statistics > App Patrol > Summary The following table describes the labels in this screen. Table 62 Monitor > Security Statistics > App Patrol > Summary LABEL Collect Statistics DESCRIPTION Select this check box to have the Zyxel Device collect app patrol statistics. The collection starting time displays after you click Apply. All of the statistics in this screen are for the time period starting at the time displayed here. The format is year, month, day and hour, minute, second. All of the statistics are erased if you restart the Zyxel Device or click Flush Data. Collecting starts over and a new collection start time displays. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Apply Reset ZyWALL ATP Series Users Guide 167 Chapter 6 Monitor Table 62 Monitor > Security Statistics > App Patrol > Summary LABEL DESCRIPTION Click this button to update the report display. Click this button to discard all of the screens statistics and update the report display. Refresh Flush Data App Patrol Statistics

#

Application Forwarded Data (KB) Dropped Data (KB) Rejected Data (KB) Matched Auto Connection Inbound Kbps Outbound Kbps This field is a sequential value, and it is not associated with a specific App Patrol session. This is the protocol. This is how much of the applications traffic the Zyxel Device has sent (in kilobytes). This is how much of the applications traffic the Zyxel Device has discarded without notifying the client (in kilobytes). This traffic was dropped because it matched an application policy set to drop. This is how much of the applications traffic the Zyxel Device has discarded and notified the client that the traffic was rejected (in kilobytes). This traffic was rejected because it matched an application policy set to reject. This is how much of the applications traffic the Zyxel Device identified by examining the IP payload. This field displays the amount of the applications traffic that has gone to the ZyWALL

(in kilo bits per second). This field displays the amount of the applications traffic that has gone from the ZyWALL (in kilo bits per second). 6.30 The Anti-Malware Screen Click Monitor > Security Statistics > Anti-Malware > Summary to display the following screen. This screen displays anti-malware statistics. Figure 138 Monitor > Security Statistics > Anti-Malware > Summary: Virus Name ZyWALL ATP Series Users Guide 168 Chapter 6 Monitor The following table describes the labels in this screen. Table 63 Monitor > Security Statistics > Anti-Malware > Summary: Virus Name LABEL Collect Statistics DESCRIPTION Select this check box to have the Zyxel Device collect anti-malware statistics. The collection starting time displays after you click Apply. All of the statistics in this screen are for the time period starting at the time displayed here. The format is year, month, day and hour, minute, second. All of the statistics are erased if you restart the Zyxel Device or click Flush Data. Collecting starts over and a new collection start time displays. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Click this button to update the report display. Click this button to discard all of the screens statistics and update the report display. This field displays the number of different viruses that the Zyxel Device has detected. Use this field to have the following (read-only) table display the top anti-malware log entries by Virus Name, Source IP, and Destination IP, Source IPv6 and Destination IPv6. This table displays the most common, recent virus logs. See the log screen for less common virus logs or use a syslog server to record all virus logs. Select Virus Name to list the most common viruses that the Zyxel Device has detected. Select Source IP to list the source IP addresses from which the Zyxel Device has detected the most virus-infected files. Select Destination IP to list the most common destination IP addresses for virus-infected files that Zyxel Device has detected. Select Source IPv6 to list the source IPv6 addresses from which the Zyxel Device has detected the most virus-infected files. Select Destination IPv6 to list the most common destination IPv6 addresses for virus-

infected files that Zyxel Device has detected. Select an entry and click this to add it to the anti-malware white list. Select an entry and click this to remove it from the anti-malware white list. This field displays the entrys rank in the list of the top entries. This column displays when you display the entries by Virus Name. This displays the name of a detected virus. This column displays a hash value, MD5 (Message Digest 5) and SHA (Secure Hash Algorithm), of the detected virus file. MD5 and SHA are hash algorithms used to authenticate packet data. This column displays when you display the entries by Source IP. It shows the source IP address of virus-infected files that the Zyxel Device has detected. his column displays when you display the entries by Source IPv6. It shows the source IPv6 address of virus-infected files that the Zyxel Device has detected. This column displays when you display the entries by Destination IP. It shows the destination IP address of virus-infected files that the Zyxel Device has detected. This column displays when you display the entries by Destination IPv6. It shows the destination IPv6 address of virus-infected files that the Zyxel Device has detected. This field displays how many times the Zyxel Device has detected the event described in the entry. Click this to add this signature to the anti-malware white list. Click this to remove this signature from the anti-malware white list. Apply Reset Refresh Flush Data Total Viruses Detected Top Entries By Add to white list Remove from white list

#

Virus name Hash Source IP Source IPv6 Destination IP Destination IPv6 Occurrences White List The statistics display as follows when you display the top entries by source IP. ZyWALL ATP Series Users Guide 169 Chapter 6 Monitor Figure 139 Monitor > Security Statistics > Anti-Malware > Summary: Source IP The statistics display as follows when you display the top entries by source IPv6. Figure 140 Monitor > Security Statistics > Anti-Malware: Source IPv6 The statistics display as follows when you display the top entries by destination IP. Figure 141 Monitor > Security Statistics > Anti-Malware > Summary: Destination IP The statistics display as follows when you display the top entries by destination IPv6. Figure 142 Monitor > Security Statistics > Anti-Malware: Destination IPv6 6.31 The Reputation Filter Screen Click Monitor > Security Statistics > Reputation Filter > Summary to display the following screen. This screen displays statistics of IP reputation and botnet filtering. ZyWALL ATP Series Users Guide 170 Chapter 6 Monitor Figure 143 Monitor > Security Statistics > Reputation Filter > Summary The following table describes the labels in this screen. Table 64 Monitor > Security Statistics > Reputation Filter > Summary LABEL Collect Statistics Apply Reset Refresh Flush Data Summary IP Scanned IP Hit Count URL Scanned URL Hit Count IP Detected Add to white list Remove from white list Time Malicious IP DESCRIPTION Select this check box to have the Zyxel Device collect anti-malware statistics. The collection starting time displays after you click Apply. All of the statistics in this screen are for the time period starting at the time displayed here. The format is year, month, day and hour, minute, second. All of the statistics are erased if you restart the Zyxel Device or click Flush Data. Collecting starts over and a new collection start time displays. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Click this button to update the report display. Click this button to discard all of the screens statistics and update the report display. This field displays the total number of IPv4 addresses that have been scanned. This field displays the total number of the hit counts on the scanned IPv4 addresses. This field displays the total number of URLs that have been scanned. This field displays the total number of the hit counts on the scanned URLs. Select an entry and click this to add it to the IP reputation white list. Select an entry and click this to remove it from the IP reputation white list. This field displays the date and time the entry was created. This field displays the IPv4 address with bad reputation. ZyWALL ATP Series Users Guide 171 Chapter 6 Monitor DESCRIPTION This field displays the MAC address of the infected host. This field displays the category of the entry. This field displays the threat level of the entry. Table 64 Monitor > Security Statistics > Reputation Filter > Summary (continued) LABEL Infected/Victim Host Threat Category Threat Level URL Detected Add to white list Remove from white list Time Source IP Destination IP Botnet URL Threat Category Select an entry and click this to add it to the botnet filtering white list. Select an entry and click this to remove it from the botnet filtering white list. This field displays the date and time the entry was created. This field displays the source IP address of traffic that you want to trace. This field displays the destination IP address of traffic. This field displays the URL of an infected website or a botnet C&C server. This field displays the category of the entry. 6.32 The IDP Screen Click Monitor > Security Statistics > IDP > Summary to display the following screen. This screen displays IDP (Intrusion Detection and Prevention) statistics. Figure 144 Monitor > Security Statistics > IDP > Summary: Signature Name ZyWALL ATP Series Users Guide 172 Chapter 6 Monitor The following table describes the labels in this screen. Table 65 Monitor > Security Statistics > IDP > Summary LABEL Collect Statistics Apply Reset Refresh Flush Data Total Session Scanned Total Packet Dropped Total Packet Reset Top Entries By Add to white list Remove from white list

#

Signature Name Signature ID Type Severity Source IP Destination IP Occurrences White List DESCRIPTION Select this check box to have the Zyxel Device collect IDP statistics. The collection starting time displays after you click Apply. All of the statistics in this screen are for the time period starting at the time displayed here. The format is year, month, day and hour, minute, second. All of the statistics are erased if you restart the Zyxel Device or click Flush Data. Collecting starts over and a new collection start time displays. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Click this button to update the report display. Click this button to discard all of the screens statistics and update the report display. This field displays the number of sessions that the Zyxel Device has checked for intrusion characteristics. The Zyxel Device can detect and drop malicious packets from network traffic. This field displays the number of packets that the Zyxel Device has dropped. The Zyxel Device can detect and drop malicious packets from network traffic. This field displays the number of packets that the Zyxel Device has reset. Use this field to have the following (read-only) table display the top IDP log entries by Signature Name, Source IP or Destination IP. This table displays the most common, recent IDP logs. See the log screen for less common IDP logs or use a syslog server to record all IDP logs. Select Signature Name to list the most common signatures that the Zyxel Device has detected. Select Source IP to list the source IP addresses from which the Zyxel Device has detected the most intrusion attempts. Select Destination IP to list the most common destination IP addresses for intrusion attempts that the Zyxel Device has detected. Select a signature and click this to add the selected signature to the IDP white list. Select a signature and click this to remove the selected signature from the IDP white list. This field displays the entrys rank in the list of the top entries. This column displays when you display the entries by Signature Name. The signature name identifies the type of intrusion pattern. Click the hyperlink for more detailed information on the intrusion. This column displays when you display the entries by Signature Name. The signature ID is a unique value given to each intrusion detected. This column displays when you display the entries by Signature Name. It shows the categories of intrusions. This column displays when you display the entries by Signature Name. It shows the level of threat that the intrusions may pose. This column displays when you display the entries by Source. It shows the source IP address of the intrusion attempts. This column displays when you display the entries by Destination. It shows the destination IP address at which intrusion attempts were targeted. This field displays how many times the Zyxel Device has detected the event described in the entry. Click this to add this signature to the IDP white list. Click this to remove this signature from the IDP white list. ZyWALL ATP Series Users Guide 173 Chapter 6 Monitor The statistics display as follows when you display the top entries by source. Figure 145 Monitor > Security Statistics > IDP > Summary: Source IP The statistics display as follows when you display the top entries by destination. Figure 146 Monitor > Security Statistics > IDP > Summary: Destination IP 6.33 The Email Security Screens The Email Security menu contains the Summary and Status screens. 6.33.1 Email Security Summary Click Monitor > Security Statistics > Email Security > Summary to display the following screen. This screen displays spam statistics. ZyWALL ATP Series Users Guide 174 Chapter 6 Monitor Figure 147 Monitor > Security Statistics > Email Security > Summary The following table describes the labels in this screen. Table 66 Monitor > Security Statistics > Email Security > Summary LABEL Collect Statistics DESCRIPTION Select this check box to have the Zyxel Device collect email security statistics. The collection starting time displays after you click Apply. All of the statistics in this screen are for the time period starting at the time displayed here. The format is year, month, day and hour, minute, second. All of the statistics are erased if you restart the Zyxel Device or click Flush Data. Collecting starts over and a new collection start time displays. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Click this button to update the report display. Click this button to discard all of the screens statistics and update the report display. This field displays the number of emails that the Zyxel Devices email security feature has checked. This is the number of emails that the Zyxel Device has determined to not be spam. This is the number of emails that matched an entry in the Zyxel Devices email security white list. This is the number of emails that the Zyxel Device has determined to be spam. This is the number of emails that matched an entry in the Zyxel Devices email security black list. ZyWALL ATP Series Users Guide 175 Apply Reset Refresh Flush Data Email Summary Total Mails Scanned Safe Mails Safe Mails Detected by White list Spam Mails Spam Mails Detected by Black List Chapter 6 Monitor Table 66 Monitor > Security Statistics > Email Security > Summary (continued) LABEL Spam Mails Detected by IP Reputation Spam Mails Detected by Mail Content Spam Mails Detected by Phishing Spam Mails Detected by DNSBL DESCRIPTION This is the number of emails that the Zyxel Device has determined to be spam by IP Reputation. Spam or Unwanted Bulk Email is determined by the senders IP address. This is the number of emails that the Zyxel Device has determined to have malicious contents. This is the number of emails that the Zyxel Device has determined to be spam sent by phishing websites. The Zyxel Device can check the sender and relay IP addresses in an emails header against DNS (Domain Name Service)-based spam Black Lists (DNSBLs). This is the number of emails that had a sender or relay IP address in the header which matched one of the DNSBLs that the Zyxel Device uses. This is the number of emails that the Zyxel Device has determined to have malicious contents and attached with virus. Spam Mails with Virus Detected by Mail Content Virus Mails Query Timeout When mail session threshold is reached Mail Sessions Forwarded This is the number of emails that the Zyxel Device has determined to be attached with virus. This is how many queries that were sent to the Zyxel Devices configured list of DNSBL domains or Mail Scan services and did not receive a response in time. This is how many email sessions the Zyxel Device allowed because they exceeded the maximum number of email sessions that the email security feature can check at a time. You can see the Zyxel Devices threshold of concurrent email sessions in the Email Security > Status screen. Use the Email Security > Summary screen to set whether the Zyxel Device forwards or drops sessions that exceed this threshold. This is how many email sessions the Zyxel Device dropped because they exceeded the maximum number of email sessions that the email security feature can check at a time. You can see the Zyxel Devices threshold of concurrent email sessions in the Email Security > Status screen. Use the Email Security > Summary screen to set whether the Zyxel Device forwards or drops sessions that exceed this threshold. Use this field to list the top email or IP addresses from which the Zyxel Device has detected the most spam. Select Sender IP to list the source IP addresses from which the Zyxel Device has detected the most spam. Select Sender Email Address to list the top email addresses from which the Zyxel Device has detected the most spam. This field displays the entrys rank in the list of the top entries. This column displays when you display the entries by Sender IP. It shows the source IP address of spam emails that the Zyxel Device has detected. This column displays when you display the entries by Sender Email Address. This column displays the email addresses from which the Zyxel Device has detected the most spam. This field displays how many spam emails the Zyxel Device detected from the sender. Mail Sessions Dropped Statistics Top Sender By

#

Sender IP Sender Email Address Occurrence 6.33.2 The Email Security Status Screen Click Monitor > Security Statistics > Email Security > Status to display the Email Security Status screen. ZyWALL ATP Series Users Guide 176 Chapter 6 Monitor Use the Email Security Status screen to see how many email sessions the email security feature is scanning and statistics for the DNSBLs. Figure 148 Monitor > Security Statistics > Email Security > Status The following table describes the labels in this screen. Table 67 Monitor > Security Statistics > Email Security > Status LABEL Resource Status Concurrent Mail Session Scanning DESCRIPTION The darker shaded part of the bar shows how much of the Zyxel Devices total spam checking capability is currently being used. The lighter shaded part of the bar and the pop-up show the historical high. The first number to the right of the bar is how many email sessions the Zyxel Device is presently checking for spam. The second number is the maximum number of email sessions that the Zyxel Device can check at once. An email session is when an email client and email server (or two email servers) connect through the Zyxel Device. Click this button to update the information displayed on this screen. Click this button to clear the DNSBL statistics. This also clears the concurrent mail session scanning bars historical high. These are the statistics for the service the Zyxel Device uses. These statistics are for when the Zyxel Device actually queries the service servers. This is the entrys index number in the list. This displays the name of the service. This is the total number of queries the Zyxel Device has sent to this service. This is the average for how long it takes to receive a reply from this service. This is how many queries the Zyxel Device sent to this service without receiving a reply. These are the statistics for the DNSBL the Zyxel Device uses. These statistics are for when the Zyxel Device actually queries the DNSBL servers. Matches for DNSBL responses stored in the cache do not affect these statistics. This is the entrys index number in the list. These are the DNSBLs the Zyxel Device uses to check sender and relay IP addresses in emails. This is the total number of DNS queries the Zyxel Device has sent to this DNSBL. This is the average for how long it takes to receive a reply from this DNSBL. This is how many DNS queries the Zyxel Device sent to this DNSBL without receiving a reply. Refresh Flush Mail Scan Statistics

#

Service Total Queries Avg. Response Time (sec) No Response DNSBL Statistics

#

DNSBL Domain Total Queries Avg. Response Time (sec) No Response ZyWALL ATP Series Users Guide 177 Chapter 6 Monitor 6.34 The Sandboxing Screen Click Monitor > Security Statistics > Sandboxing to display the following screen. This screen displays sandboxing statistics. Figure 149 Monitor > Security Statistics > Sandboxing The following table describes the labels in this screen. Table 68 Monitor > Security Statistics > Sandboxing LABEL Collect Statistics DESCRIPTION Select this check box to have the Zyxel Device collect sandboxing statistics. The collection starting time displays after you click Apply. All of the statistics in this screen are for the time period starting at the time displayed here. The format is year, month, day and hour, minute, second. All of the statistics are erased if you restart the Zyxel Device or click Flush Data. Collecting starts over and a new collection start time displays. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Click this button to update the report display. Click this button to discard all of the screens statistics and update the report display. This field displays the total number of files that the Zyxel Device sent to the Defend Center for analysis. This field displays the total number of files that the Zyxel Device is still scanning. This field displays the total number of files that have been scanned. This shows the number of files that have been destroyed. This shows the number of malicious files that have been detected. Malicious files are files given a high score for malware characteristics by the Defend Center. This shows the number of suspicious files that have been detected. Suspicious files are files given a medium score for malware characteristics by the Defend Center. This shows the number of clean files that have been detected. Safe files are files given a low score for malware characteristics by the Defend Center. This shows the number of internal and external networks errors. Apply Reset Refresh Flush Data Total Scanning Scanned Destroyed Files Malicious Files Suspicious Files Safe File Other ZyWALL ATP Series Users Guide 178 Chapter 6 Monitor 6.35 The SSL Inspection Screens The Zyxel Device uses SSL Inspection to decrypt SSL traffic, sends it to the Security Service engines for inspection, then encrypts traffic that passes inspection and forwards it. You must enable SSL Inspection if you want to use Content Filtering 2.0 Safe Search. Click Monitor > Security Statistics > SSL Inspection > Summary to display the following screen. Figure 150 Monitor > Security Statistics > SSL Inspection > Summaryt The following table describes the labels in this screen. Table 69 Monitor > Security Statistics > SSL Inspection > Summary LABEL Collect Statistics DESCRIPTION Select this check box to have the Zyxel Device collect SSL Inspection statistics. The collection starting time displays after you click Apply. All of the statistics in this screen are for the time period starting at the time displayed here. The format is year, month, day and hour, minute, second. All of the statistics are erased if you restart the Zyxel Device or click Flush Data. Collecting starts over and a new collection start time displays. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Click this button to update the report display. Click this button to discard all of the screens statistics and update the report display. Apply Reset Refresh Flush Data Status Maximum Concurrent Sessions Concurrent Sessions This shows the maximum number of simultaneous SSL Inspection sessions allowed for your Zyxel Device model. This shows the actual number of simultaneous SSL Inspection sessions in progress. Summary Total SSL Sessions Sessions Inspected This is the total of SSL sessions inspected and number of sessions blocked and number of sessions passed since data was last flushed or the Zyxel Device last rebooted after Collect Statistics was enabled. This shows the total number of SSL sessions inspected since data was last flushed or the Zyxel Device last rebooted after Collect Statistics was enabled ZyWALL ATP Series Users Guide 179 Chapter 6 Monitor Table 69 Monitor > Security Statistics > SSL Inspection > Summary (continued) LABEL Decrypted (Kbytes) Encrypted (Kbytes) Sessions Blocked Sessions Passed DESCRIPTION This shows the number of kilobytes (KB) of data that was decrypted for Security Service inspection. This shows the number of kilobytes (KB) of data that was re-encrypted after Security Service inspection and then forwarded. This shows the number of SSL sessions blocked. This shows the number of SSL sessions passed. 6.35.1 Certificate Cache List SSL traffic to a server to be excluded from SSL Inspection is identified by its certificate. Traffic in an Exclude List is not intercepted by SSL Inspection. Click Monitor > Security Statistics > SSL Inspection > Certificate Cache List to display a screen that shows details on SSL traffic going to servers identified by its certificate and an option to add that traffic to the Exclude List. Figure 151 Monitor > Security Statistics > SSL Inspection > Certificate Cache List The following table describes the labels in this screen. Table 70 Monitor > Security Statistics > SSL Inspection > Certificate Cache List LABEL Certificate Cache List Add to Exclude list DESCRIPTION

#

In Exclude List Time Common Name Select and item in the list and click this icon to add the common name (CN) to the Exclude List. This field is a sequential value, and it is not associated with a specific entry. If any one of common name, DNS name, email address or IP address of the certificate is in the Exclude List, then traffic to the server identified by the certificate is excluded from inspection. The icons here are defined as follows:

Gray: The identity of the certificate is not in the Exclude List Green: The common name of the certificate is in the Exclude List Yellow: The common name of certificate is not in the Exclude List but one of the DNS name, email address or IP address is. This is the latest date (yyyy-mm-dd) and time (hh-mm-ss) that the record in the certificate cache list was met. This displays the common name in the certificate of the SSL traffic destination server. ZyWALL ATP Series Users Guide 180 Chapter 6 Monitor Table 70 Monitor > Security Statistics > SSL Inspection > Certificate Cache List (continued) LABEL DESCRIPTION Server Name Indication Server Name Indication (SNI) is the domain name entered in the browser, FTP client, etc. to begin the SSL session with the server. It allows multiple SSL sessions to the same IP address and port number with different certificates from different SNI. This field displays the SNI for this SSL session. This field shows the SSL version. SSLv3/TLS1.0 is currently supported. This displays the IP address and port number of the SSL traffic destination server. This displays the cache item expiry time in seconds. The cache item is deleted when the remaining time expires. Click this button to update the information in the screen. SSL Version Destination Valid Time Refresh 6.36 Log Screens Log messages are stored in two separate logs, one for regular log messages and one for debugging messages. In the regular log, you can look at all the log messages by selecting All Logs, or you can select a specific category of log messages (for example, security policy or user). You can also look at the debugging log by selecting Debug Log. All debugging messages have the same priority. 6.36.1 View Log To access this screen, click Monitor > Log. The log is displayed in the following screen. Note: When a log reaches the maximum number of log messages, new log messages automatically overwrite existing log messages, starting with the oldest existing log message first. The maximum possible number of log messages in the Zyxel Device varies by model. Events that generate an alert (as well as a log message) display in red. Regular logs display in black. Click a columns heading cell to sort the table entries by that columns criteria. Click the heading cell again to reverse the sort order. The Web Configurator saves the filter settings if you leave the View Log screen and return to it later. ZyWALL ATP Series Users Guide 181 Chapter 6 Monitor Figure 152 Monitor > Log > View Log The following table describes the labels in this screen. Table 71 Monitor > Log > View Log LABEL Show (Hide) Filter DESCRIPTION Click this button to show or hide criteria that allow you to filter logs that will be displayed. If the filter settings are hidden, the Category, Email Log Now, Refresh, and Clear fields are available. If the filter settings are shown, the Category, Priority, Source Address, Destination Address, Source Interface, Destination Interface, Service, Keyword, Protocol and Search fields are available. Select the type of log message(s) you want to view. You can also view All Logs at one time, or you can view the Debug Log. This displays when you show the filter. Select the priority of log messages to display. The log displays the log messages with this priority or higher. Choices are: any, emerg, alert, crit, error, warn, notice, and info, from highest priority to lowest priority. This field is grayed out if the Category is Debug Log. This displays when you show the filter. Type the source IP address of the incoming packet that generated the log message. Do not include the port in this filter. This displays when you show the filter. Type the IP address of the destination of the incoming packet when the log message was generated. Do not include the port in this filter. This displays when you show the filter. Type the source interface of the incoming packet that generated the log message. This displays when you show the filter. Type the interface of the destination of the incoming packet when the log message was generated. This displays when you show the filter. Select the service whose log messages you would like to see. The Web Configurator uses the protocol and destination port number(s) of the service to select which log messages you see. Category Priority Source Address Destination Address Source Interface Destination Interface Service ZyWALL ATP Series Users Guide 182 Chapter 6 Monitor Table 71 Monitor > Log > View Log (continued) LABEL Keyword DESCRIPTION This displays when you show the filter. Type a keyword to look for in the Message, Source, Destination and Note fields. If a match is found in any field, the log message is displayed. You can use up to 63 alphanumeric characters and the underscore, as well as punctuation marks () ,:;?! +-*/= #$% @ ; the period, double quotes, and brackets are not allowed. This displays when you show the filter. Select a service protocol whose log messages you would like to see. This displays when you show the filter. Click this button to update the log using the current filter settings. Click Reset to return the screen to its last-saved settings. Click this button to send log message(s) to the Active email address(es) specified in the Send Log To field on the Log Settings page. Click this button to update the information in the screen. Click this button to clear the whole log, regardless of what is currently displayed on the screen. This field is a sequential value, and it is not associated with a specific log message. This field displays the time the log message was recorded. This field displays the priority of the log message. It has the same range of values as the Priority field above. This field displays the log that generated the log message. It is the same value used in the Category field above. This field displays the reason the log message was generated. The text [count=x], where x is a number, appears at the end of the Message field if log consolidation is turned on and multiple entries were aggregated to generate into this one. This field displays the source IP address and the port number in the event that generated the log message. This field displays the destination IP address and the port number of the event that generated the log message. This field displays any additional information about the log message. Protocol Search Reset Email Log Now Refresh Clear

#

Time Priority Category Message Source Destination Note 6.36.2 View AP Log Click on Monitor > Log > View AP Log to open the following screen. ZyWALL ATP Series Users Guide 183 Chapter 6 Monitor Figure 153 Monitor > Log > View AP Log The following table describes the labels in this screen. Select an AP Query Log Query Status AP Information Log File Status Last Log Query Time Table 72 Monitor > Log > View AP Log LABEL DESCRIPTION Click this button to show or hide the filter settings. Show Filter If the filter settings are hidden, the Display, Email Log Now, Refresh, and Clear fields are available. If the filter settings are shown, the Display, Priority, Source Address, Destination Address, Source Interface, Destination Interface, Service, Keyword, Protocol, and Search fields are available. Click the pull down menu to choose an AP. Click Query to create a Query log. The field displays the This field displays the AP information. N/A is displayed when This field displays how many logs are available. It will display Empty if theres none. This field displays the most recent time a log query was solicited. Select the category of log message(s) you want to view. You can also view All Logs at one time, or you can view the Debug Log. This displays when you show the filter. Select the priority of log messages to display. The log displays the log messages with this priority or higher. Choices are: any, emerg, alert, crit, error, warn, notice, and info, from highest priority to lowest priority. This field is read-

only if the Category is Debug Log. Type the IP address of the source AP. This displays when you show the filter. Type the IP address of the destination of the incoming packet when the log message was generated. Do not include the port in this filter. This displays when you show the filter. Type the source interface of the incoming packet that generated the log message. This displays when you show the filter. Type the interface of the destination of the incoming packet when the log message was generated. Select a policy service available from Zyxel Device from the pull down menu. Type a keyword of the policy service available from Zyxel Device to search for a log. Select the protocol of the AP from the pull down menu. Source Address Destination Address Service Keyword Protocol Destination Interface Source Interface Display Priority ZyWALL ATP Series Users Guide 184 Chapter 6 Monitor Table 72 Monitor > Log > View AP Log (continued) LABEL Search Email Log Now DESCRIPTION Click this to start the search. Click this button to send log message(s) to the Active email address(es) specified in the Send Log To field on the Log Settings page. Click this button to update the information in the screen. Click this button to clear the whole log, regardless of what is currently displayed on the screen. This field is a sequential value, and it is not associated with a specific log message. This field displays the time the log message was recorded. This displays when you show the filter. Select the priority of log messages to display. The log displays the log messages with this priority or higher. Choices are: any, emerg, alert, crit, error, warn, notice, and info, from highest priority to lowest priority. This field is read-

only if the Category is Debug Log. This field displays the log that generated the log message. It is the same value used in the Display and (other) Category fields. This field displays the message of the log. This displays the source IP address of the selected log message. This displays the source IP address of the selected log message. This field displays any additional information about the log message. Refresh Clear

#

Time Priority Category Message Source Destination Note ZyWALL ATP Series Users Guide 185 CHAPTER 7 Licensing 7.1 Registration Overview Use the Configuration > Licensing > Registration screens to register your Zyxel Device and manage its service subscriptions. Use the Registration screen (see Section 7.1.2 on page 187) to refresh Zyxel Device registration, go to portal.myZyxel.com to register your Zyxel Device and activate a service, such as content filtering. Use the Service screen (see Section 7.1.3 on page 187) to display the status of your service registrations and upgrade licenses. 7.1.1 What you Need to Know This section introduces the topics covered in this chapter. Subscription Services Available See Configuration > Licensing > Registration > Service for the subscription services that your Zyxel Device supports. Zyxel offers two types of security packs for your Zyxel Device. The subscription services you can use on the Zyxel Device vary depending on the security pack license you purchase. See the table below for services available in each pack. Table 73 Security Packs and Subscription Services SERVICE MODULE Web Security GOLD SECURITY PACK V Application Security Malware Blocker SERVICE Content Filter Botnet Filter App Patrol Email Security Anti-Malware & Cloud Query Threat Intelligence Machine Learning IDP Geo IP IP Reputation Sandboxing Intrusion Prevention Geo Enforcer Reputation Filter Sandboxing Managed AP Service Wireless Controller SecuReporter SecuReporter V V V V V V V V (Unlimited) 1-Year Standard Service Unlimited log retention period Log analysis for 30 days ZyWALL ATP Series Users Guide 186 Chapter 7 Licensing You can purchase an iCard and enter its license key at myZyxel to extend a service. Note: The trial gold security pack license is not transferable. 7.1.2 Registration Screen Click the link in this screen to register your Zyxel Device at myZyxel. Then click Refresh in this screen and wait a few moments for the registration information to update. If the page does not refresh, make sure the Internet connection is working and click Refresh again. The Zyxel Device should already have Internet access and be able to access myZyxel. Click Configuration > Licensing > Registration in the navigation panel to open the screen as shown next. Click on the icon to go to the OneSecurity website where there is guidance on configuration walkthrough and other information. Figure 154 Configuration > Licensing > Registration 7.1.3 Service Screen Use this screen to display the status of your service registrations and upgrade licenses. To activate or extend a standard service subscription, purchase an iCard and enter the iCards PIN number (license key) at myZyxel. Click Activate in this screen to enable both Trial and Standard services on this Zyxel Device. Click Configuration > Licensing > Registration > Service to open the screen as shown next. ZyWALL ATP Series Users Guide 187 Chapter 7 Licensing Figure 155 Configuration > Licensing > Registration > Service The following table describes the labels in this screen. Table 74 Configuration > Licensing > Registration > Service LABEL Service Status

#

Service DESCRIPTION Web Security Application Security Malware Blocker Intrusion Prevention Geo Enforcer Sandboxing Reputation Filter SecuReporter Managed AP Service Firmware Upgrade Service Device HA Pro This is the entrys position in the list. This lists the name of services or service modules that are available on the Zyxel Device. This is a license to a database that can block websites by category, such as Gambling. This is a license for signatures for Application Patrol inspection and signatures to recognize unsolicited commercial or junk email suspect of being sent by spammers. This is a license for signatures to detect malware patterns in files. This is a license for signatures for Intrusion Detection and Prevention attacks. This is a license to a database of country-to-IP address mappings. This is a license to create a virtual sandboxing environment to separate running programs from your network and host devices. This is a license for IP reputation to recognize packets coming from IPv4 address with bad reputation. This is a license that allows SecuReporter to collect and analyze logs from your Zyxel Device in order to identify anomalies, alert on potential internal / external threats, and report on network usage. This is a license to manage more APs than the default for your Zyxel Device when the AP controller is enabled. This is a free license to get Cloud Helper notifications when new firmware is available. You must register your Zyxel Device at myZyxel. This is a license for professional High Availability (HA) that lets a backup Zyxel Device automatically take over if the master Zyxel Device fails. ZyWALL ATP Series Users Guide 188 Chapter 7 Licensing Table 74 Configuration > Licensing > Registration > Service (continued) LABEL Status DESCRIPTION This field displays whether a service license is enabled at myZyxel (Activated) or not

(Not Activated) or expired (Expired). It displays the remaining Grace Period if your license has Expired. It displays Not Licensed if there isnt a license to be activated for this service. Default displays for quantity-based licenses when the Zyxel Device is currently using the allowed free number without a license. For example, if a Zyxel Device is allowed to manage x number of APs without a license and it is currently using that number, then Managed AP Service Status displays Default. This field displays whether you applied for a trial application (Trial) or registered a service with your iCards PIN number (Standard). This field is blank when a service is not activated. This field displays the date your service license expires or the date the grace period expires if the license has already expired. You can continue to use IDP/AppPatrol, Anti-Malware, Content Filter, Email Security during the grace period. After the grace period ends, all of these features are disabled. This field displays how many instances of a service you can use with your current license. N/A means a count does not apply to this service. If you need a license or a trial license has expired, click Buy to buy a new one. If a Standard license has expired, click Renew to extend the license. Then, click Activate to connect with the myZyxel server to activate the new license. Click this button to renew service license information (such as the registration status and expiration day). Note: It is recommended you use this button after you register for a new service. Service Type Expiration Date Count Action Service License Refresh 7.2 Signature Update This section shows you how to update the signature packages of the Zyxel Device. Use the Configuration > Licensing > Signature Update screen (Section 7.2.2 on page 190) to update the signatures used for a service, such as IDP and application patrol. 7.2.1 What you Need to Know You need a valid service registration to update the anti-malware signatures, the botnet filter signatures, the IDP signatures and the App-Patrol signatures. You do not need a service registration to update the system-protection signatures. Schedule signature updates for a day and time when your network is least busy to minimize disruption to your network. Your custom signature configurations are not over-written when you download new signatures. Note: The Zyxel Device does not have to reboot when you upload new signatures. ZyWALL ATP Series Users Guide 189 Chapter 7 Licensing 7.2.2 The Signature Screen Click Configuration > Licensing > Signature Update to display the following screen. Figure 156 Configuration > Licensing > Signature Update The following table describes the labels in this screen. Table 75 Configuration > Licensing > Signature Update LABEL Service Status Feature Type Current Version Released Date Last Sync Action DESCRIPTION The following fields display the status and information on the current signature set that the Zyxel Device is using. This field displays the name of the services available on the Zyxel Device. This field displays the type of service engine used by the Zyxel Device. This field displays the signatures version number currently used by the Zyxel Device. This number gets larger as new signatures are added. This field displays the date and time the set was released. This field displays the date and time the Zyxel Device last checked for new signatures at myZyxel. Click the Update icon to have the Zyxel Device immediately check for new signatures at myZyxel. If new signatures are found, they are then downloaded to the Zyxel Device. Click the Schedule icon to have the Zyxel Device automatically check for new signatures regularly at the time and day specified. You should select a time when your network is not busy for minimal interruption. 7.2.3 Auto Update Click the Schedule icon of a service to display the following screen. Figure 157 Configuration > Licensing > Signature Update: Schedule > Auto Update ZyWALL ATP Series Users Guide 190 Chapter 7 Licensing The following table describes the labels in this screen. Table 76 Configuration > Licensing > Signature Update: Schedule > Auto Update LABEL Auto Update DESCRIPTION Select this check box to have the Zyxel Device automatically check for new signatures regularly at the time and day specified. Hourly Daily Weekly OK You should select a time when your network is not busy for minimal interruption. Select this option to have the Zyxel Device check for new signatures every hour. Select this option to have the Zyxel Device check for new signatures every day at the specified time. The time format is the 24 hour clock, so 23 means 11 PM for example. Select this option to have the Zyxel Device check for new signatures once a week on the day and at the time specified. Click this button to save your changes to the Zyxel Device. ZyWALL ATP Series Users Guide 191 CHAPTER 8 Wireless 8.1 Overview Use the Wireless screens to configure how the Zyxel Device manages supported Access Points (APs). Supported APs should be in managed mode. See the product page Licenses tab for a list of supported APs. 8.1.1 What You Can Do in this Chapter Use the Controller screen (Section 8.2 on page 192) to set how the Zyxel Device allows new APs to connect to the network and set the country code of APs that are connected to the Zyxel Device. Use the AP Management screens (Section 8.3 on page 193) to manage all of the APs connected to the Zyxel Device. Use the Rogue AP screen (Section 8.4 on page 205) to assign APs either to the rogue AP list or the friendly AP list. Use the Auto Healing screen (Section 8.5 on page 208) to extend the wireless service coverage area of the managed APs when one of the APs fails. Use the RTLS screen (Section 8.6 on page 209) to allow managed APs with battery-powered Wi-Fi tags be part of Ekahau RTLS (Real Time Location Service). RTLS can track the location of APs managed by the Zyxel Device to create maps, alerts, and reports. 8.2 Controller Screen Use this screen to set how the Zyxel Device allows new APs to connect to the network. Click Configuration > Wireless > Controller to access this screen. Figure 158 Configuration > Wireless > Controller ZyWALL ATP Series Users Guide 192 Chapter 8 Wireless Each field is described in the following table. DESCRIPTION Table 77 Configuration > Wireless > Controller LABEL Country Code Select the country code of APs that are connected to the Zyxel Device to be the same as where the Zyxel Device is located/installed. The available channels vary depending on the country you selected. Select Manual to add each AP to the Zyxel Device for management, or Always Accept to automatically add APs to the Zyxel Device for management. If you select Manual, then go to Monitor > Wireless > AP Information > AP List, select an AP to be managed and then click Add to Mgnt AP List. That AP will then appear in Configuration > Wireless

> Controller > Mgnt. AP List. Registration Type Note: Select the Manual option for managing a specific set of APs. This is recommended as the registration mechanism cannot automatically differentiate between friendly and rogue APs. Apply Reset APs must be connected to the Zyxel Device by a wired connection or network. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. 8.3 AP Management Screens Use these screens to manage all of the APs connected to the Zyxel Device. Click Configuration >

Wireless > AP Management to access these screens. Click on the icon to go to the OneSecurity website where there is guidance on configuration walkthroughs and other information. 8.3.1 Mgnt. AP List Figure 159 Configuration > Wireless > AP Management > Mgnt. AP List ZyWALL ATP Series Users Guide 193 Chapter 8 Wireless Each field is described in the following table. Table 78 Configuration > Wireless > AP Management > Mgnt. AP List LABEL Edit Remove DESCRIPTION Select an AP and click this button to edit its properties. Select an AP and click this button to remove it from the list. Reboot DCS Now Log Suppression On Suppression Off

#

IP Address MAC Address Model R1 Mode / Profile /

ZyMesh Profile R2 Mode / Profile /

ZyMesh Profile Group Mgnt. VLAN ID(AC) Mgnt. VLAN ID(AP) Description Note: If in the Configuration > Wireless > Controller screen you set the Registration Type to Always Accept, then as soon as you remove an AP from this list it reconnects. Select an AP and click this button to force it to restart. Select one or multiple APs and click this button to use DCS (Dynamic Channel Selection) to allow the AP to automatically find a less-used channel in an environment where there are many APs and there may be interference. Note: You should have enabled DCS in the applied AP radio profile before the APs can use DCS. Note: DCS is not supported on the radio which is working in repeater AP mode. Select an AP and click this button to go to the Monitor > Log > View AP Log screen to view the selected APs current log messages. Select an AP and click this button to enable the APs LED suppression mode. All the LEDs of the AP will turn off after the AP is ready. This button is not available if the selected AP doesnt support suppression mode. Select an AP and click this button to disable the APs LED suppression mode. The AP LEDs stay lit after the AP is ready. This button is not available if the selected AP doesnt support suppression mode. This field is a sequential value, and it is not associated with any entry. This field displays the IP address of the AP. This field displays the MAC address of the AP. This field displays the APs hardware model information. It displays N/A (not applicable) only when the AP disconnects from the Zyxel Device and the information is unavailable as a result. This field displays the operating mode (AP, MON, rootap, or repeater), AP radio profile name and ZyMesh profile name for Radio 1. It displays - for the ZyMesh profile for a radio not using a ZyMesh profile. This field displays the operating mode (AP, MON, rootap, or repeater), AP radio profile name and ZyMesh profile name for Radio 2. It displays - for the ZyMesh profile for a radio not using a ZyMesh profile. This field displays the name of the AP group to which the AP belongs. The group becomes editable immediately upon clicking. This displays the Access Controller (the Zyxel Device) management VLAN ID setting for the AP. This displays the runtime management VLAN ID setting on the AP. VLAN Conflict displays if the APs management VLAN ID does not match the Mgnt. VLAN ID(AC). This field displays n/

a if the Zyxel Device cannot get VLAN information from the AP. This field displays the APs description, which you can configure by selecting the APs entry and clicking the Edit button. ZyWALL ATP Series Users Guide 194 Chapter 8 Wireless 8.3.1.1 Edit AP List Select an AP and click the Edit button in the Configuration > Wireless > AP Management table to display this screen. Figure 160 Configuration > Wireless > AP Management > Mgnt. AP List > Edit AP List ZyWALL ATP Series Users Guide 195 Chapter 8 Wireless Each field is described in the following table. Table 79 Configuration > Wireless > AP Management > Mgnt. AP List > Edit AP List LABEL Create new Object MAC Model DESCRIPTION Use this menu to create a new Radio Profile object to associate with this AP. This displays the MAC address of the selected AP. This field displays the APs hardware model information. It displays N/A (not applicable) only when the AP disconnects from the Zyxel Device and the information is unavailable as a result. Enter a description for this AP. You can use up to 31 characters, spaces and underscores allowed. Select an AP group to which you want this AP to belong. Description Group Setting Radio 1/2 Setting Override Group Radio Setting OP Mode Radio 1/2 AP Profile Radio 1/2 Profile Radio 1/2 ZyMesh Profile Enable Wireless Bridging Override Group Output Power Setting Select this option to overwrite the AP radio settings with the settings you configure here. Select the operating mode for radio 1 or radio 2. AP Mode means the AP can receive connections from wireless clients and pass their data traffic through to the Zyxel Device to be managed (or subsequently passed on to an upstream gateway for managing). MON Mode means the AP monitors the broadcast area for other APs, then passes their information on to the Zyxel Device where it can be determined if those APs are friendly or rogue. If an AP is set to this mode it cannot receive connections from wireless clients. Root AP means the radio acts as an AP and also supports the wireless connections with other APs (in repeater mode) to form a ZyMesh to extend its wireless network. Repeater AP means the radio can establish a wireless connection with other APs (in either root AP or repeater mode). Note: To prevent bridge loops, do NOT set both radios on a managed AP to Repeater AP mode. Note: The root AP and repeater AP(s) in a ZyMesh must use the same country code and AP radio profile settings in order to communicate with each other. Note: Ensure you restart the managed AP after you change its operating mode. Select an AP profile from the list. If no profile exists, you can create a new one through the Create new Object menu. Select a monitor profile from the list. If no profile exists, you can create a new one through the Create new Object menu. This field is available only when the radio is in Root AP or Repeater AP mode. Select the ZyMesh profile the radio uses to connect to a root AP or repeater. This field is available only when the radio is in Repeater AP mode. Select this option to enable wireless bridging on the radio. The managed AP must support LAN provision and the radio should be in repeater mode. VLAN and bridge interfaces are created automatically according to the LAN ports VLAN settings. When wireless bridging is enabled, the managed repeater AP can still transmit data through its Ethernet port(s) after the ZyMesh link is up. Be careful to avoid bridge loops. The managed APs in the same ZyMesh must use the same static VLAN ID. Select this option to overwrite the AP output power setting with the setting you configure here. ZyWALL ATP Series Users Guide 196 Chapter 8 Wireless Table 79 Configuration > Wireless > AP Management > Mgnt. AP List > Edit AP List (continued) LABEL Output Power Override Group SSID Setting DESCRIPTION Set the output power of the AP. Select this option to overwrite the AP SSID profile setting with the setting you configure here. Edit

#

SSID Profile Override Group VLAN Setting Force Overwrite VLAN Config Management VLAN ID As Native VLAN Suppression On This section allows you to associate an SSID profile with the radio. Select an SSID and click this button to reassign it. The selected SSID becomes editable immediately upon clicking. This is the index number of the SSID profile. You can associate up to eight SSID profiles with an AP radio. Indicates which SSID profile is associated with this radio profile. Select this option to overwrite the AP VLAN setting with the setting you configure here. Select this to have the Zyxel Device change the APs management VLAN to match the configuration in this screen. Enter a VLAN ID for this AP. Select this option to treat this VLAN ID as a VLAN created on the Zyxel Device and not one assigned to it from outside the network. Select this option to enable the APs LED suppression mode. All the LEDs of the AP will turn off after the AP is ready. OK Cancel If the check box is unchecked, it means the LEDs will stay lit after the AP is ready. Click OK to save your changes back to the Zyxel Device. Click Cancel to close the window with changes unsaved. 8.3.2 AP Policy Use this screen to configure the AP controllers IP address on the managed APs and determine the action the managed APs take if the current AP controller fails. Click Configuration > Wireless > AP Management > AP Policy to access this screen. Figure 161 Configuration > Wireless > AP Management > AP Policy ZyWALL ATP Series Users Guide 197 Chapter 8 Wireless Each field is described in the following table. Table 80 Configuration > Wireless > AP Management > AP Policy LABEL Force Override AC IP Config on AP Override Type DESCRIPTION Select this to have the Zyxel Device change the AP controllers IP address on the managed AP(s) to match the configuration in this screen. Select Auto to have the managed AP(s) automatically send broadcast packets to find any other available AP controllers. Select Manual to replace the AP controllers IP address configured on the managed AP(s) with the one(s) you specified below. Specify the IP address of the primary AP controller if you set Override Type to Manual. Specify the IP address of the secondary AP controller if you set Override Type to Manual. Select this option to have the managed AP(s) change back to associate with the primary AP controller as soon as the primary AP controller is available. Set how often the managed AP(s) check whether the primary AP controller is available. Specify how you want the Zyxel Device to upgrade AP firmware. Select CAPWAP to have the Zyxel Device use CAPWAP (Control and Provisioning of Wireless Access Points protocol) to automatically update firmware on the managed APs. Select FTP to allow the managed APs to download the latest firmware from the Zyxel Device using FTP. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Primary Controller Secondary Controller Fall back to Primary Controller when possible Fall Back Check Interval Firmware Updating Updating Type Apply Reset 8.3.3 AP Group Use this screen to configure AP groups, which define the radio, port, VLAN and load balancing settings and apply the settings to all APs in the group. An AP can belong to one AP group at a time. Click Configuration > Wireless > AP Management > AP Group to access this screen. Figure 162 Configuration > Wireless > AP Management > AP Group ZyWALL ATP Series Users Guide 198 Chapter 8 Wireless Each field is described in the following table. Table 81 Configuration > Wireless > AP Management > AP Group LABEL Group Setting Default Group Select a group that is used as the default group. DESCRIPTION Group Summary Add Edit Remove DCS Now

#

Group Name Member Count Apply Reset Any AP that is not configured to associate with a specific AP group belongs to the default group automatically. Click this button to create a new AP group. Select an entry and click this button to edit its properties. Select an entry and click this button to remove it from the list. Note: You cannot remove a group with which an AP is associated. Select one or multiple groups and click this button to use DCS (Dynamic Channel Selection) to allow the APs in the group(s) to automatically find a less-used channel in an environment where there are many APs and there may be interference. Note: You should have enabled DCS in the applied AP radio profile before the APs can use DCS. Note: DCS is not supported on the radio which is working in repeater AP mode. This is the index number of the group in the list. This is the name of the group. This is the total number of APs which belong to this group. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. ZyWALL ATP Series Users Guide 199 Chapter 8 Wireless 8.3.3.1 Add/Edit AP Group Click Add or select an AP group and click the Edit button in the Configuration > Wireless > AP Management > AP Group table to display this screen. Figure 163 Configuration > Wireless > AP Management > AP Group > Add/Edit ZyWALL ATP Series Users Guide 200 Chapter 8 Wireless Each field is described in the following table. Table 82 Configuration > Wireless > AP Management > AP Group > Add/Edit LABEL General Settings Group Name DESCRIPTION Enter a name for this group. You can use up to 31 alphanumeric characters. Dashes and underscores are also allowed. The name should start with a letter. Enter a description for this group. You can use up to 31 characters, spaces and underscores allowed. Description Radio 1/2 Setting OP Mode Radio 1/2 AP Profile Radio 1/2 Profile Radio 1/2 ZyMesh Profile Enable Wireless Bridging Select the operating mode for radio 1 or radio 2. AP Mode means the AP can receive connections from wireless clients and pass their data traffic through to the Zyxel Device to be managed (or subsequently passed on to an upstream gateway for managing). MON Mode means the AP monitors the broadcast area for other APs, then passes their information on to the Zyxel Device where it can be determined if those APs are friendly or rogue. If an AP is set to this mode it cannot receive connections from wireless clients. Root AP means the radio acts as an AP and also supports the wireless connections with other APs (in repeater mode) to form a ZyMesh to extend its wireless network. Repeater AP means the radio can establish a wireless connection with other APs (in either root AP or repeater mode). Note: To prevent bridge loops, do NOT set both radios on a managed AP to Repeater AP mode. Note: The root AP and repeater AP(s) in a ZyMesh must use the same country code and AP radio profile settings in order to communicate with each other. Note: Ensure you restart the managed AP after you change its operating mode. Select an AP profile from the list. If no profile exists, you can create a new one through the Create new Object menu. Select a monitor profile from the list. If no profile exists, you can create a new one through the Create new Object menu. This field is available only when the radio is in Root AP or Repeater AP mode. Select the ZyMesh profile the radio uses to connect to a root AP or repeater. This field is available only when the radio is in Repeater AP mode. Select this option to enable wireless bridging on the radio. The managed AP must support LAN provision and the radio should be in repeater mode. VLAN and bridge interfaces are created automatically according to the LAN ports VLAN settings. When wireless bridging is enabled, the managed repeater AP can still transmit data through its Ethernet port(s) after the ZyMesh link is up. Be careful to avoid bridge loops. Output Power The managed APs in the same ZyMesh must use the same static VLAN ID. Set the maximum output power of the AP. If there is a high density of APs in an area, decrease the output power of the managed AP to reduce interference with other APs. Note: Reducing the output power also reduces the Zyxel Devices effective broadcast radius. Edit Select an SSID and click this button to reassign it. The selected SSID becomes editable immediately upon clicking. ZyWALL ATP Series Users Guide 201 Chapter 8 Wireless Table 82 Configuration > Wireless > AP Management > AP Group > Add/Edit (continued) LABEL

#

DESCRIPTION This is the index number of the SSID profile. You can associate up to eight SSID profiles with an AP radio. Indicates which SSID profile is associated with this radio profile. SSID Profile VLAN Settings Force Overwrite VLAN Config Management VLAN ID As Native VLAN Port Settings Model Specific Setting Port Setting Edit Activate/Inactivate

#

Status Port PVID VLAN Configuration

#

Status Name VID Member Load Balancing Setting Enable Load Balancing Select this to have the Zyxel Device change the APs management VLAN to match the configuration in this screen. Enter a VLAN ID for this AP. Select this option to treat this VLAN ID as a VLAN created on the Zyxel Device and not one assigned to it from outside the network. Select the model of the managed AP to display the model-specific port and VLAN settings in the tables below. You can activate or deactivate a non-uplink port. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. This is the ports index number in this list. This displays whether or not the port is activated. This shows the name of the physical Ethernet port on the managed AP. This shows the ports PVID. A PVID (Port VLAN ID) is a tag that adds to incoming untagged frames received on a port so that the frames are forwarded to the VLAN group that the tag defines. Use Add to create a new VLAN Configuration. Select a VLAN Configuration first to use the Edit, Remove, Activate and Inactivate buttons. This is the VLANs index number in this list. This displays whether or not the VLAN is activated. This shows the name of the VLAN. This shows the VLAN ID number. This field displays the Ethernet port(s) that is a member of this VLAN. Select this to enable load balancing on the Zyxel Device. Use this section to configure wireless network traffic load balancing between the managed APs in this group. Note: Load balancing is not supported on the radio which is working in root AP or repeater AP mode. ZyWALL ATP Series Users Guide 202 Chapter 8 Wireless Table 82 Configuration > Wireless > AP Management > AP Group > Add/Edit (continued) LABEL Mode Max Station Number Traffic Level Disassociate station when overloaded DESCRIPTION Select a mode by which load balancing is carried out. Select By Station Number to balance network traffic based on the number of specified stations connected to an AP. Select By Traffic Level to balance network traffic based on the volume generated by the stations connected to an AP. Select By Smart Classroom to balance network traffic based on the number of specified stations connected to an AP. The AP ignores association request and authentication request packets from any new station when the maximum number of stations is reached. If you select By Station Number or By Traffic Level, once the threshold is crossed (either the maximum station numbers or with network traffic), the AP delays association request and authentication request packets from any new station that attempts to make a connection. This allows the station to automatically attempt to connect to another, less burdened AP if one is available. Enter the threshold number of stations at which an AP begins load balancing its connections. Select the threshold traffic level at which the AP begins load balancing its connections

(Low, Medium, High). The maximum bandwidth allowed for each level is:

Low - 11 Mbps, Medium - 23 Mbps High - 35M bps This function is enabled by default and the disassociation priority is always Signal Strength when you set Mode to By Smart Classroom. Select this option to disassociate wireless clients connected to the AP when it becomes overloaded. If you do not enable this option, then the AP simply delays the connection until it can afford the bandwidth it requires, or it transfers the connection to another AP within its broadcast radius. The disassociation priority is determined automatically by the Zyxel Device and is as follows:

Idle Timeout - Devices that have been idle the longest will be disassociated first. If none of the connected devices are idle, then the priority shifts to Signal Strength. Signal Strength - Devices with the weakest signal strength will be disassociated first. Note: If you enable this function, you should ensure that there are multiple APs within the broadcast radius that can accept any rejected or kicked wireless clients; otherwise, a wireless client attempting to connect to an overloaded AP will be kicked continuously and never be allowed to connect. This lists the APs that do not belong to this group. Select the APs that you want to add to the group you are editing, and click the right arrow button to add them. This lists the APs that belong to this group. Select any APs that you want to remove from the group, and click the left arrow button to remove them. Click OK to save your changes back to the Zyxel Device. Click Cancel to close the window with changes unsaved. Click this button to overwrite the settings of all managed APs in this group with the settings you configure here. All Override Group check boxes on the AP Management > Mgnt. AP List

> Edit AP List screen for the APs in this group will be deselected. AP List Available Member OK Cancel Override Member AP Setting ZyWALL ATP Series Users Guide 203 Chapter 8 Wireless 8.3.4 Firmware The Zyxel Device stores an AP firmware in order to manage supported APs. This screen allows the Zyxel Device to check for and download new AP firmware when it becomes available on the firmware server. All APs managed by the Zyxel Device must have the same firmware version as the AP firmware on the Zyxel Device. When an AP connects to the Zyxel Device wireless controller, the Zyxel Device will check if the AP has the same firmware version as the AP firmware on the Zyxel Device. If yes, then the Zyxel Device can manage it. If no, then the AP must upgrade (or downgrade) its firmware to be the same version as the AP firmware on the Zyxel Device (and reboot). The Zyxel Device should always have the latest AP firmware so that:

APs dont have to downgrade firmware in order to be managed All new APs are supported. Use Check to see if the Zyxel Device has the latest AP firmware. Use Apply to have the Zyxel Device download the latest AP firmware (see More Details for more information on the firmware) from the firmware server. If the Zyxel Device does not have enough space for the latest AP firmware, then the Zyxel Device will delete an existing firmware that no AP is using before downloading the new AP firmware. Click Configuration > Wireless > AP Management > Firmware to access this screen. Figure 164 Configuration > Wireless > AP Management > Firmware ZyWALL ATP Series Users Guide 204 Chapter 8 Wireless Each field is described in the following table. Table 83 Configuration > Wireless > AP Management > Firmware LABEL AP Firmware Runtime Firmware DESCRIPTION Available Firmware This displays the current AP firmware version on the Zyxel Device. The Zyxel Device must have the latest AP firmware to manage all supported APs. This field displays if there is a later AP firmware version available on the firmware server. It displays N/A if the Zyxel Device cannot connect with the firmware server. Check that the Zyxel Device has Internet access if N/A displays and then click the Check button below. If a newer Zyxel Device AP firmware is available, its version number and a More Details icon displays here. Last Check Success Check Apply AP Firmware Apply

#

Model Runtime Firmware Refresh This displays the date and time the last check for new firmware was made and whether the check is in progress (checking), was successful (success), or has failed (fail). Click this button to have the Zyxel Device display the latest AP firmware version available on the firmware server. Due to space limitations, the Zyxel Device only downloads and keeps AP firmware for APs it is currently managing. If you connect a new AP to the Zyxel Device, the Zyxel Device may need to download a new AP firmware. Please wait while downloading new firmware as the speed depends on your Internet connection speed. Make sure to maintain the Internet connection while downloading new firmware. Click this to download newer Available Firmware from the firmware server and update the Runtime Firmware version. This is an index number of a managed AP. This displays the name of all manageable AP models. This displays the firmware version that the managed AP must have in order to be managed by the Zyxel Device. Firmware for APs that the Zyxel Device already has displays in bold;

firmware that the Zyxel Device doesnt have or is still downloading is grayed out. Firmware that is in the download queue will show To be downloaded. Click this to update the model firmware table. 8.4 Rogue AP Use this screen to assign APs either to the rogue AP list or the friendly AP list. A rogue AP is a wireless access point operating in a networks coverage area that is not under the control of the network administrator, and which can potentially open up holes in a networks security. Click Configuration > Wireless > Rogue AP to access this screen. ZyWALL ATP Series Users Guide 205 Chapter 8 Wireless Figure 165 Configuration > Wireless > Rogue AP Each field is described in the following table. Table 84 Configuration > Wireless > Rogue AP LABEL Suspected Rogue AP Classification Rule Add Edit Remove

#

SSID Keyword Rogue/Friendly AP List Add Edit Remove DESCRIPTION Click the check boxes (Weak Security (Open, WEP, WPA-PSK), Un-managed AP, Hidden SSID, SSID Keyword) of the characteristics an AP should have for the Zyxel Device to rule it as a rogue AP. Click this to add an SSID Keyword. Select an SSID Keyword and click this button to modify it. Select an existing SSID keyword and click this button to delete it. This is the SSID Keywords index number in this list. This field displays the SSID Keyword. Click this button to add an AP to the list and assign it either friendly or rogue status. Select an AP in the list to edit and reassign its status. Select an AP in the list to remove. ZyWALL ATP Series Users Guide 206 Chapter 8 Wireless Table 84 Configuration > Wireless > Rogue AP (continued) LABEL DESCRIPTION Click this button to quarantine the selected AP. Containment Dis-Containment

#

Containment Role MAC Address Description Rogue/Friendly AP List Importing/Exporting File Path / Browse /

Importing Exporting Monitor Mode Settings Enable Rogue AP Containment Apply Reset A quarantined AP cannot grant access to any network services. Any stations that attempt to connect to a quarantined AP are disconnected automatically. Click this button to take the selected AP out of quarantine. An unquarantined AP has normal access to the network. This field is a sequential value, and it is not associated with any interface. This field indicates the selected APs containment status. This field indicates whether the selected AP is a rogue-ap or a friendly-ap. To change the APs role, click the Edit button. This field indicates the APs radio MAC address. This field displays the APs description. You can modify this by clicking the Edit button. These controls allow you to export the current list of rogue and friendly APs or import existing lists. Enter the file name and path of the list you want to import or click the Browse button to locate it. Once the File Path field has been populated, click Importing to bring the list into the Zyxel Device. Click this button to export the current list of either rogue APs or friendly APS. Select this to enable rogue AP containment. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. 8.4.1 Add/Edit Rogue/Friendly List Select an AP and click the Edit button in the Configuration > Wireless > Rogue AP table to display this screen. Figure 166 Configuration > Wireless > Rogue AP > Add/Edit Rogue/Friendly Each field is described in the following table. Table 85 Configuration > Wireless > Rogue AP > Add/Edit Rogue/Friendly LABEL MAC DESCRIPTION Enter the MAC address of the AP you want to add to the list. A MAC address is a unique hardware identifier in the following hexadecimal format: xx:xx:xx:xx:xx:xx where xx is a hexadecimal number separated by colons. Enter up to 60 characters for the APs description. Spaces and underscores are allowed. Description ZyWALL ATP Series Users Guide 207 Chapter 8 Wireless Table 85 Configuration > Wireless > Rogue AP > Add/Edit Rogue/Friendly (continued) LABEL Role OK Cancel DESCRIPTION Select either Rogue AP or Friendly AP for the APs role. Click OK to save your changes back to the Zyxel Device. Click Cancel to close the window with changes unsaved. 8.5 Auto Healing Use this screen to enable auto healing, which allows you to extend the wireless service coverage area of the managed APs when one of the APs fails. Click Configuration > Wireless > Auto Healing to access this screen. Figure 167 Configuration > Wireless > Auto Healing Each field is described in the following table. DESCRIPTION Select this option to turn on the auto healing feature. Table 86 Configuration > Wireless > Auto Healing LABEL Enable Auto Healing Save Current State Auto Healing Interval Click this button to have all manged APs immediately scan their neighborhoods three times in a row and update their neighbor lists to the AP controller (Zyxel Device). Set the time interval (in minutes) at which the managed APs scan their neighborhoods and report the status of neighbor APs to the AP controller (Zyxel Device). Power Threshold Apply Reset An AP is considered failed if the AP controller obtains the same scan result that the AP is missing from the neighbor list of other APs three times. Set the power level (in dBm) to which the neighbor APs of the failed AP increase their output power in order to extend their wireless service coverage areas. When the failed AP is working again, its neighbor APs return their output power to the original level. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. ZyWALL ATP Series Users Guide 208 Chapter 8 Wireless 8.6 RTLS Overview Ekahau RTLS (Real Time Location Service) tracks battery-powered Wi-Fi tags attached to APs managed by the Zyxel Device to create maps, alerts, and reports. The Ekahau RTLS Controller is the centerpiece of the RTLS system. This server software runs on a Windows computer to track and locate Ekahau tags from Wi-Fi signal strength measurements. Use the Zyxel Device with the Ekahau RTLS system to take signal strength measurements at the APs (Integrated Approach / Blink Mode). The following example shows the Ekahau RTLS Integrated Approach (Blink Mode). The Wi-Fi tag sends blink packets at specified intervals (or triggered by something like motion or button presses). The APs pick up the blink packets, measure the signal strength, and send it to the Zyxel Device. The Zyxel Device forwards the signal measurements to the Ekahau RTLS Controller. The Ekahau RTLS Controller calculates the tag positions. Figure 168 RTLS Example 1 2 3 4 8.6.1 What You Can Do in this Chapter Use the RTLS screen (Section 8.6.3 on page 210) to use the managed APs as part of an Ekahau RTLS (Real Time Location Service) to track the location of Ekahau Wi-Fi tags. 8.6.2 Before You Begin You need:

At least three APs managed by the Zyxel Device (the more APs the better since it increases the amount of information the Ekahau RTLS Controller has for calculating the location of the tags) IP addresses for the Ekahau Wi-Fi tags A dedicated RTLS SSID is recommended ZyWALL ATP Series Users Guide 209 Chapter 8 Wireless Ekahau RTLS Controller in blink mode with TZSP Updater enabled Security policies to allow RTLS traffic if the Zyxel Device security policy control is enabled or the Ekahau RTLS Controller is behind a firewall. For example, if the Ekahau RTLS Controller is behind a firewall, open ports 8550, 8553, and 8569 to allow traffic the APs send to reach the Ekahau RTLS Controller. The following table lists default port numbers and types of packets RTLS uses. Table 87 RTLS Traffic Port Numbers PORT NUMBER 8548 8549 8550 8552 8553 8554 8560 8562 8569 TYPE TCP UDP TCP UDP UDP UDP TCP UDP UDP DESCRIPTION Ekahau T201 location update. Ekahau T201 location update. Ekahau T201 tag maintenance protocol and Ekahau RTLS Controller user interface. Ekahau Location Protocol Ekahau Maintenance Protocol Ekahau T301 firmware update. Ekahau Vision web interface Ekahau T301W firmware update. Ekahau TZSP Listener Port 8.6.3 Configuring RTLS Click Configuration > Wireless > RTLS to open this screen. Use this screen to turn RTLS (Real Time Location System) on or off and specify the IP address and server port of the Ekahau RTLS Controller. Figure 169 Configuration > Wireless > RTLS The following table describes the labels in this screen. Table 88 Configuration > Wireless > RTLS LABEL Enable IP Address Server Port DESCRIPTION Select this to use Wi-Fi to track the location of Ekahau Wi-Fi tags. Specify the IP address of the Ekahau RTLS Controller. Specify the server port number of the Ekahau RTLS Controller. ZyWALL ATP Series Users Guide 210 Chapter 8 Wireless Table 88 Configuration > Wireless > RTLS (continued) LABEL Apply Reset DESCRIPTION Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. 8.7 Technical Reference The following section contains additional technical information about wireless features. 8.7.1 Dynamic Channel Selection When numerous APs broadcast within a given area, they introduce the possibility of heightened radio interference, especially if some or all of them are broadcasting on the same radio channel. If the interference becomes too great, then the network administrator must open his AP configuration options and manually change the channel to one that no other AP is using (or at least a channel that has a lower level of interference) in order to give the connected stations a minimum degree of interference. Dynamic channel selection frees the network administrator from this task by letting the AP do it automatically. The AP can scan the area around it looking for the channel with the least amount of interference. In the 2.4 GHz spectrum, each channel from 1 to 13 is broken up into discrete 22 MHz segments that are spaced 5 MHz apart. Channel 1 is centered on 2.412 GHz while channel 13 is centered on 2.472 GHz. Figure 170 An Example Three-Channel Deployment Three channels are situated in such a way as to create almost no interference with one another if used exclusively: 1, 6 and 11. When an AP broadcasts on any of these three channels, it should not interfere with neighboring APs as long as they are also limited to same trio. Figure 171 An Example Four-Channel Deployment ZyWALL ATP Series Users Guide 211 Chapter 8 Wireless However, some regions require the use of other channels and often use a safety scheme with the following four channels: 1, 4, 7 and 11. While they are situated sufficiently close to both each other and the three so-called safe channels (1,6 and 11) that interference becomes inevitable, the severity of it is dependent upon other factors: proximity to the affected AP, signal strength, activity, and so on. Finally, there is an alternative four channel scheme for ETSI, consisting of channels 1, 5, 9, 13. This offers significantly less overlap that the other one. Figure 172 An Alternative Four-Channel Deployment 8.7.2 Load Balancing Because there is a hard upper limit on an APs wireless bandwidth, load balancing can be crucial in areas crowded with wireless users. Rather than let every user connect and subsequently dilute the available bandwidth to the point where each connecting device receives a meager trickle, the load balanced AP instead limits the incoming connections as a means to maintain bandwidth integrity. There are two kinds of wireless load balancing available on the Zyxel Device:

Load balancing by station number limits the number of devices allowed to connect to your AP. If you know exactly how many stations you want to let connect, choose this option. For example, if your companys graphic design team has their own AP and they have 10 computers, you can load balance for 10. Later, if someone from the sales department visits the graphic design teams offices for a meeting and he tries to access the network, his computers connection is delayed, giving it the opportunity to connect to a different, neighboring AP. If he still connects to the AP regardless of the delay, then the AP may boot other people who are already connected in order to associate with the new connection. Load balancing by traffic level limits the number of connections to the AP based on maximum bandwidth available. If you are uncertain as to the exact number of wireless connections you will have then choose this option. By setting a maximum bandwidth cap, you allow any number of devices to connect as long as their total bandwidth usage does not exceed the configured bandwidth cap associated with this setting. Once the cap is hit, any new connections are rejected or delayed provided that there are other APs in range. Imagine a coffee shop in a crowded business district that offers free wireless connectivity to its customers. The coffee shop owner cant possibly know how many connections his AP will have at any given moment. As such, he decides to put a limit on the bandwidth that is available to his customers but not on the actual number of connections he allows. This means anyone can connect to his wireless network as long as the AP has the bandwidth to spare. If too many people connect and the AP hits its bandwidth cap then all new connections must basically wait for their turn or get shunted to the nearest identical AP. ZyWALL ATP Series Users Guide 212 CHAPTER 9 Interfaces 9.1 Interface Overview Use the Interface screens to configure the Zyxel Devices interfaces. You can also create interfaces on top of other interfaces. Ports are the physical ports to which you connect cables. Interfaces are used within the system operationally. You use them in configuring various features. An interface also describes a network that is directly connected to the Zyxel Device. For example, You connect the LAN network to the LAN interface. Zones are groups of interfaces used to ease security policy configuration. 9.1.1 What You Can Do in this Chapter Use the Port Role screen (Section 9.2 on page 218) to create port groups and to assign physical ports and port groups to Ethernet interfaces. Use the Port Configuration screen (Section 9.3 on page 219) to configure Zyxel Device port settings. Use the Ethernet screens (Section 9.4 on page 220) to configure the Ethernet interfaces. Ethernet interfaces are the foundation for defining other interfaces and network policies. RIP and OSPF are also configured in these interfaces. Use the PPP screens (Section 9.5 on page 243) for PPPoE, PPTP or L2TP Internet connections. Use the Cellular screens (Section 9.6 on page 250) to configure settings for interfaces for Internet connections through an installed mobile broadband card. Use the Tunnel screens (Section 9.7 on page 259) to configure tunnel interfaces to be used in Generic Routing Encapsulation (GRE), IPv6 in IPv4, and 6to4 tunnels. Use the VLAN screens (Section 9.8 on page 266) to divide the physical network into multiple logical networks. VLAN interfaces receive and send tagged frames. The Zyxel Device automatically adds or removes the tags as needed. Each VLAN can only be associated with one Ethernet interface. Use the Bridge screens (Section 9.9 on page 279) to combine two or more network segments into a single network. Use the VTI screens (Section 9.10 on page 293) to encrypt or decrypt IPv4 traffic from or to the interface according to the IP routing table. Use the Trunk screens (Section 9.11 on page 298) to configure load balancing. 9.1.2 What You Need to Know Interface Characteristics Interfaces generally have the following characteristics (although not all characteristics apply to each type of interface). ZyWALL ATP Series Users Guide 213 Chapter 9 Interfaces An interface is a logical entity through which (layer-3) packets pass. An interface is bound to a physical port or another interface. Many interfaces can share the same physical port. An interface belongs to at most one zone. Many interfaces can belong to the same zone. Layer-3 virtualization (IP alias, for example) is a kind of interface. Types of Interfaces You can create several types of interfaces in the Zyxel Device. Setting interfaces to the same port role forms a port group. Port groups creates a hardware connection between physical ports at the layer-2 (data link, MAC address) level. Port groups are created when you use the Interface > Port Roles or Interface > Port Groups screen to set multiple physical ports to be part of the same interface. Ethernet interfaces are the foundation for defining other interfaces and network policies. RIP and OSPF are also configured in these interfaces. Tunnel interfaces send IPv4 or IPv6 packets from one network to a specific network through the Internet or a public network. VLAN interfaces receive and send tagged frames. The Zyxel Device automatically adds or removes the tags as needed. Each VLAN can only be associated with one Ethernet interface. Bridge interfaces create a software connection between Ethernet or VLAN interfaces at the layer-2

(data link, MAC address) level. Unlike port groups, bridge interfaces can take advantage of some security features in the Zyxel Device. You can also assign an IP address and subnet mask to the bridge. PPP interfaces support Point-to-Point Protocols (PPP). ISP accounts are required for PPPoE/PPTP/L2TP interfaces. Cellular interfaces are for mobile broadband WAN connections via a connected mobile broadband device. Virtual interfaces provide additional routing information in the Zyxel Device. There are three types:

virtual Ethernet interfaces, virtual VLAN interfaces, and virtual bridge interfaces. Trunk interfaces manage load balancing between interfaces. Port groups and trunks have a lot of characteristics that are specific to each type of interface. The other types of interfaces--Ethernet, PPP, cellular, VLAN, bridge, and virtual--have a lot of similar characteristics. These characteristics are listed in the following table and discussed in more detail below. Table 89 Ethernet, PPP, Cellular, VLAN, Bridge, and Virtual Interface Characteristics CHARACTERISTICS ETHERNET Name*

CELLULAR cellularx VLAN vlanx PPP pppx wan1, wan2 BRIDGE brx ETHERNET lan1, lan2, dmz No Yes Yes Yes Yes Configurable Zone IP Address Assignment No Static IP address Yes Yes DHCP client Yes Routing metric Interface Parameters Yes No Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes ZyWALL ATP Series Users Guide 214 VIRTUAL

**

No Yes No Yes Chapter 9 Interfaces Table 89 Ethernet, PPP, Cellular, VLAN, Bridge, and Virtual Interface Characteristics (continued) CHARACTERISTICS ETHERNET ETHERNET Yes PPP Yes CELLULAR Yes VLAN Yes BRIDGE Yes VIRTUAL Yes Bandwidth restrictions Packet size

(MTU) Yes Yes DHCP DHCP server DHCP relay No No Connectivity Check Yes Yes Yes Yes No Yes Yes Yes Yes No No Yes No No Yes Yes Yes Yes Yes Yes Yes No No No No Note: - * The format of interface names other than the Ethernet and ppp interface names is strict. Each name consists of 2-4 letters (interface type), followed by a number (x). For most interfaces, x is limited by the maximum number of the type of interface. For VLAN interfaces, x is defined by the number you enter in the VLAN name field. For example, Ethernet interface names are wan1, wan2, lan1, lan2, dmz; VLAN interfaces are vlan0, vlan1, vlan2,...; and so on.

** - The names of virtual interfaces are derived from the interfaces on which they are created. For example, virtual interfaces created on Ethernet interface wan1 are called wan1:1, wan1:2, and so on. Virtual interfaces created on VLAN interface vlan2 are called vlan2:1, vlan2:2, and so on. You cannot specify the number after the colon(:) in the Web Configurator; it is a sequential number. You can specify the number after the colon if you use the CLI to set up a virtual interface. Relationships Between Interfaces In the Zyxel Device, interfaces are usually created on top of other interfaces. Only Ethernet interfaces are created directly on top of the physical ports or port groups. The relationships between interfaces are explained in the following table. Table 90 Relationships Between Different Types of Interfaces INTERFACE Ethernet interface VLAN interface bridge interface REQUIRED PORT / INTERFACE physical port Ethernet interface Ethernet interface*

PPP interface VLAN interface*

Ethernet interface*

VLAN interface*

bridge interface WAN1, WAN2, OPT*

ZyWALL ATP Series Users Guide 215 Chapter 9 Interfaces Table 90 Relationships Between Different Types of Interfaces (continued) INTERFACE virtual interface REQUIRED PORT / INTERFACE

(virtual Ethernet interface)

(virtual VLAN interface)

(virtual bridge interface) trunk Ethernet interface*

VLAN interface*

bridge interface Ethernet interface Cellular interface VLAN interface bridge interface PPP interface Note: * You cannot set up a PPP interface, virtual Ethernet interface or virtual VLAN interface if the underlying interface is a member of a bridge. You also cannot add an Ethernet interface or VLAN interface to a bridge if the member interface has a virtual interface or PPP interface on top of it. IPv6 Overview IPv6 (Internet Protocol version 6), is designed to enhance IP address size and features. The increase in IPv6 address size to 128 bits (from the 32-bit IPv4 address) allows up to 3.4 x 1038 IP addresses. IPv6 Addressing An 128-bit IPv6 address is written as eight 16-bit hexadecimal blocks separated by colons (:). This is an example IPv6 address 2001:0db8:1a2b:0015:0000:0000:1a2f:0000. IPv6 addresses can be abbreviated in two ways:

Leading zeros in a block can be omitted. So 2001:0db8:1a2b:0015:0000:0000:1a2f:0000 can be written as 2001:db8:1a2b:15:0:0:1a2f:0. Any number of consecutive blocks of zeros can be replaced by a double colon. A double colon can only appear once in an IPv6 address. So 2001:0db8:0000:0000:1a2f:0000:0000:0015 can be written as 2001:0db8::1a2f:0000:0000:0015, 2001:0db8:0000:0000:1a2f::0015, 2001:db8::1a2f:0:0:15 or 2001:db8:0:0:1a2f::15. Prefix and Prefix Length Similar to an IPv4 subnet mask, IPv6 uses an address prefix to represent the network address. An IPv6 prefix length specifies how many most significant bits (start from the left) in the address compose the network address. The prefix length is written as /x where x is a number. For example, 2001:db8:1a2b:15::1a2f:0/32 means that the first 32 bits (2001:db8) from the left is the network prefix. ZyWALL ATP Series Users Guide 216 Chapter 9 Interfaces Link-local Address A link-local address uniquely identifies a device on the local network (the LAN). It is similar to a private IP address in IPv4. You can have the same link-local address on multiple interfaces on a device. A link-

local unicast address has a predefined prefix of fe80::/10. The link-local unicast address format is as follows. Table 91 Link-local Unicast Address Format Interface ID 1111 1110 10 10 bits 64 bits 0 54 bits Subnet Masking Both an IPv6 address and IPv6 subnet mask compose of 128-bit binary digits, which are divided into eight 16-bit blocks and written in hexadecimal notation. Hexadecimal uses four bits for each character

(1 ~ 10, A ~ F). Each blocks 16 bits are then represented by four hexadecimal characters. For example, FFFF:FFFF:FFFF:FFFF:FC00:0000:0000:0000. Stateless Autoconfiguration With stateless autoconfiguration in IPv6, addresses can be uniquely and automatically generated. Unlike DHCPv6 (Dynamic Host Configuration Protocol version six) which is used in IPv6 stateful autoconfiguration, the owner and status of addresses dont need to be maintained by a DHCP server. Every IPv6 device is able to generate its own and unique IP address automatically when IPv6 is initiated on its interface. It combines the prefix and the interface ID (generated from its own Ethernet MAC address) to form a complete IPv6 address. When IPv6 is enabled on a device, its interface automatically generates a link-local address (beginning with fe80). When the Zyxel Devices WAN interface is connected to an ISP with a router and the Zyxel Device is set to automatically obtain an IPv6 network prefix from the router for the interface, it generates another address which combines its interface ID and global and subnet information advertised from the router.

(In IPv6, all network interfaces can be associated with several addresses.) This is a routable global IP address. Prefix Delegation Prefix delegation enables an IPv6 router (the Zyxel Device) to use the IPv6 prefix (network address) received from the ISP (or a connected uplink router) for its LAN. The Zyxel Device uses the received IPv6 prefix (for example, 2001:db2::/48) to generate its LAN IP address. Through sending Router Advertisements (RAs) regularly by multicast, the router passes the IPv6 prefix information to its LAN hosts. The hosts then can use the prefix to generate their IPv6 addresses. IPv6 Router Advertisement An IPv6 router sends router advertisement messages periodically to advertise its presence and other parameters to the hosts in the same network. ZyWALL ATP Series Users Guide 217 Chapter 9 Interfaces DHCPv6 The Dynamic Host Configuration Protocol for IPv6 (DHCPv6, RFC 3315) is a server-client protocol that allows a DHCP server to assign and pass IPv6 network addresses, prefixes and other configuration information to DHCP clients. DHCPv6 servers and clients exchange DHCP messages using UDP. Each DHCP client and server has a unique DHCP Unique IDentifier (DUID), which is used for identification when they are exchanging DHCPv6 messages. The DUID is generated from the MAC address, time, vendor assigned ID and/or the vendor's private enterprise number registered with the IANA. It should not change over time even after you reboot the device. 9.1.3 What You Need to Do First For IPv6 settings, go to the Configuration > System > IPv6 screen to enable IPv6 support on the Zyxel Device first. 9.2 Port Role To access this screen, click Configuration > Network > Interface > Port Role. Use the Port Role screen to set the Zyxel Devices flexible ports as part of the lan1, lan2, ext-wlan, ext-lan or dmz interfaces. This creates a hardware connection between the physical ports at the layer-2 (data link, MAC address) level. This provides wire-speed throughput but no security. Note the following if you are configuring from a computer connected to a lan1, lan2, ext-wlan, ext-lan or dmz port and change the port's role:

A port's IP address varies as its role changes, make sure your computer's IP address is in the same subnet as the Zyxel Device's lan1, lan2, ext-wlan, ext-lan or dmz IP address. Use the appropriate lan1, lan2, ext-wlan, ext-lan or dmz IP address to access the Zyxel Device. Figure 173 Configuration > Network > Interface > Port Role Physical Ports Default interface

(ZONE) ZyWALL ATP Series Users Guide 218 Chapter 9 Interfaces The physical Ethernet ports are shown at the top and the Ethernet interfaces and zones are shown at the bottom of the screen. Use the radio buttons to select for which interface (network) you want to use each physical port. For example, select a ports LAN radio button to use the port as part of the LAN interface. The port will use the Zyxel Devices LAN IP address and MAC address. When you assign more than one physical port to a network, you create a port group. Port groups have the following characteristics:

There is a layer-2 Ethernet switch between physical ports in the port group. This provides wire-speed throughput but no security. It can increase the bandwidth between the port group and other interfaces. The port group uses a single MAC address. Click Apply to save your changes and apply them to the Zyxel Device. Click Reset to change the port groups to their current configuration (last-saved values). 9.3 Port Configuration Use this screen to configure port settings. Click Configuration > Network > Interface > Port Configuration in the navigation panel to display the configuration screen. Note: You cant configure the speed and duplex mode of the fiber ports on the USG2200 and UGS2200-VPN. Figure 174 Configuration > Network > Interface > Port Configuration ZyWALL ATP Series Users Guide 219 Chapter 9 Interfaces Each field is described in the following table. Table 92 Configuration > Network > Interface > Port Configuration LABEL Edit DESCRIPTION Select an entry, and click this button to configure the speed and the duplex mode of the Ethernet connection on this port. This field displays the name of the port. This field displays the interface for the port. This field displays the cable type that is used on the port. Select the speed and the duplex mode of the Ethernet connection on this port. Choices are Auto Negotiate, 1000Mbps-Full Duplex, 100Mbps-Full Duplex, 100Mbps-Half Duplex, 10Mbps-Full Duplex, and 10Mbps-Half Duplex. Selecting Auto Negotiate allows one port to negotiate with a peer port automatically to obtain the connection speed (of up to 1000M) and duplex mode that both ends support. When auto-negotiation is turned on, a port on the Zyxel Device negotiates with the peer automatically to determine the connection speed and duplex mode. If the peer port does not support auto-negotiation or turns off this feature, the Zyxel Device determines the connection speed by detecting the signal on the cable and using half duplex mode. When the Zyxel Devices auto-negotiation is turned off, a port uses the pre-configured speed and duplex mode when making a connection, thus requiring you to make sure that the settings of the peer port are the same in order to connect. This field displays the speed and the duplex mode of the Ethernet connection on the port. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Name Interface Type Settings Status Apply Reset 9.4 Ethernet Summary Screen This screen lists every Ethernet interface and virtual interface created on top of Ethernet interfaces. If you enabled IPv6 in the Configuration > System > IPv6 screen, you can also configure Ethernet interfaces used for your IPv6 networks on this screen. To access this screen, click Configuration > Network >

Interface > Ethernet. Unlike other types of interfaces, you cannot create new Ethernet interfaces nor can you delete any of them. If an Ethernet interface does not have any physical ports assigned to it, the Ethernet interface is effectively removed from the Zyxel Device, but you can still configure it. Ethernet interfaces are similar to other types of interfaces in many ways. They have an IP address, subnet mask, and gateway used to make routing decisions. They restrict the amount of bandwidth and packet size. They can provide DHCP services, and they can verify the gateway is available. Use Ethernet interfaces to control which physical ports exchange routing information with other routers and how much information is exchanged through each one. The more routing information is exchanged, the more efficient the routers should be. However, the routers also generate more network traffic, and some routing protocols require a significant amount of configuration and management. The Zyxel Device supports the following routing protocols: RIP, OSPF and BGP. See Chapter 10 on page 321 for background information about these routing protocols. ZyWALL ATP Series Users Guide 220 Chapter 9 Interfaces Figure 175 Configuration > Network > Interface > Ethernet Each field is described in the following table. Table 93 Configuration > Network > Interface > Ethernet LABEL Configuration / IPv6 Configuration DESCRIPTION Use the Configuration section for IPv4 network settings. Use the IPv6 Configuration section for IPv6 network settings if you connect your Zyxel Device to an IPv6 network. Both sections have similar fields as described below. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove a virtual interface, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. To turn on an interface, select it and click Activate. To turn off an interface, select it and click Inactivate. To open the screen where you can create a virtual Ethernet interface, select an Ethernet interface and click Create Virtual Interface. Select an entry and click References to open a screen that shows which settings use the entry. See Section 9.4.4 on page 240 for an example. This field is a sequential value, and it is not associated with any interface. This icon is lit when the entry is active and dimmed when the entry is inactive. This field displays the name of the interface. This field displays the description of the interface. Edit Remove Activate Inactivate Create Virtual Interface References

#

Status Name Description ZyWALL ATP Series Users Guide 221 Chapter 9 Interfaces Table 93 Configuration > Network > Interface > Ethernet (continued) LABEL IP Address DESCRIPTION This field displays the current IP address of the interface. If the IP address is 0.0.0.0 (in the IPv4 network) or :: (in the IPv6 network), the interface does not have an IP address yet. In the IPv4 network, this screen also shows whether the IP address is a static IP address

(STATIC) or dynamically assigned (DHCP). IP addresses are always static in virtual interfaces. In the IPv6 network, this screen also shows whether the IP address is a static IP address

(STATIC), link-local IP address (LINK LOCAL), dynamically assigned (DHCP), or an IPv6 StateLess Address AutoConfiguration IP address (SLAAC). See Section 9.1.2 on page 213 for more information about IPv6. This field displays the interfaces subnet mask in dot decimal notation. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Mask Apply Reset 9.4.1 Ethernet Edit The Ethernet Edit screen lets you configure IP address assignment, interface parameters, RIP settings, OSPF settings, DHCP settings, connectivity check, and MAC address settings. To access this screen, click an Edit icon in the Ethernet Summary screen. (See Section 9.4 on page 220.) The OPT interfaces Edit > Configuration screen is shown here as an example. The screens for other interfaces are similar and contain a subset to the OPT interface screens fields. Note: If you create IP address objects based on an interfaces IP address, subnet, or gateway, the Zyxel Device automatically updates every rule or setting that uses the object whenever the interfaces IP address settings change. For example, if you change the VLAN's IP address, the Zyxel Device automatically updates the corresponding interface-based, LAN subnet address object. With RIP, you can use Ethernet interfaces to do the following things. Enable and disable RIP in the underlying physical port or port group. Select which direction(s) routing information is exchanged - The Zyxel Device can receive routing information, send routing information, or do both. Select which version of RIP to support in each direction - The Zyxel Device supports RIP-1, RIP-2, and both versions. Select the broadcasting method used by RIP-2 packets - The Zyxel Device can use subnet broadcasting or multicasting. With OSPF, you can use Ethernet interfaces to do the following things. Enable and disable OSPF in the underlying physical port or port group. Select the area to which the interface belongs. Override the default link cost and authentication method for the selected area. Select in which direction(s) routing information is exchanged - The Zyxel Device can receive routing information, send routing information, or do both. Set the priority used to identify the DR or BDR if one does not exist. ZyWALL ATP Series Users Guide 222 Chapter 9 Interfaces 9.4.1.1 IGMP Proxy Internet Group Management Protocol (IGMP) proxy is used for multicast routing. IGMP proxy enables the Zyxel Device to issue IGMP host messages on behalf of hosts that the Zyxel Device discovered on its IGMP-enabled interfaces. The Zyxel Device acts as a proxy for its hosts. Refer to the following figure. DS: Downstream traffic US: Upstream traffic R: Router MS: Multicast Server Enable IGMP Upstream (US) on the Zyxel Device interface that connects to a router (R) running IGMP that is closer to the multicast server (MS). Enable IGMP Downstream on the Zyxel Device interface which connects to the multicast hosts. Figure 176 IGMP Proxy ZyWALL ATP Series Users Guide 223 Chapter 9 Interfaces Figure 177 Configuration > Network > Interface > Ethernet > Edit (External Type) ZyWALL ATP Series Users Guide 224 Chapter 9 Interfaces Configuration > Network > Interface > Ethernet > Edit (External Type ZyWALL ATP Series Users Guide 225 Chapter 9 Interfaces Figure 178 Configuration > Network > Interface > Ethernet > Edit (Internal Type) ZyWALL ATP Series Users Guide 226 Chapter 9 Interfaces Configuration > Network > Interface > Ethernet > Edit (Internal Type) ZyWALL ATP Series Users Guide 227 Chapter 9 Interfaces Figure 179 Configuration > Network > Interface > Ethernet > Edit (OPT) ZyWALL ATP Series Users Guide 228

 

 

Chapter 9 Interfaces Configuration > Network > Interface > Ethernet > Edit (OPT) These screens fields are described in the table below. Table 94 Configuration > Network > Interface > Ethernet > Edit LABEL IPv4/IPv6 View / IPv4 View / IPv6 View Show Advanced Settings / Hide Advanced Settings Create New Object DESCRIPTION Use this button to display both IPv4 and IPv6, IPv4-only, or IPv6-only configuration fields. Click this button to display a greater or lesser number of configuration fields. Click this button to create a DHCPv6 lease or DHCPv6 request object that you may use for the DHCPv6 settings in this screen. General Settings Enable Interface General IPv6 Setting Select this to enable this interface. Clear this to disable this interface. Enable IPv6 Select this to enable IPv6 on this interface. Otherwise, clear this to disable it. Interface Properties Interface Type Interface Name This field is configurable for the OPT interface only. Select to which type of network you will connect this interface. When you select internal or external the rest of the screens options automatically adjust to correspond. The Zyxel Device automatically adds default route and SNAT settings for traffic it routes from internal interfaces to external interfaces; for example LAN to WAN traffic. internal is for connecting to a local network. Other corresponding configuration options:

DHCP server and DHCP relay. The Zyxel Device automatically adds default SNAT settings for traffic flowing from this interface to an external interface. external is for connecting to an external network (like the Internet). The Zyxel Device automatically adds this interface to the default WAN trunk. For general, the rest of the screens options do not automatically adjust and you must manually configure a policy route to add routing and SNAT settings for the interface. Specify a name for the interface. It can use alphanumeric characters, hyphens, and underscores, and it can be up to 11 characters long. ZyWALL ATP Series Users Guide 229 Chapter 9 Interfaces Table 94 Configuration > Network > Interface > Ethernet > Edit (continued) LABEL Port Zone MAC Address Description IP Address Assignment Get Automatically DHCP Option 60 Use Fixed IP Address IP Address Subnet Mask Gateway Metric Enable IGMP Support IGMP Upstream IGMP Downstream IPv6 Address Assignment Enable Stateless Address Auto-

configuration

(SLAAC) DESCRIPTION This is the name of the Ethernet interfaces physical port. Select the zone to which this interface is to belong. You use zones to apply security settings such as security policy, IDP, remote management, anti-malware, and application patrol. Make sure to select the correct zone as otherwise traffic may be blocked by a security policy. This field is read-only. This is the MAC address that the Ethernet interface uses. Enter a description of this interface. You can use alphanumeric and ()+/:=?!*#@$_%-

characters, and it can be up to 60 characters long. Spaces are allowed, but the string cant start with a space. These IP address fields configure an IPv4 IP address on the interface itself. If you change this IP address on the interface, you may also need to change a related address object for the network connected to the interface. For example, if you use this screen to change the IP address of your LAN interface, you should also change the corresponding LAN subnet address object. This option appears when Interface Type is external or general. Select this to make the interface a DHCP client and automatically get the IP address, subnet mask, and gateway address from a DHCP server. You should not select this if the interface is assigned to a VRRP group. See Chapter 36 on page 717. DHCP Option 60 is used by the Zyxel Device for identification to the DHCP server using the VCI (Vendor Class Identifier) on the DHCP server. The Zyxel Device adds it in the initial DHCP discovery message that a DHCP client broadcasts in search of an IP address. The DHCP server can assign different IP addresses or options to clients with the specific VCI or reject the request from clients without the specific VCI. Type a string using up to 64 of these characters [a-zA-Z0-9!\"#$%&\'()*+,-./

:;<=>?@\[\\\]^_`{|}~] to identify this Zyxel Device to the DHCP server. For example, Zyxel-

TW. This option appears when Interface Type is external or general. Select this if you want to specify the IP address, subnet mask, and gateway manually. Enter the IP address for this interface. Enter the subnet mask of this interface in dot decimal notation. The subnet mask indicates what part of the IP address is the same for all computers in the network. This option appears when Interface Type is external or general. Enter the IP address of the gateway. The Zyxel Device sends packets to the gateway when it does not know how to route the packet to its destination. The gateway should be on the same network as the interface. This option appears when Interface Type is external or general. Enter the priority of the gateway (if any) on this interface. The Zyxel Device decides which gateway to use based on this priority. The lower the number, the higher the priority. If two or more gateways have the same priority, the Zyxel Device uses the one that was configured first. Select this to allow the Zyxel Device to act as an IGMP proxy for hosts connected on the IGMP downstream interface. Enable IGMP Upstream on the interface which connects to a router running IGMP that is closer to the multicast server. Enable IGMP Downstream on the interface which connects to the multicast hosts. These IP address fields configure an IPv6 IP address on the interface itself. Select this to enable IPv6 stateless auto-configuration on this interface. The interface will generate an IPv6 IP address itself from a prefix obtained from an IPv6 router in the network. ZyWALL ATP Series Users Guide 230 Chapter 9 Interfaces Table 94 Configuration > Network > Interface > Ethernet > Edit (continued) LABEL Link-Local Address IPv6 Address/

Prefix Length Gateway Metric Address from DHCPv6 Prefix Delegation Add Edit Remove References

#

Delegated Prefix Suffix Address Address DHCPv6 Setting DHCPv6 DUID DESCRIPTION This displays the IPv6 link-local address and the network prefix that the Zyxel Device generates itself for the interface. Enter the IPv6 address and the prefix length for this interface if you want to use a static IP address. This field is optional. The prefix length indicates what the left-most part of the IP address is the same for all computers in the network, that is, the network address. Enter the IPv6 address of the default outgoing gateway using colon (:) hexadecimal notation. Enter the priority of the gateway (if any) on this interface. The Zyxel Device decides which gateway to use based on this priority. The lower the number, the higher the priority. If two or more gateways have the same priority, the Zyxel Device uses the one that was configured first. Use this table to have the Zyxel Device obtain an IPv6 prefix from the ISP or a connected uplink router for an internal network, such as the LAN or DMZ. You have to also enter a suffix address which is appended to the delegated prefix to form an address for this interface. See Prefix Delegation on page 217 for more information. To use prefix delegation, you must:

Create at least one DHCPv6 request object before configuring this table. The external interface must be a DHCPv6 client. You must configure the DHCPv6 request options using a DHCPv6 request object with the type of prefix-delegation. Assign the prefix delegation to an internal interface and enable router advertisement on that interface. Click this to create an entry. Select an entry and click this to change the settings. Select an entry and click this to delete it from this table. Select an entry and click References to check which settings use the entry. This field is a sequential value, and it is not associated with any entry. Select the DHCPv6 request object to use from the drop-down list. Enter the ending part of the IPv6 address, a slash (/), and the prefix length. The Zyxel Device will append it to the delegated prefix. For example, you got a delegated prefix of 2003:1234:5678/48. You want to configure an IP address of 2003:1234:5678:1111::1/128 for this interface, then enter ::1111:0:0:0:1/128 in this field. This field displays the combined IPv6 IP address for this interface. Note: This field displays the combined address after you click OK and reopen this screen. Select N/A to not use DHCPv6. Select Client to set this interface to act as a DHCPv6 client. Select Server to set this interface to act as a DHCPv6 server which assigns IP addresses and provides subnet mask, gateway, and DNS server information to clients. Select Relay to set this interface to route DHCPv6 requests to the DHCPv6 relay server you specify. The DHCPv6 server(s) may be on another network. This field displays the DHCP Unique IDentifier (DUID) of the interface, which is unique and used for identification purposes when the interface is exchanging DHCPv6 messages with others. See DHCPv6 on page 218 for more information. ZyWALL ATP Series Users Guide 231 Chapter 9 Interfaces Table 94 Configuration > Network > Interface > Ethernet > Edit (continued) LABEL DESCRIPTION Select this if you want the DUID is generated from the interfaces default MAC address. DUID as MAC Customized DUID If you want to use a customized DUID, enter it here for the interface. Enable Rapid Commit Select this to shorten the DHCPv6 message exchange process from four to two steps. This function helps reduce heavy network traffic load. Note: Make sure you also enable this option in the DHCPv6 clients to make rapid commit work. Enter the number of seconds a DHCPv6 client should wait before refreshing information retrieved from DHCPv6. This field is available if you set this interface to DHCPv6 Client. Select this to get an IPv6 IP address for this interface from the DHCP server. Clear this to not get any IP address information through DHCPv6. If this interface is a DHCPv6 client, use this section to configure DHCPv6 request settings that determine what additional information to get from the DHCPv6 server. If the interface is a DHCPv6 server, use this section to configure DHCPv6 lease settings that determine what additional information to offer to the DHCPv6 clients. Click this to create an entry in this table. See Section 9.4.5 on page 241 for more information. Select an entry and click this to delete it from this table. Select an entry and click References to open a screen that shows which settings use the entry. See Section 9.4.4 on page 240 for an example. This field is a sequential value, and it is not associated with any entry. This field displays the name of the DHCPv6 request or lease object. This field displays the type of the object. This field displays the IPv6 prefix that the Zyxel Device obtained from an uplink router (Server is selected) or will advertise to its clients (Client is selected). When Relay is selected, select this check box and an interface from the drop-down list if you want to use it as the relay server. When Relay is selected, select this check box and enter the IP address of a DHCPv6 server as the relay server. Information Refresh Time Request Address DHCPv6 Request Options /

DHCPv6 Lease Options Add Remove References

#

Name Type Value Interface Relay Server IPv6 Router Advertisement Setting Enable Router Advertisement Advertised Hosts Get Network Configuration From DHCPv6 Advertised Hosts Get Other Configuration From DHCPv6 Router Preference Select this to enable this interface to send router advertisement messages periodically. See IPv6 Router Advertisement on page 217 for more information. Select this to have the Zyxel Device indicate to hosts to obtain network settings (such as prefix and DNS settings) through DHCPv6. Clear this to have the Zyxel Device indicate to hosts that DHCPv6 is not available and they should use the prefix in the router advertisement message. Select this to have the Zyxel Device indicate to hosts to obtain DNS information through DHCPv6. Clear this to have the Zyxel Device indicate to hosts that DNS information is not available in this network. Select the router preference (Low, Medium or High) for the interface. The interface sends this preference in the router advertisements to tell hosts what preference they should use for the Zyxel Device. This helps hosts to choose their default router especially when there are multiple IPv6 router in the network. Note: Make sure the hosts also support router preference to make this function work. ZyWALL ATP Series Users Guide 232 Chapter 9 Interfaces Table 94 Configuration > Network > Interface > Ethernet > Edit (continued) LABEL MTU DESCRIPTION The Maximum Transmission Unit. Type the maximum size of each IPv6 data packet, in bytes, that can move through this interface. If a larger packet arrives, the Zyxel Device discards the packet and sends an error message to the sender to inform this. Enter the maximum number of network segments that a packet can cross before reaching the destination. When forwarding an IPv6 packet, IPv6 routers are required to decrease the Hop Limit by 1 and to discard the IPv6 packet when the Hop Limit is 0. Configure this table only if you want the Zyxel Device to advertise a fixed prefix to the network. Click this to create an IPv6 prefix address. Select an entry in this table and click this to modify it. Select an entry in this table and click this to delete it. This field is a sequential value, and it is not associated with any entry. Enter the IPv6 network prefix address and the prefix length. The prefix length indicates what the left-most part of the IP address is the same for all computers in the network, that is, the network address. This table is available when the Interface Type is internal. Use this table to configure the network prefix if you want to use a delegated prefix as the beginning part of the network prefix. Click this to create an entry in this table. Select an entry in this table and click this to modify it. Select an entry in this table and click this to delete it. This field is a sequential value, and it is not associated with any entry. Select the DHCPv6 request object to use for generating the network prefix for the network. Enter the ending part of the IPv6 network address plus a slash (/) and the prefix length. The Zyxel Device will append it to the selected delegated prefix. The combined address is the network prefix for the network. For example, you got a delegated prefix of 2003:1234:5678/48. You want to divide it into 2003:1234:5678:1111/64 for this interface and 2003:1234:5678:2222/64 for another interface. You can use ::1111/64 and ::2222/64 for the suffix address respectively. But if you do not want to divide the delegated prefix into subnetworks, enter ::0/48 here, which keeps the same prefix length (/48) as the delegated prefix. This is the final network prefix combined by the delegated prefix and the suffix. Note: This field displays the combined address after you click OK and reopen this screen. Hop Limit Advertised Prefix Table Add Edit Remove

#

IPv6 Address/

Prefix Length Advertised Prefix from DHCPv6 Prefix Delegation Add Edit Remove

#

Delegated Prefix Suffix Address Address Interface Parameters Ingress Bandwidth MTU Egress Bandwidth Enter the maximum amount of traffic, in kilobits per second, the Zyxel Device can send through the interface to the network. Allowed values are 0 - 1048576. This is reserved for future use. Enter the maximum amount of traffic, in kilobits per second, the Zyxel Device can receive from the network through the interface. Allowed values are 0 - 1048576. Maximum Transmission Unit. Type the maximum size of each data packet, in bytes, that can move through this interface. If a larger packet arrives, the Zyxel Device divides it into smaller fragments. Allowed values are 576 - 1500. Usually, this value is 1500. ZyWALL ATP Series Users Guide 233 Chapter 9 Interfaces Table 94 Configuration > Network > Interface > Ethernet > Edit (continued) LABEL Connectivity Check DESCRIPTION These fields appear when Interface Properties is External or General. The interface can regularly check the connection to the gateway you specified to make sure it is still available. You specify how often the interface checks the connection, how long to wait for a response before the attempt is a failure, and how many consecutive failures are required before the Zyxel Device stops routing to the gateway. The Zyxel Device resumes routing to the gateway the first time the gateway passes the connectivity check. Select this to turn on the connection check. Select the method that the gateway allows. Select icmp to have the Zyxel Device regularly ping the gateway you specify to make sure it is still available. Select tcp to have the Zyxel Device regularly perform a TCP handshake with the gateway you specify to make sure it is still available. Enter the number of seconds between connection check attempts. Enter the number of seconds to wait for a response before the attempt is a failure. Enter the number of consecutive failures before the Zyxel Device stops routing through the gateway. Select this to use the default gateway for the connectivity check. Select this to specify a domain name or IP address for the connectivity check. Enter that domain name or IP address in the field next to it. This field only displays when you set the Check Method to tcp. Specify the port number to use for a TCP connectivity check. Type one or two domain names or IP addresses for the connectivity check. This field applies when you specify two domain names or IP addresses for the connectivity check. Select any one if you want the check to pass if at least one of the domain names or IP addresses responds. Select all if you want the check to pass only if both domain names or IP addresses respond. This section appears when Interface Type is internal or general. Select what type of DHCP service the Zyxel Device provides to the network. Choices are:

None - the Zyxel Device does not provide any DHCP services. There is already a DHCP server on the network. DHCP Relay - the Zyxel Device routes DHCP requests to one or more DHCP servers you specify. The DHCP server(s) may be on another network. DHCP Server - the Zyxel Device assigns IP addresses and provides subnet mask, gateway, and DNS server information to the network. The Zyxel Device is the DHCP server for the network. These fields appear if the Zyxel Device is a DHCP Relay. Enter the IP address of a DHCP server for the network. This field is optional. Enter the IP address of another DHCP server for the network. These fields appear if the Zyxel Device is a DHCP Server. Enable Connectivity Check Check Method Check Period Check Timeout Check Fail Tolerance Check Default Gateway Check this address Check Port Check these addresses Probe Succeeds When DHCP Setting DHCP Relay Server 1 Relay Server 2 ZyWALL ATP Series Users Guide 234 Chapter 9 Interfaces Table 94 Configuration > Network > Interface > Ethernet > Edit (continued) LABEL IP Pool Start Address Pool Size First DNS Server, Second DNS Server, Third DNS Server First WINS Server, Second WINS Server Default Router Lease time Extended Options Add Edit Remove

#

Name Code Type Value DESCRIPTION Enter the IP address from which the Zyxel Device begins allocating IP addresses. If you want to assign a static IP address to a specific computer, use the Static DHCP Table. If this field is blank, the Pool Size must also be blank. In this case, the Zyxel Device can assign every IP address allowed by the interfaces IP address and subnet mask, except for the first address (network address), last address (broadcast address) and the interfaces IP address. Enter the number of IP addresses to allocate. This number must be at least one and is limited by the interfaces Subnet Mask. For example, if the Subnet Mask is 255.255.255.0 and IP Pool Start Address is 10.10.10.10, the Zyxel Device can allocate 10.10.10.10 to 10.10.10.254, or 245 IP addresses. If this field is blank, the IP Pool Start Address must also be blank. In this case, the Zyxel Device can assign every IP address allowed by the interfaces IP address and subnet mask, except for the first address (network address), last address (broadcast address) and the interfaces IP address. Specify the IP addresses up to three DNS servers for the DHCP clients to use. Use one of the following ways to specify these IP addresses. Custom Defined - enter a static IP address. From ISP - select the DNS server that another interface received from its DHCP server. Zyxel Device - the DHCP clients use the IP address of this interface and the Zyxel Device works as a DNS relay. Type the IP address of the WINS (Windows Internet Naming Service) server that you want to send to the DHCP clients. The WINS server keeps a mapping table of the computer names on your network and the IP addresses that they are currently using. If you set this interface to DHCP Server, you can select to use either the interfaces IP address or another IP address as the default router. This default router will become the DHCP clients default gateway. To use another IP address as the default router, select Custom Defined and enter the IP address. Specify how long each computer can use the information (especially the IP address) before it has to request the information again. Choices are:

infinite - select this if IP addresses never expire. days, hours, and minutes - select this to enter how long IP addresses are valid. This table is available if you selected DHCP server. Configure this table if you want to send more information to DHCP clients through DHCP packets. Click this to create an entry in this table. See Section 9.4.6 on page 242. Select an entry in this table and click this to modify it. Select an entry in this table and click this to delete it. This field is a sequential value, and it is not associated with any entry. This is the name of the DHCP option. This is the code number of the DHCP option. This is the type of the set value for the DHCP option. This is the value set for the DHCP option. ZyWALL ATP Series Users Guide 235 Chapter 9 Interfaces Table 94 Configuration > Network > Interface > Ethernet > Edit (continued) LABEL DESCRIPTION PXE (Preboot eXecution Environment) allows a client computer to use the network to boot up and install an operating system via a PXE-capable Network Interface Card (NIC). PXE Server PXE Boot Loader File Enable IP/MAC Binding Enable Logs for IP/MAC Binding Violation Static DHCP Table Add Edit Remove

#

IP Address MAC Description RIP Setting Enable RIP Direction Send Version Receive Version V2-Broadcast OSPF Setting Area Priority Link Cost PXE is available for computers on internal interfaces to allow them to boot up using boot software on a PXE server. The Zyxel Device acts as an intermediary between the PXE server and the computers that need boot software. The PXE server must have a public IPv4 address. You must enable DHCP Server on the Zyxel Device so that it can receive information from the PXE server. A boot loader is a computer program that loads the operating system for the computer. Type the exact file name of the boot loader software file, including filename extension, that is on the PXE server. If the wrong filename is typed, then the client computers cannot boot. Select this option to have this interface enforce links between specific IP addresses and specific MAC addresses. This stops anyone else from manually using a bound IP address on another device connected to this interface. Use this to make use only the intended users get to use specific IP addresses. Select this option to have the Zyxel Device generate a log if a device connected to this interface attempts to use an IP address that is bound to another devices MAC address. Configure a list of static IP addresses the Zyxel Device assigns to computers connected to the interface. Otherwise, the Zyxel Device assigns an IP address dynamically using the interfaces IP Pool Start Address and Pool Size. Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. This field is a sequential value, and it is not associated with a specific entry. Enter the IP address to assign to a device with this entrys MAC address. Enter the MAC address to which to assign this entrys IP address. Enter a description to help identify this static DHCP entry. You can use alphanumeric and

()+/:=?!*#@$_%- characters, and it can be up to 60 characters long. See Section 10.6 on page 322 for more information about RIP. Select this to enable RIP in this interface. This field is effective when RIP is enabled. Select the RIP direction from the drop-down list box. BiDir - This interface sends and receives routing information. In-Only - This interface receives routing information. Out-Only - This interface sends routing information. This field is effective when RIP is enabled. Select the RIP version(s) used for sending RIP packets. Choices are 1, 2, and 1 and 2. This field is effective when RIP is enabled. Select the RIP version(s) used for receiving RIP packets. Choices are 1, 2, and 1 and 2. This field is effective when RIP is enabled. Select this to send RIP-2 packets using subnet broadcasting; otherwise, the Zyxel Device uses multicasting. See Section 10.7 on page 324 for more information about OSPF. Select the area in which this interface belongs. Select None to disable OSPF in this interface. Enter the priority (between 0 and 255) of this interface when the area is looking for a Designated Router (DR) or Backup Designated Router (BDR). The highest-priority interface identifies the DR, and the second-highest-priority interface identifies the BDR. Set the priority to zero if the interface can not be the DR or BDR. Enter the cost (between 1 and 65,535) to route packets through this interface. ZyWALL ATP Series Users Guide 236 Chapter 9 Interfaces Table 94 Configuration > Network > Interface > Ethernet > Edit (continued) LABEL Passive Interface Authentication Text Authentication Key MD5 Authentication ID MD5 Authentication Key DESCRIPTION Select this to stop forwarding OSPF routing information from the selected interface. As a result, this interface only receives routing information. Select an authentication method, or disable authentication. To exchange OSPF routing information with peer border routers, you must use the same authentication method that they use. Choices are:

Same-as-Area - use the default authentication method in the area None - disable authentication Text - authenticate OSPF routing information using a plain-text password MD5 - authenticate OSPF routing information using MD5 encryption This field is available if the Authentication is Text. Type the password for text authentication. The key can consist of alphanumeric characters and the underscore, and it can be up to 16 characters long. This field is available if the Authentication is MD5. Type the ID for MD5 authentication. The ID can be between 1 and 255. This field is available if the Authentication is MD5. Type the password for MD5 authentication. The password can consist of alphanumeric characters and the underscore, and it can be up to 16 characters long. Use Default MAC Address MAC Address Setting This section appears when Interface Properties is External or General. Have the interface use either the factory assigned default MAC address, a manually specified MAC address, or clone the MAC address of another device or computer. Select this option to have the interface use the factory assigned default MAC address. By default, the Zyxel Device uses the factory assigned MAC address to identify itself. Select this option to have the interface use a different MAC address. Either enter the MAC address in the fields or click Clone by host and enter the IP address of the device or computer whose MAC you are cloning. Once it is successfully configured, the address will be copied to the configuration file. It will not change unless you change the setting or upload a different configuration file. Proxy ARP is available for external or general interfaces on the Zyxel Device. See Section 9.4.2 on page 238 for more information on Proxy ARP. Overwrite Default MAC Address Proxy ARP Enable Proxy ARP Select this to allow the Zyxel Device to answer external interface ARP requests on behalf of a device on its internal interface. Interfaces supported are:

Ethernet VLAN Bridge See Section 9.4.2 on page 238 for more information. Click Add to create an IPv4 Address, an IPv4 CIDR (for example, 192.168.1.1/24) or an IPv4 Range (for example, 192.168.1.2-192.168.1.100) as the target IP address. The Zyxel Device answers external ARP requests only if they match one of these inputted target IP addresses. For example, if the IPv4 Address is 192.168.1.5, then the Zyxel Device will answer ARP requests coming from the WAN only if it contains 192.168.1.5 as the target IP address. Select an existing entry and click Remove to delete that entry. Add Related Setting ZyWALL ATP Series Users Guide 237 Chapter 9 Interfaces Table 94 Configuration > Network > Interface > Ethernet > Edit (continued) LABEL DESCRIPTION Click PPPoE/PPTP if this interfaces Internet connection uses PPPoE or PPTP or L2TP. Click VLAN if you want to configure a VLAN interface for this Ethernet interface. Click WAN TRUNK to go to a screen where you can set this interface to be part of a WAN trunk for load balancing. Click Policy Route to go to the policy route summary screen where you can manually associate traffic with this interface. You must manually configure a policy route to add routing and SNAT settings for an interface with the Interface Type set to general. You can also configure a policy route to override the default routing and SNAT behavior for an interface with an Interface Type of internal or external. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving. Configure PPPoE/PPTP Configure VLAN Configure WAN TRUNK Configure Policy Route OK Cancel 9.4.2 Proxy ARP An Address Resolution Protocol (ARP) is a protocol for mapping an IP address to a MAC address. An ARP broadcast is sent to all devices in the same Ethernet network to request the MAC address of a target IP address. In the following figure, a host in a WAN subnet (A) broadcasts an ARP request to all devices within its network in order to find the MAC address of a target IP address (172.16.x.x). However, the target IP address may be in another subnet (B) that has the same network IP address (172.16.x.x). A router, such as the Zyxel Device, does not forward broadcasts, so the request will not reach its destination. Enable Proxy ARP (RFC 1027) to allow the Zyxel Device to answer external interface ARP requests on behalf of a device on its internal interface. Interfaces supported are:

Ethernet VLAN Bridge The Zyxel Device sends its external MAC address to the WAN sender as the destination for the target IP address. From then on the sender will send packets containing that target IP address directly to the external interface of the Zyxel Device. The Zyxel Device then forwards the packet to the correct target IP address in its LAN. Figure 180 Proxy ARP 172.16.x.x 172.16.x.x ZyWALL ATP Series Users Guide 238 Chapter 9 Interfaces To allow the Zyxel Device to answer external interface ARP requests on behalf of a device on a supported interface, select the interface, click Add or Edit, then click Add in the Proxy ARP section of the screen. Figure 181 Interface > Edit > Add Proxy ARP The following table describes labels that can appear in this screen. Table 95 Interface > Edit > Add Proxy ARP LABEL Interface Name Address Type DESCRIPTION This identifies the interface for which the configuration settings that use it are displayed. Choose IPv4 Address, or IPv4 CIDR (for example, 192.168.1.1/24) or an IPv4 Range (for example, 192.168.1.2-192.168.1.100) and then enter the target IP address information. The Zyxel Device answers external ARP requests only if they match one of these inputted target IP addresses. For example, if the IPv4 Address is 192.168.1.5, then the Zyxel Device will answer ARP requests coming from the WAN only if it contains 192.168.1.5 as the target IP address. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving. OK Cancel 9.4.3 Virtual Interfaces Use virtual interfaces to tell the Zyxel Device where to route packets. Virtual interfaces can also be used in VPN gateways (see Chapter 20 on page 396) and VRRP groups (see Chapter 36 on page 717). Virtual interfaces can be created on top of Ethernet interfaces, VLAN interfaces, or bridge interfaces. Virtual VLAN interfaces recognize and use the same VLAN ID. Otherwise, there is no difference between each type of virtual interface. Network policies (for example, security policies) that apply to the underlying interface automatically apply to the virtual interface as well. Like other interfaces, virtual interfaces have an IP address, subnet mask, and gateway used to make routing decisions. However, you have to manually specify the IP address and subnet mask; virtual interfaces cannot be DHCP clients. The virtual interface uses the same MTU and bandwidth settings that the underlying interface uses. Unlike other interfaces, virtual interfaces do not provide DHCP services, and they do not verify that the gateway is available. This screen lets you configure IP address assignment and interface parameters for virtual interfaces. To access this screen, click the Create Virtual Interface icon in the Ethernet, VLAN, or bridge interface summary screen. ZyWALL ATP Series Users Guide 239 Chapter 9 Interfaces Figure 182 Configuration > Network > Interface > Create Virtual Interface Each field is described in the table below. Table 96 Configuration > Network > Interface > Create Virtual Interface LABEL Interface Properties Interface Name DESCRIPTION This field is read-only. It displays the name of the virtual interface, which is automatically derived from the underlying Ethernet interface, VLAN interface, or bridge interface. Enter a description of this interface. It is not used elsewhere. You can use alphanumeric and

()+/:=?!*#@$_%- characters, and it can be up to 60 characters long. Enter the IP address for this interface. Enter the subnet mask of this interface in dot decimal notation. The subnet mask indicates what part of the IP address is the same for all computers in the network. Enter the IP address of the gateway. The Zyxel Device sends packets to the gateway when it does not know how to route the packet to its destination. The gateway should be on the same network as the interface. Enter the priority of the gateway (if any) on this interface. The Zyxel Device decides which gateway to use based on this priority. The lower the number, the higher the priority. If two or more gateways have the same priority, the Zyxel Device uses the one that was configured first. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving. Description IP Address Assignment IP Address Subnet Mask Gateway Metric OK Cancel 9.4.4 References When a configuration screen includes an References icon, select a configuration object and click References to open the References screen. This screen displays which configuration settings reference the selected object. The fields shown vary with the type of object. ZyWALL ATP Series Users Guide 240 Chapter 9 Interfaces Figure 183 References The following table describes labels that can appear in this screen. Table 97 References LABEL Name

#

Service Priority Name Description Refresh Cancel DESCRIPTION This identifies the object for which the configuration settings that use it are displayed. Click the objects name to display the objects configuration screen in the main window. This field is a sequential value, and it is not associated with any entry. This is the type of setting that references the selected object. Click a services name to display the services configuration screen in the main window. If it is applicable, this field lists the referencing configuration items position in its list, otherwise N/A displays. This field identifies the configuration item that references the object. If the referencing configuration item has a description configured, it displays here. Click this to update the information in this screen. Click Cancel to close the screen. 9.4.5 Add/Edit DHCPv6 Request/Release Options When you configure an interface as a DHCPv6 server or client, you can additionally add DHCPv6 request or lease options which have the Zyxel Device to add more information in the DHCPv6 packets. To open the screen, click Configuration > Network > Interface > Ethernet > Edit, select DHCPv6 Server or DHCPv6 Client in the DHCPv6 Setting section, and then click Add in the DHCPv6 Request Options or DHCPv6 Lease Options table. Figure 184 Configuration > Network > Interface > Ethernet > Edit > Add DHCPv6 Request/Lease Options Select a DHCPv6 request or lease object in the Select one object field and click OK to save it. Click Cancel to exit without saving the setting. ZyWALL ATP Series Users Guide 241 Chapter 9 Interfaces 9.4.6 Add/Edit DHCP Extended Options When you configure an interface as a DHCPv4 server, you can additionally add DHCP extended options which have the Zyxel Device to add more information in the DHCP packets. The available fields vary depending on the DHCP option you select in this screen. To open the screen, click Configuration >

Network > Interface > Ethernet > Edit, select DHCP Server in the DHCP Setting section, and then click Add or Edit in the Extended Options table. Figure 185 Configuration > Network > Interface > Ethernet > Edit > Add/Edit Extended Options The following table describes labels that can appear in this screen. Table 98 Configuration > Network > Interface > Ethernet > Edit > Add/Edit Extended Options LABEL Option Name Code Type Value First IP Address, Second IP Address, Third IP Address First Enterprise ID, Second Enterprise ID First Class, Second Class First Information, Second Information DESCRIPTION Select which DHCP option that you want to add in the DHCP packets sent through the interface. See the next table for more information. This field displays the name of the selected DHCP option. If you selected User Defined in the Option field, enter a descriptive name to identify the DHCP option. You can enter up to 16 characters (a-z, A-Z, 0-9, -, and _) with no spaces allowed. The first character must be alphabetical (a-z, A-Z). This field displays the code number of the selected DHCP option. If you selected User Defined in the Option field, enter a number for the option. This field is mandatory. This is the type of the selected DHCP option. If you selected User Defined in the Option field, select an appropriate type for the value that you will enter in the next field. Only advanced users should configure User Defined. Misconfiguration could result in interface lockout. Enter the value for the selected DHCP option. For example, if you selected TFTP Server Name

(66) and the type is TEXT, enter the DNS domain name of a TFTP server here. This field is mandatory. If you selected Time Server (4), NTP Server (41), SIP Server (120), CAPWAP AC (138), or TFTP Server (150), you have to enter at least one IP address of the corresponding servers in these fields. The servers should be listed in order of your preference. If you selected VIVC (124) or VIVS (125), you have to enter at least one vendors 32-bit enterprise number in these fields. An enterprise number is a unique number that identifies a company. If you selected VIVC (124), enter the details of the hardware configuration of the host on which the client is running, or of industry consortium compliance. If you selected VIVS (125), enter additional information for the corresponding enterprise number in these fields. ZyWALL ATP Series Users Guide 242 Chapter 9 Interfaces Table 98 Configuration > Network > Interface > Ethernet > Edit > Add/Edit Extended Options LABEL OK Cancel DESCRIPTION Click this to close this screen and update the settings to the previous Edit screen. Click Cancel to close the screen. The following table lists the available DHCP extended options (defined in RFCs) on the Zyxel Device. See RFCs for more information. Table 99 DHCP Extended Options OPTION NAME Time Offset CODE 2 Time Server NTP Server TFTP Server Name Bootfile SIP Server VIVC VIVS 4 42 66 67 120 124 125 CAPWAP AC 138 TFTP Server 150 DESCRIPTION This option specifies the offset of the client's subnet in seconds from Coordinated Universal Time (UTC). This option specifies a list of Time servers available to the client. This option specifies a list of the NTP servers available to the client by IP address. This option is used to identify a TFTP server when the sname field in the DHCP header has been used for DHCP options. The minimum length of the value is 1. This option is used to identify a bootfile when the file field in the DHCP header has been used for DHCP options. The minimum length of the value is 1. This option carries either an IPv4 address or a DNS domain name to be used by the SIP client to locate a SIP server. Vendor-Identifying Vendor Class option A DHCP client may use this option to unambiguously identify the vendor that manufactured the hardware on which the client is running, the software in use, or an industry consortium to which the vendor belongs. Vendor-Identifying Vendor-Specific option DHCP clients and servers may use this option to exchange vendor-specific information. CAPWAP Access Controller addresses option The Control And Provisioning of Wireless Access Points Protocol allows a Wireless Termination Point (WTP) to use DHCP to discover the Access Controllers to which it is to connect. This option carries a list of IPv4 addresses indicating one or more CAPWAP ACs available to the WTP. The option contains one or more IPv4 addresses that the client may use. The current use of this option is for downloading configuration from a VoIP server via TFTP; however, the option may be used for purposes other than contacting a VoIP configuration server. 9.5 PPP Interfaces Use PPPoE/PPTP/L2TP interfaces to connect to your ISP. This way, you do not have to install or manage PPPoE/PPTP/L2TP software on each computer in the network. ZyWALL ATP Series Users Guide 243 Chapter 9 Interfaces Figure 186 Example: PPPoE/PPTP/L2TP Interfaces PPPoE/PPTP/L2TP interfaces are similar to other interfaces in some ways. They have an IP address, subnet mask, and gateway used to make routing decisions; they restrict bandwidth and packet size; and they can verify the gateway is available. There are two main differences between PPPoE/PPTP/L2TP interfaces and other interfaces. You must also configure an ISP account object for the PPPoE/PPTP/L2TP interface to use. Each ISP account specifies the protocol (PPPoE or PPTP or L2TP), as well as your ISP account information. If you change ISPs later, you only have to create a new ISP account, not a new PPPoE/

PPTP/L2TP interface. You should not have to change any network policies. You do not set up the subnet mask or gateway. PPPoE/PPTP/L2TP interfaces are interfaces between the Zyxel Device and only one computer. Therefore, the subnet mask is always 255.255.255.255. In addition, the Zyxel Device always treats the ISP as a gateway. 9.5.1 PPP Interface Summary This screen lists every PPPoE/PPTP/L2TP interface. To access this screen, click Configuration > Network >

Interface > PPP. Figure 187 Configuration > Network > Interface > PPP ZyWALL ATP Series Users Guide 244 Chapter 9 Interfaces Each field is described in the table below. Table 100 Configuration > Network > Interface > PPP LABEL User Configuration /

System Default DESCRIPTION The Zyxel Device comes with the (non-removable) System Default PPP interfaces pre-

configured. You can create (and delete) User Configuration PPP interfaces. System Default PPP interfaces vary by model. Click this to create a new user-configured PPP interface. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove a user-configured PPP interface, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. To connect an interface, select it and click Connect. You might use this in testing the interface or to manually establish the connection for a Dial-on-Demand PPPoE/PPTP interface. To disconnect an interface, select it and click Disconnect. You might use this in testing the interface. Select an entry and click References to open a screen that shows which settings use the entry. See Section 9.4.4 on page 240 for an example. This field is a sequential value, and it is not associated with any interface. The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. Add Edit Remove Activate Inactivate Connect Disconnect References

#

Status Name Description Base Interface Account Profile Apply Reset The connect icon is lit when the interface is connected and dimmed when it is disconnected. This field displays the name of the interface. This field displays the description of the interface. This field displays the interface on the top of which the PPPoE/PPTP/L2TP interface is. This field displays the ISP account used by this PPPoE/PPTP interface. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. 9.5.2 PPP Interface Add or Edit Note: You have to set up an ISP account before you create a PPPoE/PPTP/L2TP interface. This screen lets you configure a PPPoE or PPTP or L2TP interface. If you enabled IPv6 in the Configuration

> System > IPv6 screen, you can also configure PPP interfaces used for your IPv6 networks on this screen. To access this screen, click the Add icon or an Edit icon in the PPP Interface screen. ZyWALL ATP Series Users Guide 245 Chapter 9 Interfaces Figure 188 Configuration > Network > Interface > PPP > Add ZyWALL ATP Series Users Guide 246 Chapter 9 Interfaces Each field is explained in the following table. Table 101 Configuration > Network > Interface > PPP > Add LABEL IPv4/IPv6 View / IPv4 View / IPv6 View Show Advanced Settings / Hide Advanced Settings Create New Object DESCRIPTION Use this button to display both IPv4 and IPv6, IPv4-only, or IPv6-only configuration fields. Click this button to display a greater or lesser number of configuration fields. Click this button to create an ISP Account or a DHCPv6 request object that you may use for the ISP or DHCPv6 settings in this screen. General Settings Enable Interface General IPv6 Setting Select this to enable this interface. Clear this to disable this interface. Enable IPv6 Select this to enable IPv6 on this interface. Otherwise, clear this to disable it. Interface Properties Interface Name Base Interface Zone Description Connectivity Nailed-Up Dial-on-Demand ISP Setting Account Profile Protocol User Name Service Name IP Address Assignment Get Automatically Use Fixed IP Address IP Address Specify a name for the interface. It can use alphanumeric characters, hyphens, and underscores, and it can be up to 11 characters long. Select the interface upon which this PPP interface is built. Note: Multiple PPP interfaces can use the same base interface. Select the zone to which this PPP interface belongs. The zone determines the security settings the Zyxel Device uses for the interface. Enter a description of this interface. You can use alphanumeric and ()+/:=?!*#@$_%-

characters, and it can be up to 60 characters long. Spaces are allowed, but the string cant start with a space. Select this if the PPPoE/PPTP/L2TP connection should always be up. Clear this to have the Zyxel Device establish the PPPoE/PPTP/L2TP connection only when there is traffic. You might use this option if a lot of traffic needs to go through the interface or it does not cost extra to keep the connection up all the time. Select this to have the Zyxel Device establish the PPPoE/PPTP/L2TP connection only when there is traffic. You might use this option if there is little traffic through the interface or if it costs money to keep the connection available. Select the ISP account that this PPPoE/PPTP/L2TP interface uses. The drop-down box lists ISP accounts by name. Use Create new Object if you need to configure a new ISP account

(see Chapter 35 on page 710 for details). This field is read-only. It displays the protocol specified in the ISP account. This field is read-only. It displays the user name for the ISP account. This field is read-only. It displays the PPPoE service name specified in the ISP account. This field is blank if the ISP account uses PPTP. Click Show Advanced Settings to display more settings. Click Hide Advanced Settings to display fewer settings. Select this if this interface is a DHCP client. In this case, the DHCP server configures the IP address automatically. The subnet mask and gateway are always defined automatically in PPPoE/PPTP/L2TP interfaces. Select this if you want to specify the IP address manually. This field is enabled if you select Use Fixed IP Address. Enter the IP address for this interface. ZyWALL ATP Series Users Guide 247 Chapter 9 Interfaces Table 101 Configuration > Network > Interface > PPP > Add (continued) LABEL DESCRIPTION This field is enabled if you select Use Fixed IP Address. Gateway Metric IPv6 Address Assignment Enable Stateless Address Auto-

configuration

(SLAAC) Metric Address from DHCPv6 Prefix Delegation Add Edit Remove References

#

Delegated Prefix Suffix Address Address DHCPv6 Setting DHCPv6 DUID Enter the IP address of the gateway. The Zyxel Device sends packets to the gateway when it does not know how to route the packet to its destination. The gateway should be on the same network as the interface. Enter the priority of the gateway (the ISP) on this interface. The Zyxel Device decides which gateway to use based on this priority. The lower the number, the higher the priority. If two or more gateways have the same priority, the Zyxel Device uses the one that was configured first. These IP address fields configure an IPv6 IP address on the interface itself. Select this to enable IPv6 stateless auto-configuration on this interface. The interface will generate an IPv6 IP address itself from a prefix obtained from an IPv6 router in the network. Enter the priority of the gateway (if any) on this interface. The Zyxel Device decides which gateway to use based on this priority. The lower the number, the higher the priority. If two or more gateways have the same priority, the Zyxel Device uses the one that was configured first. Use this table to have the Zyxel Device obtain an IPv6 prefix from the ISP or a connected uplink router for an internal network, such as the LAN or DMZ. You have to also enter a suffix address which is appended to the delegated prefix to form an address for this interface. See Prefix Delegation on page 217 for more information. To use prefix delegation, you must:

Create at least one DHCPv6 request object before configuring this table. The external interface must be a DHCPv6 client. You must configure the DHCPv6 request options using a DHCPv6 request object with the type of prefix-delegation. Assign the prefix delegation to an internal interface and enable router advertisement on that interface. Click this to create an entry. Select an entry and click this to change the settings. Select an entry and click this to delete it from this table. Select an entry and click References to open a screen that shows which settings use the entry. This field is a sequential value, and it is not associated with any entry. Select the DHCPv6 request object to use from the drop-down list. Enter the ending part of the IPv6 address, a slash (/), and the prefix length. The Zyxel Device will append it to the delegated prefix. For example, you got a delegated prefix of 2003:1234:5678/48. You want to configure an IP address of 2003:1234:5678:1111::1/128 for this interface, then enter ::1111:0:0:0:1/128 in this field. This field displays the combined IPv6 IP address for this interface. Note: This field displays the combined address after you click OK and reopen this screen. Select Client to obtain an IP address and DNS information from the service provider for the interface. Otherwise, select N/A to disable the function. This field displays the DHCP Unique IDentifier (DUID) of the interface, which is unique and used for identification purposes when the interface is exchanging DHCPv6 messages with others. See DHCPv6 on page 218 for more information. ZyWALL ATP Series Users Guide 248 Chapter 9 Interfaces Table 101 Configuration > Network > Interface > PPP > Add (continued) LABEL DESCRIPTION Select this if you want the DUID is generated from the interfaces default MAC address. DUID as MAC Customized DUID If you want to use a customized DUID, enter it here for the interface. Enable Rapid Commit Select this to shorten the DHCPv6 message exchange process from four to two steps. This function helps reduce heavy network traffic load. Note: Make sure you also enable this option in the DHCPv6 clients to make rapid commit work. Request Address DHCPv6 Request Options Add Remove References Name Type Value Select this to get an IPv6 IP address for this interface from the DHCP server. Clear this to not get any IP address information through DHCPv6. Use this section to configure DHCPv6 request settings that determine what additional information to get from the DHCPv6 server. Click this to create an entry in this table. See Section 9.4.6 on page 242 for more information. Select an entry and click this to delete it from this table. Select an entry and click References to open a screen that shows which settings use the entry. See Section 9.4.4 on page 240 for an example. This field displays the name of the DHCPv6 request object. This field displays the type of the object. This field displays the IPv6 prefix that the Zyxel Device will advertise to its clients. Interface Parameters Egress Bandwidth Enter the maximum amount of traffic, in kilobits per second, the Zyxel Device can send through the interface to the network. Allowed values are 0 - 1048576. This is reserved for future use. Ingress Bandwidth MTU Connectivity Check Enable Connectivity Check Check Method Check Period Check Timeout Check Fail Tolerance Check Default Gateway Enter the maximum amount of traffic, in kilobits per second, the Zyxel Device can receive from the network through the interface. Allowed values are 0 - 1048576. Maximum Transmission Unit. Type the maximum size of each data packet, in bytes, that can move through this interface. If a larger packet arrives, the Zyxel Device divides it into smaller fragments. Allowed values are 576 - 1492. Usually, this value is 1492. The interface can regularly check the connection to the gateway you specified to make sure it is still available. You specify how often the interface checks the connection, how long to wait for a response before the attempt is a failure, and how many consecutive failures are required before the Zyxel Device stops routing to the gateway. The Zyxel Device resumes routing to the gateway the first time the gateway passes the connectivity check. Select this to turn on the connection check. Select the method that the gateway allows. Select icmp to have the Zyxel Device regularly ping the gateway you specify to make sure it is still available. Select tcp to have the Zyxel Device regularly perform a TCP handshake with the gateway you specify to make sure it is still available. Enter the number of seconds between connection check attempts. Enter the number of seconds to wait for a response before the attempt is a failure. Enter the number of consecutive failures before the Zyxel Device stops routing through the gateway. Select this to use the default gateway for the connectivity check. ZyWALL ATP Series Users Guide 249 Chapter 9 Interfaces Table 101 Configuration > Network > Interface > PPP > Add (continued) LABEL DESCRIPTION Select this to specify a domain name or IP address for the connectivity check. Enter that domain name or IP address in the field next to it. This field only displays when you set the Check Method to tcp. Specify the port number to use for a TCP connectivity check. Click WAN TRUNK to go to a screen where you can configure the interface as part of a WAN trunk for load balancing. Click Policy Route to go to the screen where you can manually configure a policy route to associate traffic with this interface. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving. Check this address Check Port Related Setting Configure WAN TRUNK Policy Route OK Cancel 9.6 Cellular Configuration Screen Mobile broadband is a digital, packet-switched wireless technology. Bandwidth usage is optimized as multiple users share the same channel and bandwidth is only allocated to users when they send data. It allows fast transfer of voice and non-voice data and provides broadband Internet access to mobile devices. Note: The actual data rate you obtain varies depending on the mobile broadband device you use, the signal strength to the service providers base station, and so on. You can configure how the Zyxel Devices mobile broadband device connects to a network (refer to Section 9.6.1 on page 253):

You can set the mobile broadband device to connect only to the home network, which is the network to which you are originally subscribed. You can set the mobile broadband device to connect to other networks if the signal strength of the home network is too low or it is unavailable. 3G 3G (Third Generation) is a digital, packet-switched wireless technology. Bandwidth usage is optimized as multiple users share the same channel and bandwidth is only allocated to users when they send data. It allows fast transfer of voice and non-voice data and provides broadband Internet access to mobile devices. 4G 4G is the fourth generation of the mobile telecommunications technology and a successor of 3G. Both the WiMAX and Long Term Evolution (LTE) standards are the 4G candidate systems. 4G only supports all-

IP-based packet-switched telephony services and is required to offer Gigabit speed access. Note: The actual data rate you obtain varies depending on your mobile environment. The environmental factors may include the number of mobile devices which are currently connected to the mobile network, the signal strength to the mobile network, and so on. ZyWALL ATP Series Users Guide 250 Chapter 9 Interfaces See the following table for a comparison between 2G, 2.5G, 2.75G, 3G and 4G wireless technologies. Table 102 2G, 2.5G, 2.75G, 3G, 3.5G and 4G Wireless Technologies DATA SPEED Slow CDMA-BASED Interim Standard 95 (IS-95), the first CDMA-based digital cellular standard pioneered by Qualcomm. The brand name for IS-95 is cdmaOne. IS-95 is also known as TIA-EIA-95. CDMA2000 is a hybrid 2.5G / 3G protocol of mobile telecommunications standards that use CDMA, a multiple access scheme for digital radio. CDMA2000 1xRTT (1 times Radio Transmission Technology) is the core CDMA2000 wireless air interface standard. It is also known as 1x, 1xRTT, or IS-

2000 and considered to be a 2.5G or 2.75G technology. CDMA2000 EV-DO (Evolution-Data Optimized, originally 1x Evolution-Data Only), also referred to as EV-DO, EVDO, or just EV, is an evolution of CDMA2000 1xRTT and enables high-speed wireless connectivity. It is also denoted as IS-856 or High Data Rate (HDR). NAME TYPE 2G Circuit-

switched MOBILE PHONE AND DATA STANDARDS GSM-BASED GSM (Global System for Mobile Communications), Personal Handy-

phone System (PHS), etc. 2.5G 2.75G Packet-

switched Packet-

switched GPRS (General Packet Radio Services), High-Speed Circuit-Switched Data

(HSCSD), etc. Enhanced Data rates for GSM Evolution

(EDGE), Enhanced GPRS (EGPRS), etc. 3G Packet-

switched 3.5G Packet-

switched 4G/LTE Packet-

switched UMTS (Universal Mobile Telecommunications System), a third-

generation (3G) wireless standard defined in ITU specification, is sometimes marketed as 3GSM. The UMTS uses GSM infrastructures and W-CDMA (Wideband Code Division Multiple Access) as the air interface. The International Telecommunication Union (ITU) is an international organization within which governments and the private sector coordinate global telecom networks and services. HSDPA (High-Speed Downlink Packet Access) is a mobile telephony protocol, used for UMTS-based 3G networks and allows for higher data transfer speeds. The LTE (Long Term Evolution) standard is based on the GSM and UMTS network technologies. To change your mobile broadband WAN settings, click Configuration > Network > Interface > Cellular. Note: Install (or connect) a compatible mobile broadband USB device to use a cellular connection. Note: The WAN IP addresses of a Zyxel Device with multiple WAN interfaces must be on different subnets. Fast ZyWALL ATP Series Users Guide 251 Chapter 9 Interfaces Figure 189 Configuration > Network > Interface > Cellular The following table describes the labels in this screen. Table 103 Configuration > Network > Interface > Cellular LABEL Add Edit Remove Activate Inactivate Connect Disconnect References

#

Status Name Description Extension Slot Connected Device ISP Settings Mobile Broadband Dongle Support DESCRIPTION Click this to create a new cellular interface. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. To connect an interface, select it and click Connect. You might use this in testing the interface or to manually establish the connection. To disconnect an interface, select it and click Disconnect. You might use this in testing the interface. Select an entry and click References to open a screen that shows which settings use the entry. See Section 9.4.4 on page 240 for an example. This field is a sequential value, and it is not associated with any interface. The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. The connect icon is lit when the interface is connected and dimmed when it is disconnected. This field displays the name of the interface. This field displays the description of the interface. This field displays where the entrys cellular card is located. This field displays the name of the cellular card. This field displays the profile of ISP settings that this cellular interface is set to use. You should have registered your Zyxel Device at myZyxel. myZyxel hosts a list of supported mobile broadband dongle devices. You should have an Internet connection to access this website. ZyWALL ATP Series Users Guide 252 Chapter 9 Interfaces Table 103 Configuration > Network > Interface > Cellular (continued) LABEL Latest Version Current Version Update Now Apply Reset DESCRIPTION This displays the latest supported mobile broadband dongle list version number. This displays the currently supported (by the Zyxel Device) mobile broadband dongle list version number. If the latest version number is greater than the current version number, then click this button to download the latest list of supported mobile broadband dongle devices to the Zyxel Device. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. 9.6.1 Cellular Choose Slot To change your mobile broadband settings, click Configuration > Network > Interface > Cellular > Add

(or Edit). In the pop-up window that displays, select the slot that contains the mobile broadband device, then the Add Cellular configuration screen displays. 9.6.2 Add / Edit Cellular Configuration This screen displays after you select the slot that contains the mobile broadband device in the previous pop-up window. ZyWALL ATP Series Users Guide 253 Chapter 9 Interfaces Figure 190 Configuration > Network > Interface > Cellular > Add / Edit ZyWALL ATP Series Users Guide 254 Chapter 9 Interfaces The following table describes the labels in this screen. Table 104 Configuration > Network > Interface > Cellular > Add / Edit LABEL Show Advanced Settings / Hide Advanced Settings General Settings DESCRIPTION Click this button to display a greater or lesser number of configuration fields. Enable Interface Interface Properties Interface Name Zone Extension Slot Connected Device Description Connectivity Nailed-Up Idle timeout ISP Settings Profile Selection APN Dial String Authentication Type Select this option to turn on this interface. Select a name for the interface. Select the zone to which you want the cellular interface to belong. The zone determines the security settings the Zyxel Device uses for the interface. This is the USB slot that you are configuring for use with a mobile broadband card. This displays the manufacturer and model name of your mobile broadband card if you inserted one in the Zyxel Device. Otherwise, it displays none. Enter a description of this interface. You can use alphanumeric and ()+/:=?!*#@$_%-

characters, and it can be up to 60 characters long. Spaces are allowed, but the string cant start with a space. Select this if the connection should always be up. Clear this to have the Zyxel Device to establish the connection only when there is traffic. You might not nail up the connection if there is little traffic through the interface or if it costs money to keep the connection available. This value specifies the time in seconds (0~360) that elapses before the Zyxel Device automatically disconnects from the ISPs server. Zero disables the idle timeout. Select Device to use one of the mobile broadband devices profiles of device settings. Then select the profile (use Profile 1 unless your ISP instructed you to do otherwise). Select Custom to configure your device settings yourself. This field is read-only if you selected Device in the profile selection. Select Custom in the profile selection to be able to manually input the APN (Access Point Name) provided by your service provider. This field applies with a GSM or HSDPA mobile broadband card. Enter the APN from your service provider. Connections with different APNs may provide different services (such as Internet access or MMS (Multi-Media Messaging Service)) and charge method. You can enter up to 63 ASCII printable characters. Spaces are allowed. Enter the dial string if your ISP provides a string, which would include the APN, to initialize the mobile broadband card. You can enter up to 63 ASCII printable characters. Spaces are allowed. This field is available only when you insert a GSM mobile broadband card. The Zyxel Device supports PAP (Password Authentication Protocol) and CHAP (Challenge Handshake Authentication Protocol). CHAP is more secure than PAP; however, PAP is readily available on more platforms. Use the drop-down list box to select an authentication protocol for outgoing calls. Options are:

None: No authentication for outgoing calls. CHAP - Your Zyxel Device accepts CHAP requests only. PAP - Your Zyxel Device accepts PAP requests only. ZyWALL ATP Series Users Guide 255 Chapter 9 Interfaces Table 104 Configuration > Network > Interface > Cellular > Add / Edit (continued) LABEL DESCRIPTION This field displays when you select an authentication type other than None. This field is read-

only if you selected Device in the profile selection. If this field is configurable, enter the user name for this mobile broadband card exactly as the service provider gave it to you. User Name Password Retype to Confirm SIM Card Setting PIN Code Retype to Confirm Interface Parameters Ingress Bandwidth MTU Connectivity Check Enable Connectivity Check Check Method Check Period Check Timeout You can use 1 ~ 64 alphanumeric and #:%-_@$./ characters. The first character must be alphanumeric or -_@$./. Spaces are not allowed. This field displays when you select an authentication type other than None. This field is read-

only if you selected Device in the profile selection and the password is included in the mobile broadband cards profile. If this field is configurable, enter the password for this SIM card exactly as the service provider gave it to you. You can use 0 ~ 63 alphanumeric and `~!@#$%^&*()_-+={}|;:'<,>./ characters. Spaces are not allowed. This field displays when you select an authentication type other than None. This field is read-

only if you selected Device in the profile selection and the password is included in the mobile broadband cards profile. If this field is configurable, re-enter the password for this SIM card exactly as the service provider gave it to you. This field displays with a GSM or HSDPA mobile broadband card. A PIN (Personal Identification Number) code is a key to a mobile broadband card. Without the PIN code, you cannot use the mobile broadband card. Enter the 4-digit PIN code (0000 for example) provided by your ISP. If you enter the PIN code incorrectly, the mobile broadband card may be blocked by your ISP and you cannot use the account to access the Internet. If your ISP disabled PIN code authentication, enter an arbitrary number. Type the PIN code again to confirm it. through the interface to the network. Allowed values are 0 - 1048576. This setting is used in WAN load balancing and bandwidth management. This is reserved for future use. Enter the maximum amount of traffic, in kilobits per second, the Zyxel Device can receive from the network through the interface. Allowed values are 0 - 1048576. Maximum Transmission Unit. Type the maximum size of each data packet, in bytes, that can move through this interface. If a larger packet arrives, the Zyxel Device divides it into smaller fragments. Allowed values are 576 - 1492. Usually, this value is 1492. The interface can regularly check the connection to the gateway you specified to make sure it is still available. You specify how often the interface checks the connection, how long to wait for a response before the attempt is a failure, and how many consecutive failures are required before the Zyxel Device stops routing to the gateway. The Zyxel Device resumes routing to the gateway the first time the gateway passes the connectivity check. Select this to turn on the connection check. Select the method that the gateway allows. Select icmp to have the Zyxel Device regularly ping the gateway you specify to make sure it is still available. Select tcp to have the Zyxel Device regularly perform a TCP handshake with the gateway you specify to make sure it is still available. Enter the number of seconds between connection check attempts. Enter the number of seconds to wait for a response before the attempt is a failure. ZyWALL ATP Series Users Guide 256 Egress Bandwidth Enter the maximum amount of traffic, in kilobits per second, the Zyxel Device can send Chapter 9 Interfaces Table 104 Configuration > Network > Interface > Cellular > Add / Edit (continued) LABEL DESCRIPTION Enter the number of consecutive failures before the Zyxel Device stops routing through the gateway. Select this to use the default gateway for the connectivity check. Select this to specify a domain name or IP address for the connectivity check. Enter that domain name or IP address in the field next to it. This field only displays when you set the Check Method to tcp. Specify the port number to use for a TCP connectivity check. Check Fail Tolerance Check Default Gateway Check this address Check Port Related Setting Configure WAN TRUNK Configure Policy Route Click WAN TRUNK to go to a screen where you can configure the interface as part of a WAN trunk for load balancing. Click Policy Route to go to the policy route summary screen where you can configure a policy route to override the default routing and SNAT behavior for the interface. IP Address Assignment Get Automatically Use Fixed IP Address IP Address Assignment Metric Device Settings Band Selection Select this option If your ISP did not assign you a fixed IP address. This is the default selection. Select this option If the ISP assigned a fixed IP address. Enter the cellular interfaces WAN IP address in this field if you selected Use Fixed IP Address. Enter the priority of the gateway (if any) on this interface. The Zyxel Device decides which gateway to use based on this priority. The lower the number, the higher the priority. If two or more gateways have the same priority, the Zyxel Device uses the one that was configured first. This field appears if you selected a mobile broadband device that allows you to select the type of network to use. Select the type of mobile broadband service for your mobile broadband connection. If you are unsure what to select, check with your mobile broadband service provider to find the mobile broadband service available to you in your region. Select auto to have the card connect to an available network. Choose this option if you do not know what networks are available. You may want to manually specify the type of network to use if you are charged differently for different types of network or you only have one type of network available to you. Select GPRS / EDGE (GSM) only to have this interface only use a 2.5G or 2.75G network

(respectively). If you only have a GSM network available to you, you may want to select this so the Zyxel Device does not spend time looking for a WCDMA network. Select UMTS / HSDPA (WCDMA) only to have this interface only use a 3G or 3.5G network

(respectively). You may want to do this if you want to make sure the interface does not use the GSM network. Select LTE only to have this interface only use a 4G LTE network. This option only appears when a USG dongle for 4G technology is inserted. ZyWALL ATP Series Users Guide 257 Chapter 9 Interfaces Table 104 Configuration > Network > Interface > Cellular > Add / Edit (continued) LABEL Network Selection Budget Setup Enable Budget Control Time Budget Data Budget Reset time and data budget counters on Reset time and data budget counters Actions when over budget Log New connection Current connection Actions when over %

of time budget or %

of data budget DESCRIPTION Home network is the network to which you are originally subscribed. Select Home to have the mobile broadband device connect only to the home network. If the home network is down, the Zyxel Devices mobile broadband Internet connection is also unavailable. Select Auto (Default) to allow the mobile broadband device to connect to a network to which you are not subscribed when necessary, for example when the home network is down or another mobile broadband base station's signal is stronger. This is recommended if you need continuous Internet connectivity. If you select this, you may be charged using the rate of a different network. Select this to set a monthly limit for the user account of the installed mobile broadband card. You can set a limit on the total traffic and/or call time. The Zyxel Device takes the actions you specified when a limit is exceeded during the month. Select this and specify the amount of time (in hours) that the mobile broadband connection can be used within one month. If you change the value after you configure and enable budget control, the Zyxel Device resets the statistics. Select this and specify how much downstream and/or upstream data (in Mega bytes) can be transmitted via the mobile broadband connection within one month. Select Download to set a limit on the downstream traffic (from the ISP to the Zyxel Device). Select Upload to set a limit on the upstream traffic (from the Zyxel Device to the ISP). Select Download/Upload to set a limit on the total traffic in both directions. If you change the value after you configure and enable budget control, the Zyxel Device resets the statistics. Select the date on which the Zyxel Device resets the budget every month. If the date you selected is not available in a month, such as 30th or 31st, the Zyxel Device resets the budget on the last day of the month. This button is available only when you enable budget control in this screen. Click this button to reset the time and data budgets immediately. The count starts over with the mobile broadband connections full configured monthly time and data budgets. This does not affect the normal monthly budget restart; so if you configured the time and data budget counters to reset on the second day of the month and you use this button on the first, the time and data budget counters will still reset on the second. Specify the actions the Zyxel Device takes when the time or data limit is exceeded. Select None to not create a log, Log to create a log, or Log-alert to create an alert log. If you select Log or Log-alert you can also select recurring every to have the Zyxel Device send a log or alert for this event periodically. Specify how often (from 1 to 65535 minutes) to send the log or alert. Select Allow to permit new mobile broadband connections or Disallow to drop/block new mobile broadband connections. Select Keep to maintain an existing mobile broadband connection or Drop to disconnect it. You cannot set New connection to Allow and Current connection to Drop at the same time. If you set New connection to Disallow and Current connection to Keep, the Zyxel Device allows you to transmit data using the current connection, but you cannot build a new connection if the existing connection is disconnected. Specify the actions the Zyxel Device takes when the specified percentage of time budget or data limit is exceeded. Enter a number from 1 to 99 in the percentage fields. If you change the value after you configure and enable budget control, the Zyxel Device resets the statistics. ZyWALL ATP Series Users Guide 258 Chapter 9 Interfaces Table 104 Configuration > Network > Interface > Cellular > Add / Edit (continued) LABEL Log DESCRIPTION Select None to not create a log when the Zyxel Device takes this action, Log to create a log, or Log-alert to create an alert log. If you select Log or Log-alert you can also select recurring every to have the Zyxel Device send a log or alert for this event periodically. Specify how often (from 1 to 65535 minutes) to send the log or alert. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving. OK Cancel 9.7 Tunnel Interfaces The Zyxel Device uses tunnel interfaces in Generic Routing Encapsulation (GRE), IPv6 in IPv4, and 6to4 tunnels. GRE Tunneling GRE tunnels encapsulate a wide variety of network layer protocol packet types inside IP tunnels. A GRE tunnel serves as a virtual point-to-point link between the Zyxel Device and another router over an IPv4 network. At the time of writing, the Zyxel Device only supports GRE tunneling in IPv4 networks. Figure 191 GRE Tunnel Example IPv6 Over IPv4 Tunnels To route traffic between two IPv6 networks over an IPv4 network, an IPv6 over IPv4 tunnel has to be used. Figure 192 IPv6 over IPv4 Network On the Zyxel Device, you can either set up a manual IPv6-in-IPv4 tunnel or an automatic 6to4 tunnel. The following describes each method:

ZyWALL ATP Series Users Guide 259 Chapter 9 Interfaces IPv6-in-IPv4 Tunneling Use this mode on the WAN of the Zyxel Device if your Zyxel Device has a public IPv4 IP address given from your ISP, and you want to transmit your IPv6 packets to one and only one remote site whose LAN network is also an IPv6 network. With this mode, the Zyxel Device encapsulates IPv6 packets within IPv4 packets across the Internet. You must know the WAN IP address of the remote gateway device. This mode is normally used for a site-to-

site application such as two branch offices. Figure 193 IPv6-in-IPv4 Tunnel In the Zyxel Device, you must also manually configure a policy route for an IPv6-in-IPv4 tunnel to make the tunnel work. 6to4 Tunneling This mode also enables IPv6 packets to cross IPv4 networks. Unlike IPv6-in-IPv4 tunneling, you do not need to configure a policy route for a 6to4 tunnel. Through your properly pre-configuring the destination routers IP address in the IP address assignments to hosts, the Zyxel Device can automatically forward 6to4 packets to the destination they want to go. A 6to4 relay router is required to route 6to4 packets to a native IPv6 network if the packets destination do not match your specified criteria. In this mode, the Zyxel Device should get a public IPv4 address for the WAN. The Zyxel Device adds an IPv4 IP header to an IPv6 packet when transmitting the packet to the Internet. In reverse, the Zyxel Device removes the IPv4 header from an IPv6 packet when receiving it from the Internet. An IPv6 address using the 6to4 mode consists of an IPv4 address, the format is as the following:

2002:[a public IPv4 address in hexadecimal]::/48 For example, a public IPv4 address is 202.156.30.41. The converted hexadecimal IP string is ca.9c.1Ee.29. The IPv6 address prefix becomes 2002:ca9c:1e29::/48. ZyWALL ATP Series Users Guide 260 Chapter 9 Interfaces Figure 194 6to4 Tunnel IPv6 IPv4 IPv6 Internet IPv6 9.7.1 Configuring a Tunnel This screen lists the Zyxel Devices configured tunnel interfaces. To access this screen, click Network >

Interface > Tunnel. Figure 195 Network > Interface > Tunnel Each field is explained in the following table. Table 105 Network > Interface > Tunnel LABEL Add Edit DESCRIPTION Click this to create a new GRE tunnel interface. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. Select an entry and click References to open a screen that shows which settings use the entry. See Section 9.4.4 on page 240 for an example. This field is a sequential value, and it is not associated with any interface. The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. This field displays the name of the interface. Remove Activate Inactivate References

#

Status Name ZyWALL ATP Series Users Guide 261 Chapter 9 Interfaces Table 105 Network > Interface > Tunnel (continued) LABEL IP Address DESCRIPTION This is the IP address of the interface. If the interface is active (and connected), the Zyxel Device tunnels local traffic sent to this IP address to the Remote Gateway Address. This is the tunnel mode of the interface (GRE, IPv6-in-IPv4 or 6to4). This field also displays the interfaces IPv4 IP address and subnet mask if it is a GRE tunnel. Otherwise, it displays the interfaces IPv6 IP address and prefix length. This is the interface or IP address uses to identify itself to the remote gateway. The Zyxel Device uses this as the source for the packets it tunnels to the remote gateway. This is the IP address or domain name of the remote gateway to which this interface tunnels traffic. Click Apply to save your changes back to the Zyxel Device. Click Reset to begin configuring this screen afresh. Tunnel Mode My Address Remote Gateway Address Apply Reset 9.7.2 Tunnel Add or Edit Screen This screen lets you configure a tunnel interface. Click Configuration > Network > Interface > Tunnel >

Add (or Edit) to open the following screen. ZyWALL ATP Series Users Guide 262 Chapter 9 Interfaces Figure 196 Network > Interface > Tunnel > Add/Edit Each field is explained in the following table. Table 106 Network > Interface > Tunnel > Add/Edit LABEL Show Advanced Settings / Hide Advanced Settings General Settings DESCRIPTION Click this button to display a greater or lesser number of configuration fields. Enable Select this to enable this interface. Clear this to disable this interface. Interface Properties ZyWALL ATP Series Users Guide 263 Chapter 9 Interfaces Table 106 Network > Interface > Tunnel > Add/Edit (continued) LABEL Interface Name Zone Tunnel Mode IP Address Assignment IP Address Subnet Mask Metric IPv6 Address Assignment DESCRIPTION This field is read-only if you are editing an existing tunnel interface. Enter the name of the tunnel interface. The format is tunnelx, where x is 0 - 3. For example, tunnel0. Use this field to select the zone to which this interface belongs. This controls what security settings the Zyxel Device applies to this interface. Select the tunneling protocol of the interface (GRE, IPv6-in-IPv4 or 6to4). See Section 9.7 on page 259 for more information. This section is available if you are configuring a GRE tunnel. Enter the IP address for this interface. Enter the subnet mask of this interface in dot decimal notation. The subnet mask indicates what part of the IP address is the same for all computers in the network. Enter the priority of the gateway (if any) on this interface. The Zyxel Device decides which gateway to use based on this priority. The lower the number, the higher the priority. If two or more gateways have the same priority, the Zyxel Device uses the one that was configured first. This section is available if you are configuring an IPv6-in-IPv4 or a 6to4 tunnel. IPv6 Address/

Prefix Length Enter the IPv6 address and the prefix length for this interface if you want to use a static IP address. This field is optional. Metric 6to4 Tunnel Parameter 6to4 Prefix Relay Router Remote Gateway Prefix Gateway Settings My Address The prefix length indicates what the left-most part of the IP address is the same for all computers in the network, that is, the network address. Enter the priority of the gateway (if any) on this interface. The Zyxel Device decides which gateway to use based on this priority. The lower the number, the higher the priority. If two or more gateways have the same priority, the Zyxel Device uses the one that was configured first. This section is available if you are configuring a 6to4 tunnel which encapsulates IPv6 to IPv4 packets. Enter the IPv6 prefix of a destination network. The Zyxel Device forwards IPv6 packets to the hosts in the matched network. If you enter a prefix starting with 2002, the Zyxel Device will forward the matched packets to the IPv4 IP address converted from the packets destination address. The IPv4 IP address can be converted from the next 32 bits after the prefix you specified in this field. See 6to4 Tunneling on page 260 for an example. The Zyxel Device forwards the unmatched packets to the specified Relay Router. Enter the IPv4 address of a 6to4 relay router which helps forward packets between 6to4 networks and native IPv6 networks. Enter the IPv4 network address and network bits of a remote 6to4 gateway, for example, 14.15.0.0/16. This field works if you enter a 6to4 Prefix not starting with 2002 (2003 for example). The Zyxel Device forwards the matched packets to a remote gateway with the network address you specify here, and the bits converted after the 6to4 Prefix in the packets. For example, you configure the 6to4 prefix to 2003:A0B::/32 and the remote gateway prefix to 14.15.0.0/16. If a packets destination is 2003:A0B:1011:5::8, the Zyxel Device forwards the packet to 14.15.16.17, where the network address is 14.15.0.0 and the host address is the remain bits converted from 1011 after the packets 6to4 prefix (2003:A0B). Specify the interface or IP address to use as the source address for the packets this interface tunnels to the remote gateway. The remote gateway sends traffic to this interface or IP address. ZyWALL ATP Series Users Guide 264 Chapter 9 Interfaces Table 106 Network > Interface > Tunnel > Add/Edit (continued) LABEL DESCRIPTION Enter the IP address or domain name of the remote gateway to which this interface tunnels traffic. Automatic displays in this field if you are configuring a 6to4 tunnel. It means the 6to4 tunnel will help forward packets to the corresponding remote gateway automatically by looking at the packets destination address. Egress Bandwidth Enter the maximum amount of traffic, in kilobits per second, the Zyxel Device can send Remote Gateway Address Interface Parameters Ingress Bandwidth MTU Connectivity Check Enable Connectivity Check Check Method Check Period Check Timeout Check Fail Tolerance Check Default Gateway Check this address Check Port Related Setting WAN TRUNK Policy Route OK Cancel through the interface to the network. Allowed values are 0 - 1048576. This setting is used in WAN load balancing and bandwidth management. This is reserved for future use. Enter the maximum amount of traffic, in kilobits per second, the Zyxel Device can receive from the network through the interface. Allowed values are 0 - 1048576. Maximum Transmission Unit. Type the maximum size of each data packet, in bytes, that can move through this interface. If a larger packet arrives, the Zyxel Device divides it into smaller fragments. Allowed values are 576 - 1500. Usually, this value is 1500. This section is available if you are configuring a GRE tunnel. The interface can regularly check the connection to the gateway you specified to make sure it is still available. You specify how often the interface checks the connection, how long to wait for a response before the attempt is a failure, and how many consecutive failures are required before the Zyxel Device stops routing to the gateway. The Zyxel Device resumes routing to the gateway the first time the gateway passes the connectivity check. Select this to turn on the connection check. Select the method that the gateway allows. Select icmp to have the Zyxel Device regularly ping the gateway you specify to make sure it is still available. Select tcp to have the Zyxel Device regularly perform a TCP handshake with the gateway you specify to make sure it is still available. Enter the number of seconds between connection check attempts. Enter the number of seconds to wait for a response before the attempt is a failure. Enter the number of consecutive failures before the Zyxel Device stops routing through the gateway. Select this to use the default gateway for the connectivity check. Select this to specify a domain name or IP address for the connectivity check. Enter that domain name or IP address in the field next to it. This field displays when you set the Check Method to tcp. Specify the port number to use for a TCP connectivity check. Click this link to go to a screen where you can configure WAN trunk load balancing. Click this link to go to the screen where you can manually configure a policy route to associate traffic with this interface. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving. ZyWALL ATP Series Users Guide 265 Chapter 9 Interfaces 9.8 VLAN Interfaces A Virtual Local Area Network (VLAN) divides a physical network into multiple logical networks. The standard is defined in IEEE 802.1q. Figure 197 Example: Before VLAN In this example, there are two physical networks and three departments A, B, and C. The physical networks are connected to hubs, and the hubs are connected to the router. Alternatively, you can divide the physical networks into three VLANs. Figure 198 Example: After VLAN Each VLAN is a separate network with separate IP addresses, subnet masks, and gateways. Each VLAN also has a unique identification number (ID). The ID is a 12-bit value that is stored in the MAC header. The VLANs are connected to switches, and the switches are connected to the router. (If one switch has enough connections for the entire network, the network does not need switches A and B.) Traffic inside each VLAN is layer-2 communication (data link layer, MAC addresses). It is handled by the switches. As a result, the new switch is required to handle traffic inside VLAN 2. Traffic is only broadcast inside each VLAN, not each physical network. Traffic between VLANs (or between a VLAN and another type of network) is layer-3 communication

(network layer, IP addresses). It is handled by the router. This approach provides a few advantages. Increased performance - In VLAN 2, the extra switch should route traffic inside the sales department faster than the router does. In addition, broadcasts are limited to smaller, more logical groups of users. Higher security - If each computer has a separate physical connection to the switch, then broadcast traffic in each VLAN is never sent to computers in another VLAN. ZyWALL ATP Series Users Guide 266 Chapter 9 Interfaces Better manageability - You can align network policies more appropriately for users. For example, you can create different content filtering rules for each VLAN (each department in the example above), and you can set different bandwidth limits for each VLAN. These rules are also independent of the physical network, so you can change the physical network without changing policies. In this example, the new switch handles the following types of traffic:

Inside VLAN 2. Between the router and VLAN 1. Between the router and VLAN 2. Between the router and VLAN 3. VLAN Interfaces Overview In the Zyxel Device, each VLAN is called a VLAN interface. As a router, the Zyxel Device routes traffic between VLAN interfaces, but it does not route traffic within a VLAN interface. All traffic for each VLAN interface can go through only one Ethernet interface, though each Ethernet interface can have one or more VLAN interfaces. Note: Each VLAN interface is created on top of only one Ethernet interface. Otherwise, VLAN interfaces are similar to other interfaces in many ways. They have an IP address, subnet mask, and gateway used to make routing decisions. They restrict bandwidth and packet size. They can provide DHCP services, and they can verify the gateway is available. 9.8.1 VLAN Summary Screen This screen lists every VLAN interface and virtual interface created on top of VLAN interfaces. If you enabled IPv6 in the Configuration > System > IPv6 screen, you can also configure VLAN interfaces used for your IPv6 networks on this screen. To access this screen, click Configuration > Network > Interface >

VLAN. Figure 199 Configuration > Network > Interface > VLAN ZyWALL ATP Series Users Guide 267 Chapter 9 Interfaces Each field is explained in the following table. Table 107 Configuration > Network > Interface > VLAN LABEL Configuration

/ IPv6 Configuration Edit DESCRIPTION Use the Configuration section for IPv4 network settings. Use the IPv6 Configuration section for IPv6 network settings if you connect your Zyxel Device to an IPv6 network. Both sections have similar fields as described below. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. To open the screen where you can create a virtual interface, select an interface and click Create Virtual Interface. Select an entry and click References to open a screen that shows which settings use the entry. See Section 9.4.4 on page 240 for an example. This field is a sequential value, and it is not associated with any interface. This icon is lit when the entry is active and dimmed when the entry is inactive. This field displays the name of the interface. This field displays the description of the interface. For VLAN interfaces, this field displays the Ethernet interface on which the VLAN interface is created the VLAN ID For virtual interfaces, this field is blank. This field displays the current IP address of the interface. If the IP address is 0.0.0.0, the interface does not have an IP address yet. This screen also shows whether the IP address is a static IP address (STATIC) or dynamically assigned (DHCP). IP addresses are always static in virtual interfaces. This field displays the interfaces subnet mask in dot decimal notation. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Remove Activate Inactivate Create Virtual Interface References

#

Status Name Description Port/VID IP Address Mask Apply Reset 9.8.2 VLAN Add/Edit Select an existing entry in the previous screen and click Edit or click Add to create a new entry. The following screen appears. ZyWALL ATP Series Users Guide 268 Chapter 9 Interfaces Figure 200 Configuration > Network > Interface > VLAN > Add /Edit ZyWALL ATP Series Users Guide 269 Chapter 9 Interfaces ZyWALL ATP Series Users Guide 270 Chapter 9 Interfaces Each field is explained in the following table. DESCRIPTION Use this button to display both IPv4 and IPv6, IPv4-only, or IPv6-only configuration fields. Table 108 Configuration > Network > Interface > VLAN > Add / Edit LABEL IPv4/IPv6 View / IPv4 View / IPv6 View Show Advanced Settings / Hide Advanced Settings Create New Object Click this button to display a greater or lesser number of configuration fields. Click this button to create a DHCPv6 lease or DHCPv6 request object that you may use for the DHCPv6 settings in this screen. General Settings Enable Interface General IPv6 Setting Select this to turn this interface on. Clear this to disable this interface. Enable IPv6 Select this to enable IPv6 on this interface. Otherwise, clear this to disable it. Interface Properties Interface Type Interface Name Zone Base Port VLAN ID Select one of the following option depending on the type of network to which the Zyxel Device is connected or if you want to additionally manually configure some related settings. internal is for connecting to a local network. Other corresponding configuration options:

DHCP server and DHCP relay. The Zyxel Device automatically adds default SNAT settings for traffic flowing from this interface to an external interface. external is for connecting to an external network (like the Internet). The Zyxel Device automatically adds this interface to the default WAN trunk. For general, the rest of the screens options do not automatically adjust and you must manually configure a policy route to add routing and SNAT settings for the interface. This field is read-only if you are editing an existing VLAN interface. Enter the number of the VLAN interface. You can use a number from 0~4094. For example, use vlan0, vlan8, and so on. The total number of VLANs you can configure on the Zyxel Device depends on the model. Select the zone to which the VLAN interface belongs. Select the Ethernet interface on which the VLAN interface runs. Enter the VLAN ID. This 12-bit number uniquely identifies each VLAN. Allowed values are 1 -

4094. (0 and 4095 are reserved.) ZyWALL ATP Series Users Guide 271 Chapter 9 Interfaces Table 108 Configuration > Network > Interface > VLAN > Add / Edit (continued) LABEL DESCRIPTION This is a 3-bit field within a 802.1Q VLAN tag thats used to prioritize associated outgoing VLAN traffic. 0 is the lowest priority level and 7 is the highest. See Table 179 on page 451. The setting configured in Configuration > BWM overwrites the priority setting here. Enter a description of this interface. You can use alphanumeric and ()+/:=?!*#@$_%-

characters, and it can be up to 60 characters long. Spaces are allowed, but the string cant start with a space. Priority Code Description IP Address Assignment Get Automatically Select this if this interface is a DHCP client. In this case, the DHCP server configures the IP address, subnet mask, and gateway automatically. DHCP Option 60 Use Fixed IP Address IP Address Subnet Mask Gateway Metric Enable IGMP Support IGMP Upstream IGMP Downstream IPv6 Address Assignment Enable Stateless Address Auto-

configuration

(SLAAC) Link-Local address You should not select this if the interface is assigned to a VRRP group. DHCP Option 60 is used by the Zyxel Device for identification to the DHCP server using the VCI (Vendor Class Identifier) on the DHCP server. The Zyxel Device adds it in the initial DHCP discovery message that a DHCP client broadcasts in search of an IP address. The DHCP server can assign different IP addresses or options to clients with the specific VCI or reject the request from clients without the specific VCI. Type a string using up to 64 of these characters [a-zA-Z0-9!\"#$%&\'()*+,-./

:;<=>?@\[\\\]^_`{|}~] to identify this Zyxel Device to the DHCP server. For example, Zyxel-

TW. Select this if you want to specify the IP address, subnet mask, and gateway manually. This field is enabled if you select Use Fixed IP Address. Enter the IP address for this interface. This field is enabled if you select Use Fixed IP Address. Enter the subnet mask of this interface in dot decimal notation. The subnet mask indicates what part of the IP address is the same for all computers in the network. This field is enabled if you select Use Fixed IP Address. Enter the IP address of the gateway. The Zyxel Device sends packets to the gateway when it does not know how to route the packet to its destination. The gateway should be on the same network as the interface. Enter the priority of the gateway (if any) on this interface. The Zyxel Device decides which gateway to use based on this priority. The lower the number, the higher the priority. If two or more gateways have the same priority, the Zyxel Device uses the one that was configured first. Select this to allow the Zyxel Device to act as an IGMP proxy for hosts connected on the IGMP downstream interface. Enable IGMP Upstream on the interface which connects to a router running IGMP that is closer to the multicast server. Enable IGMP Downstream on the interface which connects to the multicast hosts. These IP address fields configure an IPv6 IP address on the interface itself. Select this to enable IPv6 stateless auto-configuration on this interface. The interface will generate an IPv6 IP address itself from a prefix obtained from an IPv6 router in the network. This displays the IPv6 link-local address and the network prefix that the Zyxel Device generates itself for the interface. ZyWALL ATP Series Users Guide 272 Chapter 9 Interfaces Table 108 Configuration > Network > Interface > VLAN > Add / Edit (continued) LABEL DESCRIPTION Enter the IPv6 address and the prefix length for this interface if you want to configure a static IP address for this interface. This field is optional. IPv6 Address/

Prefix Length Gateway Metric Address from DHCPv6 Prefix Delegation Add Edit Remove References

#

Delegated Prefix Suffix Address Address DHCPv6 Setting DHCPv6 DUID DUID as MAC The prefix length indicates what the left-most part of the IP address is the same for all computers in the network, that is, the network address. Enter the IPv6 address of the default outgoing gateway using colon (:) hexadecimal notation. Enter the priority of the gateway (if any) on this interface. The Zyxel Device decides which gateway to use based on this priority. The lower the number, the higher the priority. If two or more gateways have the same priority, the Zyxel Device uses the one that was configured first. Use this table to have the Zyxel Device obtain an IPv6 prefix from the ISP or a connected uplink router for an internal network, such as the LAN or DMZ. You have to also enter a suffix address which is appended to the delegated prefix to form an address for this interface. See Prefix Delegation on page 217 for more information. To use prefix delegation, you must:

Create at least one DHCPv6 request object before configuring this table. The external interface must be a DHCPv6 client. You must configure the DHCPv6 request options using a DHCPv6 request object with the type of prefix-delegation. Assign the prefix delegation to an internal interface and enable router advertisement on that interface. Click this to create an entry. Select an entry and click this to change the settings. Select an entry and click this to delete it from this table. Select an entry and click References to open a screen that shows which settings use the entry. See Section 9.4.4 on page 240 for an example. This field is a sequential value, and it is not associated with any entry. Select the DHCPv6 request object to use from the drop-down list. Enter the ending part of the IPv6 address, a slash (/), and the prefix length. The Zyxel Device will append it to the delegated prefix. For example, you got a delegated prefix of 2003:1234:5678/48. You want to configure an IP address of 2003:1234:5678:1111::1/128 for this interface, then enter ::1111:0:0:0:1/128 in this field. This field displays the combined IPv6 IP address for this interface. Note: This field displays the combined address after you click OK and reopen this screen. Select N/A to not use DHCPv6. Select Client to set this interface to act as a DHCPv6 client. Select Server to set this interface to act as a DHCPv6 server which assigns IP addresses and provides subnet mask, gateway, and DNS server information to clients. Select Relay to set this interface to route DHCPv6 requests to the DHCPv6 relay server you specify. The DHCPv6 server(s) may be on another network. This field displays the DHCP Unique IDentifier (DUID) of the interface, which is unique and used for identification purposes when the interface is exchanging DHCPv6 messages with others. See DHCPv6 on page 218 for more information. Select this to have the DUID generated from the interfaces default MAC address. ZyWALL ATP Series Users Guide 273 Chapter 9 Interfaces Table 108 Configuration > Network > Interface > VLAN > Add / Edit (continued) LABEL DESCRIPTION Customized DUID If you want to use a customized DUID, enter it here for the interface. Enable Rapid Commit Select this to shorten the DHCPv6 message exchange process from four to two steps. This function helps reduce heavy network traffic load. Note: Make sure you also enable this option in the DHCPv6 clients to make rapid commit work. Enter the number of seconds a DHCPv6 client should wait before refreshing information retrieved from DHCPv6. This field is available if you set this interface to DHCPv6 Client. Select this to get an IPv6 IP address for this interface from the DHCP server. Clear this to not get any IP address information through DHCPv6. If this interface is a DHCPv6 client, use this section to configure DHCPv6 request settings that determine what additional information to get from the DHCPv6 server. If this interface is a DHCPv6 server, use this section to configure DHCPv6 lease settings that determine what to offer to the DHCPv6 clients. Click this to create an entry in this table. See Section 9.4.5 on page 241 for more information. Select an entry and click this to delete it from this table. Select an entry and click References to open a screen that shows which settings use the entry. See Section 9.4.4 on page 240 for an example. This field is a sequential value, and it is not associated with any entry. This field displays the name of the DHCPv6 request or lease object. This field displays the type of the object. This field displays the IPv6 prefix that the Zyxel Device obtained from an uplink router (Server is selected) or will advertise to its clients (Client is selected). When Relay is selected, select this check box and an interface from the drop-down list if you want to use it as the relay server. When Relay is selected, select this check box and enter the IP address of a DHCPv6 server as the relay server. Information Refresh Time Request Address DHCPv6 Request Options /

DHCPv6 Lease Options Add Remove References

#

Name Type Value Interface Relay Server IPv6 Router Advertisement Setting Enable Router Advertisement Advertised Hosts Get Network Configuration From DHCPv6 Advertised Hosts Get Other Configuration From DHCPv6 Router Preference Select this to enable this interface to send router advertisement messages periodically. See IPv6 Router Advertisement on page 217 for more information. Select this to have the Zyxel Device indicate to hosts to obtain network settings (such as prefix and DNS settings) through DHCPv6. Clear this to have the Zyxel Device indicate to hosts that DHCPv6 is not available and they should use the prefix in the router advertisement message. Select this to have the Zyxel Device indicate to hosts to obtain DNS information through DHCPv6. Clear this to have the Zyxel Device indicate to hosts that DNS information is not available in this network. Select the router preference (Low, Medium or High) for the interface. The interface sends this preference in the router advertisements to tell hosts what preference they should use for the Zyxel Device. This helps hosts to choose their default router especially when there are multiple IPv6 router in the network. Note: Make sure the hosts also support router preference to make this function work. ZyWALL ATP Series Users Guide 274 Chapter 9 Interfaces Table 108 Configuration > Network > Interface > VLAN > Add / Edit (continued) LABEL MTU DESCRIPTION The Maximum Transmission Unit. Type the maximum size of each IPv6 data packet, in bytes, that can move through this interface. If a larger packet arrives, the Zyxel Device divides it into smaller fragments. Enter the maximum number of network segments that a packet can cross before reaching the destination. When forwarding an IPv6 packet, IPv6 routers are required to decrease the Hop Limit by 1 and to discard the IPv6 packet when the Hop Limit is 0. Configure this table only if you want the Zyxel Device to advertise a fixed prefix to the network. Click this to create an IPv6 prefix address. Select an entry in this table and click this to modify it. Select an entry in this table and click this to delete it. This field is a sequential value, and it is not associated with any entry. Enter the IPv6 network prefix address and the prefix length. The prefix length indicates what the left-most part of the IP address is the same for all computers in the network, that is, the network address. Use this table to configure the network prefix if you want to use a delegated prefix as the beginning part of the network prefix. Click this to create an entry in this table. Select an entry in this table and click this to modify it. Select an entry in this table and click this to delete it. Select an entry and click References to open a screen that shows which settings use the entry. See Section 9.4.4 on page 240 for an example. This field is a sequential value, and it is not associated with any entry. Select the DHCPv6 request object to use for generating the network prefix for the network. Enter the ending part of the IPv6 network address plus a slash (/) and the prefix length. The Zyxel Device will append it to the selected delegated prefix. The combined address is the network prefix for the network. For example, you got a delegated prefix of 2003:1234:5678/48. You want to divide it into 2003:1234:5678:1111/64 for this interface and 2003:1234:5678:2222/64 for another interface. You can use ::1111/64 and ::2222/64 for the suffix address respectively. But if you do not want to divide the delegated prefix into subnetworks, enter ::0/48 here, which keeps the same prefix length (/48) as the delegated prefix. This is the final network prefix combined by the delegated prefix and the suffix. Note: This field displays the combined address after you click OK and reopen this screen. Hop Limit Advertised Prefix Table Add Edit Remove

#

IPv6 Address/

Prefix Length Advertised Prefix from DHCPv6 Prefix Delegation Add Edit Remove References

#

Delegated Prefix Suffix Address Address Interface Parameters Ingress Bandwidth MTU Egress Bandwidth Enter the maximum amount of traffic, in kilobits per second, the Zyxel Device can send through the interface to the network. Allowed values are 0 - 1048576. This is reserved for future use. Enter the maximum amount of traffic, in kilobits per second, the Zyxel Device can receive from the network through the interface. Allowed values are 0 - 1048576. Maximum Transmission Unit. Type the maximum size of each data packet, in bytes, that can move through this interface. If a larger packet arrives, the Zyxel Device divides it into smaller fragments. Allowed values are 576 - 1500. Usually, this value is 1500. ZyWALL ATP Series Users Guide 275 Chapter 9 Interfaces Table 108 Configuration > Network > Interface > VLAN > Add / Edit (continued) LABEL Connectivity Check DESCRIPTION The Zyxel Device can regularly check the connection to the gateway you specified to make sure it is still available. You specify how often to check the connection, how long to wait for a response before the attempt is a failure, and how many consecutive failures are required before the Zyxel Device stops routing to the gateway. The Zyxel Device resumes routing to the gateway the first time the gateway passes the connectivity check. Select this to turn on the connection check. Enable Connectivity Check Check Method Check Period Check Timeout Check Fail Tolerance Check Default Gateway Check this address Check Port Check these addresses Probe Succeeds When DHCP Setting DHCP Relay Server 1 Relay Server 2 IP Pool Start Address Select the method that the gateway allows. Select icmp to have the Zyxel Device regularly ping the gateway you specify to make sure it is still available. Select tcp to have the Zyxel Device regularly perform a TCP handshake with the gateway you specify to make sure it is still available. Enter the number of seconds between connection check attempts. Enter the number of seconds to wait for a response before the attempt is a failure. Enter the number of consecutive failures before the Zyxel Device stops routing through the gateway. Select this to use the default gateway for the connectivity check. Select this to specify a domain name or IP address for the connectivity check. Enter that domain name or IP address in the field next to it. This field only displays when you set the Check Method to tcp. Specify the port number to use for a TCP connectivity check. Type one or two domain names or IP addresses for the connectivity check. This field applies when you specify two domain names or IP addresses for the connectivity check. Select any one if you want the check to pass if at least one of the domain names or IP addresses responds. Select all if you want the check to pass only if both domain names or IP addresses respond. The DHCP settings are available for the OPT, LAN and DMZ interfaces. Select what type of DHCP service the Zyxel Device provides to the network. Choices are:

None - the Zyxel Device does not provide any DHCP services. There is already a DHCP server on the network. DHCP Relay - the Zyxel Device routes DHCP requests to one or more DHCP servers you specify. The DHCP server(s) may be on another network. DHCP Server - the Zyxel Device assigns IP addresses and provides subnet mask, gateway, and DNS server information to the network. The Zyxel Device is the DHCP server for the network. These fields appear if the Zyxel Device is a DHCP Relay. Enter the IP address of a DHCP server for the network. This field is optional. Enter the IP address of another DHCP server for the network. These fields appear if the Zyxel Device is a DHCP Server. Enter the IP address from which the Zyxel Device begins allocating IP addresses. If you want to assign a static IP address to a specific computer, click Add Static DHCP. If this field is blank, the Pool Size must also be blank. In this case, the Zyxel Device can assign every IP address allowed by the interfaces IP address and subnet mask, except for the first address (network address), last address (broadcast address) and the interfaces IP address. ZyWALL ATP Series Users Guide 276 Chapter 9 Interfaces Table 108 Configuration > Network > Interface > VLAN > Add / Edit (continued) LABEL Pool Size First DNS Server Second DNS Server Third DNS Server First WINS Server, Second WINS Server Default Router Lease time Extended Options Add Edit Remove

#

Name Code Type Value Enable IP/MAC Binding Enable Logs for IP/MAC Binding Violation Static DHCP Table DESCRIPTION Enter the number of IP addresses to allocate. This number must be at least one and is limited by the interfaces Subnet Mask. For example, if the Subnet Mask is 255.255.255.0 and IP Pool Start Address is 10.10.10.10, the Zyxel Device can allocate 10.10.10.10 to 10.10.10.254, or 245 IP addresses. If this field is blank, the IP Pool Start Address must also be blank. In this case, the Zyxel Device can assign every IP address allowed by the interfaces IP address and subnet mask, except for the first address (network address), last address (broadcast address) and the interfaces IP address. Specify the IP addresses up to three DNS servers for the DHCP clients to use. Use one of the following ways to specify these IP addresses. Custom Defined - enter a static IP address. From ISP - select the DNS server that another interface received from its DHCP server. Zyxel Device - the DHCP clients use the IP address of this interface and the Zyxel Device works as a DNS relay. Type the IP address of the WINS (Windows Internet Naming Service) server that you want to send to the DHCP clients. The WINS server keeps a mapping table of the computer names on your network and the IP addresses that they are currently using. If you set this interface to DHCP Server, you can select to use either the interfaces IP address or another IP address as the default router. This default router will become the DHCP clients default gateway. To use another IP address as the default router, select Custom Defined and enter the IP address. Specify how long each computer can use the information (especially the IP address) before it has to request the information again. Choices are:

infinite - select this if IP addresses never expire days, hours, and minutes - select this to enter how long IP addresses are valid. The default is 2 days. This table is available if you selected DHCP server. Configure this table if you want to send more information to DHCP clients through DHCP packets. Click this to create an entry in this table. See Section 9.4.6 on page 242. Select an entry in this table and click this to modify it. Select an entry in this table and click this to delete it. This field is a sequential value, and it is not associated with any entry. This is the options name. This is the options code number. This is the options type. This is the options value. Select this option to have the Zyxel Device enforce links between specific IP addresses and specific MAC addresses for this VLAN. This stops anyone else from manually using a bound IP address on another device connected to this interface. Use this to make use only the intended users get to use specific IP addresses. Select this option to have the Zyxel Device generate a log if a device connected to this VLAN attempts to use an IP address that is bound to another devices MAC address. Configure a list of static IP addresses the Zyxel Device assigns to computers connected to the interface. Otherwise, the Zyxel Device assigns an IP address dynamically using the interfaces IP Pool Start Address and Pool Size. ZyWALL ATP Series Users Guide 277 Chapter 9 Interfaces Table 108 Configuration > Network > Interface > VLAN > Add / Edit (continued) LABEL Add Edit Remove

#

IP Address MAC Address Description RIP Setting Enable RIP Direction Send Version Receive Version V2-Broadcast OSPF Setting Area Priority Link Cost Passive Interface Authentication Text Authentication Key MD5 Authentication ID MD5 Authentication Key DESCRIPTION Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. This field is a sequential value, and it is not associated with a specific entry. Enter the IP address to assign to a device with this entrys MAC address. Enter the MAC address to which to assign this entrys IP address. Enter a description to help identify this static DHCP entry. You can use alphanumeric and

()+/:=?!*#@$_%- characters, and it can be up to 60 characters long. See Section 10.6 on page 322 for more information about RIP. Select this to enable RIP on this interface. This field is effective when RIP is enabled. Select the RIP direction from the drop-down list box. BiDir - This interface sends and receives routing information. In-Only - This interface receives routing information. Out-Only - This interface sends routing information. This field is effective when RIP is enabled. Select the RIP version(s) used for sending RIP packets. Choices are 1, 2, and 1 and 2. This field is effective when RIP is enabled. Select the RIP version(s) used for receiving RIP packets. Choices are 1, 2, and 1 and 2. This field is effective when RIP is enabled. Select this to send RIP-2 packets using subnet broadcasting; otherwise, the Zyxel Device uses multicasting. See Section 10.7 on page 324 for more information about OSPF. Select the area in which this interface belongs. Select None to disable OSPF in this interface. Enter the priority (between 0 and 255) of this interface when the area is looking for a Designated Router (DR) or Backup Designated Router (BDR). The highest-priority interface identifies the DR, and the second-highest-priority interface identifies the BDR. Set the priority to zero if the interface can not be the DR or BDR. Enter the cost (between 1 and 65,535) to route packets through this interface. Select this to stop forwarding OSPF routing information from the selected interface. As a result, this interface only receives routing information. Select an authentication method, or disable authentication. To exchange OSPF routing information with peer border routers, you must use the same authentication method that they use. Choices are:

Same-as-Area - use the default authentication method in the area None - disable authentication Text - authenticate OSPF routing information using a plain-text password MD5 - authenticate OSPF routing information using MD5 encryption This field is available if the Authentication is Text. Type the password for text authentication. The key can consist of alphanumeric characters and the underscore, and it can be up to 16 characters long. This field is available if the Authentication is MD5. Type the ID for MD5 authentication. The ID can be between 1 and 255. This field is available if the Authentication is MD5. Type the password for MD5 authentication. The password can consist of alphanumeric characters and the underscore, and it can be up to 16 characters long. ZyWALL ATP Series Users Guide 278 Chapter 9 Interfaces DESCRIPTION Table 108 Configuration > Network > Interface > VLAN > Add / Edit (continued) LABEL MAC Address Setting This section appears when Interface Properties is External or General. Have the interface use either the factory assigned default MAC address, a manually specified MAC address, or clone the MAC address of another device or computer. Select this option to have the interface use the factory assigned default MAC address. By default, the Zyxel Device uses the factory assigned MAC address to identify itself. Select this option to have the interface use a different MAC address. Either the MAC address in the field. Once it is successfully configured, the address will be copied to the configuration file. It will not change unless you change the setting or upload a different configuration file. Proxy ARP is available for external or general interfaces on the Zyxel Device. See Section on page 229 for more information on Proxy ARP. Overwrite Default MAC Address Use Default MAC Address Proxy ARP Enable Proxy ARP Select this to allow the Zyxel Device to answer external interface ARP requests on behalf of a device on its internal interface. Interfaces supported are:

Add Ethernet VLAN Bridge See Section 9.4.2 on page 238 for more information. Click Add to create an IPv4 Address, an IPv4 CIDR (for example, 192.168.1.1/24) or an IPv4 Range (for example, 192.168.1.2-192.168.1.100) as the target IP address. The Zyxel Device answers external ARP requests only if they match one of these inputted target IP addresses. For example, if the IPv4 Address is 192.168.1.5, then the Zyxel Device will answer ARP requests coming from the WAN only if it contains 192.168.1.5 as the target IP address. Select an existing entry and click Remove to delete that entry. Related Setting Configure WAN TRUNK Configure Policy Route OK Cancel Click WAN TRUNK to go to a screen where you can set this VLAN to be part of a WAN trunk for load balancing. Click Policy Route to go to the screen where you can manually configure a policy route to associate traffic with this VLAN. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving. 9.9 Bridge Interfaces This section introduces bridges and bridge interfaces and then explains the screens for bridge interfaces. ZyWALL ATP Series Users Guide 279 Chapter 9 Interfaces Bridge Overview A bridge creates a connection between two or more network segments at the layer-2 (MAC address) level. In the following example, bridge X connects four network segments. When the bridge receives a packet, the bridge records the source MAC address and the port on which it was received in a table. It also looks up the destination MAC address in the table. If the bridge knows on which port the destination MAC address is located, it sends the packet to that port. If the destination MAC address is not in the table, the bridge broadcasts the packet on every port (except the one on which it was received). In the example above, computer A sends a packet to computer B. Bridge X records the source address 0A:0A:0A:0A:0A:0A and port 2 in the table. It also looks up 0B:0B:0B:0B:0B:0B in the table. There is no entry yet, so the bridge broadcasts the packet on ports 1, 3, and 4. Table 109 Example: Bridge Table After Computer A Sends a Packet to Computer B MAC ADDRESS 0A:0A:0A:0A:0A:0A PORT 2 If computer B responds to computer A, bridge X records the source address 0B:0B:0B:0B:0B:0B and port 4 in the table. It also looks up 0A:0A:0A:0A:0A:0A in the table and sends the packet to port 2 accordingly. Table 110 Example: Bridge Table After Computer B Responds to Computer A MAC ADDRESS 0A:0A:0A:0A:0A:0A PORT 2 4 0B:0B:0B:0B:0B:0B Bridge Interface Overview A bridge interface creates a software bridge between the members of the bridge interface. It also becomes the Zyxel Devices interface for the resulting network. Unlike the device-wide bridge mode in ZyNOS-based Zyxel Devices, this Zyxel Device can bridge traffic between some interfaces while it routes traffic for other interfaces. The bridge interfaces also support more functions, like interface bandwidth parameters, DHCP settings, and connectivity check. To use the whole Zyxel Device as a transparent bridge, add all of the Zyxel Devices interfaces to a bridge interface. ZyWALL ATP Series Users Guide 280 Chapter 9 Interfaces A bridge interface may consist of the following members:

Zero or one VLAN interfaces (and any associated virtual VLAN interfaces) Any number of Ethernet interfaces (and any associated virtual Ethernet interfaces) When you create a bridge interface, the Zyxel Device removes the members entries from the routing table and adds the bridge interfaces entries to the routing table. For example, this table shows the routing table before and after you create bridge interface br0 (250.250.250.0/23) between lan1 and vlan1. Table 111 Example: Routing Table Before and After Bridge Interface br0 Is Created IP ADDRESS(ES) 210.210.210.0/24 210.211.1.0/24 221.221.221.0/24 222.222.222.0/24 230.230.230.192/26 241.241.241.241/32 242.242.242.242/32 DESTINATION lan1 lan1:1 vlan0 vlan1 wan2 dmz dmz IP ADDRESS(ES) 221.221.221.0/24 230.230.230.192/26 241.241.241.241/32 242.242.242.242/32 250.250.250.0/23 DESTINATION vlan0 wan2 dmz dmz br0 In this example, virtual Ethernet interface lan1:1 is also removed from the routing table when lan1 is added to br0. Virtual interfaces are automatically added to or remove from a bridge interface when the underlying interface is added or removed. 9.9.1 Bridge Summary This screen lists every bridge interface and virtual interface created on top of bridge interfaces. If you enabled IPv6 in the Configuration > System > IPv6 screen, you can also configure bridge interfaces used for your IPv6 network on this screen. To access this screen, click Configuration > Network > Interface >

Bridge. Figure 201 Configuration > Network > Interface > Bridge ZyWALL ATP Series Users Guide 281 Chapter 9 Interfaces Each field is described in the following table. Table 112 Configuration > Network > Interface > Bridge LABEL Configuration / IPv6 Configuration DESCRIPTION Use the Configuration section for IPv4 network settings. Use the IPv6 Configuration section for IPv6 network settings if you connect your Zyxel Device to an IPv6 network. Both sections have similar fields as described below. Click this to create a new entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. To open the screen where you can create a virtual interface, select an interface and click Create Virtual Interface. Select an entry and click References to open a screen that shows which settings use the entry. See Section 9.4.4 on page 240 for an example. This field is a sequential value, and it is not associated with any interface. This icon is lit when the entry is active and dimmed when the entry is inactive. This field displays the name of the interface. This field displays the description of the interface. This field displays the current IP address of the interface. If the IP address is 0.0.0.0, the interface does not have an IP address yet. This screen also shows whether the IP address is a static IP address (STATIC) or dynamically assigned (DHCP). IP addresses are always static in virtual interfaces. This field displays the Ethernet interfaces and VLAN interfaces in the bridge interface. It is blank for virtual interfaces. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Add Edit Remove Activate Inactivate Create Virtual Interface References

#

Status Name Description IP Address Member Apply Reset 9.9.2 Bridge Add/Edit This screen lets you configure IP address assignment, interface bandwidth parameters, DHCP settings, and connectivity check for each bridge interface. To access this screen, click the Add or Edit icon in the Bridge Summary screen. The following screen appears. ZyWALL ATP Series Users Guide 282 Chapter 9 Interfaces Figure 202 Configuration > Network > Interface > Bridge > Add / Edit ZyWALL ATP Series Users Guide 283 Chapter 9 Interfaces ZyWALL ATP Series Users Guide 284 Chapter 9 Interfaces Each field is described in the table below. DESCRIPTION Use this button to display both IPv4 and IPv6, IPv4-only, or IPv6-only configuration fields. Table 113 Configuration > Network > Interface > Bridge > Add / Edit LABEL IPv4/IPv6 View / IPv4 View / IPv6 View Show Advanced Settings / Hide Advanced Settings Create New Object Click this button to display a greater or lesser number of configuration fields. Click this button to create a DHCPv6 lease or DHCPv6 request object that you may use for the DHCPv6 settings in this screen. General Settings Enable Interface General IPv6 Setting Select this to enable this interface. Clear this to disable this interface. Enable IPv6 Select this to enable IPv6 on this interface. Otherwise, clear this to disable it. Interface Properties Interface Type Interface Name Zone Description Member Configuration Select one of the following option depending on the type of network to which the Zyxel Device is connected or if you want to additionally manually configure some related settings. internal is for connecting to a local network. Other corresponding configuration options:

DHCP server and DHCP relay. The Zyxel Device automatically adds default SNAT settings for traffic flowing from this interface to an external interface. external is for connecting to an external network (like the Internet). The Zyxel Device automatically adds this interface to the default WAN trunk. For general, the rest of the screens options do not automatically adjust and you must manually configure a policy route to add routing and SNAT settings for the interface. This field is read-only if you are editing the interface. Enter the name of the bridge interface. The format is brx, where x is 0 - 11. For example, br0, br3, and so on. Select the zone to which the interface is to belong. You use zones to apply security settings such as security policy, IDP, remote management, anti-malware, and application patrol. Enter a description of this interface. You can use alphanumeric and ()+/:=?!*#@$_%-

characters, and it can be up to 60 characters long. Spaces are allowed, but the string cant start with a space. ZyWALL ATP Series Users Guide 285 Chapter 9 Interfaces Table 113 Configuration > Network > Interface > Bridge > Add / Edit (continued) LABEL DESCRIPTION This field displays Ethernet interfaces and VLAN interfaces that can become part of the bridge interface. An interface is not available in the following situations:

Available Member IP Address Assignment Get Automatically DHCP Option 60 Use Fixed IP Address IP Address Subnet Mask Gateway Metric Enable IGMP Support IGMP Upstream IGMP Downstream IPv6 Address Assignment Enable Stateless Address Auto-

configuration

(SLAAC) Link-Local address There is a virtual interface on top of it It is already used in a different bridge interface Select one, and click the >> arrow to add it to the bridge interface. Each bridge interface can only have one VLAN interface. This field displays the interfaces that are part of the bridge interface. Select one, and click the << arrow to remove it from the bridge interface. Select this if this interface is a DHCP client. In this case, the DHCP server configures the IP address, subnet mask, and gateway automatically. DHCP Option 60 is used by the Zyxel Device for identification to the DHCP server using the VCI (Vendor Class Identifier) on the DHCP server. The Zyxel Device adds it in the initial DHCP discovery message that a DHCP client broadcasts in search of an IP address. The DHCP server can assign different IP addresses or options to clients with the specific VCI or reject the request from clients without the specific VCI. Type a string using up to 64 of these characters [a-zA-Z0-9!\"#$%&\'()*+,-./

:;<=>?@\[\\\]^_`{|}~] to identify this Zyxel Device to the DHCP server. For example, Zyxel-

TW. Select this if you want to specify the IP address, subnet mask, and gateway manually. This field is enabled if you select Use Fixed IP Address. Enter the IP address for this interface. This field is enabled if you select Use Fixed IP Address. Enter the subnet mask of this interface in dot decimal notation. The subnet mask indicates what part of the IP address is the same for all computers in the network. This field is enabled if you select Use Fixed IP Address. Enter the IP address of the gateway. The Zyxel Device sends packets to the gateway when it does not know how to route the packet to its destination. The gateway should be on the same network as the interface. Enter the priority of the gateway (if any) on this interface. The Zyxel Device decides which gateway to use based on this priority. The lower the number, the higher the priority. If two or more gateways have the same priority, the Zyxel Device uses the one that was configured first. Select this to allow the Zyxel Device to act as an IGMP proxy for hosts connected on the IGMP downstream interface. Enable IGMP Upstream on the interface which connects to a router running IGMP that is closer to the multicast server. Enable IGMP Downstream on the interface which connects to the multicast hosts. These IP address fields configure an IPv6 IP address on the interface itself. Select this to enable IPv6 stateless auto-configuration on this interface. The interface will generate an IPv6 IP address itself from a prefix obtained from an IPv6 router in the network. This displays the IPv6 link-local address and the network prefix that the Zyxel Device generates itself for the interface. ZyWALL ATP Series Users Guide 286 Chapter 9 Interfaces Table 113 Configuration > Network > Interface > Bridge > Add / Edit (continued) LABEL DESCRIPTION Enter the IPv6 address and the prefix length for this interface if you want to use a static IP address. This field is optional. IPv6 Address/

Prefix Length Gateway Metric Address from DHCPv6 Prefix Delegation Add Edit Remove References

#

Delegated Prefix Suffix Address Address DHCPv6 Setting DHCPv6 DUID DUID as MAC The prefix length indicates what the left-most part of the IP address is the same for all computers in the network, that is, the network address. Enter the IPv6 address of the default outgoing gateway using colon (:) hexadecimal notation. Enter the priority of the gateway (if any) on this interface. The Zyxel Device decides which gateway to use based on this priority. The lower the number, the higher the priority. If two or more gateways have the same priority, the Zyxel Device uses the one that was configured first. Use this table to have the Zyxel Device obtain an IPv6 prefix from the ISP or a connected uplink router for an internal network, such as the LAN or DMZ. You have to also enter a suffix address which is appended to the delegated prefix to form an address for this interface. See Prefix Delegation on page 217 for more information. To use prefix delegation, you must:

Create at least one DHCPv6 request object before configuring this table. The external interface must be a DHCPv6 client. You must configure the DHCPv6 request options using a DHCPv6 request object with the type of prefix-delegation. Assign the prefix delegation to an internal interface and enable router advertisement on that interface. Click this to create an entry. Select an entry and click this to change the settings. Select an entry and click this to delete it from this table. Select an entry and click References to open a screen that shows which settings use the entry. See Section 9.4.4 on page 240 for an example. This field is a sequential value, and it is not associated with any entry. Select the DHCPv6 request object to use from the drop-down list. Enter the ending part of the IPv6 address, a slash (/), and the prefix length. The Zyxel Device will append it to the delegated prefix. For example, you got a delegated prefix of 2003:1234:5678/48. You want to configure an IP address of 2003:1234:5678:1111:1/128 for this interface, then enter ::1111:0:0:0:1/128 in this field. This field displays the combined IPv6 IP address for this interface. Note: This field displays the combined address after you click OK and reopen this screen. Select N/A to not use DHCPv6. Select Client to set this interface to act as a DHCPv6 client. Select Server to set this interface to act as a DHCPv6 server which assigns IP addresses and provides subnet mask, gateway, and DNS server information to clients. Select Relay to set this interface to route DHCPv6 requests to the DHCPv6 relay server you specify. The DHCPv6 server(s) may be on another network. This field displays the DHCP Unique IDentifier (DUID) of the interface, which is unique and used for identification purposes when the interface is exchanging DHCPv6 messages with others. See DHCPv6 on page 218 for more information. Select this if you want the DUID is generated from the interfaces default MAC address. ZyWALL ATP Series Users Guide 287 Chapter 9 Interfaces Table 113 Configuration > Network > Interface > Bridge > Add / Edit (continued) LABEL DESCRIPTION Customized DUID If you want to use a customized DUID, enter it here for the interface. Enable Rapid Commit Select this to shorten the DHCPv6 message exchange process from four to two steps. This function helps reduce heavy network traffic load. Note: Make sure you also enable this option in the DHCPv6 clients to make rapid commit work. Enter the number of seconds a DHCPv6 client should wait before refreshing information retrieved from DHCPv6. This field is available if you set this interface to DHCPv6 Client. Select this to get an IPv6 IP address for this interface from the DHCP server. Clear this to not get any IP address information through DHCPv6. If this interface is a DHCPv6 client, use this section to configure DHCPv6 request settings that determine what additional information to get from the DHCPv6 server. If the interface is a DHCPv6 server, use this section to configure DHCPv6 lease settings that determine what to offer to the DHCPv6 clients. Click this to create an entry in this table. See Section 9.4.5 on page 241 for more information. Select an entry and click this to change the settings. Select an entry and click this to delete it from this table. Select an entry and click References to open a screen that shows which settings use the entry. See Section 9.4.4 on page 240 for an example. This field is a sequential value, and it is not associated with any entry. This field displays the name of the DHCPv6 request or lease object. This field displays the type of the object. This field displays the IPv6 prefix that the Zyxel Device obtained from an uplink router (Server is selected) or will advertise to its clients (Client is selected). When Relay is selected, select this check box and an interface from the drop-down list if you want to use it as the relay server. When Relay is selected, select this check box and enter the IP address of a DHCPv6 server as the relay server. Information Refresh Time Request Address DHCPv6 Request Options /

DHCPv6 Lease Options Add Edit Remove References

#

Name Type Value Interface Relay Server IPv6 Router Advertisement Setting Enable Router Advertisement Advertised Hosts Get Network Configuration From DHCPv6 Advertised Hosts Get Other Configuration From DHCPv6 Select this to enable this interface to send router advertisement messages periodically. See IPv6 Router Advertisement on page 217 for more information. Select this to have the Zyxel Device indicate to hosts to obtain network settings (such as prefix and DNS settings) through DHCPv6. Clear this to have the Zyxel Device indicate to hosts that DHCPv6 is not available and they should use the prefix in the router advertisement message. Select this to have the Zyxel Device indicate to hosts to obtain DNS information through DHCPv6. Clear this to have the Zyxel Device indicate to hosts that DNS information is not available in this network. ZyWALL ATP Series Users Guide 288 Chapter 9 Interfaces Table 113 Configuration > Network > Interface > Bridge > Add / Edit (continued) LABEL DESCRIPTION Select the router preference (Low, Medium or High) for the interface. The interface sends this preference in the router advertisements to tell hosts what preference they should use for the Zyxel Device. This helps hosts to choose their default router especially when there are multiple IPv6 router in the network. Router Preference MTU Hop Limit Advertised Prefix Table Add Edit Remove

#

IPv6 Address/

Prefix Length Advertised Prefix from DHCPv6 Prefix Delegation Add Edit Remove References

#

Delegated Prefix Suffix Address Address Interface Parameters Note: Make sure the hosts also support router preference to make this function work. The Maximum Transmission Unit. Type the maximum size of each IPv6 data packet, in bytes, that can move through this interface. If a larger packet arrives, the Zyxel Device divides it into smaller fragments. Enter the maximum number of network segments that a packet can cross before reaching the destination. When forwarding an IPv6 packet, IPv6 routers are required to decrease the Hop Limit by 1 and to discard the IPv6 packet when the Hop Limit is 0. Configure this table only if you want the Zyxel Device to advertise a fixed prefix to the network. Click this to create an IPv6 prefix address. Select an entry in this table and click this to modify it. Select an entry in this table and click this to delete it. This field is a sequential value, and it is not associated with any entry. Enter the IPv6 network prefix address and the prefix length. The prefix length indicates what the left-most part of the IP address is the same for all computers in the network, that is, the network address. Use this table to configure the network prefix if you want to use a delegated prefix as the beginning part of the network prefix. Click this to create an entry in this table. Select an entry in this table and click this to modify it. Select an entry in this table and click this to delete it. Select an entry and click References to open a screen that shows which settings use the entry. See Section 9.4.4 on page 240 for an example. This field is a sequential value, and it is not associated with any entry. Select the DHCPv6 request object to use for generating the network prefix for the network. Enter the ending part of the IPv6 network address plus a slash (/) and the prefix length. The Zyxel Device will append it to the selected delegated prefix. The combined address is the network prefix for the network. For example, you got a delegated prefix of 2003:1234:5678/48. You want to divide it into 2003:1234:5678:1111/64 for this interface and 2003:1234:5678:2222/64 for another interface. You can use ::1111/64 and ::2222/64 for the suffix address respectively. But if you do not want to divide the delegated prefix into subnetworks, enter ::0/48 here, which keeps the same prefix length (/48) as the delegated prefix. This is the final network prefix combined by the selected delegated prefix and the suffix. Note: This field displays the combined address after you click OK and reopen this screen. Egress Bandwidth Enter the maximum amount of traffic, in kilobits per second, the Zyxel Device can send through the interface to the network. Allowed values are 0 - 1048576. ZyWALL ATP Series Users Guide 289 Chapter 9 Interfaces Table 113 Configuration > Network > Interface > Bridge > Add / Edit (continued) LABEL DESCRIPTION This is reserved for future use. Ingress Bandwidth MTU DHCP Setting DHCP Relay Server 1 Relay Server 2 IP Pool Start Address Pool Size First DNS Server Second DNS Server Third DNS Server First WINS Server, Second WINS Server Default Router Enter the maximum amount of traffic, in kilobits per second, the Zyxel Device can receive from the network through the interface. Allowed values are 0 - 1048576. Maximum Transmission Unit. Type the maximum size of each data packet, in bytes, that can move through this interface. If a larger packet arrives, the Zyxel Device divides it into smaller fragments. Allowed values are 576 - 1500. Usually, this value is 1500. Select what type of DHCP service the Zyxel Device provides to the network. Choices are:

None - the Zyxel Device does not provide any DHCP services. There is already a DHCP server on the network. DHCP Relay - the Zyxel Device routes DHCP requests to one or more DHCP servers you specify. The DHCP server(s) may be on another network. DHCP Server - the Zyxel Device assigns IP addresses and provides subnet mask, gateway, and DNS server information to the network. The Zyxel Device is the DHCP server for the network. These fields appear if the Zyxel Device is a DHCP Relay. Enter the IP address of a DHCP server for the network. This field is optional. Enter the IP address of another DHCP server for the network. These fields appear if the Zyxel Device is a DHCP Server. Enter the IP address from which the Zyxel Device begins allocating IP addresses. If you want to assign a static IP address to a specific computer, click Add Static DHCP. If this field is blank, the Pool Size must also be blank. In this case, the Zyxel Device can assign every IP address allowed by the interfaces IP address and subnet mask, except for the first address (network address), last address (broadcast address) and the interfaces IP address. Enter the number of IP addresses to allocate. This number must be at least one and is limited by the interfaces Subnet Mask. For example, if the Subnet Mask is 255.255.255.0 and IP Pool Start Address is 10.10.10.10, the Zyxel Device can allocate 10.10.10.10 to 10.10.10.254, or 245 IP addresses. If this field is blank, the IP Pool Start Address must also be blank. In this case, the Zyxel Device can assign every IP address allowed by the interfaces IP address and subnet mask, except for the first address (network address), last address (broadcast address) and the interfaces IP address. Specify the IP addresses up to three DNS servers for the DHCP clients to use. Use one of the following ways to specify these IP addresses. Custom Defined - enter a static IP address. From ISP - select the DNS server that another interface received from its DHCP server. Zyxel Device - the DHCP clients use the IP address of this interface and the Zyxel Device works as a DNS relay. Type the IP address of the WINS (Windows Internet Naming Service) server that you want to send to the DHCP clients. The WINS server keeps a mapping table of the computer names on your network and the IP addresses that they are currently using. If you set this interface to DHCP Server, you can select to use either the interfaces IP address or another IP address as the default router. This default router will become the DHCP clients default gateway. To use another IP address as the default router, select Custom Defined and enter the IP address. ZyWALL ATP Series Users Guide 290 Chapter 9 Interfaces Table 113 Configuration > Network > Interface > Bridge > Add / Edit (continued) LABEL Lease time Extended Options Add Edit Remove

#

Name Code Type Value PXE Server PXE Boot Loader File Enable IP/MAC Binding Enable Logs for IP/MAC Binding Violation Static DHCP Table Add Edit Remove

#

IP Address MAC Address Description DESCRIPTION Specify how long each computer can use the information (especially the IP address) before it has to request the information again. Choices are:

infinite - select this if IP addresses never expire days, hours, and minutes - select this to enter how long IP addresses are valid. This table is available if you selected DHCP server. Configure this table if you want to send more information to DHCP clients through DHCP packets. Click this to create an entry in this table. See Section 9.4.6 on page 242. Select an entry in this table and click this to modify it. Select an entry in this table and click this to delete it. This field is a sequential value, and it is not associated with any entry. This is the options name. This is the options code number. This is the options type. This is the options value. PXE (Preboot eXecution Environment) allows a client computer to use the network to boot up and install an operating system via a PXE-capable Network Interface Card (NIC). PXE is available for computers on internal interfaces to allow them to boot up using boot software on a PXE server. The Zyxel Device acts as an intermediary between the PXE server and the computers that need boot software. The PXE server must have a public IPv4 address. You must enable DHCP Server on the Zyxel Device so that it can receive information from the PXE server. A boot loader is a computer program that loads the operating system for the computer. Type the exact file name of the boot loader software file, including filename extension, that is on the PXE server. If the wrong filename is typed, then the client computers cannot boot. Select this option to have this interface enforce links between specific IP addresses and specific MAC addresses. This stops anyone else from manually using a bound IP address on another device connected to this interface. Use this to make use only the intended users get to use specific IP addresses. Select this option to have the Zyxel Device generate a log if a device connected to this interface attempts to use an IP address that is bound to another devices MAC address. Configure a list of static IP addresses the Zyxel Device assigns to computers connected to the interface. Otherwise, the Zyxel Device assigns an IP address dynamically using the interfaces IP Pool Start Address and Pool Size. Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. This field is a sequential value, and it is not associated with a specific entry. Enter the IP address to assign to a device with this entrys MAC address. Enter the MAC address to which to assign this entrys IP address. Enter a description to help identify this static DHCP entry. You can use alphanumeric and

()+/:=?!*#@$_%- characters, and it can be up to 60 characters long. ZyWALL ATP Series Users Guide 291 Chapter 9 Interfaces Table 113 Configuration > Network > Interface > Bridge > Add / Edit (continued) LABEL Connectivity Check DESCRIPTION The interface can regularly check the connection to the gateway you specified to make sure it is still available. You specify how often the interface checks the connection, how long to wait for a response before the attempt is a failure, and how many consecutive failures are required before the Zyxel Device stops routing to the gateway. The Zyxel Device resumes routing to the gateway the first time the gateway passes the connectivity check. Select this to turn on the connection check. Enable Connectivity Check Check Method Check Period Check Timeout Check Fail Tolerance Check Default Gateway Check this address Check Port Check these addresses Probe Succeeds When Proxy ARP Select the method that the gateway allows. Select icmp to have the Zyxel Device regularly ping the gateway you specify to make sure it is still available. Select tcp to have the Zyxel Device regularly perform a TCP handshake with the gateway you specify to make sure it is still available. Enter the number of seconds between connection check attempts. Enter the number of seconds to wait for a response before the attempt is a failure. Enter the number of consecutive failures before the Zyxel Device stops routing through the gateway. Select this to use the default gateway for the connectivity check. Select this to specify a domain name or IP address for the connectivity check. Enter that domain name or IP address in the field next to it. This field only displays when you set the Check Method to tcp. Specify the port number to use for a TCP connectivity check. Type one or two domain names or IP addresses for the connectivity check. This field applies when you specify two domain names or IP addresses for the connectivity check. Select any one if you want the check to pass if at least one of the domain names or IP addresses responds. Select all if you want the check to pass only if both domain names or IP addresses respond. Proxy ARP is available for external or general interfaces on the Zyxel Device. See Section on page 229 for more information on Proxy ARP. Enable Proxy ARP Select this to allow the Zyxel Device to answer external interface ARP requests on behalf of a device on its internal interface. Interfaces supported are:

Add Ethernet VLAN Bridge See Section 9.4.2 on page 238 for more information. Click Add to create an IPv4 Address, an IPv4 CIDR (for example, 192.168.1.1/24) or an IPv4 Range (for example, 192.168.1.2-192.168.1.100) as the target IP address. The Zyxel Device answers external ARP requests only if they match one of these inputted target IP addresses. For example, if the IPv4 Address is 192.168.1.5, then the Zyxel Device will answer ARP requests coming from the WAN only if it contains 192.168.1.5 as the target IP address. Select an existing entry and click Remove to delete that entry. ZyWALL ATP Series Users Guide 292 Chapter 9 Interfaces Table 113 Configuration > Network > Interface > Bridge > Add / Edit (continued) LABEL Related Setting DESCRIPTION Configure WAN TRUNK Configure Policy Route OK Cancel Click WAN TRUNK to go to a screen where you can configure the interface as part of a WAN trunk for load balancing. Click Policy Route to go to the screen where you can manually configure a policy route to associate traffic with this bridge interface. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving. 9.10 VTI IPSec VPN Tunnel Interface (VTI) encrypts or decrypts IPv4 traffic from or to the interface according to the IP routing table. VTI allows static routes to send traffic over the VPN. The IPSec tunnel endpoint is associated with an actual (virtual) interface. Therefore many interface capabilities such as Policy Route, Static Route, Trunk, and BWM can be applied to the IPSec tunnel as soon as the tunnel is active IPSec VTI simplifies network management and load balancing. Create a trunk using VPN tunnel interfaces for load balancing. In the following example configure VPN tunnels with static IP addresses or DNS on both Zyxel Devices (or IPSec routers at the end of the tunnel). Also configure VTI and a trunk on both Zyxel Devices. Figure 203 VTI and Trunk for VPN Load Balancing 9.10.1 Restrictions for IPSec Virtual Tunnel Interface IPv4 traffic only IPSec tunnel mode only. A shared keyword must not be configured when using tunnel mode. With a VTI VPN you do not add local or remote LANs to your VPN configuration. For a VTI VPN you should only have one local and one remote WAN. A dynamic peer is not supported The IPSec VTI is limited to IP unicast and multicast traffic only. ZyWALL ATP Series Users Guide 293 Chapter 9 Interfaces 9.10.2 VTI Screen To access this screen, click Configuration > Network > Interface > VTI. Figure 204 Configuration > Network > Interface > VTI The following table describes the fields in this screen. Table 114 Configuration > Network > Interface > VTI LABEL Configuration Add Edit DESCRIPTION Click this to create a new entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. Select an entry and click References to open a screen that shows which settings use the entry. This field is a sequential value, and it is not associated with any interface. This icon is lit when the entry is active and dimmed when the entry is inactive. This field displays the name of the VTI interface. This field displays the current IP address of the virtual interface and subnet mask in bits. If the IP address is 0.0.0.0, the interface does not have an IP address yet. This shows the name of the associated IPSec VPN rule with VPN Tunnel Interface application scenario. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Remove Activate Inactivate References

#

Status Name IP Address vpn-rule Apply Reset 9.10.3 VTI Add/Edit This screen lets you configure IP address assignment and interface parameters for VTI. Note: You should have created a VPN tunnel for a VPN Tunnel Interface scenario first. To access this screen, click the Add or Edit icon in Network > Interface > VTI. The following screen appears. ZyWALL ATP Series Users Guide 294 Chapter 9 Interfaces Figure 205 Configuration > Network > Interface > VTI > Add Each field is described in the table below. Table 115 Configuration > Network > Interface > VTI > Add LABEL General Settings DESCRIPTION Enable Select this to enable VTI. Clear this to disable it. Interface Properties Interface Name This field is read-only if you are editing an existing VPN tunnel interface. For a new VPN tunnel interface, enter the name of the VPN tunnel interface in vtix format, where x is a number from 0 to the maximum number of VPN connections allowed for this model. For example, enter vti10. ZyWALL ATP Series Users Guide 295 Chapter 9 Interfaces Table 115 Configuration > Network > Interface > VTI > Add (continued) LABEL DESCRIPTION Select a zone. Make sure that the zone you select does not have traffic blocked by a security feature such as a security policy. You should have created a VPN tunnel first for a VPN Tunnel Interface scenario. Select one of the VPN Tunnel Interface scenario rules that you created. Enter the IP address for this interface. Enter the subnet mask of this interface in dot decimal notation. The subnet mask indicates what part of the IP address is the same for all computers in the network. Enter the priority of the gateway (if any) on this interface. The Zyxel Device decides which gateway to use based on this priority. The lower the number, the higher the priority. If two or more gateways have the same priority, the Zyxel Device uses the one that was configured first. Select this to allow the Zyxel Device to act as an IGMP proxy for hosts connected on the IGMP downstream interface. Enable IGMP Upstream on the interface which connects to a router running IGMP that is closer to the multicast server. Enable IGMP Downstream on the interface which connects to the multicast hosts. Egress Bandwidth Enter the maximum amount of traffic, in kilobits per second, the Zyxel Device can send through the interface to the network. Allowed values are 0 - 1048576. This is reserved for future use. Enter the maximum amount of traffic, in kilobits per second, the Zyxel Device can receive from the network through the interface. Allowed values are 0 - 1048576. These fields appear when you select a vpn-rule. The interface can regularly check the connection to the gateway you specified to make sure it is still available. You specify how often the interface checks the connection, how long to wait for a response before the attempt is a failure, and how many consecutive failures are required before the Zyxel Device stops routing to the gateway. The Zyxel Device resumes routing to the gateway the first time the gateway passes the connectivity check. Select this to turn on the connection check. Select the method that the gateway allows. Select icmp to have the Zyxel Device regularly ping the gateway you specify to make sure it is still available. Select tcp to have the Zyxel Device regularly perform a TCP handshake with the gateway you specify to make sure it is still available. Enter the number of seconds between connection check attempts. Enter the number of seconds to wait for a response before the attempt is a failure. Enter the number of consecutive failures before the Zyxel Device stops routing through the gateway. Select this to specify a domain name or IP address for the connectivity check. Enter that domain name or IP address in the field next to it. This field only displays when you set the Check Method to tcp. Specify the port number to use for a TCP connectivity check. See Section 10.6 on page 322 for more information about RIP. ZyWALL ATP Series Users Guide 296 Zone vpn-rule IP Address Assignment IP Address Subnet Mask Metric Enable IGMP Support IGMP Upstream IGMP Downstream Interface Parameters Ingress Bandwidth Connectivity Check Enable Connectivity Check Check Method Check Period Check Timeout Check Fail Tolerance Check this address Check Port RIP Setting Chapter 9 Interfaces Table 115 Configuration > Network > Interface > VTI > Add (continued) LABEL Enable RIP Direction Send Version Receive Version V2-Broadcast OSPF Setting Area Priority Link Cost Passive Interface Authentication Text Authentication Key MD5 Authentication ID MD5 Authentication Key Related Setting Configure WAN TRUNK Configure Policy Route OK Cancel DESCRIPTION Select this to enable RIP in this interface. This field is effective when RIP is enabled. Select the RIP direction from the drop-down list box. BiDir - This interface sends and receives routing information. In-Only - This interface receives routing information. Out-Only - This interface sends routing information. This field is effective when RIP is enabled. Select the RIP version(s) used for sending RIP packets. Choices are 1, 2, and 1 and 2. This field is effective when RIP is enabled. Select the RIP version(s) used for receiving RIP packets. Choices are 1, 2, and 1 and 2. This field is effective when RIP is enabled. Select this to send RIP-2 packets using subnet broadcasting; otherwise, the Zyxel Device uses multicasting. See Section 10.7 on page 324 for more information about OSPF. Select the area in which this interface belongs. Select None to disable OSPF in this interface. Enter the priority (between 0 and 255) of this interface when the area is looking for a Designated Router (DR) or Backup Designated Router (BDR). The highest-priority interface identifies the DR, and the second-highest-priority interface identifies the BDR. Set the priority to zero if the interface can not be the DR or BDR. Enter the cost (between 1 and 65,535) to route packets through this interface. Select this to stop forwarding OSPF routing information from the selected interface. As a result, this interface only receives routing information. Select an authentication method, or disable authentication. To exchange OSPF routing information with peer border routers, you must use the same authentication method that they use. Choices are:

Same-as-Area - use the default authentication method in the area None - disable authentication Text - authenticate OSPF routing information using a plain-text password MD5 - authenticate OSPF routing information using MD5 encryption This field is available if the Authentication is Text. Type the password for text authentication. The key can consist of alphanumeric characters and the underscore, and it can be up to 16 characters long. This field is available if the Authentication is MD5. Type the ID for MD5 authentication. The ID can be between 1 and 255. This field is available if the Authentication is MD5. Type the password for MD5 authentication. The password can consist of alphanumeric characters and the underscore, and it can be up to 16 characters long. Click WAN TRUNK to go to a screen where you can configure the interface as part of a WAN trunk for load balancing. Click Policy Route to go to the screen where you can manually configure a policy route to associate traffic with this bridge interface. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving. ZyWALL ATP Series Users Guide 297 Chapter 9 Interfaces 9.11 Trunk Overview Use trunks for WAN traffic load balancing to increase overall network throughput and reliability. Load balancing divides traffic loads between multiple interfaces. This allows you to improve quality of service and maximize bandwidth utilization for multiple ISP links. Maybe you have two Internet connections with different bandwidths. You could set up a trunk that uses spillover or weighted round robin load balancing so time-sensitive traffic (like video) usually goes through the higher-bandwidth interface. For other traffic, you might want to use least load first load balancing to even out the distribution of the traffic load. Suppose ISP A has better connections to Europe while ISP B has better connections to Australia. You could use policy routes and trunks to have traffic for your European branch office primarily use ISP A and traffic for your Australian branch office primarily use ISP B. Or maybe one of the Zyxel Device's interfaces is connected to an ISP that is also your Voice over IP

(VoIP) service provider. You can use policy routing to send the VoIP traffic through a trunk with the interface connected to the VoIP service provider set to active and another interface (connected to another ISP) set to passive. This way VoIP traffic goes through the interface connected to the VoIP service provider whenever the interfaces connection is up. Use the Trunk summary screen (Section 9.12 on page 301) to view the list of configured trunks and which load balancing algorithm each trunk uses. Use the Add Trunk screen (Section 9.12.1 on page 302) to configure the member interfaces for a trunk and the load balancing algorithm the trunk uses. Use the Add System Default screen (Section 9.12.2 on page 304) to configure the load balancing algorithm for the system default trunk. 9.11.1 What You Need to Know Add WAN interfaces to trunks to have multiple connections share the traffic load. If one WAN interfaces connection goes down, the Zyxel Device sends traffic through another member of the trunk. For example, you connect one WAN interface to one ISP and connect a second WAN interface to a second ISP. The Zyxel Device balances the WAN traffic load between the connections. If one interface's connection goes down, the Zyxel Device can automatically send its traffic through another interface. You can also use trunks with policy routing to send specific traffic types through the best WAN interface for that type of traffic. If that interfaces connection goes down, the Zyxel Device can still send its traffic through another interface. You can define multiple trunks for the same physical interfaces. 1 2 3 LAN user A logs into server B on the Internet. The Zyxel Device uses wan1 to send the request to server B. The Zyxel Device is using active/active load balancing. So when LAN user A tries to access something on the server, the request goes out through wan2. The server finds that the request comes from wan2s IP address instead of wan1s IP address and rejects the request. ZyWALL ATP Series Users Guide 298 Chapter 9 Interfaces If link sticking had been configured, the Zyxel Device would have still used wan1 to send LAN user As request to the server and server would have given the user A access. Load Balancing Algorithms The following sections describe the load balancing algorithms the Zyxel Device can use to decide which interface the traffic (from the LAN) should use for a session. In the load balancing section, a session may refer to normal connection-oriented, UDP or SNMP2 traffic. The available bandwidth you configure on the Zyxel Device refers to the actual bandwidth provided by the ISP and the measured bandwidth refers to the bandwidth an interface is currently using. Least Load First The least load first algorithm uses the current (or recent) outbound bandwidth utilization of each trunk member interface as the load balancing index(es) when making decisions about to which interface a new session is to be distributed. The outbound bandwidth utilization is defined as the measured outbound throughput over the available outbound bandwidth. Here the Zyxel Device has two WAN interfaces connected to the Internet. The configured available outbound bandwidths for WAN 1 and WAN 2 are 512K and 256K respectively. Figure 206 Load Balancing Least Load First Example The outbound bandwidth utilization is used as the load balancing index. In this example, the measured

(current) outbound throughput of WAN 1 is 412K and WAN 2 is 198K. The Zyxel Device calculates the load balancing index as shown in the table below. Since WAN 2 has a smaller load balancing index (meaning that it is less utilized than WAN 1), the Zyxel Device will send the subsequent new session traffic through WAN 2. Table 116 Least Load First Example INTERFACE WAN 1 WAN 2 OUTBOUND AVAILABLE (A) 512 K 256 K Weighted Round Robin MEASURED (M) 412 K 198 K LOAD BALANCING INDEX

(M/A) 0.8 0.77 Round Robin scheduling services queues on a rotating basis and is activated only when an interface has more traffic than it can handle. A queue is given an amount of bandwidth irrespective of the incoming ZyWALL ATP Series Users Guide 299 Chapter 9 Interfaces traffic on that interface. This queue then moves to the back of the list. The next queue is given an equal amount of bandwidth, and then moves to the end of the list; and so on, depending on the number of queues being used. This works in a looping fashion until a queue is empty. The Weighted Round Robin (WRR) algorithm is best suited for situations when the bandwidths set for the two WAN interfaces are different. Similar to the Round Robin (RR) algorithm, the Weighted Round Robin

(WRR) algorithm sets the Zyxel Device to send traffic through each WAN interface in turn. In addition, the WAN interfaces are assigned weights. An interface with a larger weight gets more chances to transmit traffic than an interface with a smaller weight. For example, in the figure below, the configured available bandwidth of WAN1 is 1M and WAN2 is 512K. You can set the Zyxel Device to distribute the network traffic between the two interfaces by setting the weight of wan1 and wan2 to 2 and 1 respectively. The Zyxel Device assigns the traffic of two sessions to wan1 and one session's traffic to wan2 in each round of 3 new sessions. Figure 207 Weighted Round Robin Algorithm Example Spillover The spillover load balancing algorithm sends network traffic to the first interface in the trunk member list until the interfaces maximum allowable load is reached, then sends the excess network traffic of new sessions to the next interface in the trunk member list. This continues as long as there are more member interfaces and traffic to be sent through them. Suppose the first trunk member interface uses an unlimited access Internet connection and the second is billed by usage. Spillover load balancing only uses the second interface when the traffic load exceeds the threshold on the first interface. This fully utilizes the bandwidth of the first interface to reduce Internet usage fees and avoid overloading the interface. In this example figure, the upper threshold of the first interface is set to 800K. The Zyxel Device sends network traffic of new sessions that exceed this limit to the secondary WAN interface. Figure 208 Spillover Algorithm Example ZyWALL ATP Series Users Guide 300 Chapter 9 Interfaces 9.12 The Trunk Summary Screen Click Configuration > Network > Interface > Trunk to open the Trunk screen. The Trunk Summary screen lists the configured trunks and the load balancing algorithm that each is configured to use. Figure 209 Configuration > Network > Interface > Trunk The following table describes the items in this screen. Table 117 Configuration > Network > Interface > Trunk LABEL Show Advanced Settings / Hide Advanced Settings Configuration DESCRIPTION Click this button to display a greater or lesser number of configuration fields. Disconnect Connections Before Falling Back Enable Default SNAT Default Trunk Selection Configure what to do with existing passive mode interface connections when an interface set to active mode in the same trunk comes back up. Select this to terminate existing connections on an interface which is set to passive mode when any interface set to active mode in the same trunk comes back up. Select this to have the Zyxel Device use the IP address of the outgoing interface as the source IP address of the packets it sends out through its WAN trunks. The Zyxel Device automatically adds SNAT settings for traffic it routes from internal interfaces to external interfaces. Select whether the Zyxel Device is to use the default system WAN trunk or one of the user configured WAN trunks as the default trunk for routing traffic from internal interfaces to external interfaces. ZyWALL ATP Series Users Guide 301 Chapter 9 Interfaces Table 117 Configuration > Network > Interface > Trunk (continued) LABEL User Configuration /

System Default DESCRIPTION The Zyxel Device automatically adds all external interfaces into the pre-configured system default SYSTEM_DEFAULT_WAN_TRUNK. You cannot delete it. You can create your own User Configuration trunks and customize the algorithm, member interfaces and the active/passive mode. Click this to create a new user-configured trunk. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove a user-configured trunk, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Select an entry and click References to open a screen that shows which settings use the entry. See Section 9.4.4 on page 240 for an example. This field is a sequential value, and it is not associated with any interface. This field displays the label that you specified to identify the trunk. This field displays the load balancing method the trunk is set to use. Click this button to save your changes to the Zyxel Device. Click this button to return the screen to its last-saved settings. Add Edit Remove References

#

Name Algorithm Apply Reset 9.12.1 Configuring a User-Defined Trunk Click Configuration > Network > Interface > Trunk, in the User Configuration table click the Add (or Edit) icon to open the following screen. Use this screen to create or edit a WAN trunk entry. Figure 210 Configuration > Network > Interface > Trunk > Add (or Edit) ZyWALL ATP Series Users Guide 302 Chapter 9 Interfaces Each field is described in the table below. Table 118 Configuration > Network > Interface > Trunk > Add (or Edit) LABEL Name Load Balancing Algorithm Load Balancing Index(es) Add Edit Remove Move

#

Member Mode Weight DESCRIPTION This is read-only if you are editing an existing trunk. When adding a new trunk, enter a descriptive name for this trunk. You may use 1-31 alphanumeric characters, underscores

(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Select a load balancing method to use from the drop-down list box. Select Weighted Round Robin to balance the traffic load between interfaces based on their respective weights. An interface with a larger weight gets more chances to transmit traffic than an interface with a smaller weight. For example, if the weight ratio of wan1 and wan2 interfaces is 2:1, the Zyxel Device chooses wan1 for 2 sessions traffic and wan2 for 1 sessions traffic in each round of 3 new sessions. Select Least Load First to send new session traffic through the least utilized trunk member. Select Spillover to send network traffic through the first interface in the group member list until there is enough traffic that the second interface needs to be used (and so on). This field is available if you selected to use the Least Load First or Spillover method. Select Outbound, Inbound, or Outbound + Inbound to set the traffic to which the Zyxel Device applies the load balancing method. Outbound means the traffic traveling from an internal interface (ex. LAN) to an external interface (ex. WAN). Inbound means the opposite. The table lists the trunks member interfaces. You can add, edit, remove, or move entries for user configured trunks. Click this to add a member interface to the trunk. Select an interface and click Add to add a new member interface after the selected member interface. Select an entry and click Edit to modify the entrys settings. To remove a member interface, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. To move an interface to a different number in the list, click the Move icon. In the field that appears, specify the number to which you want to move the interface. This column displays the priorities of the groups interfaces. The order of the interfaces in the list is important since they are used in the order they are listed. Click this table cell and select an interface to be a group member. If you select an interface that is part of another Ethernet interface, the Zyxel Device does not send traffic through the interface as part of the trunk. For example, if you have physical port 5 in the ge2 representative interface, you must select interface ge2 in order to send traffic through port 5 as part of the trunk. If you select interface ge5 as a member here, the Zyxel Device will not send traffic through port 5 as part of the trunk. Click this table cell and select Active to have the Zyxel Device always attempt to use this connection. Select Passive to have the Zyxel Device only use this connection when all of the connections set to active are down. You can only set one of a groups interfaces to passive mode. This field displays with the weighted round robin load balancing algorithm. Specify the weight (1~10) for the interface. The weights of the different member interfaces form a ratio. This ratio determines how much traffic the Zyxel Device assigns to each member interface. The higher an interfaces weight is (relative to the weights of the interfaces), the more sessions that interface should handle. ZyWALL ATP Series Users Guide 303 Chapter 9 Interfaces Table 118 Configuration > Network > Interface > Trunk > Add (or Edit) (continued) LABEL Ingress Bandwidth DESCRIPTION This is reserved for future use. This field displays with the least load first load balancing algorithm. It displays the maximum number of kilobits of data the Zyxel Device is to allow to come in through the interface per second. Note: You can configure the bandwidth of an interface in the corresponding interface edit screen. Egress Bandwidth This field displays with the least load first or spillover load balancing algorithm. It displays the maximum number of kilobits of data the Zyxel Device is to send out through the interface per second. Spillover OK Cancel Note: You can configure the bandwidth of an interface in the corresponding interface edit screen. This field displays with the spillover load balancing algorithm. Specify the maximum bandwidth of traffic in kilobits per second (1~1048576) to send out through the interface before using another interface. When this spillover bandwidth limit is exceeded, the Zyxel Device sends new session traffic through the next interface. The traffic of existing sessions still goes through the interface on which they started. The Zyxel Device uses the group member interfaces in the order that they are listed. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving. 9.12.2 Configuring the System Default Trunk In the Configuration > Network > Interface > Trunk screen and the System Default section, select the default trunk entry and click Edit to open the following screen. Use this screen to change the load balancing algorithm and view the bandwidth allocations for each member interface. Note: The available bandwidth is allocated to each member interface equally and is not allowed to be changed for the default trunk. Figure 211 Configuration > Network > Interface > Trunk > Edit (System Default) ZyWALL ATP Series Users Guide 304 Chapter 9 Interfaces Each field is described in the table below. Table 119 Configuration > Network > Interface > Trunk > Edit (System Default) LABEL Name Load Balancing Algorithm DESCRIPTION This field displays the name of the selected system default trunk. Select the load balancing method to use for the trunk. Select Weighted Round Robin to balance the traffic load between interfaces based on their respective weights. An interface with a larger weight gets more chances to transmit traffic than an interface with a smaller weight. For example, if the weight ratio of wan1 and wan2 interfaces is 2:1, the Zyxel Device chooses wan1 for 2 sessions traffic and wan2 for 1 sessions traffic in each round of 3 new sessions. Select Least Load First to send new session traffic through the least utilized trunk member. Select Spillover to send network traffic through the first interface in the group member list until there is enough traffic that the second interface needs to be used (and so on). The table lists the trunks member interfaces. This table is read-only. This column displays the priorities of the groups interfaces. The order of the interfaces in the list is important since they are used in the order they are listed. This column displays the name of the member interfaces. This field displays Active if the Zyxel Device always attempt to use this connection. This field displays Passive if the Zyxel Device only use this connection when all of the connections set to active are down. Only one of a groups interfaces can be set to passive mode. This field displays with the weighted round robin load balancing algorithm. Specify the weight (1~10) for the interface. The weights of the different member interfaces form a ratio. s This is reserved for future use. This field displays with the least load first load balancing algorithm. It displays the maximum number of kilobits of data the Zyxel Device is to allow to come in through the interface per second. This field displays with the least load first or spillover load balancing algorithm. It displays the maximum number of kilobits of data the Zyxel Device is to send out through the interface per second. This field displays with the spillover load balancing algorithm. Specify the maximum bandwidth of traffic in kilobits per second (1~1048576) to send out through the interface before using another interface. When this spillover bandwidth limit is exceeded, the Zyxel Device sends new session traffic through the next interface. The traffic of existing sessions still goes through the interface on which they started. The Zyxel Device uses the group member interfaces in the order that they are listed. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving.

#

Member Mode Weight Ingress Bandwidth Egress Bandwidth Spillover OK Cancel 9.13 Interface Technical Reference Here is more detailed information about interfaces on the Zyxel Device. ZyWALL ATP Series Users Guide 305 Chapter 9 Interfaces IP Address Assignment Most interfaces have an IP address and a subnet mask. This information is used to create an entry in the routing table. Figure 212 Example: Entry in the Routing Table Derived from Interfaces lan1 wan1 Table 120 Example: Routing Table Entries for Interfaces IP ADDRESS(ES) 100.100.1.1/16 200.200.200.1/24 DESTINATION lan1 wan1 For example, if the Zyxel Device gets a packet with a destination address of 100.100.25.25, it routes the packet to interface lan1. If the Zyxel Device gets a packet with a destination address of 200.200.200.200, it routes the packet to interface wan1. In most interfaces, you can enter the IP address and subnet mask manually. In PPPoE/PPTP/L2TP interfaces, however, the subnet mask is always 255.255.255.255 because it is a point-to-point interface. For these interfaces, you can only enter the IP address. In many interfaces, you can also let the IP address and subnet mask be assigned by an external DHCP server on the network. In this case, the interface is a DHCP client. Virtual interfaces, however, cannot be DHCP clients. You have to assign the IP address and subnet mask manually. In general, the IP address and subnet mask of each interface should not overlap, though it is possible for this to happen with DHCP clients. In the example above, if the Zyxel Device gets a packet with a destination address of 5.5.5.5, it might not find any entries in the routing table. In this case, the packet is dropped. However, if there is a default router to which the Zyxel Device should send this packet, you can specify it as a gateway in one of the interfaces. For example, if there is a default router at 200.200.200.100, you can create a gateway at 200.200.200.100 on ge2. In this case, the Zyxel Device creates the following entry in the routing table. Table 121 Example: Routing Table Entry for a Gateway IP ADDRESS(ES) 0.0.0.0/0 DESTINATION 200.200.200.100 The gateway is an optional setting for each interface. If there is more than one gateway, the Zyxel Device uses the gateway with the lowest metric, or cost. If two or more gateways have the same metric, the Zyxel Device uses the one that was set up first (the first entry in the routing table). In PPPoE/PPTP/L2TP interfaces, the other computer is the gateway for the interface by default. In this case, you should specify the metric. ZyWALL ATP Series Users Guide 306 Chapter 9 Interfaces If the interface gets its IP address and subnet mask from a DHCP server, the DHCP server also specifies the gateway, if any. Interface Parameters The Zyxel Device restricts the amount of traffic into and out of the Zyxel Device through each interface. Egress bandwidth sets the amount of traffic the Zyxel Device sends out through the interface to the network. Ingress bandwidth sets the amount of traffic the Zyxel Device allows in through the interface from the network.At the time of writing, the Zyxel Device does not support ingress bandwidth management. If you set the bandwidth restrictions very high, you effectively remove the restrictions. The Zyxel Device also restricts the size of each data packet. The maximum number of bytes in each packet is called the maximum transmission unit (MTU). If a packet is larger than the MTU, the Zyxel Device divides it into smaller fragments. Each fragment is sent separately, and the original packet is re-

assembled later. The smaller the MTU, the more fragments sent, and the more work required to re-

assemble packets correctly. On the other hand, some communication channels, such as Ethernet over ATM, might not be able to handle large data packets. DHCP Settings Dynamic Host Configuration Protocol (DHCP, RFC 2131, RFC 2132) provides a way to automatically set up and maintain IP addresses, subnet masks, gateways, and some network information (such as the IP addresses of DNS servers) on computers in the network. This reduces the amount of manual configuration you have to do and usually uses available IP addresses more efficiently. In DHCP, every network has at least one DHCP server. When a computer (a DHCP client) joins the network, it submits a DHCP request. The DHCP servers get the request; assign an IP address; and provide the IP address, subnet mask, gateway, and available network information to the DHCP client. When the DHCP client leaves the network, the DHCP servers can assign its IP address to another DHCP client. In the Zyxel Device, some interfaces can provide DHCP services to the network. In this case, the interface can be a DHCP relay or a DHCP server. As a DHCP relay, the interface routes DHCP requests to DHCP servers on different networks. You can specify more than one DHCP server. If you do, the interface routes DHCP requests to all of them. It is possible for an interface to be a DHCP relay and a DHCP client simultaneously. As a DHCP server, the interface provides the following information to DHCP clients. ZyWALL ATP Series Users Guide 307 Chapter 9 Interfaces IP address - If the DHCP clients MAC address is in the Zyxel Devices static DHCP table, the interface assigns the corresponding IP address. If not, the interface assigns IP addresses from a pool, defined by the starting address of the pool and the pool size. Table 122 Example: Assigning IP Addresses from a Pool START IP ADDRESS 50.50.50.33 75.75.75.1 99.99.1.1 120.120.120.100 POOL SIZE 5 200 1023 100 RANGE OF ASSIGNED IP ADDRESS 50.50.50.33 - 50.50.50.37 75.75.75.1 - 75.75.75.200 99.99.1.1 - 99.99.4.255 120.120.120.100 - 120.120.120.199 The Zyxel Device cannot assign the first address (network address) or the last address (broadcast address) in the subnet defined by the interfaces IP address and subnet mask. For example, in the first entry, if the subnet mask is 255.255.255.0, the Zyxel Device cannot assign 50.50.50.0 or 50.50.50.255. If the subnet mask is 255.255.0.0, the Zyxel Device cannot assign 50.50.0.0 or 50.50.255.255. Otherwise, it can assign every IP address in the range, except the interfaces IP address. If you do not specify the starting address or the pool size, the interface the maximum range of IP addresses allowed by the interfaces IP address and subnet mask. For example, if the interfaces IP address is 9.9.9.1 and subnet mask is 255.255.255.0, the starting IP address in the pool is 9.9.9.2, and the pool size is 253. Subnet mask - The interface provides the same subnet mask you specify for the interface. See IP Address Assignment on page 306. Gateway - The interface provides the same gateway you specify for the interface. See IP Address Assignment on page 306. DNS servers - The interface provides IP addresses for up to three DNS servers that provide DNS services for DHCP clients. You can specify each IP address manually (for example, a companys own DNS server), or you can refer to DNS servers that other interfaces received from DHCP servers (for example, a DNS server at an ISP). These other interfaces have to be DHCP clients. It is not possible for an interface to be the DHCP server and a DHCP client simultaneously. WINS WINS (Windows Internet Naming Service) is a Windows implementation of NetBIOS Name Server (NBNS) on Windows. It keeps track of NetBIOS computer names. It stores a mapping table of your networks computer names and IP addresses. The table is dynamically updated for IP addresses assigned by DHCP. This helps reduce broadcast traffic since computers can query the server instead of broadcasting a request for a computer names IP address. In this way WINS is similar to DNS, although WINS does not use a hierarchy (unlike DNS). A network can have more than one WINS server. Samba can also serve as a WINS server. PPPoE/PPTP/L2TP Overview Point-to-Point Protocol over Ethernet (PPPoE, RFC 2516) and Point-to-Point Tunneling Protocol (PPTP, RFC 2637) are usually used to connect two computers over phone lines or broadband connections. PPPoE is often used with cable modems and DSL connections. It provides the following advantages:

The access and authentication method works with existing systems, including RADIUS. You can access one of several network services. This makes it easier for the service provider to offer the service PPPoE does not usually require any special configuration of the modem. ZyWALL ATP Series Users Guide 308 Chapter 9 Interfaces PPTP is used to set up virtual private networks (VPN) in unsecured TCP/IP environments. It sets up two sessions. 1 2 The first one runs on TCP port 1723. It is used to start and manage the second one. The second one uses Generic Routing Encapsulation (GRE, RFC 2890) to transfer information between the computers. PPTP is convenient and easy-to-use, but you have to make sure that firewalls support both PPTP sessions. Layer 2 Tunneling Protocol (L2TP) was taken from PPTP of Microsoft and Ciscos L2F (Layer 2 Forwarding technology), so LT2P combines PPTPs control and runs over a faster transport protocol, UDP, although it may be a bit more complicated to set up. It supports up to 256 bit session keys using the IPSec protocol. When security is a priority, L2TP is a good option as it requires certificates unlike PPTP. It uses the following ports: UDP 500, Protocol 50, UDP 1701 and UDP 4500. ZyWALL ATP Series Users Guide 309 CHAPTER 10 Routing 10.1 Policy and Static Routes Overview Use policy routes and static routes to override the Zyxel Devices default routing behavior in order to send packets through the appropriate interface or VPN tunnel. For example, the next figure shows a computer (A) connected to the Zyxel Devices LAN interface. The Zyxel Device routes most traffic from A to the Internet through the Zyxel Devices default gateway (R1). You create one policy route to connect to services offered by your ISP behind router R2. You create another policy route to communicate with a separate network behind another router (R3) connected to the LAN. Figure 213 Example of Policy Routing Topology Note: You can generally just use policy routes. You only need to use static routes if you have a large network with multiple routers where you use RIP or OSPF to propagate routing information to other routers. 10.1.1 What You Can Do in this Chapter Use the Policy Route screens (see Section 10.2 on page 312) to list and configure policy routes. Use the Static Route screens (see Section 10.3 on page 319) to list and configure static routes. ZyWALL ATP Series Users Guide 310 Chapter 10 Routing 10.1.2 What You Need to Know Policy Routing Traditionally, routing is based on the destination address only and the Zyxel Device takes the shortest path to forward a packet. IP Policy Routing (IPPR) provides a mechanism to override the default routing behavior and alter the packet forwarding based on the policy defined by the network administrator. Policy-based routing is applied to incoming packets on a per interface basis, prior to the normal routing. How You Can Use Policy Routing Source-Based Routing Network administrators can use policy-based routing to direct traffic from different users through different connections. Bandwidth Shaping You can allocate bandwidth to traffic that matches routing policies and prioritize traffic (however the application patrols bandwidth management is more flexible and recommended for TCP and UDP traffic). You can also use policy routes to manage other types of traffic (like ICMP traffic) and send traffic through VPN tunnels. Note: Bandwidth management in policy routes has priority over application patrol bandwidth management. Cost Savings IPPR allows organizations to distribute interactive traffic on high-bandwidth, high-cost paths while using low-cost paths for batch traffic. Load Sharing Network administrators can use IPPR to distribute traffic among multiple paths. NAT - The Zyxel Device performs NAT by default for traffic going to or from the WAN interfaces. A routing policys SNAT allows network administrators to have traffic received on a specified interface use a specified IP address as the source IP address. Note: The Zyxel Device automatically uses SNAT for traffic it routes from internal interfaces to external interfaces. For example LAN to WAN traffic. Static Routes The Zyxel Device usually uses the default gateway to route outbound traffic from computers on the LAN to the Internet. To have the Zyxel Device send data to devices not reachable through the default gateway, use static routes. Configure static routes if you need to use RIP or OSPF to propagate the routing information to other routers. See Chapter 10 on page 321 for more on RIP and OSPF. Policy Routes Versus Static Routes Policy routes are more flexible than static routes. You can select more criteria for the traffic to match and can also use schedules, NAT, and bandwidth management. Policy routes are only used within the Zyxel Device itself. Static routes can be propagated to other routers using RIP or OSPF. Policy routes take priority over static routes. If you need to use a routing policy on the Zyxel Device and propagate it to other routers, you could configure a policy route and an equivalent static route. DiffServ QoS is used to prioritize source-to-destination traffic flows. All packets in the same flow are given the same priority. CoS (class of service) is a way of managing traffic in a network by grouping similar types of ZyWALL ATP Series Users Guide 311 Chapter 10 Routing traffic together and treating each type as a class. You can use CoS to give different priorities to different packet types. DiffServ (Differentiated Services) is a class of service (CoS) model that marks packets so that they receive specific per-hop treatment at DiffServ-compliant network devices along the route based on the application types and traffic flow. Packets are marked with DiffServ Code Points (DSCPs) indicating the level of service desired. This allows the intermediary DiffServ-compliant network devices to handle the packets differently depending on the code points without the need to negotiate paths or remember state information for every flow. In addition, applications do not have to request a particular service or give advanced notice of where the traffic is going. DSCP Marking and Per-Hop Behavior DiffServ defines a new DS (Differentiated Services) field to replace the Type of Service (TOS) field in the IP header. The DS field contains a 2-bit unused field and a 6-bit DSCP field which can define up to 64 service levels. The following figure illustrates the DS field. DSCP (6 bits) Unused (2 bits) DSCP is backward compatible with the three precedence bits in the ToS octet so that non-DiffServ compliant, ToS-enabled network device will not conflict with the DSCP mapping. The DSCP value determines the forwarding behavior, the PHB (Per-Hop Behavior), that each packet gets across the DiffServ network. Based on the marking rule, different kinds of traffic can be marked for different kinds of forwarding. Resources can then be allocated according to the DSCP values and the configured policies. 10.2 Policy Route Screen Click Configuration > Network > Routing to open the Policy Route screen. Use this screen to see the configured policy routes and turn policy routing based bandwidth management on or off. A policy route defines the matching criteria and the action to take when a packet meets the criteria. The action is taken only when all the criteria are met. The criteria can include the user name, source address and incoming interface, destination address, schedule, IP protocol (ICMP, UDP, TCP, etc.) and port. The actions that can be taken include:

Routing the packet to a different gateway, outgoing interface, VPN tunnel, or trunk. Limiting the amount of bandwidth available and setting a priority for traffic. IPPR follows the existing packet filtering facility of RAS in style and in implementation. If you enabled IPv6 in the Configuration > System > IPv6 screen, you can also configure policy routes used for your IPv6 networks on this screen. Click on the icons to go to the OneSecurity website where there is guidance on configuration walkthroughs, troubleshooting, and other information. ZyWALL ATP Series Users Guide 312 Chapter 10 Routing Figure 214 Configuration > Network > Routing > Policy Route The following table describes the labels in this screen. Table 123 Configuration > Network > Routing > Policy Route LABEL Show Filter / Hide Filter Click this button to display a greater or lesser number of configuration fields. IPv4 Configuration /

IPv6 Configuration DESCRIPTION Use the IPv4 Configuration section for IPv4 network settings. Use the IPv6 Configuration section for IPv6 network settings if you connect your Zyxel Device to an IPv6 network. Both sections have similar fields as described below. Select this to have the Zyxel Device forward packets that match a policy route according to the policy route instead of sending the packets directly to a connected network. Use IPv4/IPv6 Policy Route to Override Direct Route Add Edit Remove Activate Inactivate Move Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. To change a rules position in the numbered list, select the rule and click Move to display a field to type a number for where you want to put that rule and press [ENTER] to move the rule to the number that you typed. The ordering of your rules is important as they are applied in order of their numbering. ZyWALL ATP Series Users Guide 313 Chapter 10 Routing Table 123 Configuration > Network > Routing > Policy Route (continued) LABEL

#

Status DESCRIPTION This is the number of an individual policy route. This icon is lit when the entry is active, red when the next hops connection is down, and dimmed when the entry is inactive. This is the name of the user (group) object from which the packets are sent. any means all users. This is the name of the schedule object. none means the route is active at all times if enabled. This is the interface on which the packets are received. This is the name of the source IP address (group) object, including geographic address and FQDN (group) objects. any means all IP addresses. This is the name of the destination IP address (group) object, including geographic and FQDN (group) address objects. any means all IP addresses. This is the DSCP value of incoming packets to which this policy route applies. any means all DSCP values or no DSCP marker. default means traffic with a DSCP value of 0. This is usually best effort traffic The af entries stand for Assured Forwarding. The number following the af identifies one of four classes and one of three drop preferences. See Assured Forwarding (AF) PHB for DiffServ for more details. This is the name of the service object. any means all services. This is the name of a service object. The Zyxel Device applies the policy route to the packets sent from the corresponding service port. any means all service ports. This is the next hop to which packets are directed. It helps forward packets to their destinations and can be a router, VPN tunnel, outgoing interface or trunk. This is how the Zyxel Device handles the DSCP value of the outgoing packets that match this route. If this field displays a DSCP value, the Zyxel Device applies that DSCP value to the routes outgoing packets. preserve means the Zyxel Device does not modify the DSCP value of the routes outgoing packets. default means the Zyxel Device sets the DSCP value of the routes outgoing packets to 0. The af choices stand for Assured Forwarding. The number following the af identifies one of four classes and one of three drop preferences. See Assured Forwarding (AF) PHB for DiffServ for more details. This is the source IP address that the route uses. It displays none if the Zyxel Device does not perform NAT for this route. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. User Schedule Incoming Source Destination DSCP Code Service Source Port Next-Hop DSCP Marking SNAT Apply Reset 10.2.1 Policy Route Edit Screen Click Configuration > Network > Routing to open the Policy Route screen. Then click the Add or Edit icon in the IPv4 Configuration or IPv6 Configuration section. The Add Policy Route or Policy Route Edit screen opens. Use this screen to configure or edit a policy route. Both IPv4 and IPv6 policy route have similar settings except the Address Translation (SNAT) settings. ZyWALL ATP Series Users Guide 314 Chapter 10 Routing Figure 215 Configuration > Network > Routing > Policy Route > Add/Edit (IPv4 Configuration) ZyWALL ATP Series Users Guide 315 Chapter 10 Routing Figure 216 Configuration > Network > Routing > Policy Route > Add/Edit (IPv6 Configuration) The following table describes the labels in this screen. DESCRIPTION Click this button to display a greater or lesser number of configuration fields. Table 124 Configuration > Network > Routing > Policy Route > Add/Edit LABEL Show Advanced Settings / Hide Advanced Settings Create new Object Configuration Enable Description Criteria User Incoming Select this to activate the policy. Enter a descriptive name of up to 31 printable ASCII characters for the policy. Use this to configure any new settings objects that you need to use in this screen. Source Address Destination Address Select a user name or user group from which the packets are sent. Select where the packets are coming from; any, an interface, a tunnel, an SSL VPN, or the Zyxel Device itself. For an interface, a tunnel, or an SSL VPN, you also need to select the individual interface, VPN tunnel, or SSL VPN connection. Select a source IP address object, including geographic address and FQDN (group) objects, from which the packets are sent. Select a destination IP address object, including geographic address and FQDN (group) objects, to which the traffic is being sent. If the next hop is a dynamic VPN tunnel and you enable Auto Destination Address, the Zyxel Device uses the local network of the peer router that initiated an incoming dynamic IPSec tunnel as the destination address of the policy instead of your configuration here. ZyWALL ATP Series Users Guide 316 Chapter 10 Routing Table 124 Configuration > Network > Routing > Policy Route > Add/Edit (continued) LABEL DSCP Code User-Defined DSCP Code Schedule Service Source Port Next-Hop Type Gateway VPN Tunnel Auto Destination Address Trunk Interface DESCRIPTION Select a DSCP code point value of incoming packets to which this policy route applies or select User Define to specify another DSCP code point. The lower the number the higher the priority with the exception of 0 which is usually given only best-effort treatment. any means all DSCP value or no DSCP marker. default means traffic with a DSCP value of 0. This is usually best effort traffic The af choices stand for Assured Forwarding. The number following the af identifies one of four classes and one of three drop preferences. See Assured Forwarding (AF) PHB for DiffServ for more details. Use this field to specify a custom DSCP code point when you select User Define in the previous field. Select a schedule to control when the policy route is active. none means the route is active at all times if enabled. Select a service or service group to identify the type of traffic to which this policy route applies. Select a service or service group to identify the source port of packets to which the policy route applies. Select Auto to have the Zyxel Device use the routing table to find a next-hop and forward the matched packets automatically. Select Gateway to route the matched packets to the next-hop router or switch you specified in the Gateway field. You have to set up the next-hop router or switch as a HOST address object first. Select VPN Tunnel to route the matched packets via the specified VPN tunnel. Select Trunk to route the matched packets through the interfaces in the trunk group based on the load balancing algorithm. Select Interface to route the matched packets through the specified outgoing interface to a gateway (which is connected to the interface). This field displays when you select Gateway in the Type field. Select a HOST address object. The gateway is an immediate neighbor of your Zyxel Device that will forward the packet to the destination. The gateway must be a router or switch on the same segment as your Zyxel Device's interface(s). This field displays when you select VPN Tunnel in the Type field. Select a VPN tunnel through which the packets are sent to the remote network that is connected to the Zyxel Device directly. This field displays when you select VPN Tunnel in the Type field. Select this to have the Zyxel Device use the local network of the peer router that initiated an incoming dynamic IPSec tunnel as the destination address of the policy. Leave this cleared if you want to manually specify the destination address. This field displays when you select Trunk in the Type field. Select a trunk group to have the Zyxel Device send the packets via the interfaces in the group. This field displays when you select Interface in the Type field. Select an interface to have the Zyxel Device send traffic that matches the policy route through the specified interface. ZyWALL ATP Series Users Guide 317 Chapter 10 Routing Table 124 Configuration > Network > Routing > Policy Route > Add/Edit (continued) LABEL DSCP Marking DESCRIPTION Set how the Zyxel Device handles the DSCP value of the outgoing packets that match this route. Select one of the pre-defined DSCP values to apply or select User Define to specify another DSCP value. The af choices stand for Assured Forwarding. The number following the af identifies one of four classes and one of three drop preferences. See Assured Forwarding

(AF) PHB for DiffServ for more details. Select preserve to have the Zyxel Device keep the packets original DSCP value. Select default to have the Zyxel Device set the DSCP value of the packets to 0. Use this field to specify a custom DSCP value. User-Defined DSCP Marking Address Translation Source Network Address Translation Healthy Check Disable policy route automatically while Interface link down Enable Connectivity Check Check Method:

Check Period:

Check Timeout:

Use this section to configure NAT for the policy route. This section does not apply to policy routes that use a VPN tunnel as the next hop. Select none to not use NAT for the route. Select outgoing-interface to use the IP address of the outgoing interface as the source IP address of the packets that matches this route. To use SNAT for a virtual interface that is in the same WAN trunk as the physical interface to which the virtual interface is bound, the virtual interface and physical interface must be in different subnets. Otherwise, select a pre-defined address (group) to use as the source IP address(es) of the packets that match this route. Use Create new Object if you need to configure a new address (group) to use as the source IP address(es) of the packets that match this route. Use this part of the screen to configure a route connectivity check and disable the policy if the interface is down. Select this to disable the policy if the interface is down or disabled. This is available for Interface and Trunk in the Type field above. Select this to turn on the connection check. This is available for Interface and Gateway in the Type field above. Select the method that the gateway allows. Select icmp to have the Zyxel Device regularly ping the gateway you specify to make sure it is still available. Select tcp to have the Zyxel Device regularly perform a TCP handshake with the gateway you specify to make sure it is still available. Enter the number of seconds between connection check attempts (5-600 seconds). Enter the number of seconds to wait for a response before the attempt is a failure (1-10 seconds). Check Fail Tolerance: Enter the number of consecutive failures before the Zyxel Device stops routing using this Check Port:

Check this address:

OK Cancel policy (1-10). This field only displays when you set the Check Method to tcp. Specify the port number to use for a TCP connectivity check (1-65535). Select this to specify a domain name or IP address for the connectivity check. Enter that domain name or IP address in the field next to it. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving. ZyWALL ATP Series Users Guide 318 Chapter 10 Routing 10.3 IP Static Route Screen Click Configuration > Network > Routing > Static Route to open the Static Route screen. This screen displays the configured static routes. Configure static routes to be able to use RIP or OSPF to propagate the routing information to other routers. If you enabled IPv6 in the Configuration > System > IPv6 screen, you can also configure static routes used for your IPv6 networks on this screen. Figure 217 Configuration > Network > Routing > Static Route The following table describes the labels in this screen. Table 125 Configuration > Network > Routing > Static Route LABEL IPv4 Configuration /

IPv6 Configuration DESCRIPTION Use the IPv4 Configuration section for IPv4 network settings. Use the IPv6 Configuration section for IPv6 network settings if you connect your Zyxel Device to an IPv6 network. Both sections have similar fields as described below. Click this to create a new static route. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. This is the number of an individual static route. This is the destination IP address. This is the IP subnet mask. This is the IPv6 prefix for the destination IP address. This is the IP address of the next-hop gateway or the interface through which the traffic is routed. The gateway is a router or switch on the same segment as your Zyxel Device's interface(s). The gateway helps forward packets to their destinations. This is the routes priority among the Zyxel Devices routes. The smaller the number, the higher priority the route has. Add Edit Remove

#

Destination Subnet Mask Prefix Next-Hop Metric 10.3.1 Static Route Add/Edit Screen Select a static route index number and click Add or Edit. The screen shown next appears. Use this screen to configure the required information for a static route. ZyWALL ATP Series Users Guide 319 Chapter 10 Routing Figure 218 Configuration > Network > Routing > Static Route > Add (IPv4 Configuration) Figure 219 Configuration > Network > Routing > Static Route > Add (IPv6 Configuration) The following table describes the labels in this screen. Table 126 Configuration > Network > Routing > Static Route > Add LABEL Destination IP DESCRIPTION This parameter specifies the IP network address of the final destination. Routing is always based on network number. If you need to specify a route to a single host, enter the specific IP address here and use a subnet mask of 255.255.255.255 (for IPv4) in the Subnet Mask field or a prefix of 128 (for IPv6) in the Prefix Length field to force the network number to be identical to the host ID. For IPv6, if you want to send all traffic to the gateway or interface specified in the Gateway IP or Interface field, enter :: in this field and 0 in the Prefix Length field. Enter the IP subnet mask here. Enter the number of left-most digits in the destination IP address, which indicates the network prefix. Enter :: in the Destination IP field and 0 in this field if you want to send all traffic to the gateway or interface specified in the Gateway IP or Interface field. Select the radio button and enter the IP address of the next-hop gateway. The gateway is a router or switch on the same segment as your Zyxel Device's interface(s). The gateway helps forward packets to their destinations. Select the radio button and a predefined interface through which the traffic is sent. Metric represents the cost of transmission for routing purposes. IP routing uses hop count as the measurement of cost, with a minimum of 1 for directly connected networks. Enter a number that approximates the cost for this link. The number need not be precise, but it must be 0~127. In practice, 2 or 3 is usually a good number. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving. Subnet Mask Prefix Length Gateway IP Interface Metric OK Cancel ZyWALL ATP Series Users Guide 320 Chapter 10 Routing 10.4 Policy Routing Technical Reference Here is more detailed information about some of the features you can configure in policy routing. NAT and SNAT NAT (Network Address Translation - NAT, RFC 1631) is the translation of the IP address in a packet in one network to a different IP address in another network. Use SNAT (Source NAT) to change the source IP address in one network to a different IP address in another network. Assured Forwarding (AF) PHB for DiffServ Assured Forwarding (AF) behavior is defined in RFC 2597. The AF behavior group defines four AF classes. Inside each class, packets are given a high, medium or low drop precedence. The drop precedence determines the probability that routers in the network will drop packets when congestion occurs. If congestion occurs between classes, the traffic in the higher class (smaller numbered class) is generally given priority. Combining the classes and drop precedence produces the following twelve DSCP encodings from AF11 through AF43. The decimal equivalent is listed in brackets. Table 127 Assured Forwarding (AF) Behavior Group CLASS 2 AF21 (18) AF22 (20) AF23 (22) Low Drop Precedence Medium Drop Precedence High Drop Precedence CLASS 1 AF11 (10) AF12 (12) AF13 (14) CLASS 3 AF31 (26) AF32 (28) AF33 (30) CLASS 4 AF41 (34) AF42 (36) AF43 (38) Maximize Bandwidth Usage The maximize bandwidth usage option allows the Zyxel Device to divide up any available bandwidth on the interface (including unallocated bandwidth and any allocated bandwidth that a policy route is not using) among the policy routes that require more bandwidth. When you enable maximize bandwidth usage, the Zyxel Device first makes sure that each policy route gets up to its bandwidth allotment. Next, the Zyxel Device divides up an interfaces available bandwidth

(bandwidth that is unbudgeted or unused by the policy routes) depending on how many policy routes require more bandwidth and on their priority levels. When only one policy route requires more bandwidth, the Zyxel Device gives the extra bandwidth to that policy route. When multiple policy routes require more bandwidth, the Zyxel Device gives the highest priority policy routes the available bandwidth first (as much as they require, if there is enough available bandwidth), and then to lower priority policy routes if there is still bandwidth available. The Zyxel Device distributes the available bandwidth equally among policy routes with the same priority level. 10.5 Routing Protocols Overview Routing protocols give the Zyxel Device routing information about the network from other routers. The Zyxel Device stores this routing information in the routing table it uses to make routing decisions. In turn, the Zyxel Device can also use routing protocols to propagate routing information to other routers. ZyWALL ATP Series Users Guide 321 Chapter 10 Routing Routing protocols are usually only used in networks using multiple routers like campuses or large enterprises. Use the RIP screen (see Section 10.6 on page 322) to configure the Zyxel Device to use RIP to receive and/or send routing information. Use the OSPF screen (see Section 10.7 on page 324) to configure general OSPF settings and manage OSPF areas. Use the OSPF Area Add/Edit screen (see Section 10.7.2 on page 328) to create or edit an OSPF area. Use the BGP screen (see Section 10.8 on page 331) to configure eBGP (exterior Border Gate Protocol). 10.5.1 What You Need to Know The Zyxel Device supports two standards, RIP and OSPF, for routing protocols. RIP and OSPF are compared here and discussed further in the rest of the chapter. Table 128 RIP vs. OSPF Network Size Metric RIP Small (with up to 15 routers) Hop count Convergence Slow OSPF Large Bandwidth, hop count, throughput, round trip time and reliability. Fast 10.6 The RIP Screen RIP (Routing Information Protocol, RFC 1058 and RFC 1389) allows a device to exchange routing information with other routers. RIP is a vector-space routing protocol, and, like most such protocols, it uses hop count to decide which route is the shortest. Unfortunately, it also broadcasts its routes asynchronously to the network and converges slowly. Therefore, RIP is more suitable for small networks

(up to 15 routers). In the Zyxel Device, you can configure two sets of RIP settings before you can use it in an interface. First, the Authentication field specifies how to verify that the routing information that is received is the same routing information that is sent. Second, the Zyxel Device can also redistribute routing information from non-RIP networks, specifically OSPF networks and static routes, to the RIP network. Costs might be calculated differently, however, so you use the Metric field to specify the cost in RIP terms. RIP uses UDP port 520. Use the RIP screen to specify the authentication method and maintain the policies for redistribution. Click Configuration > Network > Routing > RIP to open the following screen. ZyWALL ATP Series Users Guide 322 Chapter 10 Routing Figure 220 Configuration > Network > Routing > RIP The following table describes the labels in this screen. Table 129 Configuration > Network > Routing Protocol > RIP LABEL Authentication DESCRIPTION The transmitting and receiving routers must have the same key. Authentication Text Authentication Key MD5 Authentication ID MD5 Authentication Key For RIP, authentication is not available in RIP version 1. In RIP version 2, you can only select one authentication type for all interfaces. Select the authentication method used in the RIP network. This authentication protects the integrity, but not the confidentiality, of routing updates. None uses no authentication. Text uses a plain text password that is sent over the network (not very secure). MD5 uses an MD5 password and authentication ID (most secure). This field is available if the Authentication is Text. Type the password for text authentication. The key can consist of alphanumeric characters and the underscore, and it can be up to 16 characters long. This field is available if the Authentication is MD5. Type the ID for MD5 authentication. The ID can be between 1 and 255. This field is available if the Authentication is MD5. Type the password for MD5 authentication. The password can consist of alphanumeric characters and the underscore, and it can be up to 16 characters long. Redistribute Active OSPF Metric Apply Reset Select this to use RIP to advertise routes that were learned through OSPF. Type the cost for routes provided by OSPF. The metric represents the cost of transmission for routing purposes. RIP routing uses hop count as the measurement of cost, with 1 usually used for directly connected networks. The number does not have to be precise, but it must be between 0 and 16. In practice, 2 or 3 is usually used. Click this button to save your changes to the Zyxel Device. Click this button to return the screen to its last-saved settings. ZyWALL ATP Series Users Guide 323 Chapter 10 Routing 10.7 The OSPF Screen OSPF (Open Shortest Path First, RFC 2328) is a link-state protocol designed to distribute routing information within a group of networks, called an Autonomous System (AS). OSPF offers some advantages over vector-space routing protocols like RIP. OSPF supports variable-length subnet masks, which can be set up to use available IP addresses more efficiently. OSPF filters and summarizes routing information, which reduces the size of routing tables throughout the network. OSPF responds to changes in the network, such as the loss of a router, more quickly. OSPF considers several factors, including bandwidth, hop count, throughput, round trip time, and reliability, when it calculates the shortest path. OSPF converges more quickly than RIP. Naturally, OSPF is also more complicated than RIP, so OSPF is usually more suitable for large networks. OSPF uses IP protocol 89. OSPF Areas An OSPF Autonomous System (AS) is divided into one or more areas. Each area represents a group of adjacent networks and is identified by a 32-bit ID. In OSPF, this number may be expressed as an integer or as an IP address. There are several types of areas. The backbone is the transit area that routes packets between other areas. All other areas are connected to the backbone. A normal area is a group of adjacent networks. A normal area has routing information about the OSPF AS, any networks outside the OSPF AS to which it is directly connected, and any networks outside the OSPF AS that provide routing information to any area in the OSPF AS. A stub area has routing information about the OSPF AS. It does not have any routing information about any networks outside the OSPF AS, including networks to which it is directly connected. It relies on a default route to send information outside the OSPF AS. A Not So Stubby Area (NSSA, RFC 1587) has routing information about the OSPF AS and networks outside the OSPF AS to which the NSSA is directly connected. It does not have any routing information about other networks outside the OSPF AS. Each type of area is illustrated in the following figure. ZyWALL ATP Series Users Guide 324 Chapter 10 Routing Figure 221 OSPF: Types of Areas This OSPF AS consists of four areas, areas 0-3. Area 0 is always the backbone. In this example, areas 1, 2, and 3 are all connected to it. Area 1 is a normal area. It has routing information about the OSPF AS and networks X and Y. Area 2 is a stub area. It has routing information about the OSPF AS, but it depends on a default route to send information to networks X and Y. Area 3 is a NSSA. It has routing information about the OSPF AS and network Y but not about network X. OSPF Routers Every router in the same area has the same routing information. They do this by exchanging Hello messages to confirm which neighbor (layer-3) devices exist, and then they exchange database descriptions (DDs) to create a synchronized link-state database. The link-state database contains records of router IDs, their associated links and path costs. The link-state database is then constantly updated through Link State Advertisements (LSA). Each router uses the link state database and the Dijkstra algorithm to compute the least cost paths to network destinations. Like areas, each router has a unique 32-bit ID in the OSPF AS, and there are several types of routers. Each type is really just a different role, and it is possible for one router to play multiple roles at one time. An internal router (IR) only exchanges routing information with other routers in the same area. An Area Border Router (ABR) connects two or more areas. It is a member of all the areas to which it is connected, and it filters, summarizes, and exchanges routing information between them. An Autonomous System Boundary Router (ASBR) exchanges routing information with routers in networks outside the OSPF AS. This is called redistribution in OSPF. Table 130 OSPF: Redistribution from Other Sources to Each Type of Area SOURCE \ TYPE OF AREA Static routes RIP NORMAL Yes Yes NSSA Yes Yes STUB No Yes A backbone router (BR) has at least one interface with area 0. By default, every router in area 0 is a backbone router, and so is every ABR. Each type of router is illustrated in the following example. ZyWALL ATP Series Users Guide 325 Chapter 10 Routing Figure 222 OSPF: Types of Routers In order to reduce the amount of traffic between routers, a group of routers that are directly connected to each other selects a designated router (DR) and a backup designated router (BDR). All of the routers only exchange information with the DR and the BDR, instead of exchanging information with all of the other routers in the group. The DR and BDR are selected by priority; if two routers have the same priority, the highest router ID is used. The DR and BDR are selected in each group of routers that are directly connected to each other. If a router is directly connected to several groups, it might be a DR in one group, a BDR in another group, and neither in a third group all at the same time. Virtual Links In some OSPF AS, it is not possible for an area to be directly connected to the backbone. In this case, you can create a virtual link through an intermediate area to logically connect the area to the backbone. This is illustrated in the following example. Figure 223 OSPF: Virtual Link In this example, area 100 does not have a direct connection to the backbone. As a result, you should set up a virtual link on both ABR in area 10. The virtual link becomes the connection between area 100 and the backbone. You cannot create a virtual link to a router in a different area. OSPF Configuration Follow these steps when you configure OSPF on the Zyxel Device. ZyWALL ATP Series Users Guide 326 Chapter 10 Routing 1 2 Enable OSPF. Set up the OSPF areas. 3 Configure the appropriate interfaces. See Section 9.4.1 on page 222. 4 Set up virtual links, as needed. 10.7.1 Configuring the OSPF Screen Use the first OSPF screen to specify the OSPF router the Zyxel Device uses in the OSPF AS and maintain the policies for redistribution. In addition, it provides a summary of OSPF areas, allows you to remove them, and opens the OSPF Add/Edit screen to add or edit them. Click Configuration > Network > Routing > OSPF to open the following screen. Figure 224 Configuration > Network > Routing > OSPF The following table describes the labels in this screen. See Section 10.7.2 on page 328 for more information as well. Table 131 Configuration > Network > Routing Protocol > OSPF LABEL OSPF Router ID DESCRIPTION Select the 32-bit ID the Zyxel Device uses in the OSPF AS. Default - the first available interface IP address is the Zyxel Devices ID. User Defined - enter the ID (in IP address format) in the field that appears when you select User Define. Redistribute Active RIP Type Select this to advertise routes that were learned from RIP. The Zyxel Device advertises routes learned from RIP to Normal and NSSA areas but not to Stub areas. Select how OSPF calculates the cost associated with routing information from RIP. Choices are: Type 1 and Type 2. Type 1 - cost = OSPF AS cost + external cost (Metric) Type 2 - cost = external cost (Metric); the OSPF AS cost is ignored. ZyWALL ATP Series Users Guide 327 Chapter 10 Routing Table 131 Configuration > Network > Routing Protocol > OSPF (continued) LABEL Metric Area Add Edit Remove References

#

Area Type Authentication Apply Reset DESCRIPTION Type the external cost for routes provided by RIP. The metric represents the cost of transmission for routing purposes. The way this is used depends on the Type field. This value is usually the average cost in the OSPF AS, and it can be between 1 and 16777214. This section displays information about OSPF areas in the Zyxel Device. Click this to create a new OSPF area. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Select an entry and click References to open a screen that shows which settings use the entry. Click Refresh to update information on this screen. This field is a sequential value, and it is not associated with a specific area. This field displays the 32-bit ID for each area in IP address format. This field displays the type of area. This type is different from the Type field above. This field displays the default authentication method in the area. Click this button to save your changes to the Zyxel Device. Click this button to return the screen to its last-saved settings. 10.7.2 OSPF Area Add/Edit Screen The OSPF Area Add/Edit screen allows you to create a new area or edit an existing one. To access this screen, go to the OSPF summary screen (see Section 10.7 on page 324), and click either the Add icon or an Edit icon. Figure 225 Configuration > Network > Routing > OSPF > Add ZyWALL ATP Series Users Guide 328 Chapter 10 Routing The following table describes the labels in this screen. Table 132 Configuration > Network > Routing > OSPF > Add LABEL Area ID Type DESCRIPTION Type the unique, 32-bit identifier for the area in IP address format. Select the type of OSPF area. Normal - This area is a normal area. It has routing information about the OSPF AS and about networks outside the OSPF AS. Stub - This area is an stub area. It has routing information about the OSPF AS but not about networks outside the OSPF AS. It depends on a default route to send information outside the OSPF AS. NSSA - This area is a Not So Stubby Area (NSSA), per RFC 1587. It has routing information about the OSPF AS and networks that are outside the OSPF AS and are directly connected to the NSSA. It does not have information about other networks outside the OSPF AS. Select the default authentication method used in the area. This authentication protects the integrity, but not the confidentiality, of routing updates. None uses no authentication. Text uses a plain text password that is sent over the network (not very secure). MD5 uses an MD5 password and authentication ID (most secure). This field is available if the Authentication is Text. Type the password for text authentication. The key can consist of alphanumeric characters and the underscore, and it can be up to 16 characters long. This field is available if the Authentication is MD5. Type the default ID for MD5 authentication in the area. The ID can be between 1 and 255. This field is available if the Authentication is MD5. Type the default password for MD5 authentication in the area. The password can consist of alphanumeric characters and the underscore, and it can be up to 16 characters long. This section is displayed if the Type is Normal. Create a virtual link if you want to connect a different area (that does not have a direct connection to the backbone) to the backbone. You should set up the virtual link on the ABR that is connected to the other area and on the ABR that is connected to the backbone. Click this to create a new virtual link. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. This field is a sequential value, and it is not associated with a specific area. This is the 32-bit ID (in IP address format) of the other ABR in the virtual link. Authentication Text Authentication Key MD5 Authentication ID MD5 Authentication Key Virtual Link Add Edit Remove

#

Peer Router ID ZyWALL ATP Series Users Guide 329 Chapter 10 Routing Table 132 Configuration > Network > Routing > OSPF > Add (continued) LABEL Authentication DESCRIPTION This is the authentication method the virtual link uses. This authentication protects the integrity, but not the confidentiality, of routing updates. For OSPF, the Zyxel Device supports a default authentication type by area. If you want to use this default in an interface or virtual link, you set the associated Authentication Type field to Same as Area. As a result, you only have to update the authentication information for the area to update the authentication type used by these interfaces and virtual links. Alternatively, you can override the default in any interface or virtual link by selecting a specific authentication method. Please see the respective interface sections for more information. None uses no authentication. Text uses a plain text password that is sent over the network (not very secure). Hover your cursor over this label to display the password. MD5 uses an MD5 password and authentication ID (most secure). Hover your cursor over this label to display the authentication ID and key. Same as Area has the virtual link also use the Authentication settings above. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving. OK Cancel 10.7.3 Virtual Link Add/Edit Screen The Virtual Link Add/Edit screen allows you to create a new virtual link or edit an existing one. When the OSPF add or edit screen (see Section 10.7.2 on page 328) has the Type set to Normal, a Virtual Link table displays. Click either the Add icon or an entry and the Edit icon to display a screen like the following. Figure 226 Configuration > Network > Routing > OSPF > Add > Add ZyWALL ATP Series Users Guide 330 Chapter 10 Routing The following table describes the labels in this screen. Table 133 Configuration > Network > Routing > OSPF > Add > Add LABEL Peer Router ID Authentication DESCRIPTION Enter the 32-bit ID (in IP address format) of the other ABR in the virtual link. Select the authentication method the virtual link uses. This authentication protects the integrity, but not the confidentiality, of routing updates. For OSPF, the Zyxel Device supports a default authentication type by area. If you want to use this default in an interface or virtual link, you set the associated Authentication Type field to Same as Area. As a result, you only have to update the authentication information for the area to update the authentication type used by these interfaces and virtual links. Alternatively, you can override the default in any interface or virtual link by selecting a specific authentication method. Please see the respective interface sections for more information. None uses no authentication. Text uses a plain text password that is sent over the network (not very secure). MD5 uses an MD5 password and authentication ID (most secure). Same as Area has the virtual link also use the Authentication settings above. This field is available if the Authentication is Text. Type the password for text authentication. The key can consist of alphanumeric characters and the underscore, and it can be up to 16 characters long. This field is available if the Authentication is MD5. Type the default ID for MD5 authentication in the area. The ID can be between 1 and 255. This field is available if the Authentication is MD5. Type the default password for MD5 authentication in the area. The password can consist of alphanumeric characters and the underscore, and it can be up to 16 characters long. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving. Text Authentication Key MD5 Authentication ID MD5 Authentication Key OK Cancel 10.8 BGP (Border Gateway Protocol) The Zyxel Device supports eBGP (exterior Border Gate Protocol) to route IPv4 traffic between routers in different Autonomous Systems (AS). An AS number is a number from 1 to 4294967295), that identifies an autonomous system. 4200000000 4294967294 are private AS numbers. See Section 10.7 on page 324 for more information on autonomous systems. Figure 227 eBGP Concept ZyWALL ATP Series Users Guide 331 Chapter 10 Routing 10.8.1 Allow BGP Packets to Enter the Zyxel Device You must first allow BGP packets to enter the Zyxel Device from the WAN. 1 Go to Configuration > Object > Service > Service Group 2 Select the Default_Allow_WAN_To_ZyWALL rule and click Edit. 3 Move BGP from Available to Member. 4 Click OK. Figure 228 Allow BGP to the Zyxel Device 10.8.2 Configuring the BGP Screen Use this screen to configure BGP information about the Zyxel Device and its peer BGP routers. Click Configuration > Network > Routing > BGP to open the following screen. ZyWALL ATP Series Users Guide 332 Chapter 10 Routing Figure 229 Configuration > Network > Routing > BGP The following table describes the labels in this screen. Table 134 Configuration > Network > Routing Protocol > BGP LABEL AS Number DESCRIPTION Type a number from 1 to 4294967295 in this field. Router ID Redistribute Neighbors Add Edit Remove

#

IP Address AS Number Network Add Edit Note: The Zyxel Device can only belong to one AS at a time. Type the IP address of the interface on the Zyxel Device. This field is optional. Select Connected to redistribute routes of directly attached devices to the Zyxel Device into the BGP Routing Information Base (RIB). This section displays information about peer BGP routers in neighboring AS. Note: The maximum number of neighboring BGP routers supported by the Zyxel Device is 5. Click this to configure BGP criteria for a new peer BGP router. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. This field is a sequential value, and it is not associated with a specific area. This displays the IPv4 address of the peer BGP router in a neighboring AS. This displays the AS Number of the peer BGP router in a neighboring AS. Use this section to add routes that will be announced to all BGP neighbors. Note: You may configure up to 16 network routes. Click this to configure network information for a new route. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. ZyWALL ATP Series Users Guide 333 Chapter 10 Routing Table 134 Configuration > Network > Routing Protocol > BGP (continued) LABEL Remove

#

Network Apply Reset DESCRIPTION To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. This field is a sequential value, and it is not associated with a specific area. This displays the IP address and the number of subnet mask bits for the peer BGP route. Click this button to save your changes to the Zyxel Device. Click this button to return the screen to its last-saved settings. 10.8.3 The BGP Neighbors Screen Use this screen to configure BGP information about a peer BGP router. Click Configuration > Network > Routing > BGP > Add Neighbors to open the following screen. Figure 230 Configuration > Network > Routing > BGP > Add Neighbors The following table describes the labels in this screen. Table 135 Configuration > Network > Routing Protocol > BGP LABEL IP Address AS Number DESCRIPTION Type the IP address of the interface on the peer BGP router. Type a number from 1 to 4294967295 in this field. Get the number from your service provider. Select this to allow the Zyxel Device to attempt BGP connections to external peers on indirectly connected networks. eBGP neighbors must also perform multihop. Multihop is not established if the only route to the multihop peer is a default route. This avoids loop formation. Enter a maximum hop count from <1-255>. The default is 255. Enable EBGP Multihop EBGP Maximum Hops ZyWALL ATP Series Users Guide 334 Chapter 10 Routing Table 135 Configuration > Network > Routing Protocol > BGP (continued) LABEL Update Source DESCRIPTION Use this to allow BGP sessions use the selected interface for TCP connections. Choose Gateway and then enter the gateway IP address Choose Interface and then select a Zyxel Device interface. Choose None to use the closest interface. Type the default password for MD5 authentication of communication between the Zyxel Device and the peer BGP router. The password can consist of alphanumeric characters and the underscore, and it can be up to 63 characters long. Specify a weight value for all routes learned from this peer BGP router in the specified network. The route with the highest weight gets preference. Keepalive messages are sent by the Zyxel Device to a peer BGP router to inform it that the BGP connection between the two is still active. The Keepalive Time is the interval between each Keepalive message sent by the Zyxel Device. We recommend Keepalive Time is 1/3 of the Hold Time time. This is the maximum time the Zyxel Device waits to receive a Keepalive message from a peer BGP router before it declares that the peer BGP router is dead. Hold Time must be greater than the Keepalive Time. A prefix is a network address (IP/subnet mask) that a BGP router can reach and that it shares with its neighbors. Set the maximum number, from 1 to 4294967295, of prefixes that can be received from a neighbor. This limits the number of prefixes that the Zyxel Device is allowed to receive from a neighbor. If extra prefixes are received, the Zyxel Device ends the connection with the peer BGP router. You need to edit the peer BGP router configuration to bring the connection back. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving. MD5 authentication key Weight Keepalive Time Hold Time Maximum Prefix OK Cancel 10.8.4 Example Scenario This is an example scenario for using BGP on the Zyxel Device. 10.8.4.1 Scenario: CE - PE (MLPS) In this scenario, you want to transmit BGP packets from a CE router (Zyxel Device) to a peer BGP PE router in an MPLS network. CE: The Zyxel Device is the customer edge router located on the customer premises and connects to a PE router in the service provider MPLS network. PE: The provider edge router is located at the edge of the service provider MPLS network. MPLS: MultiProtocol Label Switching (MPLS) forwards data from one network node to the next based on path labels rather than network addresses. ZyWALL ATP Series Users Guide 335 Chapter 10 Routing Figure 231 Scenario 1: CE Router - to - MPLS 10.8.4.2 CE - PE Configuration Process The process for configuring BGP in this scenario is:

1 Configure the AS number for BGP on the Zyxel Device (CE) in Configuration > Network > Routing > BGP. Note: The Zyxel Device can only belong to one AS at a time. 2 Configure the AS number and BGP criteria of the peer BGP routers (PE) in the neighboring AS in Configuration > Network > Routing > BGP > Add Neighbors. Note: The maximum number of neighboring BGP routers supported by the Zyxel Device is 5. 3 Configure the network for BGP routes in the neighboring AS. Note: You may configure up to 16 network routes. ZyWALL ATP Series Users Guide 336 CHAPTER 11 DDNS 11.1 DDNS Overview Dynamic DNS (DDNS) services let you use a domain name with a dynamic IP address. 11.1.1 What You Can Do in this Chapter Use the DDNS screen (see Section 11.2 on page 338) to view a list of the configured DDNS domain names and their details. Use the DDNS Add/Edit screen (see Section 11.2.1 on page 339) to add a domain name to the Zyxel Device or to edit the configuration of an existing domain name. 11.1.2 What You Need to Know DNS maps a domain name to a corresponding IP address and vice versa. Similarly, Dynamic DNS (DDNS) maps a domain name to a dynamic IP address. As a result, anyone can use the domain name to contact you (in NetMeeting, CU-SeeMe, etc.) or to access your FTP server or Web site, regardless of the current (dynamic) IP address. Note: You must have a public WAN IP address to use Dynamic DNS. You must set up a dynamic DNS account with a supported DNS service provider before you can use Dynamic DNS services with the Zyxel Device. When registration is complete, the DNS service provider gives you a password or key. At the time of writing, the Zyxel Device supports the following DNS service providers. See the listed websites for details about the DNS services offered by each. Table 136 DDNS Service Providers PROVIDER DynDNS Dynu No-IP Peanut Hull 3322 Selfhost SERVICE TYPES SUPPORTED Dynamic DNS, Static DNS, and Custom DNS Basic, Premium No-IP Peanut Hull 3322 Dynamic DNS, 3322 Static DNS Selfhost WEBSITE www.dyndns.com www.dynu.com www.no-ip.com www.oray.cn www.3322.org selfhost.de Note: Record your DDNS accounts user name, password, and domain name to use to configure the Zyxel Device. After you configure the Zyxel Device, it automatically sends updated IP addresses to the DDNS service provider, which helps redirect traffic accordingly. ZyWALL ATP Series Users Guide 337 Chapter 11 DDNS 11.2 The DDNS Screen The DDNS screen provides a summary of all DDNS domain names and their configuration. In addition, this screen allows you to add new domain names, edit the configuration for existing domain names, and delete domain names. Click Configuration > Network > DDNS to open the following screen. Figure 232 Configuration > Network > DDNS The following table describes the labels in this screen. Table 137 Configuration > Network > DDNS LABEL Add Edit Remove Activate Inactivate

#

Status Profile Name DDNS Type Domain Name Primary Interface/IP Backup Interface/IP DESCRIPTION Click this to create a new entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. This is the number of an individual DDNS profile. This icon is lit when the entry is active and dimmed when the entry is inactive. This field displays the descriptive profile name for this entry. This field displays which DDNS service you are using. This field displays each domain name the Zyxel Device can route. This field displays the interface to use for updating the IP address mapped to the domain name followed by how the Zyxel Device determines the IP address for the domain name. from interface - The IP address comes from the specified interface. auto detected -The DDNS server checks the source IP address of the packets from the Zyxel Device for the IP address to use for the domain name. custom - The IP address is static. This field displays the alternate interface to use for updating the IP address mapped to the domain name followed by how the Zyxel Device determines the IP address for the domain name. The Zyxel Device uses the backup interface and IP address when the primary interface is disabled, its link is down or its connectivity check fails. from interface - The IP address comes from the specified interface. auto detected -The DDNS server checks the source IP address of the packets from the Zyxel Device for the IP address to use for the domain name. custom - The IP address is static. ZyWALL ATP Series Users Guide 338 Chapter 11 DDNS Table 137 Configuration > Network > DDNS (continued) LABEL Apply Reset DESCRIPTION Click this button to save your changes to the Zyxel Device. Click this button to return the screen to its last-saved settings. 11.2.1 The Dynamic DNS Add/Edit Screen The DDNS Add/Edit screen allows you to add a domain name to the Zyxel Device or to edit the configuration of an existing domain name. Click Configuration > Network > DDNS and then an Add or Edit icon to open this screen. Figure 233 Configuration > Network > DDNS > Add ZyWALL ATP Series Users Guide 339 Chapter 11 DDNS Figure 234 Configuration > Network > DDNS > Add - Custom The following table describes the labels in this screen. Table 138 Configuration > Network > DDNS > Add LABEL Show Advanced Settings / Hide Advanced Settings Enable DDNS Profile Profile Name DESCRIPTION Click this button to display a greater or lesser number of configuration fields. Select this check box to use this DDNS entry. When you are adding a DDNS entry, type a descriptive name for this DDNS entry in the Zyxel Device. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. DDNS Type HTTPS Username This field is read-only when you are editing an entry. Select the type of DDNS service you are using. Select User custom to create your own DDNS service and configure the DYNDNS Server, URL, and Additional DDNS Options fields below. Select this to encrypt traffic using SSL (port 443), including traffic with username and password, to the DDNS server. Not all DDNS providers support this option. Type the user name used when you registered your domain name. You can use up to 31 alphanumeric characters and the underscore. Spaces are not allowed. For a Dynu DDNS entry, this user name is the one you use for logging into the service, not the name recorded in your personal information in the Dynu website. ZyWALL ATP Series Users Guide 340 Chapter 11 DDNS Table 138 Configuration > Network > DDNS > Add (continued) LABEL Password DESCRIPTION Type the password provided by the DDNS provider. You can use up to 64 alphanumeric characters and the underscore. Spaces are not allowed. Type the password again to confirm it. Retype to Confirm DDNS Settings Domain name Primary Binding Address Interface IP Address Custom IP Backup Binding Address Interface IP Address Custom IP Enable Wildcard Type the domain name you registered. You can use up to 255 characters. Use these fields to set how the Zyxel Device determines the IP address that is mapped to your domain name in the DDNS server. The Zyxel Device uses the Backup Binding Address if the interface specified by these settings is not available. Select the interface to use for updating the IP address mapped to the domain name. Select Any to let the domain name be used with any interface. The options available in this field vary by DDNS provider. Interface -The Zyxel Device uses the IP address of the specified interface. This option appears when you select a specific interface in the Primary Binding Address Interface field. Auto - If the interface has a dynamic IP address, the DDNS server checks the source IP address of the packets from the Zyxel Device for the IP address to use for the domain name. You may want to use this if there are one or more NAT routers between the Zyxel Device and the DDNS server. Note: The Zyxel Device may not determine the proper IP address if there is an HTTP proxy server between the Zyxel Device and the DDNS server. Custom - If you have a static IP address, you can select this to use it for the domain name. The Zyxel Device still sends the static IP address to the DDNS server. This field is only available when the IP Address is Custom. Type the IP address to use for the domain name. Use these fields to set an alternate interface to map the domain name to when the interface specified by the Primary Binding Interface settings is not available. Select the interface to use for updating the IP address mapped to the domain name. Select Any to let the domain name be used with any interface. Select None to not use a backup address. The options available in this field vary by DDNS provider. Interface -The Zyxel Device uses the IP address of the specified interface. This option appears when you select a specific interface in the Backup Binding Address Interface field. Auto -The DDNS server checks the source IP address of the packets from the Zyxel Device for the IP address to use for the domain name. You may want to use this if there are one or more NAT routers between the Zyxel Device and the DDNS server. Note: The Zyxel Device may not determine the proper IP address if there is an HTTP proxy server between the Zyxel Device and the DDNS server. Custom - If you have a static IP address, you can select this to use it for the domain name. The Zyxel Device still sends the static IP address to the DDNS server. This field is only available when the IP Address is Custom. Type the IP address to use for the domain name. This option is only available with a DynDNS account. Enable the wildcard feature to alias subdomains to be aliased to the same IP address as your (dynamic) domain name. This feature is useful if you want to be able to use, for example, www.yourhost.dyndns.org and still reach your hostname. ZyWALL ATP Series Users Guide 341 Chapter 11 DDNS Table 138 Configuration > Network > DDNS > Add (continued) LABEL Mail Exchanger DESCRIPTION This option is only available with a DynDNS account. DynDNS can route email for your domain name to a mail server (called a mail exchanger). For example, DynDNS routes email for john-doe@yourhost.dyndns.org to the host record specified as the mail exchanger. If you are using this service, type the host record of your mail server here. Otherwise leave the field blank. See www.dyndns.org for more information about mail exchangers. This option is only available with a DynDNS account. Select this check box if you are using DynDNSs backup service for email. With this service, DynDNS holds onto your email if your mail server is not available. Once your mail server is available again, the DynDNS server delivers the mail to you. See www.dyndns.org for more information about this service. This field displays when you select User custom from the DDNS Type field above. Type the IP address of the server that will host the DDSN service. This field displays when you select User custom from the DDNS Type field above. Type the URL that can be used to access the server that will host the DDSN service. This field displays when you select User custom from the DDNS Type field above. These are the options supported at the time of writing:

dyndns_system to specify the DYNDNS Server type - for example, dyndns@dyndns.org ip_server_name which should be the URL to get the servers public IP address - for example, http://myip.easylife.tw/

Backup Mail Exchanger DYNDNS Server URL Additional DDNS Options OK Cancel Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving. ZyWALL ATP Series Users Guide 342 CHAPTER 12 NAT 12.1 NAT Overview NAT (Network Address Translation - NAT, RFC 1631) is the translation of the IP address of a host in a packet. For example, the source address of an outgoing packet, used within one network is changed to a different IP address known within another network. Use Network Address Translation (NAT) to make computers on a private network behind the Zyxel Device available outside the private network. If the Zyxel Device has only one public IP address, you can make the computers in the private network available by using ports to forward packets to the appropriate private IP address. Suppose you want to assign ports 21-25 to one FTP, Telnet and SMTP server (A in the example), port 80 to another (B in the example) and assign a default server IP address of 192.168.1.35 to a third (C in the example). You assign the LAN IP addresses and the ISP assigns the WAN IP address. The NAT network appears as a single host on the Internet. Figure 235 Multiple Servers Behind NAT Example 12.1.1 What You Can Do in this Chapter Use the NAT screens (see Section 12.2 on page 344) to view and manage the list of NAT rules and see their configuration details. You can also create new NAT rules and edit or delete existing ones. 12.1.2 What You Need to Know NAT is also known as virtual server, port forwarding, or port translation. Well-known Ports Port numbers range from 0 to 65535, but only port numbers 0 to 1023 are reserved for privileged services and designated as well-known ports. The following list specifies the ports used by the server process as its contact ports. See Section 35.7 on page 665 (Configuration > Object > Service) for more information about service objects. ZyWALL ATP Series Users Guide 343 Chapter 12 NAT Well-known ports range from 0 to 1023. Registered ports range from 1024 to 49151. Dynamic ports (also called private ports) range from 49152 to 65535. Table 139 Well-known Ports PORT 1 20 21 22 23 25 42 43 53 67 68 69 79 80 110 119 123 135 137 138 139 143 161 179 389 443 445 636 953 990 995 DESCRIPTION TCP Port Service Multiplexer (TCPMUX) FTP- Data FTP - Control SSH Remote Login Protocol Telnet Simple Mail Transfer Protocol (SMTP) Host Name Server (Nameserv) WhoIs Domain Name System (DNS) BOOTP/DHCP server BOOTP/DHCP client Trivial File Transfer Protocol (TFTP) Finger HTTP POP3 Newsgroup (NNTP) Network Time Protocol (NTP) RPC Locator service NetBIOS Name Service NetBIOS Datagram Service NetBIOS Datagram Service Interim Mail Access Protocol (IMAP) SNMP Border Gateway Protocol (BGP) Lightweight Directory Access Protocol (LDAP) HTTPS Microsoft - DS LDAP over TLS/SSL (LDAPS) BIND DNS FTP over TLS/SSL (FTPS) POP3 over TLS/SSL (POP3S) TCP/UDP TCP TCP TCP TCP TCP TCP UDP TCP TCP/UDP UDP UDP UDP TCP TCP TCP TCP UDP TCP/UDP TCP/UDP UDP TCP TCP UDP TCP TCP/UDP TCP TCP TCP TCP TCP TCP 12.2 The NAT Screen The NAT summary screen provides a summary of all NAT rules and their configuration. In addition, this screen allows you to create new NAT rules and edit and delete existing NAT rules. To access this screen, ZyWALL ATP Series Users Guide 344 Chapter 12 NAT login to the Web Configurator and click Configuration > Network > NAT. The following screen appears, providing a summary of the existing NAT rules. Click on the icons to go to the OneSecurity website where there is guidance on configuration walkthroughs, troubleshooting, and other information. Figure 236 Configuration > Network > NAT The following table describes the labels in this screen. Table 140 Configuration > Network > NAT LABEL Use Static-Dynamic Route to Control 1-1 NAT Route DESCRIPTION If you are using SiteToSite VPN and 1-1 SNAT, its recommended that you select this check box. Otherwise, youll need to create policy route rules for VPN and Destination NAT traffic. Note that the selection of this check box will change the priority of the routing flow

(SiteToSite VPN, Static-Dynamic Route, and 1-1 SNAT). See Chapter 42 on page 842 for more information about the routing flow. Click this to create a new entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. To change a rules position in the numbered list, select the rule and click Move to display a field to type a number for where you want to put that rule and press [ENTER] to move the rule to the number that you typed. The ordering of your rules is important as they are applied in order of their numbering. This field is a sequential value, and it is not associated with a specific entry. This icon is lit when the entry is active and dimmed when the entry is inactive. This field displays the priority for the entry. The smaller the number, the higher the priority. This field displays the name of the entry. This field displays what kind of NAT this entry performs: Virtual Server, 1:1 NAT, or Many 1:1 NAT. This field displays the interface on which packets for the NAT entry are received. This field displays the source IP address (or address object) of traffic that matches this NAT entry. It displays any if there is no restriction on the source IP address. This field displays the original destination IP address (or address object) of traffic that matches this NAT entry. It displays any if there is no restriction on the original destination IP address. ZyWALL ATP Series Users Guide 345 Add Edit Remove Activate Inactivate Move

#

Status Priority Name Mapping Type Interface Source IP External IP Chapter 12 NAT Table 140 Configuration > Network > NAT (continued) LABEL Internal IP Protocol DESCRIPTION This field displays the new destination IP address for the packet. This field displays the service used by the packets for this NAT entry. It displays any if there is no restriction on the services. This field displays the original destination port(s) of packets for the NAT entry. This field is blank if there is no restriction on the original destination port. This field displays the new destination port(s) for the packet. This field is blank if there is no restriction on the original destination port. Click this button to save your changes to the Zyxel Device. Click this button to return the screen to its last-saved settings. External Port Internal Port Apply Reset 12.2.1 The NAT Add/Edit Screen The NAT Add/Edit screen lets you create new NAT rules and edit existing ones. To open this window, open the NAT summary screen. (See Section 12.2 on page 344.) Then, click on an Add icon or Edit icon to open the following screen. Figure 237 Configuration > Network > NAT > Add The following table describes the labels in this screen. Table 141 Configuration > Network > NAT > Add LABEL Create new Object Enable Rule Rule Name DESCRIPTION Use to configure any new settings objects that you need to use in this screen. Use this option to turn the NAT rule on or off. Type in the name of the NAT rule. The name is used to refer to the NAT rule. You may use 1-

31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. ZyWALL ATP Series Users Guide 346 Chapter 12 NAT Table 141 Configuration > Network > NAT > Add (continued) LABEL Classification DESCRIPTION Select what kind of NAT this rule is to perform. Virtual Server - This makes computers on a private network behind the Zyxel Device available to a public network outside the Zyxel Device (like the Internet). 1:1 NAT - If the private network server will initiate sessions to the outside clients, select this to have the Zyxel Device translate the source IP address of the servers outgoing traffic to the same public IP address that the outside clients use to access the server. Many 1:1 NAT - If you have a range of private network servers that will initiate sessions to the outside clients and a range of public IP addresses, select this to have the Zyxel Device translate the source IP address of each servers outgoing traffic to the same one of the public IP addresses that the outside clients use to access the server. The private and public ranges must have the same number of IP addresses. Incoming Interface Source IP External IP User Defined External IP External IP Subnet/

Range Internal IP User Defined Internal IP Internal IP Subnet/

Range One many 1:1 NAT rule works like multiple 1:1 NAT rules, but it eases configuration effort since you only create one rule. Select the interface on which packets for the NAT rule must be received. It can be an Ethernet, VLAN, bridge, or PPPoE/PPTP interface. Specify the source IP address of the packets received by this NAT rules specified incoming interface. any - Select this to use all of the incoming interfaces IP addresses including dynamic addresses or those of any virtual interfaces built upon the selected incoming interface. User Defined - Select this to manually enter an IP address in the User Defined field. For example, you could enter a static IP address. Host address - select a address object to use the IP address it specifies. Specify the destination IP address of the packets received by this NAT rules specified incoming interface. The specified IP address will be translated to the Internal IP address. any - Select this to use all of the incoming interfaces IP addresses including dynamic addresses or those of any virtual interfaces built upon the selected incoming interface. User Defined - Select this to manually enter an IP address in the User Defined field. For example, you could enter a static public IP assigned by the ISP without having to create a virtual interface for it. Host address - select a host address object to use the IP address it specifies. The list also includes address objects based on interface IPs. So for example you could select an address object based on a WAN interface even if it has a dynamic IP address. This field is available if External IP is User Defined. Type the destination IP address that this NAT rule supports. This field displays for Many 1:1 NAT. Select the destination IP address subnet or IP address range that this NAT rule supports. The original and mapped IP address subnets or ranges must have the same number of IP addresses. Select to which translated destination IP address this NAT rule forwards packets. User Defined - this NAT rule supports a specific IP address, specified in the User Defined field. HOST address - the drop-down box lists all the HOST address objects in the Zyxel Device. If you select one of them, this NAT rule supports the IP address specified by the address object. This field is available if Internal IP is User Defined. Type the translated destination IP address that this NAT rule supports. This field displays for Many 1:1 NAT. Select to which translated destination IP address subnet or IP address range this NAT rule forwards packets. The original and mapped IP address subnets or ranges must have the same number of IP addresses. ZyWALL ATP Series Users Guide 347 Chapter 12 NAT Table 141 Configuration > Network > NAT > Add (continued) LABEL Port Mapping Type DESCRIPTION Use the drop-down list box to select how many original destination ports this NAT rule supports for the selected destination IP address (Original IP). Choices are:

Any - this NAT rule supports all the destination ports. Port - this NAT rule supports one destination port. Ports - this NAT rule supports a range of destination ports. You might use a range of destination ports for unknown services or when one server supports more than one service. Service - this NAT rule supports a service such as FTP (see Object > Service > Service) Service-Group - this NAT rule supports a group of services such as all service objects related to DNS (see Object > Service > Service Group) This field is available if Mapping Type is Port or Ports. Select the protocol (TCP, UDP, or Any) used by the service requesting the connection. This field is available if Mapping Type is Port. Enter the external destination port this NAT rule supports. This field is available if Mapping Type is Port. Enter the translated destination port if this NAT rule forwards the packet. This field is available if Mapping Type is Ports. Enter the beginning of the range of original destination ports this NAT rule supports. This field is available if Mapping Type is Ports. Enter the end of the range of original destination ports this NAT rule supports. This field is available if Mapping Type is Ports. Enter the beginning of the range of translated destination ports if this NAT rule forwards the packet. This field is available if Mapping Type is Ports. Enter the end of the range of translated destination ports if this NAT rule forwards the packet. The original port range and the mapped port range must be the same size. Enable NAT loopback to allow users connected to any interface (instead of just the specified Incoming Interface) to use the NAT rules specified External IP address to access the Internal IP device. For users connected to the same interface as the Internal IP device, the Zyxel Device uses that interfaces IP address as the source address for the traffic it sends from the users to the Internal IP device. For example, if you configure a NAT rule to forward traffic from the WAN to a LAN server, enabling NAT loopback allows users connected to other interfaces to also access the server. For LAN users, the Zyxel Device uses the LAN interfaces IP address as the source address for the traffic it sends to the LAN server. See NAT Loopback on page 349 for more details. If you do not enable NAT loopback, this NAT rule only applies to packets received on the rules specified incoming interface. By default the security policy blocks incoming connections from external addresses. After you configure your NAT rule settings, click the Security Policy link to configure a security policy to allow the NAT rules traffic to come in. The Zyxel Device checks NAT rules before it applies To-Zyxel Device security policies, so To-

Zyxel Device security policies, do not apply to traffic that is forwarded by NAT rules. The Zyxel Device still checks other security policies, according to the source IP address and mapped IP address. Click OK to save your changes back to the Zyxel Device. Click Cancel to return to the NAT summary screen without creating the NAT rule (if it is new) or saving any changes (if it already exists). ZyWALL ATP Series Users Guide 348 Protocol Type External Port Internal Port External Start Port External End Port Internal Start Port Internal End Port Enable NAT Loopback Security Policy OK Cancel Chapter 12 NAT 12.3 NAT Technical Reference Here is more detailed information about NAT on the Zyxel Device. NAT Loopback Suppose an NAT 1:1 rule maps a public IP address to the private IP address of a LAN SMTP email server to give WAN users access. NAT loopback allows other users to also use the rules original IP to access the mail server. For example, a LAN users computer at IP address 192.168.1.89 queries a public DNS server to resolve the SMTP servers domain name (xxx.LAN-SMTP.com in this example) and gets the SMTP servers mapped public IP address of 1.1.1.1. Figure 238 LAN Computer Queries a Public DNS Server DNS xxx.LAN-SMTP.com = 1.1.1.1 xxx.LAN-SMTP.com =?

1.1.1.1 LAN 192.168.1.21 192.168.1.89 The LAN users computer then sends traffic to IP address 1.1.1.1. NAT loopback uses the IP address of the Zyxel Devices LAN interface (192.168.1.1) as the source address of the traffic going from the LAN users to the LAN SMTP server. ZyWALL ATP Series Users Guide 349 Figure 239 LAN to LAN Traffic Chapter 12 NAT NAT Source 192.168.1.1 Source 192.168.1.89 SMTP LAN SMTP 192.168.1.21 192.168.1.89 The LAN SMTP server replies to the Zyxel Devices LAN IP address and the Zyxel Device changes the source address to 1.1.1.1 before sending it to the LAN user. The return traffics source matches the original destination address (1.1.1.1). If the SMTP server replied directly to the LAN user without the traffic going through NAT, the source would not match the original destination address which would cause the LAN users computer to shut down the session. Figure 240 LAN to LAN Return Traffic NAT Source 192.168.1.21 SMTP LAN Source 1.1.1.1 SMTP 192.168.1.21 192.168.1.89 ZyWALL ATP Series Users Guide 350 CHAPTER 13 Redirect Service 13.1 Overview Redirect Service redirects HTTP and SMTP traffic. 13.1.1 HTTP Redirect HTTP redirect forwards the clients HTTP request (except HTTP traffic destined for the Zyxel Device) to a web proxy server. In the following example, proxy server A is connected to the DMZ interface. When a client connected to the LAN1 zone wants to open a web page, its HTTP request is redirected to proxy server A first. If proxy server A cannot find the web page in its cache, a policy route allows it to access the Internet to get them from a server. Proxy server A then forwards the response to the client. Figure 241 HTTP Redirect Example 13.1.2 SMTP Redirect SMTP redirect forwards the authenticated clients SMTP message to a SMTP server, that handles all outgoing email messages. In the following example, SMTP server A is connected to the lan2 interface in the LAN2 zone. When a client connected to the lan1 interface in the LAN1 zone logs into the Zyxel Device and wants to send an email, its SMTP message is redirected to SMTP server A. SMTP server A then sends it to a mail server, where the message will be delivered to the recipient. The Zyxel Device forwards SMTP traffic using TCP port 25. ZyWALL ATP Series Users Guide 351 Chapter 13 Redirect Service Figure 242 SMTP Redirect Example 13.1.3 What You Can Do in this Chapter Use the Redirect Service screens (see Section 13.2 on page 354) to display and edit the HTTP and SMTP redirect rules. 13.1.4 What You Need to Know Web Proxy Server A proxy server helps client devices make indirect requests to access the Internet or outside network resources/services. A proxy server can act as a security policy or an ALG (application layer gateway) between the private network and the Internet or other networks. It also keeps hackers from knowing internal IP addresses. A client connects to a web proxy server each time he/she wants to access the Internet. The web proxy provides caching service to allow quick access and reduce network usage. The proxy checks its local cache for the requested web resource first. If it is not found, the proxy gets it from the specified server and forwards the response to the client. HTTP Redirect, Security Policy and Policy Route With HTTP redirect, the relevant packet flow for HTTP traffic is:

1 Security Policy 2 Application Patrol 3 4 HTTP Redirect Policy Route ZyWALL ATP Series Users Guide 352 Chapter 13 Redirect Service Even if you set a policy route to the same incoming interface and service as a HTTP redirect rule, the Zyxel Device checks the HTTP redirect rules first and forwards HTTP traffic to a proxy server if matched. You need to make sure there is no security policy blocking the HTTP requests from the client to the proxy server. You also need to manually configure a policy route to forward the HTTP traffic from the proxy server to the Internet. To make the example in Figure 241 on page 351 work, make sure you have the following settings. For HTTP traffic between lan1 and dmz:

a from LAN1 to DMZ security policy (default) to allow HTTP requests from lan1 to dmz. Responses to this request are allowed automatically. a application patrol rule to allow HTTP traffic between lan1 and dmz. a HTTP redirect rule to forward HTTP traffic from lan1 to proxy server A. For HTTP traffic between dmz and wan1:

a from DMZ to WAN security policy (default) to allow HTTP requests from dmz to wan1. Responses to these requests are allowed automatically. a application patrol rule to allow HTTP traffic between dmz and wan1. a policy route to forward HTTP traffic from proxy server A to the Internet. SMTP Simple Mail Transfer Protocol (SMTP) is the Internets message transport standard. It controls the sending of email messages between servers. Email clients (also called email applications) then use mail server protocols such as POP (Post Office Protocol) or IMAP (Internet Message Access Protocol) to retrieve email. Email clients also generally use SMTP to send messages to a mail server. The older POP2 requires SMTP for sending messages while the newer POP3 can be used with or without it. This is why many email applications require you to specify both the SMTP server and the POP or IMAP server (even though they may actually be the same server). SMTP Redirect, Firewall and Policy Route With SMTP redirect, the relevant packet flow for SMTP traffic is:

1 2 3 Firewall SMTP Redirect Policy Route Even if you set a policy route to the same incoming interface and service as a SMTP redirect rule, the Zyxel Device checks the SMTP redirect rules first and forwards SMTP traffic to a SMTP server if matched. You need to make sure there is no firewall rule(s) blocking the SMTP traffic from the client to the SMTP server. You also need to manually configure a policy route to forward the SMTP traffic from the SMTP server to the Internet. To make the example in Figure 242 on page 352 work, make sure you have the following settings. ZyWALL ATP Series Users Guide 353 Chapter 13 Redirect Service For SMTP traffic between lan1 and lan2:

a from LAN1 to LAN2 firewall rule to allow SMTP messages from lan1 to lan2. Responses to this request are allowed automatically. a SMTP redirect rule to forward SMTP traffic from lan1 to SMTP server A. For SMTP traffic between lan2 and wan1:

a from LAN2 to WAN firewall rule (default) to allow SMTP messages from lan2 to wan1. Responses to these requests are allowed automatically. a policy route to forward SMTP messages from SMTP server A to the Internet. 13.2 The Redirect Service Screen To configure redirection of a HTTP or SMTP request, click Configuration > Network > HTTP Redirect. This screen displays the summary of the redirect rules. Note: You can configure up to one HTTP redirect rule and one SMTP redirect rule for each

(incoming) interface. Figure 243 Configuration > Network > Redirect Service The following table describes the labels in this screen. Table 142 Configuration > Network > Redirect Service LABEL Add Edit DESCRIPTION Click this to create a new entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. To change a rules position in the numbered list, select the rule and click Move to display a field to type a number for where you want to put that rule and press [ENTER] to move the rule to the number that you typed. The ordering of your rules is important as they are applied in order of their numbering. This field is a sequential value, and it is not associated with a specific entry. ZyWALL ATP Series Users Guide 354 Remove Activate Inactivate Move

#

Chapter 13 Redirect Service Table 142 Configuration > Network > Redirect Service (continued) LABEL Status Service Name User/Group Interface Source Address DESCRIPTION This icon is lit when the entry is active and dimmed when the entry is inactive. This is the name of the service: HTTP or SMTP. This is the descriptive name of a rule. This is the user account or user group name to which this rule is applied. This is the interface on which the request must be received. This is the name of the source IP address object from which the traffic should be sent. If any displays, the rule is effective for every source. This is the IP address of the HTTP proxy server or the SMTP server to which the matched traffic is forwarded. This is the service port number used by the HTTP proxy server or SMTP server. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Server Port Apply Reset 13.2.1 The Redirect Service Edit Screen Click Network > Redirect Service to open the Redirect Service screen. Then click the Add or Edit icon to open the Redirect Service Edit screen where you can configure the rule. Figure 244 Network > Redirect Service > Edit ZyWALL ATP Series Users Guide 355 Chapter 13 Redirect Service The following table describes the labels in this screen. Table 143 Network > Redirect Service > Edit LABEL Enable Service Name DESCRIPTION Use this option to turn the Redirect Service rule on or off. Select the service to be redirected: HTTP Redirect or SMTP redirect. Enter a name to identify this rule. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Criteria User Interface Source Address Redirect Settings Server Port OK Cancel Select the user account or user group name to which this rule is applied. Select the interface on which the request must be received for the Zyxel Device to forward it to the specified server. Select the name of the source IP address object from which the traffic should be sent. Select any for the rule to be effective for every source. Enter the IP address of the HTTP proxy or SMTP server. Enter the port number that the HTTP proxy or SMTP server uses. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving. ZyWALL ATP Series Users Guide 356 CHAPTER 14 ALG 14.1 ALG Overview Application Layer Gateway (ALG) allows the following applications to operate properly through the Zyxel Devices NAT. SIP - Session Initiation Protocol (SIP) - An application-layer protocol that can be used to create voice and multimedia sessions over Internet. H.323 - A teleconferencing protocol suite that provides audio, data and video conferencing. FTP - File Transfer Protocol - an Internet file transfer service. The following example shows SIP signaling (1) and audio (2) sessions between SIP clients A and B and the SIP server. Figure 245 SIP ALG Example The ALG feature is only needed for traffic that goes through the Zyxel Devices NAT. 14.1.1 What You Need to Know Application Layer Gateway (ALG), NAT and Security Policy The Zyxel Device can function as an Application Layer Gateway (ALG) to allow certain NAT un-friendly applications (such as SIP) to operate properly through the Zyxel Devices NAT and security policy. The Zyxel Device dynamically creates an implicit NAT session and security policy session for the applications traffic from the WAN to the LAN. The ALG on the Zyxel Device supports all of the Zyxel Devices NAT mapping types. ZyWALL ATP Series Users Guide 357 Chapter 14 ALG FTP ALG The FTP ALG allows TCP packets with a specified port destination to pass through. If the FTP server is located on the LAN, you must also configure NAT (port forwarding) and security policies if you want to allow access to the server from the WAN. Bandwidth management can be applied to FTP ALG traffic. H.323 ALG The H.323 ALG supports peer-to-peer H.323 calls. The H.323 ALG handles H.323 calls that go through NAT or that the Zyxel Device routes. You can also make other H.323 calls that do not go through NAT or routing. Examples would be calls between LAN IP addresses that are on the same subnet. The H.323 ALG allows calls to go out through NAT. For example, you could make a call from a private IP address on the LAN to a peer device on the WAN. The H.323 ALG operates on TCP packets with a specified port destination. Bandwidth management can be applied to H.323 ALG traffic. The Zyxel Device allows H.323 audio connections. The Zyxel Device can also apply bandwidth management to traffic that goes through the H.323 ALG. The following example shows H.323 signaling (1) and audio (2) sessions between H.323 devices A and B. Figure 246 H.323 ALG Example SIP ALG SIP phones can be in any zone (including LAN, DMZ, WAN), and the SIP server and SIP clients can be in the same network or different networks. The SIP server cannot be on the LAN. It must be on the WAN or the DMZ. There should be only one SIP server (total) on the Zyxel Devices private networks. Any other SIP servers must be on the WAN. So for example you could have a Back-to-Back User Agent such as the IPPBX x6004 or an asterisk PBX on the DMZ or on the LAN but not on both. Using the SIP ALG allows you to use bandwidth management on SIP traffic. Bandwidth management can be applied to FTP ALG traffic. Use the option in the Configuration > BWM screen to configure the highest bandwidth available for SIP traffic. The SIP ALG handles SIP calls that go through NAT or that the Zyxel Device routes. You can also make other SIP calls that do not go through NAT or routing. Examples would be calls between LAN IP addresses that are on the same subnet. The SIP ALG supports peer-to-peer SIP calls. The security policy (by default) allows peer to peer calls from the LAN zone to go to the WAN zone and blocks peer to peer calls from the WAN zone to the LAN zone. The SIP ALG allows UDP packets with a specified port destination to pass through. The Zyxel Device allows SIP audio connections. ZyWALL ATP Series Users Guide 358 Chapter 14 ALG You do not need to use TURN (Traversal Using Relay NAT) for VoIP devices behind the Zyxel Device when you enable the SIP ALG. Configuring the SIP ALG to use custom port numbers for SIP traffic also configures the application patrol (see Chapter 26 on page 515) to use the same port numbers for SIP traffic. Likewise, configuring the application patrol to use custom port numbers for SIP traffic also configures SIP ALG to use the same port numbers for SIP traffic. Peer-to-Peer Calls and the Zyxel Device The Zyxel Device ALG can allow peer-to-peer VoIP calls for both H.323 and SIP. You must configure the security policy and NAT (port forwarding) to allow incoming (peer-to-peer) calls from the WAN to a private IP address on the LAN (or DMZ). VoIP Calls from the WAN with Multiple Outgoing Calls When you configure the security policy and NAT (port forwarding) to allow calls from the WAN to a specific IP address on the LAN, you can also use policy routing to have H.323 (or SIP) calls from other LAN or DMZ IP addresses go out through a different WAN IP address. The policy routing lets the Zyxel Device correctly forward the return traffic for the calls initiated from the LAN IP addresses. For example, you configure the security policy and NAT to allow LAN IP address A to receive calls from the Internet through WAN IP address 1. You also use a policy route to have LAN IP address A make calls out through WAN IP address 1. Configure another policy route to have H.323 (or SIP) calls from LAN IP addresses B and C go out through WAN IP address 2. Even though only LAN IP address A can receive incoming calls from the Internet, LAN IP addresses B and C can still make calls out to the Internet. Figure 247 VoIP Calls from the WAN with Multiple Outgoing Calls VoIP with Multiple WAN IP Addresses With multiple WAN IP addresses on the Zyxel Device, you can configure different security policy and NAT

(port forwarding) rules to allow incoming calls from each WAN IP address to go to a specific IP address on the LAN (or DMZ). Use policy routing to have the H.323 (or SIP) calls from each of those LAN or DMZ IP addresses go out through the same WAN IP address that calls come in on. The policy routing lets the Zyxel Device correctly forward the return traffic for the calls initiated from the LAN IP addresses. For example, you configure security policy and NAT rules to allow LAN IP address A to receive calls through public WAN IP address 1. You configure different security policy and port forwarding rules to allow LAN IP address B to receive calls through public WAN IP address 2. You configure corresponding ZyWALL ATP Series Users Guide 359 Chapter 14 ALG policy routes to have calls from LAN IP address A go out through WAN IP address 1 and calls from LAN IP address B go out through WAN IP address 2. Figure 248 VoIP with Multiple WAN IP Addresses 14.1.2 Before You Begin You must also configure the security policy and enable NAT in the Zyxel Device to allow sessions initiated from the WAN. 14.2 The ALG Screen Click Configuration > Network > ALG to open the ALG screen. Use this screen to turn ALGs off or on, configure the port numbers to which they apply, and configure SIP ALG time outs. Note: If the Zyxel Device provides an ALG for a service, you must enable the ALG in order to use the application patrol on that services traffic. ZyWALL ATP Series Users Guide 360 Chapter 14 ALG Figure 249 Configuration > Network > ALG The following table describes the labels in this screen. Table 144 Configuration > Network > ALG LABEL Enable SIP ALG Enable SIP Transformations Enable Configure SIP Inactivity Timeout SIP Media Inactivity Timeout DESCRIPTION Turn on the SIP ALG to detect SIP traffic and help build SIP sessions through the Zyxel Devices NAT. Enabling the SIP ALG also allows you to use the application patrol to detect SIP traffic and manage the SIP traffics bandwidth (see Chapter 26 on page 515). Select this to have the Zyxel Device modify IP addresses and port numbers embedded in the SIP data payload. You do not need to use this if you have a SIP device or server that will modify IP addresses and port numbers embedded in the SIP data payload. Select this option to have the Zyxel Device apply SIP media and signaling inactivity time out limits. These timeouts will take priority over the SIP session time out Expires value in a SIP registration response packet. Use this field to set how many seconds (1~86400) the Zyxel Device will allow a SIP session to remain idle (without voice traffic) before dropping it. If no voice packets go through the SIP ALG before the timeout period expires, the Zyxel Device deletes the audio session. You cannot hear anything and you will need to make a new call to continue your conversation. ZyWALL ATP Series Users Guide 361 Chapter 14 ALG Table 144 Configuration > Network > ALG (continued) LABEL SIP Signaling Inactivity Timeout DESCRIPTION Most SIP clients have an expire mechanism indicating the lifetime of signaling sessions. The SIP user agent sends registration packets to the SIP server periodically and keeps the session alive in the Zyxel Device. Restrict Peer to Peer Signaling Connection Restrict Peer to Peer Media Connection SIP Signaling Port Enable H.323 ALG Enable H.323 Transformations H.323 Signaling Port Additional H.323 Signaling Port for Transformations Enable FTP ALG Enable FTP Transformations FTP Signaling Port Additional FTP Signaling Port for Transformations Apply Reset If the SIP client does not have this mechanism and makes no calls during the Zyxel Device SIP timeout, the Zyxel Device deletes the signaling session after the timeout period. Enter the SIP signaling session timeout value (1~86400). A signaling connection is used to set up the SIP connection. Enable this if you want signaling connections to only arrive from the IP address(es) you registered with. Signaling connections from other IP addresses will be dropped. A media connection is the audio transfer in a SIP connection. Enable this if you want media connections to only arrive from the IP address(es) you registered with. Media connections from other IP addresses will be dropped. You should disable this if have registered for cloud VoIP services. If you are using a custom UDP port number (not 5060) for SIP traffic, enter it here. Use the Add icon to add fields if you are also using SIP on additional UDP port numbers. Turn on the H.323 ALG to detect H.323 traffic (used for audio communications) and help build H.323 sessions through the Zyxel Devices NAT. Enabling the H.323 ALG also allows you to use the application patrol to detect H.323 traffic and manage the H.323 traffics bandwidth (see Chapter 26 on page 515). Select this to have the Zyxel Device modify IP addresses and port numbers embedded in the H.323 data payload. You do not need to use this if you have a H.323 device or server that will modify IP addresses and port numbers embedded in the H.323 data payload. If you are using a custom TCP port number (not 1720) for H.323 traffic, enter it here. If you are also using H.323 on an additional TCP port number, enter it here. Turn on the FTP ALG to detect FTP (File Transfer Program) traffic and help build FTP sessions through the Zyxel Devices NAT. Enabling the FTP ALG also allows you to use the application patrol to detect FTP traffic and manage the FTP traffics bandwidth (see Chapter 26 on page 515). Select this option to have the Zyxel Device modify IP addresses and port numbers embedded in the FTP data payload to match the Zyxel Devices NAT environment. Clear this option if you have an FTP device or server that will modify IP addresses and port numbers embedded in the FTP data payload to match the Zyxel Devices NAT environment. If you are using a custom TCP port number (not 21) for FTP traffic, enter it here. If you are also using FTP on an additional TCP port number, enter it here. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. 14.3 ALG Technical Reference Here is more detailed information about the Application Layer Gateway. ZyWALL ATP Series Users Guide 362 Chapter 14 ALG ALG Some applications cannot operate through NAT (are NAT unfriendly) because they embed IP addresses and port numbers in their packets data payload. The Zyxel Device examines and uses IP address and port number information embedded in the VoIP traffics data stream. When a device behind the Zyxel Device uses an application for which the Zyxel Device has VoIP pass through enabled, the Zyxel Device translates the devices private IP address inside the data stream to a public IP address. It also records session port numbers and allows the related sessions to go through the security policy so the applications traffic can come in from the WAN to the LAN. ALG and Trunks If you send your ALG-managed traffic through an interface trunk and all of the interfaces are set to active, you can configure routing policies to specify which interface the ALG-managed traffic uses. You could also have a trunk with one interface set to active and a second interface set to passive. The Zyxel Device does not automatically change ALG-managed connections to the second (passive) interface when the active interfaces connection goes down. When the active interfaces connection fails, the client needs to re-initialize the connection through the second interface (that was set to passive) in order to have the connection go through the second interface. VoIP clients usually re-register automatically at set intervals or the users can manually force them to re-register. FTP File Transfer Protocol (FTP) is an Internet file transfer service that operates on the Internet and over TCP/IP networks. A system running the FTP server accepts commands from a system running an FTP client. The service allows users to send commands to the server for uploading and downloading files. H.323 H.323 is a standard teleconferencing protocol suite that provides audio, data and video conferencing. It allows for real-time point-to-point and multipoint communication between client computers over a packet-based network that does not provide a guaranteed quality of service. NetMeeting uses H.323. SIP The Session Initiation Protocol (SIP) is an application-layer control (signaling) protocol that handles the setting up, altering and tearing down of voice and multimedia sessions over the Internet. SIP is used in VoIP (Voice over IP), the sending of voice signals over the Internet Protocol. SIP signaling is separate from the media for which it handles sessions. The media that is exchanged during the session can use a different path from that of the signaling. SIP handles telephone calls and can interface with traditional circuit-switched telephone networks. RTP When you make a VoIP call using H.323 or SIP, the RTP (Real time Transport Protocol) is used to handle voice data transfer. See RFC 1889 for details on RTP. ZyWALL ATP Series Users Guide 363 CHAPTER 15 UPnP 15.1 UPnP and NAT-PMP Overview The Zyxel Device supports both UPnP and NAT-PMP to permit networking devices to discover each other and connect seamlessly. Universal Plug and Play (UPnP) is a distributed, open networking standard that uses TCP/IP for simple peer-to-peer network connectivity between devices. A UPnP device can dynamically join a network, obtain an IP address, convey its capabilities and learn about other devices on the network. In turn, a device can leave a network smoothly and automatically when it is no longer in use. A gateway that supports UPnP is called Internet Gateway Device (IGD). The standardized Device Control Protocol (DCP) is defined by the UPnP Forum for IGDs to configure port mapping automatically. NAT Port Mapping Protocol (NAT-PMP), introduced by Apple and implemented in current Apple products, is used as an alternative NAT traversal solution to the UPnP IGD protocol. NAT-PMP runs over UDP port 5351. NAT-PMP is much simpler than UPnP IGD and mainly designed for small home networks. It allows a client behind a NAT router to retrieve the routers public IP address and port number and make them known to the peer device with which it wants to communicate. The client can automatically configure the NAT router to create a port mapping to allow the peer to contact it. 15.2 What You Need to Know UPnP hardware is identified as an icon in the Network folder (Windows 7). Each UPnP compatible device installed on your network will appear as a separate icon. Selecting the icon of a UPnP device will allow you to access the information and properties of that device. 15.2.1 NAT Traversal UPnP NAT traversal automates the process of allowing an application to operate through NAT. UPnP network devices can automatically configure network addressing, announce their presence in the network to other UPnP devices and enable exchange of simple product and service descriptions. NAT traversal allows the following:

Dynamic port mapping Learning public IP addresses Assigning lease times to mappings Windows Messenger is an example of an application that supports NAT traversal and UPnP. See the NAT chapter for more information on NAT. ZyWALL ATP Series Users Guide 364 Chapter 15 UPnP 15.2.2 Cautions with UPnP and NAT-PMP The automated nature of NAT traversal applications in establishing their own services and opening security policy ports may present network security issues. Network information and configuration may also be obtained and modified by users in some network environments. When a UPnP or NAT-PMP device joins a network, it announces its presence with a multicast message. For security reasons, the Zyxel Device allows multicast messages on the LAN only. All UPnP-enabled or NAT-PMP-enabled devices may communicate freely with each other without additional configuration. Disable UPnP or NAT-PMP if this is not your intention. 15.3 UPnP Screen Use this screen to enable UPnP and NAT-PMP on your Zyxel Device. Click Configuration > Network > UPnP to display the screen shown next. Figure 250 Configuration > Network > UPnP ZyWALL ATP Series Users Guide 365 Chapter 15 UPnP The following table describes the fields in this screen. Table 145 Configuration > Network > UPnP LABEL Enable UPnP DESCRIPTION Select this check box to activate UPnP on the Zyxel Device. Be aware that anyone could use a UPnP application to open the web configurator's login screen without entering the Zyxel Device's IP address (although you must still enter the password to access the web configurator). NAT Port Mapping Protocol (NAT-PMP) automates port forwarding to allow a computer in a private network (behind the Zyxel Device) to automatically configure the Zyxel Device to allow computers outside the private network to contact it. Select this check box to activate NAT-PMP on the Zyxel Device. Be aware that anyone could use a NAT-PMP application to open the web configurator's login screen without entering the Zyxel Device's IP address (although you must still enter the password to access the web configurator). Select this check box to allow traffic from UPnP-enabled or NAT-PMP-enabled applications to bypass the security policy. Clear this check box to have the security policy block all UPnP or NAT-PMP application packets (for example, MSN packets). Select through which WAN interface(s) you want to send out traffic from UPnP-enabled or NAT-PMP-enabled applications. If the WAN interface you select loses its connection, the Zyxel Device attempts to use the other WAN interface. If the other WAN interface also does not work, the Zyxel Device drops outgoing packets from UPnP-enabled or NAT-PMP-enabled applications. The Available list displays the name(s) of the internal interface(s) on which the Zyxel Device supports UPnP and/or NAT-PMP. To enable UPnP and/or NAT-PMP on an interface, you can double-click a single entry to move it or use the [Shift] or [Ctrl] key to select multiple entries and click the right arrow button to add to the Member list. To remove an interface, select the name(s) in the Member list and click the left arrow button. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Enable NAT-PMP Allow UPnP or NAT-PMP to pass through Firewall Outgoing WAN Interface Support LAN List Apply Reset 15.4 Technical Reference The sections show examples of using UPnP. 15.4.1 Turning on UPnP in Windows 7 Example This section shows you how to use the UPnP feature in Windows 7. UPnP server is installed in Windows 7. Activate UPnP on the Zyxel Device. Make sure the computer is connected to a LAN port of the Zyxel Device. Turn on your computer and the Zyxel Device. 1 Click the start icon, Control Panel and then the Network and Sharing Center. ZyWALL ATP Series Users Guide 366 Chapter 15 UPnP 2 Click Change Advanced Sharing Settings. 3 Select Turn on network discovery and click Save Changes. Network discovery allows your computer to find other computers and devices on the network and other computers on the network to find your computer. This makes it easier to share files and printers. ZyWALL ATP Series Users Guide 367 Chapter 15 UPnP 15.4.1.1 Auto-discover Your UPnP-enabled Network Device Before you follow these steps, make sure you already have UPnP activated on the Zyxel Device and in your computer. Make sure your computer is connected to a LAN port of the Zyxel Device. 1 Open the Windows Explorer and click Network. 2 Right-click the device icon and select Properties. Figure 251 Network Connections 3 In the Internet Connection Properties window, click Settings to see port mappings. ZyWALL ATP Series Users Guide 368 Chapter 15 UPnP Figure 252 Internet Connection Properties 4 You may edit or delete the port mappings or click Add to manually add port mappings. Figure 253 Internet Connection Properties: Advanced Settings ZyWALL ATP Series Users Guide 369 Chapter 15 UPnP Figure 254 Internet Connection Properties: Advanced Settings: Add Note: When the UPnP-enabled device is disconnected from your computer, all port mappings will be deleted automatically. 5 Click OK. Check the network icon on the system tray to see your Internet connection status. Figure 255 System Tray Icon 6 To see more details about your current Internet connection status, right click on the network icon in the system tray and click Open Network and Sharing Center. Click Local Area Network. Figure 256 Internet Connection Status 15.4.2 Turn on UPnP in Windows 10 Example This section shows you how to use the UPnP feature in Windows 10. UPnP server is installed in Windows 10. Activate UPnP on the Zyxel Device by clicking Network Setting > Home Networking > UPnP. Make sure the computer is connected to the LAN port of the Zyxel Device. Turn on your computer and the Zyxel Device. 1 Click the start icon, Settings and then Network & Internet. ZyWALL ATP Series Users Guide 370 Chapter 15 UPnP 2 Click Network and Sharing Center. 3 Click Change advanced sharing settings. ZyWALL ATP Series Users Guide 371 Chapter 15 UPnP 4 Under Domain, select Turn on network discovery and click Save Changes. Network discovery allows your computer to find other computers and devices on the network and other computers on the network to find your computer. This makes it easier to share files and printers. 15.4.3 Auto-discover Your UPnP-enabled Network Device Before you follow these steps, make sure you already have UPnP activated on the Zyxel Device and in your computer. ZyWALL ATP Series Users Guide 372 Chapter 15 UPnP Make sure your computer is connected to the LAN port of the Zyxel Device. 1 Open File Explorer and click Network. 2 Right-click the Zyxel Device icon and select Properties. Figure 257 Network Connections 3 In the Internet Connection Properties window, click Settings to see port mappings. Figure 258 Internet Connection Properties 4 You may edit or delete the port mappings or click Add to manually add port mappings. ZyWALL ATP Series Users Guide 373 Chapter 15 UPnP Figure 259 Internet Connection Properties: Advanced Settings Figure 260 Internet Connection Properties: Advanced Settings: Add Note: When the UPnP-enabled device is disconnected from your computer, all port mappings will be deleted automatically. 5 Click OK. Check the network icon on the system tray to see your Internet connection status. Figure 261 System Tray Icon 6 To see more details about your current Internet connection status, right click the network icon in the system tray and click Open Network & Internet settings. Click Network and Sharing Center and click the Connections. ZyWALL ATP Series Users Guide 374 Chapter 15 UPnP Figure 262 Internet Connection Status 15.4.4 Web Configurator Easy Access in Windows 7 With UPnP, you can access the web-based configurator on the Zyxel Device without finding out the IP address of the Zyxel Device first. This comes helpful if you do not know the IP address of the Zyxel Device. Follow the steps below to access the web configurator. 1 Open Windows Explorer. 2 Click Network. ZyWALL ATP Series Users Guide 375 Chapter 15 UPnP Figure 263 Network Connections 3 An icon with the description for each UPnP-enabled device displays under Network Infrastructure. 4 Right-click on the icon for your Zyxel Device and select View device webpage. The web configurator login screen displays. Figure 264 Network Connections: My Network Places 5 Right-click on the icon for your Zyxel Device and select Properties. Click the Network Device tab. A window displays with information about the Zyxel Device. ZyWALL ATP Series Users Guide 376 Chapter 15 UPnP Figure 265 Network Connections: My Network Places: Properties: Example 15.4.5 Web Configurator Easy Access in Windows 10 Follow the steps below to access the Web Configurator. 1 Open File Explorer. 2 Click Network. Figure 266 Network Connections ZyWALL ATP Series Users Guide 377 Chapter 15 UPnP 3 An icon with the description for each UPnP-enabled device displays under Network Infrastructure. 4 Right-click the icon for your Zyxel Device and select View device webpage. The Web Configurator login screen displays. Figure 267 Network Connections: Network Infrastructure 5 Right-click the icon for your Zyxel Device and select Properties. Click the Network Device tab. A window displays information about the Zyxel Device. Figure 268 Network Connections: Network Infrastructure: Properties: Example ZyWALL ATP Series Users Guide 378 CHAPTER 16 IP/MAC Binding 16.1 IP/MAC Binding Overview IP address to MAC address binding helps ensure that only the intended devices get to use privileged IP addresses. The Zyxel Device uses DHCP to assign IP addresses and records the MAC address it assigned to each IP address. The Zyxel Device then checks incoming connection attempts against this list. A user cannot manually assign another IP to his computer and use it to connect to the Zyxel Device. Suppose you configure access privileges for IP address 192.168.1.27 and use static DHCP to assign it to Tims computers MAC address of 12:34:56:78:90:AB. IP/MAC binding drops traffic from any computer trying to use IP address 192.168.1.27 with another MAC address. Figure 269 IP/MAC Binding Example Tim Jim MAC: 12:34:56:78:90:AB IP: 192.168.1.27 MAC: AB:CD:EF:12:34:56 IP: 192.168.1.27 16.1.1 What You Can Do in this Chapter Use the Summary and Edit screens (Section 16.2 on page 380) to bind IP addresses to MAC addresses. Use the Exempt List screen (Section 16.3 on page 383) to configure ranges of IP addresses to which the Zyxel Device does not apply IP/MAC binding. 16.1.2 What You Need to Know DHCP IP/MAC address bindings are based on the Zyxel Devices dynamic and static DHCP entries. ZyWALL ATP Series Users Guide 379 Chapter 16 IP/MAC Binding Interfaces Used With IP/MAC Binding IP/MAC address bindings are grouped by interface. You can use IP/MAC binding with Ethernet, bridge, VLAN, and WLAN interfaces. You can also enable or disable IP/MAC binding and logging in an interfaces configuration screen. 16.2 IP/MAC Binding Summary Click Configuration > Network > IP/MAC Binding to open the IP/MAC Binding Summary screen. This screen lists the total number of IP to MAC address bindings for devices connected to each supported interface. Figure 270 Configuration > Network > IP/MAC Binding > Summary The following table describes the labels in this screen. Table 146 Configuration > Network > IP/MAC Binding > Summary LABEL Edit DESCRIPTION Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. This field is a sequential value, and it is not associated with a specific entry. This icon is lit when the entry is active and dimmed when the entry is inactive. This is the name of an interface that supports IP/MAC binding. This field displays the interfaces total number of IP/MAC bindings and IP addresses that the interface has assigned by DHCP. Activate Inactivate

#

Status Interface Number of Binding ZyWALL ATP Series Users Guide 380 Chapter 16 IP/MAC Binding Table 146 Configuration > Network > IP/MAC Binding > Summary (continued) LABEL Apply Reset DESCRIPTION Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. 16.2.1 IP/MAC Binding Edit Click Configuration > Network > IP/MAC Binding > Edit to open the IP/MAC Binding Edit screen. Use this screen to configure an interfaces IP to MAC address binding settings. Figure 271 Configuration > Network > IP/MAC Binding > Edit The following table describes the labels in this screen. Table 147 Configuration > Network > IP/MAC Binding > Edit LABEL IP/MAC Binding Settings DESCRIPTION Interface Name Enable IP/MAC Binding Enable Logs for IP/

MAC Binding Violation Static DHCP Bindings Add Edit This field displays the name of the interface within the Zyxel Device and the interfaces IP address and subnet mask. Select this option to have this interface enforce links between specific IP addresses and specific MAC addresses. This stops anyone else from manually using a bound IP address on another device connected to this interface. Use this to make use only the intended users get to use specific IP addresses. Select this option to have the Zyxel Device generate a log if a device connected to this interface attempts to use an IP address not assigned by the Zyxel Device. This table lists the bound IP and MAC addresses. The Zyxel Device checks this table when it assigns IP addresses. If the computers MAC address is in the table, the Zyxel Device assigns the corresponding IP address. You can also access this table from the interfaces edit screen. Click this to create a new entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. ZyWALL ATP Series Users Guide 381 Chapter 16 IP/MAC Binding Table 147 Configuration > Network > IP/MAC Binding > Edit (continued) LABEL Remove DESCRIPTION To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. This is the index number of the static DHCP entry. This is the IP address that the Zyxel Device assigns to a device with the entrys MAC address. This is the MAC address of the device to which the Zyxel Device assigns the entrys IP address. This helps identify the entry. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving.

#

IP Address MAC Address Description OK Cancel 16.2.2 Static DHCP Edit Click Configuration > Network > IP/MAC Binding > Edit to open the IP/MAC Binding Edit screen. Click the Add or Edit icon to open the following screen. Use this screen to configure an interfaces IP to MAC address binding settings. Figure 272 Configuration > Network > IP/MAC Binding > Edit > Add The following table describes the labels in this screen. Table 148 Configuration > Network > IP/MAC Binding > Edit > Add LABEL Interface Name DESCRIPTION This field displays the name of the interface within the Zyxel Device and the interfaces IP address and subnet mask. Enter the IP address that the Zyxel Device is to assign to a device with the entrys MAC address. Enter the MAC address of the device to which the Zyxel Device assigns the entrys IP address. Enter up to 64 printable ASCII characters to help identify the entry. For example, you may want to list the computers owner. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving. IP Address MAC Address Description OK Cancel ZyWALL ATP Series Users Guide 382 Chapter 16 IP/MAC Binding 16.3 IP/MAC Binding Exempt List Click Configuration > Network > IP/MAC Binding > Exempt List to open the IP/MAC Binding Exempt List screen. Use this screen to configure ranges of IP addresses to which the Zyxel Device does not apply IP/

MAC binding. Figure 273 Configuration > Network > IP/MAC Binding > Exempt List The following table describes the labels in this screen. Table 149 Configuration > Network > IP/MAC Binding > Exempt List LABEL Add Edit Remove DESCRIPTION Click this to create a new entry. Click an entry or select it and click Edit to modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. This is the index number of the IP/MAC binding list entry. Enter a name to help identify this entry. Enter the first IP address in a range of IP addresses for which the Zyxel Device does not apply IP/

MAC binding. Enter the last IP address in a range of IP addresses for which the Zyxel Device does not apply IP/

MAC binding. Click the Add icon to add a new entry. Click the Remove icon to delete an entry. A window displays asking you to confirm that you want to delete it. Click Apply to save your changes back to the Zyxel Device.

#

Name Start IP End IP Add icon Apply ZyWALL ATP Series Users Guide 383 CHAPTER 17 Layer 2 Isolation 17.1 Overview Layer-2 isolation is used to prevent connected devices from communicating with each other in the Zyxel Devices local network(s), except for the devices in the white list, when layer-2 isolation is enabled on the Zyxel Device and the local interface(s). Note: The security policy control must be enabled before you can use layer-2 isolation. In the following example, layer-2 isolation is enabled on the Zyxel Devices interface Vlan1. A printer, PC and AP are in the Vlan1. The IP address of network printer (C) is added to the white list. With this setting, the connected AP then cannot communicate with the PC (D), but can access the network printer (C), server (B), wireless client (A) and the Internet. Figure 274 Layer-2 Isolation Application 17.1.1 What You Can Do in this Chapter Use the General screen (Section 17.2 on page 384) to enable layer-2 isolation on the Zyxel Device and the internal interface(s). Use the White List screen (Section 17.3 on page 385) to enable and configures the white list. 17.2 Layer-2 Isolation General Screen This screen allows you to enable Layer-2 isolation on the Zyxel Device and specific internal interface(s). To access this screen click Configuration > Network > Layer 2 Isolation. ZyWALL ATP Series Users Guide 384 Chapter 17 Layer 2 Isolation Figure 275 Configuration > Network > Layer 2 Isolation The following table describes the labels in this screen. Table 150 Configuration > Network > Layer 2 Isolation LABEL Enable Layer2 Isolation DESCRIPTION Select this option to turn on the layer-2 isolation feature on the Zyxel Device. Member List Apply Reset Note: You can enable this feature only when the security policy is enabled. The Available list displays the name(s) of the internal interface(s) on which you can enable layer-2 isolation. To enable layer-2 isolation on an interface, you can double-click a single entry to move it or use the [Shift] or [Ctrl] key to select multiple entries and click the right arrow button to add to the Member list. To remove an interface, select the name(s) in the Member list and click the left arrow button. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. 17.3 White List Screen IP addresses that are not listed in the white list are blocked from communicating with other devices in the layer-2-isolation-enabled internal interface(s) except for broadcast packets. To access this screen click Configuration > Network > Layer 2 Isolation > White List. ZyWALL ATP Series Users Guide 385 Chapter 17 Layer 2 Isolation Figure 276 Configuration > Network > Layer 2 Isolation > White List The following table describes the labels in this screen. Table 151 Configuration > Network > Layer 2 Isolation > White List LABEL Enable White List DESCRIPTION Select this option to turn on the white list on the Zyxel Device. Add Edit Remove Activate Inactivate

#

Status IP Address Description Apply Reset Note: You can enable this feature only when the security policy is enabled. Click this to add a new rule. Click this to edit the selected rule. Click this to remove the selected rule. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. This field is a sequential value, and it is not associated with a specific rule. This icon is lit when the rule is active and dimmed when the rule is inactive. This field displays the IP address of device that can be accessed by the devices connected to an internal interface on which layer-2 isolation is enabled. This field displays the description for the IP address in this rule. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. 17.3.1 Add/Edit White List Rule This screen allows you to create a new rule in the white list or edit an existing one. To access this screen, click the Add button or select an entry from the list and click the Edit button. Note: You can configure up to 100 white list rules on the Zyxel Device. Note: You need to know the IP address of each connected device that you want to allow to be accessed by other devices when layer-2 isolation is enabled. ZyWALL ATP Series Users Guide 386 Chapter 17 Layer 2 Isolation Figure 277 Configuration > Network > Layer 2 Isolation > White List > Add/Edit The following table describes the labels in this screen. Table 152 Configuration > Network > Layer 2 Isolation > White List > Add/Edit LABEL Enable Host IP Address Description DESCRIPTION Select this option to turn on the rule. Enter an IPv4 address associated with this rule. Specify a description for the IP address associated with this rule. Enter up to 60 characters, spaces and underscores allowed. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. OK Cancel ZyWALL ATP Series Users Guide 387 CHAPTER 18 DNS Inbound LB 18.1 DNS Inbound Load Balancing Overview Inbound load balancing enables the Zyxel Device to respond to a DNS query message with a different IP address for DNS name resolution. The Zyxel Device checks which member interface has the least load and responds to the DNS query message with the interfaces IP address. In the following figure, an Internet host (A) sends a DNS query message to the DNS server (D) in order to resolve a domain name of www.example.com. DNS server D redirects it to the Zyxel Device (Z)s WAN1 with an IP address of 1.1.1.1. The Zyxel Device receives the DNS query message and responds to it with the WAN2s IP address, 2.2.2.2, because the WAN2 has the least load at that moment. Another Internet host (B) also sends a DNS query message to ask where www.example.com is. The Zyxel Device responds to it with the WAN1s IP address, 1.1.1.1, since WAN1 has the least load this time. Figure 278 DNS Load Balancing Example W W A:

Where is www.example.com?

D Its 2.2.2.2. Z:

2 1.1.1.1 Z 2.2.2.2 3 B:

Where is www.example.com?

D Its 1.1.1.1 Z:

2 3 1.1.1.1 2.2.2.2 Z A:

D:

Where is www.example.com?

Ask 1.1.1.1. 1 A B:

D:

Where is www.example.com?

Ask 1.1.1.1. 1 B 18.1.1 What You Can Do in this Chapter Use the Inbound LB screen (see Section 18.2 on page 389) to view a list of the configured DNS load balancing rules. Use the Inbound LB Add/Edit screen (see Section 18.2.1 on page 390) to add or edit a DNS load balancing rule. ZyWALL ATP Series Users Guide 388 Chapter 18 DNS Inbound LB 18.2 The DNS Inbound LB Screen The Inbound LB screen provides a summary of all DNS load balancing rules and the details. You can also use this screen to add, edit, or remove the rules. Click Configuration > Network > Inbound LB to open the following screen. Note: After you finish the inbound load balancing settings, go to security policy and NAT screens to configure the corresponding rule and virtual server to allow the Internet users to access your internal servers. Figure 279 Configuration > Network > DNS Inbound LB The following table describes the labels in this screen. DESCRIPTION Table 153 Configuration > Network > DNS Inbound LB LABEL Global Setting Enable DNS Load Balancing Configuration Add Edit Select this to enable DNS load balancing. Remove Activate Inactivate Move Status Priority Query Domain Name Click this to create a new entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. To move an entry to a different number in the list, click the Move icon. In the field that appears, specify the number to which you want to move the entry. This icon is lit when the entry is active and dimmed when the entry is inactive. This field displays the order in which the Zyxel Device checks the member interfaces of this DNS load balancing rule. This field displays the domain name for which the Zyxel Device manages load balancing between the specified interfaces. ZyWALL ATP Series Users Guide 389 Chapter 18 DNS Inbound LB Table 153 Configuration > Network > DNS Inbound LB (continued) LABEL Query From Address DESCRIPTION This field displays the source IP address of the DNS query messages to which the Zyxel Device applies the DNS load balancing rule. The Zyxel Device applies the DNS load balancing rule to the query messages received from this zone. This field displays the member interfaces which the Zyxel Device manages for load balancing. This field displays the load balancing method the Zyxel Device uses for this DNS load balancing rule. Weighted Round Robin - Each member interface is assigned a weight. An interface with a larger weight gets more chances to transmit traffic than an interface with a smaller weight. For example, if the weight ratio of wan1 and wan2 interfaces is 2:1, the Zyxel Device chooses wan1 for 2 sessions traffic and wan2 for 1 sessions traffic in each round of 3 new sessions. Least Connection - The Zyxel Device chooses choose a member interface which is handling the least number of sessions. Least Load - Outbound - The Zyxel Device chooses a member interface which is handling the least amount of outgoing traffic. Least Load - Inbound - The Zyxel Device chooses a member interface which is handling the least amount of incoming traffic. Least Load - Total - The Zyxel Device chooses a member interface which is handling the least amount of outgoing and incoming traffic. Click this button to save your changes to the Zyxel Device. Click this button to return the screen to its last-saved settings. Query From Zone Load Balancing Member Algorithm Apply Reset 18.2.1 The DNS Inbound LB Add/Edit Screen The Add DNS Load Balancing screen allows you to add a domain name for which the Zyxel Device manages load balancing between the specified interfaces. You can configure the Zyxel Device to apply DNS load balancing to some specific hosts only by configuring the Query From settings. Click Configuration > Network > Inbound LB and then the Add or Edit icon to open this screen. ZyWALL ATP Series Users Guide 390 Chapter 18 DNS Inbound LB Figure 280 Configuration > Network > DNS Inbound LB > Add The following table describes the labels in this screen. DESCRIPTION Use this to configure any new setting objects that you need to use in this screen. Table 154 Configuration > Network > DNS Inbound LB > Add/Edit LABEL Create New Object General Settings Enable DNS Settings Query Domain Name Select this to enable this DNS load balancing rule. Type up to 255 characters for a domain name for which you want the Zyxel Device to manage DNS load balancing. You can use a wildcard (*) to let multiple domains match the name. For example, use *.example.com to specify any domain name that ends with example.com would match. Enter the number of seconds the Zyxel Device recommends DNS request hosts to keep the DNS entry in their caches before removing it. Enter 0 to have the Zyxel Device not recommend this so the DNS request hosts will follow their DNS servers TTL setting. Time to Live Query From Setting IP Address Select the name of an P address object, including geographic address object, of a computer or a DNS server which makes the DNS queries upon which to apply this rule. DNS servers process client queries using recursion or iteration:

In recursion, DNS servers make recursive queries on behalf of clients. So you have to configure this field to the DNS servers IP address when recursion is used. In iteration, a client asks the DNS server and expects the best and immediate answer without the DNS server contacting other DNS servers. If the primary DNS server cannot provide the best answer, the client makes iteration queries to other configured DNS servers to resolve the name. You have to configure this field to the clients IP address when iteration is used. ZyWALL ATP Series Users Guide 391 Chapter 18 DNS Inbound LB DESCRIPTION Select the zone of DNS query messages upon which to apply this rule. Table 154 Configuration > Network > DNS Inbound LB > Add/Edit (continued) LABEL Zone Load Balancing Member Load Balancing Algorithm Select a load balancing method to use from the drop-down list box. Select Weighted Round Robin to balance the traffic load between interfaces based on their respective weights. An interface with a larger weight gets more chances to transmit traffic than an interface with a smaller weight. For example, if the weight ratio of wan1 and wan2 interfaces is 2:1, the Zyxel Device chooses wan1 for 2 sessions traffic and wan2 for every sessions traffic in each round of 3 new sessions. Select Least Connection to have the Zyxel Device choose the member interface which is handling the least number of sessions. Select Least Load - Outbound to have the Zyxel Device choose the member interface which is handling the least amount of outgoing traffic. Select Least Load - Inbound to have the Zyxel Device choose the member interface which is handling the least amount of incoming traffic. Select Least Load - Total to have the Zyxel Device choose the member interface which is handling the least amount of outgoing and incoming traffic. Enter an alternate IP address with which the Zyxel Device will respond to a DNS query message when the load balancing algorithm cannot find any available interface. Click this to create a new member interface for this rule. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. This field displays the order in which the Zyxel Device checks this rules member interfaces. This field displays the IP address of the member interface. This field displays the name of the member interface. The Zyxel Device manages load balancing between the member interfaces. This field is available if you selected Weighted Round Robin as the load balancing algorithm. This field displays the weight of the member interface. An interface with a larger weight gets more chances to transmit traffic than an interface with a smaller weight. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving. Failover IP Address Add Edit Remove

#

IP Address Monitor Interface Weight OK Cancel 18.2.2 The DNS Inbound LB Add/Edit Member Screen The Add Load Balancing Member screen allows you to add a member interface for the DNS load balancing rule. Click Configuration > Network > DNS Inbound LB > Add or Edit and then an Add or Edit icon to open this screen. ZyWALL ATP Series Users Guide 392 Chapter 18 DNS Inbound LB Figure 281 Configuration > Network > DNS Inbound LB > Add/Edit > Add The following table describes the labels in this screen. Table 155 Configuration > Network > DNS Inbound LB > Add/Edit > Add/Edit LABEL Member Monitor Interface DESCRIPTION The Zyxel Device checks each member interfaces loading in the order displayed here. Select an interface to associate it with the DNS load balancing rule. This field also displays whether the IP address is a static IP address (Static), dynamically assigned (Dynamic) or obtained from a DHCP server (DHCP Client), as well as the IP address and subnet mask. This field is available if you selected Weighted Round Robin for the load balancing algorithm. Weight IP Address Same as Monitor Interface Custom OK Cancel Specify the weight of the member interface. An interface with a larger weight gets more chances to transmit traffic than an interface with a smaller weight. Select this to send the IP address displayed in the Monitor Interface field to the DNS query senders. Select this and enter another IP address to send to the DNS query senders. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving. ZyWALL ATP Series Users Guide 393 CHAPTER 19 IPnP 19.1 IPnP Overview IP Plug and Play (IPnP) allows a computer to access the Internet without changing the network settings

(such as IP address and subnet mask) of the computer, even when the IP addresses of the computer and the Zyxel Device are not in the same subnet. When you disable the IPnP feature, only computers with dynamic IP addresses or static IP addresses in the same subnet as the Zyxel Devices LAN IP address can connect to the Zyxel Device or access the Internet through the Zyxel Device. The IPnP feature does not apply to a computer using either a dynamic IP address or a static IP address that is in the same subnet as the Zyxel Device's IP address. Note: You must enable NAT to use the IPnP feature. The following figure depicts a scenario where a computer is set to use a static private IP address in the corporate environment. In a residential house where a Zyxel Device is installed, you can still use the computer to access the Internet without changing the network settings, even when the IP addresses of the computer and the Zyxel Device are not in the same subnet. Figure 282 IPnP Application 19.1.1 What You Can Do in this Chapter Use the IPnP screen (Section 19.2 on page 395) to enable IPnP on the Zyxel Device and the internal interface(s). ZyWALL ATP Series Users Guide 394 Chapter 19 IPnP 19.2 IPnP Screen This screen allows you to enable IPnP on the Zyxel Device and specific internal interface(s). To access this screen click Configuration > Network > IPnP. Figure 283 Configuration > Network > IPnP The following table describes the labels in this screen. Table 156 Configuration > Network > IPnP LABEL Enable IPnP DESCRIPTION Select this option to turn on the IPnP feature on the Zyxel Device. Member List Note: You can enable this feature only when the security policy is enabled. The Available list displays the name(s) of the internal interface(s) on which you can enable IPnP. To enable IPnP on an interface, you can double-click a single entry to move it or use the [Shift]

or [Ctrl] key to select multiple entries and click the right arrow button to add to the Member list. To remove an interface, select the name(s) in the Member list and click the left arrow button. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Apply Reset ZyWALL ATP Series Users Guide 395 CHAPTER 20 IPSec VPN 20.1 Virtual Private Networks (VPN) Overview A virtual private network (VPN) provides secure communications between sites without the expense of leased site-to-site lines. A secure VPN is a combination of tunneling, encryption, authentication, access control and auditing. It is used to transport traffic over the Internet or any insecure network that uses TCP/IP for communication. IPSec VPN Internet Protocol Security (IPSec) VPN connects IPSec routers or remote users using IPSec client software. This standards-based VPN offers flexible solutions for secure data communications across a public network. IPSec is built around a number of standardized cryptographic techniques to provide confidentiality, data integrity and authentication at the IP layer. The Zyxel Device can also combine multiple IPSec VPN connections into one secure network. Here local Zyxel Device X uses an IPSec VPN tunnel to remote (peer) Zyxel Device Y to connect the local (A) and remote (B) networks. Figure 284 IPSec VPN Example Internet Key Exchange (IKE): IKEv1 and IKEv2 The Zyxel Device supports IKEv1 and IKEv2 for IPv4 and IPv6 traffic. IKE (Internet Key Exchange) is a protocol used in setting up security associations that allows two parties to send data securely. IKE uses certificates or pre-shared keys for authentication and a DiffieHellman key exchange to set up a shared session secret from which encryption keys are derived. A security policy for each peer must be manually created. IPSec VPN consists of two phases: Phase 1 and Phase 2. Phase 1's purpose is to establish a secure authenticated communication channel by using the DiffieHellman key exchange algorithm to generate a shared secret key to encrypt IKE communications. This negotiation results in one single bi-

directional ISAKMP Security Association (SA). The authentication can be performed using either pre-

ZyWALL ATP Series Users Guide 396 Chapter 20 IPSec VPN shared key (shared secret), signatures, or public key encryption. Phase 1 operates in either Main Mode or Aggressive Mode. Main Mode protects the identity of the peers, but Aggressive Mode does not. During Phase 2, the remote IPSec routers use the secure channel established in Phase 1 to negotiate Security Associations for IPSec. The negotiation results in a minimum of two unidirectional security associations (one inbound and one outbound). Phase 2 uses Quick Mode (only). Quick mode occurs after IKE has established the secure tunnel in Phase 1. It negotiates a shared IPSec policy, derives shared secret keys used for the IPSec security algorithms, and establishes IPSec SAs. Quick mode is also used to renegotiate a new IPSec SA when the IPSec SA lifetime expires. In the Zyxel Device, use the VPN Connection tab to set up Phase 2 and the VPN Gateway tab to set up Phase 1. Some differences between IKEv1 and IKEv2 include:

IKEv2 uses less bandwidth than IKEv1. IKEv2 uses one exchange procedure with 4 messages. IKEv1 uses two phases with Main Mode (9 messages) or Aggressive Mode (6 messages) in phase 1. IKEv2 supports Extended Authentication Protocol (EAP) authentication, and IKEv1 supports X-Auth. EAP is important when connecting to existing enterprise authentication systems. IKEv2 always uses NAT traversal and Dead Peer Detection (DPD), but they can be disabled in IKEv1 using Zyxel Device firmware (the default is on). Configuration payload (includes the IP address pool in the VPN setup data) is supported in IKEv2 (off by default), but not in IKEv1. Narrowed is supported in IKEv2, but not in IKEv1. Narrowed has the SA apply only to IP addresses in common between the Zyxel Device and the remote IPSec router. The IKEv2 protocol supports connectivity checks which is used to detect whether the tunnel is still up or not. If the check fails (the tunnel is down), IKEv2 can re-establish the connection automatically. The Zyxel Device uses firmware to perform connectivity checks when using IKEv1. SSL VPN SSL VPN uses remote users web browsers to provide the easiest-to-use of the Zyxel Devices VPN solutions. A user just browses to the Zyxel Devices web address and enters his user name and password to securely connect to the Zyxel Devices network. Remote users do not need to configure security settings. Here a user uses his browser to securely connect to network resources in the same way as if he were part of the internal network. See Chapter 21 on page 432 for more on SSL VPN. Figure 285 SSL VPN LAN (192.168.1.X) https://

Web Mail File Share Non-Web Web-based Application Application Server ZyWALL ATP Series Users Guide 397 Chapter 20 IPSec VPN L2TP VPN L2TP VPN uses the L2TP and IPSec client software included in remote users Android, iOS, or Windows operating systems for secure connections to the network behind the Zyxel Device. The remote users do not need their own IPSec gateways or third-party VPN client software. For example, configure sales representatives laptops, tablets, or smartphones to securely connect to the Zyxel Devices network. See Chapter 22 on page 438 for more on L2TP over IPSec. Figure 286 L2TP VPN 20.1.1 What You Can Do in this Chapter Use the VPN Connection screens (see Section 20.2 on page 401) to specify which IPSec VPN gateway an IPSec VPN connection policy uses, which devices behind the IPSec routers can use the VPN tunnel, and the IPSec SA settings (phase 2 settings). You can also activate or deactivate and connect or disconnect each VPN connection (each IPSec SA). Use the VPN Gateway screens (see Section 20.2.1 on page 403) to manage the Zyxel Devices VPN gateways. A VPN gateway specifies the IPSec routers at either end of a VPN tunnel and the IKE SA settings (phase 1 settings). You can also activate and deactivate each VPN gateway. Use the VPN Concentrator screens (see Section 20.4 on page 418) to combine several IPSec VPN connections into a single secure network. Use the Configuration Provisioning screen (see Section 20.5 on page 420) to set who can retrieve VPN rule settings from the Zyxel Device using the Zyxel Device IPSec VPN Client. 20.1.2 What You Need to Know An IPSec VPN tunnel is usually established in two phases. Each phase establishes a security association

(SA), a contract indicating what security parameters the Zyxel Device and the remote IPSec router will use. The first phase establishes an Internet Key Exchange (IKE) SA between the Zyxel Device and remote IPSec router. The second phase uses the IKE SA to securely establish an IPSec SA through which the Zyxel Device and remote IPSec router can send data between computers on the local network and remote network. This is illustrated in the following figure. ZyWALL ATP Series Users Guide 398 Chapter 20 IPSec VPN Figure 287 VPN: IKE SA and IPSec SA In this example, a computer in network A is exchanging data with a computer in network B. Inside networks A and B, the data is transmitted the same way data is normally transmitted in the networks. Between routers X and Y, the data is protected by tunneling, encryption, authentication, and other security features of the IPSec SA. The IPSec SA is secure because routers X and Y established the IKE SA first. ZyWALL ATP Series Users Guide 399 Chapter 20 IPSec VPN Application Scenarios The Zyxel Devices application scenarios make it easier to configure your VPN connection settings. Table 157 IPSec VPN Application Scenarios SITE-TO-SITE SITE-TO-SITE WITH DYNAMIC PEER REMOTE ACCESS

(SERVER ROLE) REMOTE ACCESS

(CLIENT ROLE) VPN TUNNEL INTERFACE Choose this if the remote IPSec router has a static IP address or a domain name. This Zyxel Device can initiate the VPN tunnel. The remote IPSec router can also initiate the VPN tunnel if this Zyxel Device has a static IP address or a domain name. Choose this if the remote IPSec router has a dynamic IP address. Choose this to allow incoming connections from IPSec VPN clients. Choose this to connect to an IPSec server. You dont specify the remote IPSec routers address, but you specify the remote policy (the addresses of the devices behind the remote IPSec router). This Zyxel Device must have a static IP address or a domain name. Only the remote IPSec router can initiate the VPN tunnel. The clients have dynamic IP addresses and are also known as dial-in users. You dont specify the addresses of the client IPSec routers or the remote policy. This creates a dynamic IPSec VPN rule that can let multiple clients connect. Only the clients can initiate the VPN tunnel. This Zyxel Device is the client (dial-in user). Client role Zyxel Devices initiate IPSec VPN connections to a server role Zyxel Device. This Zyxel Device can have a dynamic IP address. The IPSec server doesnt configure this Zyxel Devices IP address or the addresses of the devices behind it. Only this Zyxel Device can initiate the VPN tunnel. Choose this to set up a VPN tunnel interface to bind with a VPN connection. The Zyxel Device can use the interface to do load balancing using a specific Trunk. The remote IPSec router should have a static IP address or a domain name. Finding Out More See Section 20.6 on page 422 for IPSec VPN background information. See the help in the IPSec VPN quick setup wizard screens. ZyWALL ATP Series Users Guide 400 Chapter 20 IPSec VPN 20.1.3 Before You Begin This section briefly explains the relationship between VPN tunnels and other features. It also gives some basic suggestions for troubleshooting. You should set up the following features before you set up the VPN tunnel. In any VPN connection, you have to select address objects to specify the local policy and remote policy. You should set up the address objects first. In a VPN gateway, you can select an Ethernet interface, virtual Ethernet interface, VLAN interface, or virtual VLAN interface to specify what address the Zyxel Device uses as its IP address when it establishes the IKE SA. You should set up the interface first. In a VPN gateway, you can enable extended authentication. If the Zyxel Device is in server mode, you should set up the authentication method (AAA server) first. The authentication method specifies how the Zyxel Device authenticates the remote IPSec router. In a VPN gateway, the Zyxel Device and remote IPSec router can use certificates to authenticate each other. Make sure the Zyxel Device and the remote IPSec router will trust each others certificates. 20.2 The VPN Connection Screen Click Configuration > VPN > IPSec VPN to open the VPN Connection screen. The VPN Connection screen lists the VPN connection policies and their associated VPN gateway(s), and various settings. In addition, it also lets you activate or deactivate and connect or disconnect each VPN connection (each IPSec SA). Click a columns heading cell to sort the table entries by that columns criteria. Click the heading cell again to reverse the sort order. Click on the icons to go to the OneSecurity website where there is guidance on configuration walkthroughs, troubleshooting and other information. ZyWALL ATP Series Users Guide 401 Chapter 20 IPSec VPN Figure 288 Configuration > VPN > IPSec VPN > VPN Connection Each field is discussed in the following table. Table 158 Configuration > VPN > IPSec VPN > VPN Connection LABEL Global Setting DESCRIPTION The following two fields are for all IPSec VPN policies. Use Policy Route to control dynamic IPSec rules Click on the VPN icon to go to the Zyxel VPN Client product page at the Zyxel website. Select this to be able to use policy routes to manually specify the destination addresses of dynamic IPSec rules. You must manually create these policy routes. The Zyxel Device automatically obtains source and destination addresses for dynamic IPSec rules that do not match any of the policy routes. Ignore Don't Fragment setting in packet header IPv4 / IPv6 Configuration Add Edit Remove Activate Inactivate Connect Disconnect Clear this to have the Zyxel Device automatically obtain source and destination addresses for all dynamic IPSec rules. Select this to fragment packets larger than the MTU (Maximum Transmission Unit) that have the Don't Fragment bit in the IP header turned on. When you clear this the Zyxel Device drops packets larger than the MTU that have the Don't Fragment bit in the header turned on. Click this to create a new entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. To connect an IPSec SA, select it and click Connect. To disconnect an IPSec SA, select it and click Disconnect. ZyWALL ATP Series Users Guide 402 Chapter 20 IPSec VPN Table 158 Configuration > VPN > IPSec VPN > VPN Connection (continued) LABEL References DESCRIPTION Select an entry and click References to open a screen that shows which settings use the entry. See Section 9.4.4 on page 240 for an example. This field is a sequential value, and it is not associated with a specific connection. The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. The connect icon is lit when the interface is connected and dimmed when it is disconnected. This field displays the name of the IPSec SA. This field displays the VPN gateway in use for this VPN connection. This field displays what IP version the associated VPN gateway(s) is using. An IPv4 gateway may use an IKEv1 or IKEv2 SA. An IPv6 gateway may use IKEv2 only. This field displays the local policy and the remote policy, respectively. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings.

#

Status Name VPN Gateway Gateway IP Version Policy Apply Reset 20.2.1 The VPN Connection Add/Edit Screen The VPN Connection Add/Edit Gateway screen allows you to create a new VPN connection policy or edit an existing one. To access this screen, go to the Configuration > VPN Connection screen (see Section 20.2 on page 401), and click either the Add icon or an Edit icon. ZyWALL ATP Series Users Guide 403 Chapter 20 IPSec VPN Figure 289 Configuration > VPN > IPSec VPN > VPN Connection > Add/Edit ZyWALL ATP Series Users Guide 404 Chapter 20 IPSec VPN Each field is described in the following table. DESCRIPTION Click this button to display a greater or lesser number of configuration fields. Table 159 Configuration > VPN > IPSec VPN > VPN Connection > Add/Edit LABEL Show Advanced Settings / Hide Advanced Settings Create new Object General Settings Enable Use to configure any new settings objects that you need to use in this screen. Connection Name Nailed-Up Enable Replay Detection Enable NetBIOS Broadcast over IPSec MSS Adjustment Narrowed VPN Gateway Select this check box to activate this VPN connection. Type the name used to identify this IPSec SA. You may use 1-31 alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Select this if you want the Zyxel Device to automatically renegotiate the IPSec SA when the SA life time expires. Select this check box to detect and reject old or duplicate packets to protect against Denial-of-Service attacks. Select this check box if you the Zyxel Device to send NetBIOS (Network Basic Input/

Output System) packets through the IPSec SA. NetBIOS packets are TCP or UDP packets that enable a computer to connect to and communicate with a LAN. It may sometimes be necessary to allow NetBIOS packets to pass through IPSec SAs in order to allow local computers to find computers on the remote network and vice versa. Select Custom Size to set a specific number of bytes for the Maximum Segment Size (MSS) meaning the largest amount of data in a single TCP segment or IP datagram for this VPN connection. Some VPN clients may not be able to use a custom MSS size if it is set too small. In that case those VPN clients will ignore the size set here and use the minimum size that they can use. Select Auto to have the Zyxel Device automatically set the MSS for this VPN connection. This is visible when you select any options in the VPN Gateway section except for VPN Tunnel Interface. If the IP range on the Zyxel Device (local policy) and the local IP range on the remote IPSec router overlap in an IKEv2 SA, then you may select Narrowed to have the SA only apply to the IP addresses in common. Here are some examples. Zyxel Device (local policy) Remote IPSec router IKEv2 SA-1 192.168.20.0/24 192.168.20.1 ~ 192.168.20.20 Narrowed 192.168.20.1 ~ 192.168.20.20 IKEv2 SA- 2 192.168.30.50 ~ 192.168.30.70 192.168.30.60 ~ 192.168.30.80 Narrowed 192.168.30.60 ~ 192.168.30.70 ZyWALL ATP Series Users Guide 405 Chapter 20 IPSec VPN Table 159 Configuration > VPN > IPSec VPN > VPN Connection > Add/Edit (continued) LABEL Application Scenario VPN Gateway Policy Local Policy Remote Policy Enable GRE over IPSec DESCRIPTION Select the scenario that best describes your intended VPN connection. Site-to-site - Choose this if the remote IPSec router has a static IP address or a domain name. This Zyxel Device can initiate the VPN tunnel. Site-to-site with Dynamic Peer - Choose this if the remote IPSec router has a dynamic IP address. Only the remote IPSec router can initiate the VPN tunnel. Remote Access (Server Role) - Choose this to allow incoming connections from IPSec VPN clients. The clients have dynamic IP addresses and are also known as dial-in users. Only the clients can initiate the VPN tunnel. Remote Access (Client Role) - Choose this to connect to an IPSec server. This Zyxel Device is the client (dial-in user) and can initiate the VPN tunnel. VPN Tunnel Interface - Choose this to set up a VPN tunnel interface to bind with a VPN connection. The Zyxel Device can use the interface to do load balancing using a specific Trunk. The remote IPSec router should have a static IP address or a domain name. See Configuration > Network > Interface > VTI. Select the VPN gateway this VPN connection is to use or select Create Object to add another VPN gateway for this VPN connection to use. Select the address corresponding to the local network. Use Create new Object if you need to configure a new one. Select the address corresponding to the remote network. Use Create new Object if you need to configure a new one. Select this to allow traffic using the Generic Routing Encapsulation (GRE) tunneling protocol through an IPSec tunnel. Policy Enforcement Clear this to allow traffic with source and destination IP addresses that do not match the local and remote policy to use the VPN tunnel. Leave this cleared for free access between the local and remote networks. Selecting this restricts who can use the VPN tunnel. The Zyxel Device drops traffic with source and destination IP addresses that do not match the local and remote policy. This is visible when you select Remote Access (Server Role) and a VPN Gateway. Select this to have the IPSec VPN client receive an IP address, DNS and WINS information from the Zyxel Device. Select an address object from the drop-down list box. The Domain Name System (DNS) maps a domain name to an IP address and vice versa. The Zyxel Device uses these (in the order you specify here) to resolve domain names for VPN. Enter a DNS server's IP address. Enter a secondary DNS server's IP address that is checked if the first one is unavailable. Type the IP address of the WINS (Windows Internet Naming Service) server that you want to send to the DHCP clients. The WINS server keeps a mapping table of the computer names on your network and the IP addresses that they are currently using. Enter a secondary WINS server's IP address that is checked if the first one is unavailable. This is only available when you have created an IKEv2 Gateway and are using Remote Access (Server Role). Select this to have at least have the IP address pool included in the VPN setup data. Mode Config Enable Mode Config IP Address Pool First DNS Server

(Optional) Second DNS Server

(Optional) First WINS Server

(Optional) Second WINS Server (Optional) Configuration Payload Enable Configuration Payload IP Address Pool:

Select an address object from the drop-down list box. ZyWALL ATP Series Users Guide 406 First DNS Server

(optional) Second DNS Server

(Optional) First WINS Server

(Optional) Second WINS Server (Optional) Phase 2 Settings SA Life Time Active Protocol Chapter 20 IPSec VPN Table 159 Configuration > VPN > IPSec VPN > VPN Connection > Add/Edit (continued) LABEL DESCRIPTION The Domain Name System (DNS) maps a domain name to an IP address and vice versa. The Zyxel Device uses these (in the order you specify here) to resolve domain names for VPN. Enter a DNS server's IP address. Enter a secondary DNS server's IP address that is checked if the first one is unavailable. Type the IP address of the WINS (Windows Internet Naming Service) server that you want to send to the DHCP clients. The WINS server keeps a mapping table of the computer names on your network and the IP addresses that they are currently using. Enter a secondary WINS server's IP address that is checked if the first one is unavailable. Type the maximum number of seconds the IPSec SA can last. Shorter life times provide better security. The Zyxel Device automatically negotiates a new IPSec SA before the current one expires, if there are users who are accessing remote resources. Select which protocol you want to use in the IPSec SA. Choices are:

AH (RFC 2402) - provides integrity, authentication, sequence integrity (replay resistance), and non-repudiation but not encryption. If you select AH, you must select an Authentication algorithm. ESP (RFC 2406) - provides encryption and the same services offered by AH, but its authentication is weaker. If you select ESP, you must select an Encryption algorithm and Authentication algorithm. Both AH and ESP increase processing requirements and latency (delay). Encapsulation The Zyxel Device and remote IPSec router must use the same active protocol. Select which type of encapsulation the IPSec SA uses. Choices are Tunnel - this mode encrypts the IP header information and the data. Transport - this mode only encrypts the data. Proposal Add Edit Remove

#

The Zyxel Device and remote IPSec router must use the same encapsulation. Use this section to manage the encryption algorithm and authentication algorithm pairs the Zyxel Device accepts from the remote IPSec router for negotiating the IPSec SA. Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. This field is a sequential value, and it is not associated with a specific proposal. The sequence of proposals should not affect performance significantly. ZyWALL ATP Series Users Guide 407 Chapter 20 IPSec VPN Table 159 Configuration > VPN > IPSec VPN > VPN Connection > Add/Edit (continued) LABEL Encryption Authentication Perfect Forward Secrecy (PFS) Related Settings Zone Connectivity Check Enable Connectivity Check Check Method DESCRIPTION This field is applicable when the Active Protocol is ESP. Select which key size and encryption algorithm to use in the IPSec SA. Choices are:

NULL - no encryption key or algorithm DES - a 56-bit key with the DES encryption algorithm 3DES - a 168-bit key with the DES encryption algorithm AES128 - a 128-bit key with the AES encryption algorithm AES192 - a 192-bit key with the AES encryption algorithm AES256 - a 256-bit key with the AES encryption algorithm The Zyxel Device and the remote IPSec router must both have at least one proposal that uses use the same encryption and the same key. Longer keys are more secure, but require more processing power, resulting in increased latency and decreased throughput. Select which hash algorithm to use to authenticate packet data in the IPSec SA. Choices are SHA1, SHA256, SHA512 and MD5. SHA is generally considered stronger than MD5, but it is also slower. The Zyxel Device and the remote IPSec router must both have a proposal that uses the same authentication algorithm. Select whether or not you want to enable Perfect Forward Secrecy (PFS) and, if you do, which Diffie-Hellman key group to use for encryption. Choices are:

none - disable PFS DH1 - enable PFS and use a 768-bit random number DH2 - enable PFS and use a 1024-bit random number DH5 - enable PFS and use a 1536-bit random number DH14 - enable PFS and use a 2048 bit random number PFS changes the root key that is used to generate encryption keys for each IPSec SA. The longer the key, the more secure the encryption, but also the longer it takes to encrypt and decrypt information. Both routers must use the same DH key group. PFS is ignored in initial IKEv2 authentication but is used when re-authenticating. Select the security zone into which to add this VPN connection policy. Any security rules or settings configured for the selected zone apply to this VPN connection policy. The Zyxel Device can regularly check the VPN connection to the gateway you specified to make sure it is still available. Select this to turn on the VPN connection check. Select how the Zyxel Device checks the connection. The peer must be configured to respond to the method you select. Select icmp to have the Zyxel Device regularly ping the address you specify to make sure traffic can still go through the connection. You may need to configure the peer to respond to pings. Select tcp to have the Zyxel Device regularly perform a TCP handshake with the address you specify to make sure traffic can still go through the connection. You may need to configure the peer to accept the TCP connection. ZyWALL ATP Series Users Guide 408 Chapter 20 IPSec VPN Table 159 Configuration > VPN > IPSec VPN > VPN Connection > Add/Edit (continued) LABEL Check Port Check Period Check Timeout Check Fail Tolerance Check this Address Check the First and Last IP Address in the Remote Policy Log Inbound/Outbound traffic NAT Outbound Traffic Source NAT Source Destination SNAT Inbound Traffic Source NAT Source Destination SNAT Destination NAT Add Edit Remove DESCRIPTION This field displays when you set the Check Method to tcp. Specify the port number to use for a TCP connectivity check. Enter the number of seconds between connection check attempts. Enter the number of seconds to wait for a response before the attempt is a failure. Enter the number of consecutive failures allowed before the Zyxel Device disconnects the VPN tunnel. The Zyxel Device resumes using the first peer gateway address when the VPN connection passes the connectivity check. Select this to specify a domain name or IP address for the connectivity check. Enter that domain name or IP address in the field next to it. Select this to have the Zyxel Device check the connection to the first and last IP addresses in the connections remote policy. Make sure one of these is the peer gateways LAN IP address. Select this to have the Zyxel Device generate a log every time it checks this VPN connection. This translation hides the source address of computers in the local network. It may also be necessary if you want the Zyxel Device to route packets from computers outside the local network through the IPSec SA. Select the address object that represents the original source address (or select Create Object to configure a new one). This is the address object for the computer or network outside the local network. The size of the original source address range (Source) must be equal to the size of the translated source address range (SNAT). Select the address object that represents the original destination address (or select Create Object to configure a new one). This is the address object for the remote network. Select the address object that represents the translated source address (or select Create Object to configure a new one). This is the address object for the local network. The size of the original source address range (Source) must be equal to the size of the translated source address range (SNAT). This translation hides the source address of computers in the remote network. Select the address object that represents the original source address (or select Create Object to configure a new one). This is the address object for the remote network. The size of the original source address range (Source) must be equal to the size of the translated source address range (SNAT). Select the address object that represents the original destination address (or select Create Object to configure a new one). This is the address object for the local network. Select the address object that represents the translated source address (or select Create Object to configure a new one). This is the address that hides the original source address. The size of the original source address range (Source) must be equal to the size of the translated source address range (SNAT). This translation forwards packets (for example, mail) from the remote network to a specific computer (for example, the mail server) in the local network. Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. ZyWALL ATP Series Users Guide 409 Chapter 20 IPSec VPN Table 159 Configuration > VPN > IPSec VPN > VPN Connection > Add/Edit (continued) LABEL Move

#

Original IP Mapped IP Protocol Original Port Start /

Original Port End Mapped Port Start /

Mapped Port End OK Cancel DESCRIPTION To change an entrys position in the numbered list, select it and click Move to display a field to type a number for where you want to put that entry and press [ENTER] to move the entry to the number that you typed. This field is a sequential value, and it is not associated with a specific NAT record. However, the order of records is the sequence in which conditions are checked and executed. Select the address object that represents the original destination address. This is the address object for the remote network. Select the address object that represents the desired destination address. For example, this is the address object for the mail server. Select the protocol required to use this translation. Choices are: TCP, UDP, or All. These fields are available if the protocol is TCP or UDP. Enter the original destination port or range of original destination ports. The size of the original port range must be the same size as the size of the mapped port range. These fields are available if the protocol is TCP or UDP. Enter the translated destination port or range of translated destination ports. The size of the original port range must be the same size as the size of the mapped port range. Click OK to save the changes. Click Cancel to discard all changes and return to the main VPN screen. 20.3 The VPN Gateway Screen The VPN Gateway summary screen displays the IPSec VPN gateway policies in the Zyxel Device, as well as the Zyxel Devices address, remote IPSec routers address, and associated VPN connections for each one. In addition, it also lets you activate and deactivate each VPN gateway. To access this screen, click Configuration > VPN > Network > IPSec VPN > VPN Gateway. The following screen appears. Figure 290 Configuration > VPN > IPSec VPN > VPN Gateway ZyWALL ATP Series Users Guide 410 Chapter 20 IPSec VPN Each field is discussed in the following table. See Section 20.3.1 on page 411 for more information. Table 160 Configuration > VPN > IPSec VPN > VPN Gateway LABEL Add Edit DESCRIPTION Click this to create a new entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. Select an entry and click References to open a screen that shows which settings use the entry. See Section 9.4.4 on page 240 for an example. This field is a sequential value, and it is not associated with a specific VPN gateway. The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. This field displays the name of the VPN gateway This field displays the interface or a domain name the Zyxel Device uses for the VPN gateway. This field displays the IP address(es) of the remote IPSec routers. This field displays VPN connections that use this VPN gateway. This field displays whether the gateway is using IKEv1 or IKEv2. IKEv1 applies to IPv4 traffic only. IKEv2 applies to both IPv4 and IPv6 traffic. IKE (Internet Key Exchange) is a protocol used in setting up security associations that allows two parties to send data securely. See Section 20.1 on page 396 for more information on IKEv1 and IKEv2. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Remove Activate Inactivate References

#

Status Name My address Secure Gateway VPN Connection IKE Version Apply Reset 20.3.1 The VPN Gateway Add/Edit Screen The VPN Gateway Add/Edit screen allows you to create a new VPN gateway policy or edit an existing one. To access this screen, go to the VPN Gateway summary screen (see Section 20.3 on page 410), and click either the Add icon or an Edit icon. ZyWALL ATP Series Users Guide 411 Chapter 20 IPSec VPN Figure 291 Configuration > VPN > IPSec VPN > VPN Gateway > Add/Edit ZyWALL ATP Series Users Guide 412 Chapter 20 IPSec VPN Each field is described in the following table. DESCRIPTION Click this button to display a greater or lesser number of configuration fields. Table 161 Configuration > VPN > IPSec VPN > VPN Gateway > Add/Edit LABEL Show Advanced Settings / Hide Advanced Settings Create New Object General Settings Use to configure any new settings objects that you need to use in this screen. Enable VPN Gateway Name Select this to activate the VPN Gateway policy. Type the name used to identify this VPN gateway. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. IKE Version IKEv1 / IKEv2 Gateway Settings My Address Peer Gateway Address Select IKEv1 or IKEv2. IKEv1 applies to IPv4 traffic only. IKEv2 applies to both IPv4 and IPv6 traffic. IKE (Internet Key Exchange) is a protocol used in setting up security associations that allows two parties to send data securely. See Section 20.1 on page 396 for more information on IKEv1 and IKEv2. Select how the IP address of the Zyxel Device in the IKE SA is defined. If you select Interface, select the Ethernet interface, VLAN interface, virtual Ethernet interface, virtual VLAN interface or PPPoE/PPTP interface. The IP address of the Zyxel Device in the IKE SA is the IP address of the interface. If you select Domain Name / IP, enter the domain name or the IP address of the Zyxel Device. The IP address of the Zyxel Device in the IKE SA is the specified IP address or the IP address corresponding to the domain name. 0.0.0.0 is not generally recommended as it has the Zyxel Device accept IPSec requests destined for any interface address on the Zyxel Device. Select how the IP address of the remote IPSec router in the IKE SA is defined. Select Static Address to enter the domain name or the IP address of the remote IPSec router. You can provide a second IP address or domain name for the Zyxel Device to try if it cannot establish an IKE SA with the first one. Fall back to Primary Peer Gateway when possible: When you select this, if the connection to the primary address goes down and the Zyxel Device changes to using the secondary connection, the Zyxel Device will reconnect to the primary address when it becomes available again and stop using the secondary connection. Users will lose their VPN connection briefly while the Zyxel Device changes back to the primary connection. To use this, the peer device at the secondary address cannot be set to use a nailed-up VPN connection. In the Fallback Check Interval field, set how often to check if the primary address is available. Select Dynamic Address if the remote IPSec router has a dynamic IP address (and does not use DDNS). Authentication Note: The Zyxel Device and remote IPSec router must use the same authentication method to establish the IKE SA. ZyWALL ATP Series Users Guide 413 Chapter 20 IPSec VPN Table 161 Configuration > VPN > IPSec VPN > VPN Gateway > Add/Edit (continued) LABEL DESCRIPTION Select this to have the Zyxel Device and remote IPSec router use a pre-shared key

(password) of up to 128 characters to identify each other when they negotiate the IKE SA. Type the pre-shared key in the field to the right. The pre-shared key can be:

Pre-Shared Key Certificate User-based PSK Local ID Type Content alphanumeric characters or ,;.|`~!@#$%^&*()_+\{}':./<>=-"

pairs of hexadecimal (0-9, A-F) characters, preceded by 0x. Type 0x at the beginning of a hexadecimal key. For example, "0x0123456789ABCDEF" is in hexadecimal format; 0123456789ABCDEF is in ASCII format. If you use hexadecimal, you must enter twice as many characters since you need to enter pairs. The Zyxel Device and remote IPSec router must use the same pre-shared key. Select unmasked to see the pre-shared key in readable plain text. Select this to have the Zyxel Device and remote IPSec router use certificates to authenticate each other when they negotiate the IKE SA. Then select the certificate the Zyxel Device uses to identify itself to the remote IPSec router. This certificate is one of the certificates in My Certificates. If this certificate is self-signed, import it into the remote IPsec router. If this certificate is signed by a CA, the remote IPsec router must trust that CA. Note: The IPSec routers must trust each others certificates. The Zyxel Device uses one of its Trusted Certificates to authenticate the remote IPSec routers certificate. The trusted certificate can be a self-signed certificate or that of a trusted CA that signed the remote IPSec routers certificate. User-based PSK (IKEv1 only) generates and manages separate pre-shared keys for every user. This enables multiple users, each with a unique key, to access the same VPN gateway policy with one-to-one authentication and strong encryption. Access can be denied on a per-user basis thus allowing VPN SA user-based policies. Click User-Based PSK then select a user or group object who is allowed VPN SA access using this VPN gateway policy. This is for IKEv1 only. This field is read-only if the Zyxel Device and remote IPSec router use certificates to identify each other. Select which type of identification is used to identify the Zyxel Device during authentication. Choices are:

IPv4 or IPv6 - the Zyxel Device is identified by an IP address DNS - the Zyxel Device is identified by a domain name E-mail - the Zyxel Device is identified by the string specified in this field This field is read-only if the Zyxel Device and remote IPSec router use certificates to identify each other. Type the identity of the Zyxel Device during authentication. The identity depends on the Local ID Type. IP - type an IP address; if you type 0.0.0.0, the Zyxel Device uses the IP address specified in the My Address field. This is not recommended in the following situations:

There is a NAT router between the Zyxel Device and remote IPSec router. You want the remote IPSec router to be able to distinguish between IPSec SA requests that come from IPSec routers with dynamic WAN IP addresses. In these situations, use a different IP address, or use a different Local ID Type. DNS - type the fully qualified domain name (FQDN). This value is only used for identification and can be any string that matches the peer ID string. E-mail - the Zyxel Device is identified by the string you specify here; you can use up to 63 ASCII characters including spaces, although trailing spaces are truncated. This value is only used for identification and can be any string. ZyWALL ATP Series Users Guide 414 Chapter 20 IPSec VPN Table 161 Configuration > VPN > IPSec VPN > VPN Gateway > Add/Edit (continued) LABEL Peer ID Type Content Phase 1 Settings SA Life Time

(Seconds) Negotiation Mode Proposal Add DESCRIPTION Select which type of identification is used to identify the remote IPSec router during authentication. Choices are:

IP - the remote IPSec router is identified by an IP address DNS - the remote IPSec router is identified by a domain name E-mail - the remote IPSec router is identified by the string specified in this field Any - the Zyxel Device does not check the identity of the remote IPSec router If the Zyxel Device and remote IPSec router use certificates, there is one more choice. Subject Name - the remote IPSec router is identified by the subject name in the certificate This field is disabled if the Peer ID Type is Any. Type the identity of the remote IPSec router during authentication. The identity depends on the Peer ID Type. If the Zyxel Device and remote IPSec router do not use certificates, IP - type an IP address; see the note at the end of this description. DNS - type the fully qualified domain name (FQDN). This value is only used for identification and can be any string that matches the peer ID string. E-mail - the remote IPSec router is identified by the string you specify here; you can use up to 31 ASCII characters including spaces, although trailing spaces are truncated. This value is only used for identification and can be any string. If the Zyxel Device and remote IPSec router use certificates, type the following fields from the certificate used by the remote IPSec router. IP - subject alternative name field; see the note at the end of this description. DNS - subject alternative name field E-mail - subject alternative name field Subject Name - subject name (maximum 255 ASCII characters, including spaces) Note: If Peer ID Type is IP, please read the rest of this section. If you type 0.0.0.0, the Zyxel Device uses the IP address specified in the Secure Gateway Address field. This is not recommended in the following situations:

There is a NAT router between the Zyxel Device and remote IPSec router. You want the remote IPSec router to be able to distinguish between IPSec SA requests that come from IPSec routers with dynamic WAN IP addresses. In these situations, use a different IP address, or use a different Peer ID Type. Type the maximum number of seconds the IKE SA can last. When this time has passed, the Zyxel Device and remote IPSec router have to update the encryption and authentication keys and re-negotiate the IKE SA. This does not affect any existing IPSec SAs, however. Select the negotiation mode to use to negotiate the IKE SA. Choices are Main - this encrypts the Zyxel Devices and remote IPSec routers identities but takes more time to establish the IKE SA Aggressive - this is faster but does not encrypt the identities The Zyxel Device and the remote IPSec router must use the same negotiation mode. Use this section to manage the encryption algorithm and authentication algorithm pairs the Zyxel Device accepts from the remote IPSec router for negotiating the IKE SA. Click this to create a new entry. ZyWALL ATP Series Users Guide 415 Encryption Authentication Key Group Chapter 20 IPSec VPN Table 161 Configuration > VPN > IPSec VPN > VPN Gateway > Add/Edit (continued) LABEL Edit Remove

#

DESCRIPTION Select an entry and click this to be able to modify it. Select an entry and click this to delete it. This field is a sequential value, and it is not associated with a specific proposal. The sequence of proposals should not affect performance significantly. Select which key size and encryption algorithm to use in the IKE SA. Choices are:

DES - a 56-bit key with the DES encryption algorithm 3DES - a 168-bit key with the DES encryption algorithm AES128 - a 128-bit key with the AES encryption algorithm AES192 - a 192-bit key with the AES encryption algorithm AES256 - a 256-bit key with the AES encryption algorithm The Zyxel Device and the remote IPSec router must use the same key size and encryption algorithm. Longer keys require more processing power, resulting in increased latency and decreased throughput. Select which hash algorithm to use to authenticate packet data in the IPSec SA. Choices are SHA1, SHA256, SHA512 and MD5. SHA is generally considered stronger than MD5, but it is also slower. The remote IPSec router must use the same authentication algorithm. Select which Diffie-Hellman key group (DHx) you want to use for encryption keys. Choices are:

DH1 - use a 768-bit random number DH2 - use a 1024-bit random number DH5 - use a 1536-bit random number DH14 - use a 2048 bit random number NAT Traversal The longer the key, the more secure the encryption, but also the longer it takes to encrypt and decrypt information. Both routers must use the same DH key group. Select this if any of these conditions are satisfied. This IKE SA might be used to negotiate IPSec SAs that use ESP as the active protocol. There are one or more NAT routers between the Zyxel Device and remote IPSec router, and these routers do not support IPSec pass-thru or a similar feature. The remote IPSec router must also enable NAT traversal, and the NAT routers have to forward packets with UDP port 500 and UDP 4500 headers unchanged. This field applies for IKEv1 only. NAT Traversal is always performed when you use IKEv2. Select this check box if you want the Zyxel Device to make sure the remote IPSec router is there before it transmits data through the IKE SA. The remote IPSec router must support DPD. If there has been no traffic for at least 15 seconds, the Zyxel Device sends a message to the remote IPSec router. If the remote IPSec router responds, the Zyxel Device transmits the data. If the remote IPSec router does not respond, the Zyxel Device shuts down the IKE SA. If the remote IPSec router does not support DPD, see if you can use the VPN connection connectivity check (see Section 20.2.1 on page 403). This field applies for IKEv1 only. Dead Peer Detection (DPD) is always performed when you use IKEv2. This part of the screen displays X-Auth when using IKEv1 and Extended Authentication Protocol when using IKEv2. Dead Peer Detection (DPD) X Auth / Extended Authentication Protocol ZyWALL ATP Series Users Guide 416 Chapter 20 IPSec VPN Table 161 Configuration > VPN > IPSec VPN > VPN Gateway > Add/Edit (continued) LABEL X-Auth Enable Extended Authentication Server Mode AAA Method Allowed User Client Mode User Name Password Retype to Confirm Extended Authentication Protocol Enable Extended Authentication Protocol Allowed Auth Method Server Mode Client Mode User Name Password Retype to Confirm OK Cancel DESCRIPTION This displays when using IKEv1. When different users use the same VPN tunnel to connect to the Zyxel Device (telecommuters sharing a tunnel for example), use X-auth to enforce a user name and password check. This way even though telecommuters all know the VPN tunnels security settings, each still has to provide a unique user name and password. Select this if one of the routers (the Zyxel Device or the remote IPSec router) verifies a user name and password from the other router using the local user database and/or an external server. Select this if the Zyxel Device authenticates the user name and password from the remote IPSec router. You also have to select the authentication method, which specifies how the Zyxel Device authenticates this information. Select the authentication method, which specifies how the Zyxel Device authenticates this information. Extended authentication now supports an allowed user. Select what users should be authenticated. Select this radio button if the Zyxel Device provides a username and password to the remote IPSec router for authentication. You also have to provide the User Name and the Password. This field is required if the Zyxel Device is in Client Mode for extended authentication. Type the user name the Zyxel Device sends to the remote IPSec router. The user name can be 1-

31 ASCII characters. It is case-sensitive, but spaces are not allowed. This field is required if the Zyxel Device is in Client Mode for extended authentication. Type the password the Zyxel Device sends to the remote IPSec router. The password can be 1-31 ASCII characters. It is case-sensitive, but spaces are not allowed. Type the exact same password again here to make sure an error was not made when typing it originally. This displays when using IKEv2. EAP uses a certificate for authentication. Select this if one of the routers (the Zyxel Device or the remote IPSec router) verifies a user name and password from the other router using the local user database and/or an external server or a certificate. This field displays the authentication method that is used to authenticate the users. Select this if the Zyxel Device authenticates the user name and password from the remote IPSec router. You also have to select an AAA method, which specifies how the Zyxel Device authenticates this information and who may be authenticated (Allowed User). Select this radio button if the Zyxel Device provides a username and password to the remote IPSec router for authentication. You also have to provide the User Name and the Password. This field is required if the Zyxel Device is in Client Mode for extended authentication. Type the user name the Zyxel Device sends to the remote IPSec router. The user name can be 1-

31 ASCII characters. It is case-sensitive, but spaces are not allowed. This field is required if the Zyxel Device is in Client Mode for extended authentication. Type the password the Zyxel Device sends to the remote IPSec router. The password can be 1-31 ASCII characters. It is case-sensitive, but spaces are not allowed. Type the exact same password again here to make sure an error was not made when typing it originally. Click OK to save your settings and exit this screen. Click Cancel to exit this screen without saving. ZyWALL ATP Series Users Guide 417 Chapter 20 IPSec VPN 20.4 VPN Concentrator A VPN concentrator combines several IPSec VPN connections into one secure network. Figure 292 VPN Topologies (Fully Meshed and Hub and Spoke) 1 2 In a fully-meshed VPN topology (1 in the figure), there is a VPN connection between every pair of routers. In a hub-and-spoke VPN topology (2 in the figure), there is a VPN connection between each spoke router (B, C, D, and E) and the hub router (A), which uses the VPN concentrator. The VPN concentrator routes VPN traffic between the spoke routers and itself. A VPN concentrator reduces the number of VPN connections that you have to set up and maintain in the network. You might also be able to consolidate the policy routes in each spoke router, depending on the IP addresses and subnets of each spoke. However a VPN concentrator is not for every situation. The hub router is a single failure point, so a VPN concentrator is not as appropriate if the connection between spoke routers cannot be down occasionally (maintenance, for example). There is also more burden on the hub router. It receives VPN traffic from one spoke, decrypts it, inspects it to find out to which spoke to route it, encrypts it, and sends it to the appropriate spoke. Therefore, a VPN concentrator is more suitable when there is a minimum amount of traffic between spoke routers. 20.4.1 VPN Concentrator Requirements and Suggestions Consider the following when using the VPN concentrator. The local IP addresses configured in the VPN rules should not overlap. The concentrator must have at least one separate VPN rule for each spoke. In the local policy, specify the IP addresses of the networks with which the spoke is to be able to have a VPN tunnel. This may require you to use more than one VPN rule for each spoke. To have all Internet access from the spoke routers go through the VPN tunnel, set the VPN rules in the spoke routers to use 0.0.0.0 (any) as the remote IP address. Your security policies can still block VPN packets. ZyWALL ATP Series Users Guide 418 Chapter 20 IPSec VPN 20.4.2 VPN Concentrator Screen The VPN Concentrator summary screen displays the VPN concentrators in the Zyxel Device. To access this screen, click Configuration > VPN > IPSec VPN > Concentrator. Figure 293 Configuration > VPN > IPSec VPN > Concentrator Each field is discussed in the following table. See Section 20.4.3 on page 419 for more information. DESCRIPTION Choose to configure for IPv4 or IPv6 traffic. Table 162 Configuration > VPN > IPSec VPN > Concentrator LABEL IPv4/IPv6 Configuration Add Edit Remove

#

Name Group Members Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. This field is a sequential value, and it is not associated with a specific concentrator. This field displays the name of the VPN concentrator. These are the VPN connection policies that are part of the VPN concentrator. 20.4.3 The VPN Concentrator Add/Edit Screen Use the VPN Concentrator Add/Edit screen to create or edit a VPN concentrator. To access this screen, go to the VPN Concentrator summary screen (see Section 20.4 on page 418), and click either the Add icon or an Edit icon. ZyWALL ATP Series Users Guide 419 Chapter 20 IPSec VPN Figure 294 Configuration > VPN > IPSec VPN > Concentrator > Add/Edit Each field is described in the following table. Table 163 VPN > IPSec VPN > Concentrator > Add/Edit LABEL Name DESCRIPTION Enter the name of the concentrator. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Select the concentrators IPSec VPN connection policies. Member OK Cancel Note: You must disable policy enforcement in each member. See Section 20.2.1 on page 403. IPSec VPN connection policies that do not belong to a VPN concentrator appear under Available. Select any VPN connection policies that you want to add to the VPN concentrator and click the right arrow button to add them. The VPN concentrators member VPN connections appear under Member. Select any VPN connections that you want to remove from the VPN concentrator, and click the left arrow button to remove them. Click OK to save your changes in the Zyxel Device. Click Cancel to exit this screen without saving. 20.5 Zyxel Device IPSec VPN Client Configuration Provisioning Use the Configuration > VPN > IPSec VPN > Configuration Provisioning screen to configure who can retrieve VPN rule settings from the Zyxel Device using the Zyxel Device IPSec VPN Client. In the Zyxel Device IPSec VPN Client, you just need to enter the IP address of the Zyxel Device to get all the VPN rule settings automatically. You do not need to manually configure all rule settings in the Zyxel Device IPSec VPN client. VPN rules for the Zyxel Device IPSec VPN Client have certain restrictions. They must not contain the following settings:

AH active protocol NULL encryption SHA512 authentication ZyWALL ATP Series Users Guide 420 Chapter 20 IPSec VPN A subnet or range remote policy The following VPN Gateway rules configured on the Zyxel Device cannot be provisioned to the IPSec VPN Client:

IPv4 rules with IKEv2 version IPv4 rules with User-based PSK authentication Note: You must enable IPv6 in System > IPv6 to activate IPv6 VPN tunneling rules. In the Zyxel Device Quick Setup wizard, you can use the VPN Settings for Configuration Provisioning wizard to create a VPN rule that will not violate these restrictions. Figure 295 Configuration > VPN > IPSec VPN > Configuration Provisioning Each field is discussed in the following table. DESCRIPTION Select this for users to be able to retrieve VPN rule settings using the Zyxel Device IPSec VPN client. Table 164 Configuration > VPN > IPSec VPN > Configuration Provisioning LABEL Enable Configuration Provisioning Client Authentication Method Choose how users should be authenticated. They can be authenticated using the local database on the Zyxel Device or an external authentication database such as LDAP, Active Directory or RADIUS. default is a method you configured in Object > Auth Method. You may configure multiple methods there. If you choose the local database on the Zyxel Device, then configure users using the Object > User/Group screen. If you choose LDAP, Active Directory or RADIUS authentication servers, then configure users on the respective server. When you add or edit a configuration provisioning entry, you are allowed to set the VPN Connection and Allowed User fields. Duplicate entries are not allowed. You cannot select the same VPN Connection and Allowed User pair in a new entry if the same pair exists in a previous entry. Configuration You can bind different rules to the same user, but the Zyxel Device will only allow VPN rule setting retrieval for the first match found. ZyWALL ATP Series Users Guide 421 Chapter 20 IPSec VPN Table 164 Configuration > VPN > IPSec VPN > Configuration Provisioning (continued) LABEL Add DESCRIPTION Click Add to bind a configured VPN rule to a user or group. Only that user or group may then retrieve the specified VPN rule settings. If you click Add without selecting an entry in advance then the new entry appears as the first entry. Entry order is important as the Zyxel Device searches entries in the order listed here to find a match. After a match is found, the Zyxel Device stops searching. If you want to add an entry as number three for example, then first select entry 2 and click Add. To reorder an entry, use Move. Select an existing entry and click Edit to change its settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. To turn on an entry, select it and click Activate. Make sure that Enable Configuration Provisioning is also selected. To turn off an entry, select it and click Inactivate. Use Move to reorder a selected entry. Select an entry, click Move, type the number where the entry should be moved, press <ENTER>, then click Apply. This icon shows if the entry is active (yellow) or not (gray). VPN rule settings can only be retrieved when the entry is activated (and Enable Configuration Provisioning is also selected). Priority shows the order of the entry in the list. Entry order is important as the Zyxel Device searches entries in the order listed here to find a match. After a match is found the Zyxel Device stops searching. This field shows all configured VPN rules that match the rule criteria for the Zyxel Device IPSec VPN client. Select a rule to bind to the associated user or group. Select which user or group of users is allowed to retrieve the associated VPN rule settings using the Zyxel Device IPSec VPN client. A user may belong to a number of groups. If entries are configured for different groups, the Zyxel Device will allow VPN rule setting retrieval based on the first match found. Users of type admin or limited-admin are not allowed. This field shows how traffic is tunneled from the Zyxel Device to the Zyxel VPN client:

6in4 (tunnel IPv6 traffic from the Zyxel Device to the Zyxel client in an IPv4 network);

4in6 (tunnel IPv4 traffic from the Zyxel Device to the Zyxel VPN client in an IPv6 network);

4in4 (tunnel IPv4 traffic from the Zyxel Device to the Zyxel VPN client in an IPv4 network). Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Edit Remove Activate Inactivate Move Status Priority VPN Connection Allowed User Type Apply Reset 20.6 IPSec VPN Background Information Here is some more detailed IPSec VPN background information. IKE SA Overview The IKE SA provides a secure connection between the Zyxel Device and remote IPSec router. It takes several steps to establish an IKE SA. The negotiation mode determines how many. There are two negotiation modes--main mode and aggressive mode. Main mode provides better security, while aggressive mode is faster. ZyWALL ATP Series Users Guide 422 Chapter 20 IPSec VPN Note: Both routers must use the same negotiation mode. These modes are discussed in more detail in Negotiation Mode. Main mode is used in various examples in the rest of this section. The Zyxel Device supports IKEv1 and IKEv2. See Section 20.1 on page 396 for more information. IP Addresses of the Zyxel Device and Remote IPSec Router To set up an IKE SA, you have to specify the IP addresses of the Zyxel Device and remote IPSec router. You can usually enter a static IP address or a domain name for either or both IP addresses. Sometimes, your Zyxel Device might offer another alternative, such as using the IP address of a port or interface, as well. You can also specify the IP address of the remote IPSec router as 0.0.0.0. This means that the remote IPSec router can have any IP address. In this case, only the remote IPSec router can initiate an IKE SA because the Zyxel Device does not know the IP address of the remote IPSec router. This is often used for telecommuters. IKE SA Proposal The IKE SA proposal is used to identify the encryption algorithm, authentication algorithm, and Diffie-

Hellman (DH) key group that the Zyxel Device and remote IPSec router use in the IKE SA. In main mode, this is done in steps 1 and 2, as illustrated next. Figure 296 IKE SA: Main Negotiation Mode, Steps 1 - 2: IKE SA Proposal One or more proposals, each one consisting of:

- encryption algorithm

- authentication algorithm

- Diffie-Hellman key group 1 2 X Y The Zyxel Device sends one or more proposals to the remote IPSec router. (In some devices, you can only set up one proposal.) Each proposal consists of an encryption algorithm, authentication algorithm, and DH key group that the Zyxel Device wants to use in the IKE SA. The remote IPSec router selects an acceptable proposal and sends the accepted proposal back to the Zyxel Device. If the remote IPSec router rejects all of the proposals, the Zyxel Device and remote IPSec router cannot establish an IKE SA. Note: Both routers must use the same encryption algorithm, authentication algorithm, and DH key group. In most Zyxel Devices, you can select one of the following encryption algorithms for each proposal. The algorithms are listed in order from weakest to strongest. Data Encryption Standard (DES) is a widely used method of data encryption. It applies a 56-bit key to each 64-bit block of data. ZyWALL ATP Series Users Guide 423 Chapter 20 IPSec VPN Triple DES (3DES) is a variant of DES. It iterates three times with three separate keys, effectively tripling the strength of DES. Advanced Encryption Standard (AES) is a newer method of data encryption that also uses a secret key. AES applies a 128-bit key to 128-bit blocks of data. It is faster than 3DES. Some Zyxel Devices also offer stronger forms of AES that apply 192-bit or 256-bit keys to 128-bit blocks of data. In most Zyxel Devices, you can select one of the following authentication algorithms for each proposal. The algorithms are listed in order from weakest to strongest. MD5 (Message Digest 5) produces a 128-bit digest to authenticate packet data. SHA1 (Secure Hash Algorithm) produces a 160-bit digest to authenticate packet data. SHA256 (Secure Hash Algorithm) produces a 256-bit digest to authenticate packet data. SHA512 (Secure Hash Algorithm) produces a 512-bit digest to authenticate packet data. See Diffie-Hellman (DH) Key Exchange on page 424 for more information about DH key groups. Diffie-Hellman (DH) Key Exchange The Zyxel Device and the remote IPSec router use DH public-key cryptography to establish a shared secret. The shared secret is then used to generate encryption keys for the IKE SA and IPSec SA. In main mode, this is done in steps 3 and 4, as illustrated next. Figure 297 IKE SA: Main Negotiation Mode, Steps 3 - 4: DH Key Exchange Diffie-Hellman key exchange 3 4 X Y DH public-key cryptography is based on DH key groups. Each key group is a fixed number of bits long. The longer the key, the more secure the encryption, but also the longer it takes to encrypt and decrypt information. For example, DH2 keys (1024 bits) are more secure than DH1 keys (768 bits), but DH2 keys take longer to encrypt and decrypt. Authentication Before the Zyxel Device and remote IPSec router establish an IKE SA, they have to verify each others identity. This process is based on pre-shared keys and router identities. In main mode, the Zyxel Device and remote IPSec router authenticate each other in steps 5 and 6, as illustrated below. The identities are also encrypted using the encryption algorithm and encryption key the Zyxel Device and remote IPSec router selected in previous steps. ZyWALL ATP Series Users Guide 424 Chapter 20 IPSec VPN Figure 298 IKE SA: Main Negotiation Mode, Steps 5 - 6: Authentication (continued) Zyxel Device identity, consisting of Step 5:

pre-shared key

- ID type

- content Step 6:

pre-shared key

- ID type

- content Remote IPSec router identity, consisting of 5 6 X Y You have to create (and distribute) a pre-shared key. The Zyxel Device and remote IPSec router use it in the authentication process, though it is not actually transmitted or exchanged. Note: The Zyxel Device and the remote IPSec router must use the same pre-shared key. Router identity consists of ID type and content. The ID type can be domain name, IP address, or email address, and the content is a (properly-formatted) domain name, IP address, or email address. The content is only used for identification. Any domain name or email address that you enter does not have to actually exist. Similarly, any domain name or IP address that you enter does not have to correspond to the Zyxel Devices or remote IPSec routers properties. The Zyxel Device and the remote IPSec router have their own identities, so both of them must store two sets of information, one for themselves and one for the other router. Local ID type and content refers to the ID type and content that applies to the router itself, and peer ID type and content refers to the ID type and content that applies to the other router. Note: The Zyxel Devices local and peer ID type and content must match the remote IPSec routers peer and local ID type and content, respectively. For example, in the next table, the Zyxel Device and the remote IPSec router authenticate each other successfully. In contrast, in the following table, the Zyxel Device and the remote IPSec router cannot authenticate each other and, therefore, cannot establish an IKE SA. Table 165 VPN Example: Matching ID Type and Content ZYXEL DEVICE Local ID type: E-mail Local ID content: tom@yourcompany.com Peer ID type: IP Peer ID content: 1.1.1.2 REMOTE IPSEC ROUTER Local ID type: IP Local ID content: 1.1.1.2 Peer ID type: E-mail Peer ID content: tom@yourcompany.com ZyWALL ATP Series Users Guide 425 Chapter 20 IPSec VPN Table 166 VPN Example: Mismatching ID Type and Content ZYXEL DEVICE Local ID type: E-mail Local ID content: tom@yourcompany.com Peer ID type: IP Peer ID content: 1.1.1.20 REMOTE IPSEC ROUTER Local ID type: IP Local ID content: 1.1.1.2 Peer ID type: E-mail Peer ID content: tom@yourcompany.com It is also possible to configure the Zyxel Device to ignore the identity of the remote IPSec router. In this case, you usually set the peer ID type to Any. This is less secure, so you should only use this if your Zyxel Device provides another way to check the identity of the remote IPSec router (for example, extended authentication) or if you are troubleshooting a VPN tunnel. Additional Topics for IKE SA This section provides more information about IKE SA. Negotiation Mode There are two negotiation modes--main mode and aggressive mode. Main mode provides better security, while aggressive mode is faster. Main mode takes six steps to establish an IKE SA. Steps 1 - 2: The Zyxel Device sends its proposals to the remote IPSec router. The remote IPSec router selects an acceptable proposal and sends it back to the Zyxel Device. Steps 3 - 4: The Zyxel Device and the remote IPSec router exchange pre-shared keys for authentication and participate in a Diffie-Hellman key exchange, based on the accepted DH key group, to establish a shared secret. Steps 5 - 6: Finally, the Zyxel Device and the remote IPSec router generate an encryption key (from the shared secret), encrypt their identities, and exchange their encrypted identity information for authentication. In contrast, aggressive mode only takes three steps to establish an IKE SA. Aggressive mode does not provide as much security because the identity of the Zyxel Device and the identity of the remote IPSec router are not encrypted. It is usually used in remote-access situations, where the address of the initiator is not known by the responder and both parties want to use pre-shared keys for authentication. For example, the remote IPSec router may be a telecommuter who does not have a static IP address. VPN, NAT, and NAT Traversal In the following example, there is another router (A) between router X and router Y. ZyWALL ATP Series Users Guide 426 Chapter 20 IPSec VPN Figure 299 VPN/NAT Example X A Y If router A does NAT, it might change the IP addresses, port numbers, or both. If router X and router Y try to establish a VPN tunnel, the authentication fails because it depends on this information. The routers cannot establish a VPN tunnel. Most routers like router A now have an IPSec pass-thru feature. This feature helps router A recognize VPN packets and route them appropriately. If router A has this feature, router X and router Y can establish a VPN tunnel as long as the active protocol is ESP. (See Active Protocol on page 428 for more information about active protocols.) If router A does not have an IPSec pass-thru or if the active protocol is AH, you can solve this problem by enabling NAT traversal. In NAT traversal, router X and router Y add an extra header to the IKE SA and IPSec SA packets. If you configure router A to forward these packets unchanged, router X and router Y can establish a VPN tunnel. You have to do the following things to set up NAT traversal. Enable NAT traversal on the Zyxel Device and remote IPSec router. Configure the NAT router to forward packets with the extra header unchanged. (See the field description for detailed information about the extra header.) The extra header may be UDP port 500 or UDP port 4500, depending on the standard(s) the Zyxel Device and remote IPSec router support. X-Auth / Extended Authentication X-Auth / Extended authentication is often used when multiple IPSec routers use the same VPN tunnel to connect to a single IPSec router. For example, this might be used with telecommuters. In extended authentication, one of the routers (the Zyxel Device or the remote IPSec router) provides a user name and password to the other router, which uses a local user database and/or an external server to verify the user name and password. If the user name or password is wrong, the routers do not establish an IKE SA. You can set up the Zyxel Device to provide a user name and password to the remote IPSec router, or you can set up the Zyxel Device to check a user name and password that is provided by the remote IPSec router. If you use extended authentication, it takes four more steps to establish an IKE SA. These steps occur at the end, regardless of the negotiation mode (steps 7-10 in main mode, steps 4-7 in aggressive mode). ZyWALL ATP Series Users Guide 427 Chapter 20 IPSec VPN Certificates It is possible for the Zyxel Device and remote IPSec router to authenticate each other with certificates. In this case, you do not have to set up the pre-shared key, local identity, or remote identity because the certificates provide this information instead. Instead of using the pre-shared key, the Zyxel Device and remote IPSec router check the signatures on each others certificates. Unlike pre-shared keys, the signatures do not have to match. The local and peer ID type and content come from the certificates. Note: You must set up the certificates for the Zyxel Device and remote IPSec router first. IPSec SA Overview Once the Zyxel Device and remote IPSec router have established the IKE SA, they can securely negotiate an IPSec SA through which to send data between computers on the networks. Note: The IPSec SA stays connected even if the underlying IKE SA is not available anymore. This section introduces the key components of an IPSec SA. Local Network and Remote Network In an IPSec SA, the local network, the one(s) connected to the Zyxel Device, may be called the local policy. Similarly, the remote network, the one(s) connected to the remote IPSec router, may be called the remote policy. Active Protocol The active protocol controls the format of each packet. It also specifies how much of each packet is protected by the encryption and authentication algorithms. IPSec VPN includes two active protocols, AH (Authentication Header, RFC 2402) and ESP (Encapsulating Security Payload, RFC 2406). Note: The Zyxel Device and remote IPSec router must use the same active protocol. Usually, you should select ESP. AH does not support encryption, and ESP is more suitable with NAT. Encapsulation There are two ways to encapsulate packets. Usually, you should use tunnel mode because it is more secure. Transport mode is only used when the IPSec SA is used for communication between the Zyxel Device and remote IPSec router (for example, for remote management), not between computers on the local and remote networks. Note: The Zyxel Device and remote IPSec router must use the same encapsulation. These modes are illustrated below. Figure 300 VPN: Transport and Tunnel Mode Encapsulation Original Packet IP Header TCP Header Data ZyWALL ATP Series Users Guide 428 Chapter 20 IPSec VPN Figure 300 VPN: Transport and Tunnel Mode Encapsulation Transport Mode Packet IP Header Tunnel Mode Packet IP Header AH/ESP Header AH/ESP Header TCP Header Data IP Header TCP Header Data In tunnel mode, the Zyxel Device uses the active protocol to encapsulate the entire IP packet. As a result, there are two IP headers:

Outside header: The outside IP header contains the IP address of the Zyxel Device or remote IPSec router, whichever is the destination. Inside header: The inside IP header contains the IP address of the computer behind the Zyxel Device or remote IPSec router. The header for the active protocol (AH or ESP) appears between the IP headers. In transport mode, the encapsulation depends on the active protocol. With AH, the Zyxel Device includes part of the original IP header when it encapsulates the packet. With ESP, however, the Zyxel Device does not include the IP header when it encapsulates the packet, so it is not possible to verify the integrity of the source IP address. IPSec SA Proposal and Perfect Forward Secrecy An IPSec SA proposal is similar to an IKE SA proposal (see IKE SA Proposal), except that you also have the choice whether or not the Zyxel Device and remote IPSec router perform a new DH key exchange every time an IPSec SA is established. This is called Perfect Forward Secrecy (PFS). If you enable PFS, the Zyxel Device and remote IPSec router perform a DH key exchange every time an IPSec SA is established, changing the root key from which encryption keys are generated. As a result, if one encryption key is compromised, other encryption keys remain secure. If you do not enable PFS, the Zyxel Device and remote IPSec router use the same root key that was generated when the IKE SA was established to generate encryption keys. The DH key exchange is time-consuming and may be unnecessary for data that does not require such security. PFS is ignored in initial IKEv2 authentication but is used when re-authenticating. Additional Topics for IPSec SA This section provides more information about IPSec SA in your Zyxel Device. Authentication and the Security Parameter Index (SPI) For authentication, the Zyxel Device and remote IPSec router use the SPI, instead of pre-shared keys, ID type and content. The SPI is an identification number. Note: The Zyxel Device and remote IPSec router must use the same SPI. ZyWALL ATP Series Users Guide 429 Chapter 20 IPSec VPN NAT for Inbound and Outbound Traffic The Zyxel Device can translate the following types of network addresses in IPSec SA. Source address in outbound packets - this translation is necessary if you want the Zyxel Device to route packets from computers outside the local network through the IPSec SA. Source address in inbound packets - this translation hides the source address of computers in the remote network. Destination address in inbound packets - this translation is used if you want to forward packets (for example, mail) from the remote network to a specific computer (like the mail server) in the local network. Each kind of translation is explained below. The following example is used to help explain each one. Figure 301 VPN Example: NAT for Inbound and Outbound Traffic Source Address in Outbound Packets (Outbound Traffic, Source NAT) This translation lets the Zyxel Device route packets from computers that are not part of the specified local network (local policy) through the IPSec SA. For example, in Figure 301 on page 430, you have to configure this kind of translation if you want computer M to establish a connection with any computer in the remote network (B). If you do not configure it, the remote IPSec router may not route messages for computer M through the IPSec SA because computer Ms IP address is not part of its local policy. To set up this NAT, you have to specify the following information:

Source - the original source address; most likely, computer Ms network. Destination - the original destination address; the remote network (B). SNAT - the translated source address; the local network (A). Source Address in Inbound Packets (Inbound Traffic, Source NAT) You can set up this translation if you want to change the source address of computers in the remote network. To set up this NAT, you have to specify the following information:

ZyWALL ATP Series Users Guide 430 Chapter 20 IPSec VPN Source - the original source address; the remote network (B). Destination - the original destination address; the local network (A). SNAT - the translated source address; a different IP address (range of addresses) to hide the original source address. Destination Address in Inbound Packets (Inbound Traffic, Destination NAT) You can set up this translation if you want the Zyxel Device to forward some packets from the remote network to a specific computer in the local network. For example, in Figure 301 on page 430, you can configure this kind of translation if you want to forward mail from the remote network to the mail server in the local network (A). You have to specify one or more rules when you set up this kind of NAT. The Zyxel Device checks these rules similar to the way it checks rules for a security policy. The first part of these rules define the conditions in which the rule apply. Original IP - the original destination address; the remote network (B). Protocol - the protocol [TCP, UDP, or both] used by the service requesting the connection. Original Port - the original destination port or range of destination ports; in Figure 301 on page 430, it might be port 25 for SMTP. The second part of these rules controls the translation when the condition is satisfied. Mapped IP - the translated destination address; in Figure 301 on page 430, the IP address of the mail server in the local network (A). Mapped Port - the translated destination port or range of destination ports. The original port range and the mapped port range must be the same size. IPSec VPN Example Scenario Here is an example site-to-site IPSec VPN scenario. Figure 302 Site-to-site IPSec VPN Example ZyWALL ATP Series Users Guide 431 CHAPTER 21 SSL VPN 21.1 Overview Use SSL VPN to allow users to use a web browser for secure remote user login. The remote users do not need a VPN router or VPN client software. 21.1.1 What You Can Do in this Chapter Use the VPN > SSL VPN > Access Privilege screens (see Section 21.2 on page 433) to configure SSL access policies. Use the Click VPN > SSL VPN > Global Setting screen (see Section 21.3 on page 436) to set the IP address of the Zyxel Device (or a gateway device) on your network for full tunnel mode access, enter access messages or upload a custom logo to be displayed on the remote user screen. 21.1.2 What You Need to Know Full Tunnel Mode In full tunnel mode, a virtual connection is created for remote users with private IP addresses in the same subnet as the local network. This allows them to access network resources in the same way as if they were part of the internal network. Figure 303 Network Access Mode: Full Tunnel Mode LAN (192.168.1.X) https://

192.168.1.100 SSL Access Policy Web Mail File Share Non-Web Web-based Application Application Server An SSL access policy allows the Zyxel Device to perform the following tasks:

limit user access to specific applications or file sharing server on the network. allow user access to specific networks. assign private IP addresses and provide DNS/WINS server information to remote users to access internal networks. ZyWALL ATP Series Users Guide 432 Chapter 21 SSL VPN SSL Access Policy Objects The SSL access policies reference the following objects. If you update this information, in response to changes, the Zyxel Device automatically propagates the changes through the SSL policies that use the object(s). When you delete an SSL policy, the objects are not removed. Table 167 Objects OBJECT TYPE User Accounts Application OBJECT SCREEN User Account/

User Group SSL Application IP Pool Address Server Addresses VPN Network Address Address DESCRIPTION Configure a user account or user group to which you want to apply this SSL access policy. Configure an SSL application object to specify the type of application and the address of the local computer, server, or web site SSL users are to be able to access. Configure an address object that defines a range of private IP addresses to assign to user computers so they can access the internal network through a VPN connection. Configure address objects for the IP addresses of the DNS and WINS servers that the Zyxel Device sends to the VPN connection users. Configure an address object to specify which network segment users are allowed to access through a VPN connection. You cannot delete an object that is referenced by an SSL access policy. To delete the object, you must first unassociate the object from the SSL access policy. 21.2 The SSL Access Privilege Screen Click VPN > SSL VPN to open the Access Privilege screen. This screen lists the configured SSL access policies. Click on the icons to go to the OneSecurity website where there is guidance on configuration walkthroughs, troubleshooting and other information. Figure 304 VPN > SSL VPN > Access Privilege ZyWALL ATP Series Users Guide 433 Chapter 21 SSL VPN The following table describes the labels in this screen. Table 168 VPN > SSL VPN > Access Privilege LABEL Access Policy Summary DESCRIPTION This screen shows a summary of SSL VPN policies created. Add Edit Remove Activate Inactivate Move References

#

Status Name User/Group Click on the VPN icon to go to the Zyxel VPN Client product page at the Zyxel website. Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. To move an entry to a different number in the list, click the Move icon. In the field that appears, specify the number to which you want to move the interface. Select an entry and click References to open a screen that shows which settings use the entry. Click Refresh to update information on this screen. This field displays the index number of the entry. This icon is lit when the entry is active and dimmed when the entry is inactive. This field displays the descriptive name of the SSL access policy for identification purposes. This field displays the user account or user group name(s) associated to an SSL access policy. Access Policy Summary Apply Reset This field displays up to three names. This field displays details about the SSL application object this policy uses including its name, type, and address. Click Apply to save the settings. Click Reset to discard all changes. 21.2.1 The SSL Access Privilege Policy Add/Edit Screen To create a new or edit an existing SSL access policy, click the Add or Edit icon in the Access Privilege screen. ZyWALL ATP Series Users Guide 434 Chapter 21 SSL VPN Figure 305 VPN > SSL VPN > Add/Edit The following table describes the labels in this screen. Table 169 VPN > SSL VPN > Access Privilege > Add/Edit LABEL Create new Object Configuration Enable Policy Name DESCRIPTION Use to configure any new settings objects that you need to use in this screen. Select this option to activate this SSL access policy. Enter a descriptive name to identify this policy. You can enter up to 31 characters (a-z, A-Z, 0-9) with no spaces allowed. Select the zone to which to add this SSL access policy. You use zones to apply security settings such as security policy and remote management. Enter additional information about this SSL access policy. You can enter up to 60 characters

("0-9", "a-z", "A-Z", "-" and "_"). Zone Description ZyWALL ATP Series Users Guide 435 Chapter 21 SSL VPN Table 169 VPN > SSL VPN > Access Privilege > Add/Edit (continued) LABEL User/Group DESCRIPTION The Selectable User/Group Objects list displays the name(s) of the user account and/or user group(s) to which you have not applied an SSL access policy yet. To associate a user or user group to this SSL access policy, select a user account or user group and click the right arrow button to add to the Selected User/Group Objects list. You can select more than one name. To remove a user or user group, select the name(s) in the Selected User/Group Objects list and click the left arrow button. Note: Although you can select admin and limited-admin accounts in this screen, they are reserved for device configuration only. You cannot use them to access the SSL VPN portal. Network Extension (Optional) Enable Network Extension Select this option to create a VPN tunnel between the authenticated users and the internal network. This allows the users to access the resources on the network as if they were on the same local network. This includes access to resources not supported by SSL application objects. For example this lets users Telnet to the internal network even though the Zyxel Device does not have SSL application objects for Telnet. Clear this option to disable this feature. Users can only access the applications as defined by the VPN tunnels selected SSL application settings and the remote user computers are not made to be a part of the local network. Select this to send all traffic from the SSL VPN clients through the SSL VPN tunnel. This replaces the default gateway of the SSL VPN clients with the SSL VPN gateway. Select this to search for a remote computer and access its applications as if it was in a Local Area Network. The user can find a computer not only by its IP address but also by computer name. Define a separate pool of IP addresses to assign to the SSL users. Select it here. The SSL VPN IP pool should not overlap with IP addresses on the Zyxel Device's local networks

(LAN and DMZ for example), the SSL user's network, or the networks you specify in the SSL VPN Network List. Select the name of the DNS or WINS server whose information the Zyxel Device sends to the remote users. This allows them to access devices on the local network using domain names instead of IP addresses. To allow user access to local network(s), select a network name in the Selectable Address Objects list and click the right arrow button to add to the Selected Address Objects list. You can select more than one network. To block access to a network, select the network name in the Selected Address Objects list and click the left arrow button. Click OK to save the changes and return to the main Access Privilege screen. Click Cancel to discard all changes and return to the main Access Privilege screen. Force all client traffic to SSL VPN tunnel NetBIOS broadcast over SSL VPN Tunnel Assign IP Pool DNS/WINS Server 1..2 Network List OK Cancel 21.3 The SSL Global Setting Screen Click VPN > SSL VPN and click the Global Setting tab to display the following screen. Use this screen to set the IP address of the Zyxel Device (or a gateway device) on your network for full tunnel mode access. ZyWALL ATP Series Users Guide 436 Chapter 21 SSL VPN Figure 306 VPN > SSL VPN > Global Setting The following table describes the labels in this screen. Table 170 VPN > SSL VPN > Global Setting LABEL Global Setting Network Extension Local IP DESCRIPTION Specify the IP address of the Zyxel Device (or a gateway device) for full tunnel mode SSL VPN access. Apply Reset Leave this field to the default settings unless it conflicts with another interface. Click Apply to save the changes and/or start the logo file upload process. Click Reset to return the screen to its last-saved settings. ZyWALL ATP Series Users Guide 437 CHAPTER 22 L2TP VPN 22.1 Overview L2TP VPN uses the L2TP and IPSec client software included in remote users Android, iOS, Windows or Mac OS X operating systems for secure connections to the network behind the Zyxel Device. The remote users do not need their own IPSec gateways or third-party VPN client software. Figure 307 L2TP VPN Overview If you install the IPSec VPN Client software from Zyxel to a Windows computer, enable Windows IKE and AuthIP IPsec Keying Modules to use L2TP over IPSec:

1 Click Start > Control Panel > Administrative Tools > Services 2 Select IKE and AuthIP IPsec Keying Modules, and click Restart the service. 22.1.1 What You Can Do in this Chapter Use the L2TP VPN screen (see Section 22.2 on page 439) to configure the Zyxel Devices L2TP VPN settings. Use the VPN Setup Wizard screen in Quick Setup (Chapter 4 on page 75) to configure the Zyxel Devices L2TP VPN settings. 22.1.2 What You Need to Know The Layer 2 Tunneling Protocol (L2TP) works at layer 2 (the data link layer) to tunnel network traffic between two peers over another network (like the Internet). In L2TP VPN, an IPSec VPN tunnel is established first and then an L2TP tunnel is built inside it. See Chapter 20 on page 396 for information on IPSec VPN. ZyWALL ATP Series Users Guide 438 Chapter 22 L2TP VPN IPSec Configuration Required for L2TP VPN You must configure an IPSec VPN connection prior to proper L2TP VPN usage (see Chapter 22 on page 438 for details). The IPSec VPN connection must:

Be enabled. Use transport mode. Use Pre-Shared Key authentication. Use a VPN gateway with the Secure Gateway set to 0.0.0.0 if you need to allow L2TP VPN clients to connect from more than one IP address. Using the Quick Setup VPN Setup Wizard The VPN Setup Wizard is an easy and convenient way to configure the L2TP VPN settings. Click Configuration > Quick Setup > VPN Setup > VPN Settings for L2TP VPN Settings to get started. Policy Route The Policy Route for return traffic (from LAN to L2TP clients) is automatically created when Zyxel Device adds a new L2TP connection, allowing users access the resources on a network without additional configuration. However, if some of the traffic from the L2TP clients needs to go to the Internet, you will need to create a policy route to send that traffic from the L2TP tunnels out through a WAN trunk. This task can be easily performed by clicking the Allow L2TP traffic through WAN checkbox at Quick Setup > VPN Setup > Allow L2TP traffic through WAN. Figure 308 Policy Route for L2TP VPN 22.2 L2TP VPN Screen Click Configuration > VPN > L2TP VPN to open the following screen. Use this screen to configure the Zyxel Devices L2TP VPN settings. Note: Disconnect any existing L2TP VPN sessions before modifying L2TP VPN settings. The remote users must make any needed matching configuration changes and re-establish the sessions using the new settings. ZyWALL ATP Series Users Guide 439 Chapter 22 L2TP VPN Click on the icons to go to the OneSecurity website where there is guidance on configuration walkthroughs, troubleshooting, and other information. Figure 309 Configuration > VPN > L2TP VPN The following table describes the fields in this screen. Table 171 Configuration > VPN > L2TP VPN LABEL Show Advanced Settings / Hide Advanced Settings Create new Object Enable L2TP Over IPSec VPN Connection DESCRIPTION Click this button to display a greater or lesser number of configuration fields. Use to configure any new settings objects that you need to use in this screen. Use this field to turn the Zyxel Devices L2TP VPN function on or off. Select the IPSec VPN connection the Zyxel Device uses for L2TP VPN. All of the configured VPN connections display here, but the one you use must meet the requirements listed in IPSec Configuration Required for L2TP VPN. Note: Modifying this VPN connection (or the VPN gateway that it uses) disconnects any existing L2TP VPN sessions. IP Address Pool Select the pool of IP addresses that the Zyxel Device uses to assign to the L2TP VPN clients. Use Create new Object if you need to configure a new pool of IP addresses. Authentication Method This should not conflict with any WAN, LAN, DMZ or WLAN subnet even if they are not in use. Select how the Zyxel Device authenticates a remote user before allowing access to the L2TP VPN tunnel. The authentication method has the Zyxel Device check a users user name and password against the Zyxel Devices local database, a remote LDAP, RADIUS, a Active Directory server, or more than one of these. ZyWALL ATP Series Users Guide 440 Chapter 22 L2TP VPN Table 171 Configuration > VPN > L2TP VPN (continued) LABEL Authentication Server Certificate DESCRIPTION Select the certificate to use to identify the Zyxel Device for L2TP VPN connections. You must have certificates already configured in the My Certificates screen. The certificate is used with the EAP, PEAP, and MSCHAPv2 authentication protocols. The remote user must log into the Zyxel Device to use the L2TP VPN tunnel. Select a user or user group that can use the L2TP VPN tunnel. Use Create new Object if you need to configure a new user account. Otherwise, select any to allow any user with a valid account and password on the Zyxel Device to log in. The Zyxel Device sends a Hello message after waiting this long without receiving any traffic from the remote user. The Zyxel Device disconnects the VPN tunnel if the remote user does not respond. Specify the IP addresses of DNS servers to assign to the remote users. You can specify these IP addresses two ways. Custom Defined - enter a static IP address. From ISP - use the IP address of a DNS server that another interface received from its DHCP server. The WINS (Windows Internet Naming Service) server keeps a mapping table of the computer names on your network and the IP addresses that they are currently using. Type the IP addresses of up to two WINS servers to assign to the remote users. You can specify these IP addresses two ways. Click Apply to save your changes in the Zyxel Device. Click Reset to return the screen to its last-saved settings. Allowed User Keep Alive Timer First DNS Server, Second DNS Server First WINS Server, Second WINS Server Apply Reset 22.2.1 Example: L2TP and Zyxel Device Behind a NAT Router If the Zyxel Device (Z) is behind a NAT router (N), then do the following for remote clients (C) to access the network behind the Zyxel Device (Z) using L2TP over IPv4. Figure 310 L2TP and Zyxel Device Behind a NAT Router 1 Create an address object in Configuration > Object > Address/GEO IP > Address for the WAN IP address of the NAT router. ZyWALL ATP Series Users Guide 441 Chapter 22 L2TP VPN 2 Go to Configuration > VPN > IPSec VPN > VPN Connection and click Add for IPv4 Configuration to create a new VPN connection. 3 4 Select Remote Access (Server Role) as the VPN scenario for the remote client. Select the NAT router WAN IP address object as the Local Policy. 5 Go to Configuration > VPN > L2TP VPN and select the VPN Connection just configured. ZyWALL ATP Series Users Guide 442 Chapter 22 L2TP VPN ZyWALL ATP Series Users Guide 443 CHAPTER 23 BWM (Bandwidth Management) 23.1 Overview Bandwidth management provides a convenient way to manage the use of various services on the network. It manages general protocols (for example, HTTP and FTP) and applies traffic prioritization to enhance the performance of delay-sensitive applications like voice and video. 23.1.1 What You Can Do in this Chapter Use the BWM screens (see Section 23.2 on page 448) to control bandwidth for services passing through the Zyxel Device, and to identify the conditions that define the bandwidth control. 23.1.2 What You Need to Know When you allow a service, you can restrict the bandwidth it uses. It controls TCP and UDP traffic. Use policy routes to manage other types of traffic (like ICMP). Note: Bandwidth management in policy routes has priority over TCP and UDP traffic policies. If you want to use a service, make sure both the security policy allow the services packets to go through the Zyxel Device. Note: The Zyxel Device checks security policies before it checks bandwidth management rules for traffic going through the Zyxel Device. Bandwidth management examines every TCP and UDP connection passing through the Zyxel Device. Then, you can specify, by port, whether or not the Zyxel Device continues to route the connection. BWM Type The Zyxel Device supports three types of bandwidth management: Shared, Per user and Per-Source-IP. The Shared BWM type is selected by default in a bandwidth management rule. All matched traffic shares the bandwidth configured in the rule. If the BWM type is set to Per user in a rule, each user that matches the rule can use up to the configured bandwidth by his/her own. Select the Per-Source-IP type when you want to set the maximum bandwidth for traffic from an individual source IP address. ZyWALL ATP Series Users Guide 444 Chapter 23 BWM (Bandwidth Management) In the following example, you configure a Per user bandwidth management rule for radius-users to limit outgoing traffic to 300 kbs. Then all radius-users (A, B and C) can send 300 kbps of traffic. Figure 311 Bandwidth Management Per User Type DiffServ and DSCP Marking QoS is used to prioritize source-to-destination traffic flows. All packets in the same flow are given the same priority. CoS (class of service) is a way of managing traffic in a network by grouping similar types of traffic together and treating each type as a class. You can use CoS to give different priorities to different packet types. DiffServ (Differentiated Services) is a class of service (CoS) model that marks packets so that they receive specific per-hop treatment at DiffServ-compliant network devices along the route based on the application types and traffic flow. Packets are marked with DiffServ Code Points (DSCPs) indicating the level of service desired. This allows the intermediary DiffServ-compliant network devices to handle the packets differently depending on the code points without the need to negotiate paths or remember state information for every flow. In addition, applications do not have to request a particular service or give advanced notice of where the traffic is going. Connection and Packet Directions Bandwidth management looks at the connection direction, that is, from which interface the connection was initiated and to which interface the connection is going. A connection has outbound and inbound packet flows. The Zyxel Device controls the bandwidth of traffic of each flow as it is going out through an interface or VPN tunnel. The outbound traffic flows from the connection initiator to the connection responder. The inbound traffic flows from the connection responder to the connection initiator. For example, a LAN1 to WAN connection is initiated from LAN1 and goes to the WAN. Outbound traffic goes from a LAN1 device to a WAN device. Bandwidth management is applied before sending the packets out a WAN interface on the Zyxel Device. Inbound traffic comes back from the WAN device to the LAN1 device. Bandwidth management is applied before sending the traffic out a LAN1 interface. ZyWALL ATP Series Users Guide 445 Chapter 23 BWM (Bandwidth Management) Figure 312 LAN1 to WAN Connection and Packet Directions Outbound and Inbound Bandwidth Limits You can limit an applications outbound or inbound bandwidth. This limit keeps the traffic from using up too much of the out-going interfaces bandwidth. This way you can make sure there is bandwidth for other applications. When you apply a bandwidth limit to outbound or inbound traffic, each member of the out-going zone can send up to the limit. Take a LAN1 to WAN policy for example. Outbound traffic is limited to 200 kbps. The connection initiator is on the LAN1 so outbound means the traffic traveling from the LAN1 to the WAN. Each of the WAN zones two interfaces can send the limit of 200 kbps of traffic. Inbound traffic is limited to 500 kbs. The connection initiator is on the LAN1 so inbound means the traffic traveling from the WAN to the LAN1. Figure 313 LAN1 to WAN, Outbound 200 kbps, Inbound 500 kbps Outbound 200 kbps Inbound 500 kbps Bandwidth Management Priority The Zyxel Device gives bandwidth to higher-priority traffic first, until it reaches its configured bandwidth rate. Then lower-priority traffic gets bandwidth. The Zyxel Device uses a fairness-based (round-robin) scheduler to divide bandwidth among traffic flows with the same priority. The Zyxel Device automatically treats traffic with bandwidth management disabled as priority 7 (the lowest priority). ZyWALL ATP Series Users Guide 446 Chapter 23 BWM (Bandwidth Management) Maximize Bandwidth Usage Maximize bandwidth usage allows applications with maximize bandwidth usage enabled to borrow any unused bandwidth on the out-going interface. After each application gets its configured bandwidth rate, the Zyxel Device uses the fairness- based scheduler to divide any unused bandwidth on the out-going interface amongst applications that need more bandwidth and have maximize bandwidth usage enabled. Unused bandwidth is divided equally. Higher priority traffic does not get a larger portion of the unused bandwidth. Bandwidth Management Behavior The following sections show how bandwidth management behaves with various settings. For example, you configure DMZ to WAN policies for FTP servers A and B. Each server tries to send 1000 kbps, but the WAN is set to a maximum outgoing speed of 1000 kbps. You configure policy A for server As traffic and policy B for server Bs traffic. Figure 314 Bandwidth Management Behavior Configured Rate Effect In the following table the configured rates total less than the available bandwidth and maximize bandwidth usage is disabled, both servers get their configured rate. Table 172 Configured Rate Effect CONFIGURED RATE POLICY A B 300 kbps 200 kbps MAX. B. U. PRIORITY ACTUAL RATE No No 1 1 300 kbps 200 kbps ZyWALL ATP Series Users Guide 447 Chapter 23 BWM (Bandwidth Management) Priority Effect Here the configured rates total more than the available bandwidth. Because server A has higher priority, it gets up to its configured rate (800 kbps), leaving only 200 kbps for server B. Table 173 Priority Effect POLICY CONFIGURED RATE MAX. B. U. PRIORITY ACTUAL RATE A B 800 kbps 1000 kbps Yes Yes 1 2 800 kbps 200 kbps Maximize Bandwidth Usage Effect With maximize bandwidth usage enabled, after each server gets its configured rate, the rest of the available bandwidth is divided equally between the two. So server A gets its configured rate of 300 kbps and server B gets its configured rate of 200 kbps. Then the Zyxel Device divides the remaining bandwidth

(1000 - 500 = 500) equally between the two (500 / 2 = 250 kbps for each). The priority has no effect on how much of the unused bandwidth each server gets. So server A gets its configured rate of 300 kbps plus 250 kbps for a total of 550 kbps. Server B gets its configured rate of 200 kbps plus 250 kbps for a total of 450 kbps. Table 174 Maximize Bandwidth Usage Effect POLICY CONFIGURED RATE MAX. B. U. PRIORITY ACTUAL RATE A B 300 kbps 200 kbps Yes Yes 1 2 550 kbps 450 kbps Priority and Over Allotment of Bandwidth Effect Server A has a configured rate that equals the total amount of available bandwidth and a higher priority. You should regard extreme over allotment of traffic with different priorities (as shown here) as a configuration error. Even though the Zyxel Device still attempts to let all traffic get through and not be lost, regardless of its priority, server B gets almost no bandwidth with this configuration. Table 175 Priority and Over Allotment of Bandwidth Effect POLICY CONFIGURED RATE MAX. B. U. PRIORITY ACTUAL RATE A B 1000 kbps 1000 kbps Yes Yes 1 2 999 kbps 1 kbps 23.2 The Bandwidth Management Configuration The Bandwidth management screens control the bandwidth allocation for TCP and UDP traffic. You can use source interface, destination interface, destination port, schedule, user, source, destination information, DSCP code and service type as criteria to create a sequence of specific conditions, similar to the sequence of rules used by firewalls, to specify how the Zyxel Device handles the DSCP value and allocate bandwidth for the matching packets. Click Configuration > BWM to open the following screen. This screen allows you to enable/disable bandwidth management and add, edit, and remove user-defined bandwidth management policies. ZyWALL ATP Series Users Guide 448 Chapter 23 BWM (Bandwidth Management) The default bandwidth management policy is the one with the priority of default. It is the last policy the Zyxel Device checks if traffic does not match any other bandwidth management policies you have configured. You cannot remove, activate, deactivate or move the default bandwidth management policy. Figure 315 Configuration > Bandwidth Management The following table describes the labels in this screen. See Section 23.2.1 on page 451 for more information as well. Table 176 Configuration > Bandwidth Management LABEL Enable BWM Enable Highest Bandwidth Priority for SIP Traffic Add Edit Remove Activate Inactivate Move Status Priority Description BWM Type DESCRIPTION Select this check box to activate management bandwidth. Select this to maximize the throughput of SIP traffic to improve SIP-based VoIP call sound quality. This has the Zyxel Device immediately send SIP traffic upon identifying it. When this option is enabled the Zyxel Device ignores any other application patrol rules for SIP traffic (so there is no bandwidth control for SIP traffic) and does not record SIP traffic bandwidth usage statistics. Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. To change an entrys position in the numbered list, select it and click Move to display a field to type a number for where you want to put that entry and press [ENTER] to move the entry to the number that you typed. The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. The status icon is not available for the default bandwidth management policy. This field displays a sequential value for each bandwidth management policy and it is not associated with a specific setting. This field displays default for the default bandwidth management policy. This field displays additional information about this policy. This field displays the below types of BWM:

Shared, when the policy is set for all matched traffic Per User, when the policy is set for an individual user or a user group Per-Source-IP, when the policy is set for a source IP ZyWALL ATP Series Users Guide 449 Chapter 23 BWM (Bandwidth Management) Table 176 Configuration > Bandwidth Management LABEL User Schedule Incoming Interface Outgoing Interface Source Destination DSCP Code Service BWM In/Pri/Out/Pri DESCRIPTION This is the type of user account to which the policy applies. If any displays, the policy applies to all user accounts. This is the schedule that defines when the policy applies. none means the policy always applies. This is the source interface of the traffic to which this policy applies. This is the destination interface of the traffic to which this policy applies. This is the source address or address group, including geographic address and FQDN

(group) objects, for whom this policy applies. If any displays, the policy is effective for every source. This is the destination address or address group, including geographic address and FQDN

(group) objects, for whom this policy applies. If any displays, the policy is effective for every destination. These are the DSCP code point values of incoming and outgoing packets to which this policy applies. The lower the number the higher the priority with the exception of 0 which is usually given only best-effort treatment. any means all DSCP value or no DSCP marker. default means traffic with a DSCP value of 0. This is usually best effort traffic The af options stand for Assured Forwarding. The number following the af identifies one of four classes and one of three drop preferences. App and the service name displays if you selected Application Object for the service type. An Application Object is a pre-defined service. Obj and the service name displays if you selected Service Object for the service type. A Service Object is a customized pre-defined service or another service. Mouse over the service object name to view the corresponding IP protocol number. This field shows the amount of bandwidth the traffic can use. In - This is how much inbound bandwidth, in kilobits per second, this policy allows the matching traffic to use. Inbound refers to the traffic the Zyxel Device sends to a connections initiator. If no displays here, this policy does not apply bandwidth management for the inbound traffic. Out - This is how much outgoing bandwidth, in kilobits per second, this policy allows the matching traffic to use. Outbound refers to the traffic the Zyxel Device sends out from a connections initiator. If no displays here, this policy does not apply bandwidth management for the outbound traffic. Pri - This is the priority for the incoming (the first Pri value) or outgoing (the second Pri value) traffic that matches this policy. The smaller the number, the higher the priority. Traffic with a higher priority is given bandwidth before traffic with a lower priority. The Zyxel Device ignores this number if the incoming and outgoing limits are both set to 0. In this case the traffic is automatically treated as being set to the lowest priority (7) regardless of this fields configuration. ZyWALL ATP Series Users Guide 450 Chapter 23 BWM (Bandwidth Management) Table 176 Configuration > Bandwidth Management LABEL DSCP Marking DESCRIPTION This is how the Zyxel Device handles the DSCP value of the incoming and outgoing packets that match this policy. In - Inbound, the traffic the Zyxel Device sends to a connections initiator. Out - Outbound, the traffic the Zyxel Device sends out from a connections initiator. If this field displays a DSCP value, the Zyxel Device applies that DSCP value to the routes outgoing packets. preserve means the Zyxel Device does not modify the DSCP value of the routes outgoing packets. default means the Zyxel Device sets the DSCP value of the routes outgoing packets to 0. The af choices stand for Assured Forwarding. The number following the af identifies one of four classes and one of three drop preferences. Click Apply to save your changes back to the Zyxel Device. Click Reset to return the screen to its last-saved settings. Apply Reset 23.2.1 The Bandwidth Management Add/Edit Screen The Configuration > Bandwidth Management Add/Edit screen allows you to create a new condition or edit an existing one. 802.1P Marking Use 802.1P to prioritize outgoing traffic from a VLAN interface. The Priority Code is a 3-bit field within a 802.1Q VLAN tag thats used to prioritize associated outgoing VLAN traffic. "0" is the lowest priority level and "7" is the highest. Table 177 Single Tagged 802.1Q Frame Format DA SA TPID Priority VID Len/Etype Data FCS IEEE 802.1Q customer tagged frame Table 178 802.1Q Frame DA SA TPID VID Destination Address Source Address Tag Protocol IDentifier VLAN ID Priority Len/Etype Data FCS 802.1p Priority Length and type of Ethernet frame Frame data Frame Check Sequence The following table is a guide to types of traffic for the priority code. Table 179 Priority Code and Types of Traffic PRIORITY 0 (lowest) 1 TRAFFIC TYPES Background Best Effort 2 3 4 5 Excellent Effort Critical Applications Video, less than 100 ms latency and jitter Voice, less than 10 ms latency and jitter ZyWALL ATP Series Users Guide 451 Chapter 23 BWM (Bandwidth Management) Table 179 Priority Code and Types of Traffic PRIORITY 6 TRAFFIC TYPES Internetwork Control 7 (highest) Network Control To access this screen, go to the Configuration > Bandwidth Management screen (see Section 23.2 on page 448), and click either the Add icon or an Edit icon. Figure 316 Configuration > Bandwidth Management > Edit (For the Default Policy) ZyWALL ATP Series Users Guide 452 Chapter 23 BWM (Bandwidth Management) Figure 317 Configuration > Bandwidth Management > Add/Edit The following table describes the labels in this screen. Table 180 Configuration > Bandwidth Management > Add/Edit LABEL Create new Object Configuration Enable Description DESCRIPTION Use to configure any new settings objects that you need to use in this screen. Select this check box to turn on this policy. Enter a description of this policy. It is not used elsewhere. You can use alphanumeric and

()+/:=?!*#@$_%- characters, and it can be up to 60 characters long. Use this section to configure the conditions of traffic to which this policy applies. This field displays the below types of BWM rule:

Criteria BWM Type Shared, when the policy is set for all users Per User, when the policy is set for an individual user or a user group Per Source IP, when the policy is set for a source IP ZyWALL ATP Series Users Guide 453 Chapter 23 BWM (Bandwidth Management) Table 180 Configuration > Bandwidth Management > Add/Edit LABEL User DESCRIPTION Select a user name or user group to which to apply the policy. Use Create new Object if you need to configure a new user account. Select any to apply the policy for every user. Select a schedule that defines when the policy applies or select Create Object to configure a new one. Otherwise, select none to make the policy always effective. Select the source interface of the traffic to which this policy applies. Select the destination interface of the traffic to which this policy applies. Select a source address or address group, including geographic address and FQDN

(group) objects, for whom this policy applies. Use Create new Object if you need to configure a new one. Select any if the policy is effective for every source. Select a destination address or address group, including geographic address and FQDN

(group) objects, for whom this policy applies. Use Create new Object if you need to configure a new one. Select any if the policy is effective for every destination. Select a DSCP code point value of incoming packets to which this policy route applies or select User Defined to specify another DSCP code point. The lower the number the higher the priority with the exception of 0 which is usually given only best-effort treatment. any means all DSCP value or no DSCP marker. default means traffic with a DSCP value of 0. This is usually best effort traffic The af choices stand for Assured Forwarding. The number following the af identifies one of four classes and one of three drop preferences. Use this field to specify a custom DSCP code point. Schedule Incoming Interface Outgoing Interface Source Destination DSCP Code User-Defined DSCP Code Service Type Service Object Select Service Object or Application Object if you want a specific service (defined in a service object) or application patrol service to which the policy applies. This field is available if you selected Service Object as the service type. Application Object DSCP Marking Bandwidth Shaping Select a service or service group to identify the type of traffic to which this policy applies. any means all services. This field is available if you selected Application Object as the service type. Select an application patrol service to identify the specific traffic to which this policy applies. Set how the Zyxel Device handles the DSCP value of the incoming and outgoing packets that match this policy. Inbound refers to the traffic the Zyxel Device sends to a connections initiator. Outbound refers to the traffic the Zyxel Device sends out from a connections initiator. Select one of the pre-defined DSCP values to apply or select User Defined to specify another DSCP value. The af choices stand for Assured Forwarding. The number following the af identifies one of four classes and one of three drop preferences. Select preserve to have the Zyxel Device keep the packets original DSCP value. Select default to have the Zyxel Device set the DSCP value of the packets to 0. Configure these fields to set the amount of bandwidth the matching traffic can use. ZyWALL ATP Series Users Guide 454 Chapter 23 BWM (Bandwidth Management) Table 180 Configuration > Bandwidth Management > Add/Edit LABEL Inbound kbps Outbound kbps Priority Maximize Bandwidth Usage Maximum 802.1P Marking Priority Code Interface Related Setting Log OK Cancel DESCRIPTION Type how much inbound bandwidth, in kilobits per second, this policy allows the traffic to use. Inbound refers to the traffic the Zyxel Device sends to a connections initiator. If you enter 0 here, this policy does not apply bandwidth management for the matching traffic that the Zyxel Device sends to the initiator. Traffic with bandwidth management disabled (inbound and outbound are both set to 0) is automatically treated as the lowest priority (7). If the sum of the bandwidths for routes using the same next hop is higher than the actual transmission speed, lower priority traffic may not be sent if higher priority traffic uses all of the actual bandwidth. Type how much outbound bandwidth, in kilobits per second, this policy allows the traffic to use. Outbound refers to the traffic the Zyxel Device sends out from a connections initiator. If you enter 0 here, this policy does not apply bandwidth management for the matching traffic that the Zyxel Device sends out from the initiator. Traffic with bandwidth management disabled (inbound and outbound are both set to 0) is automatically treated as the lowest priority (7). If the sum of the bandwidths for routes using the same next hop is higher than the actual transmission speed, lower priority traffic may not be sent if higher priority traffic uses all of the actual bandwidth. This field displays when the inbound or outbound bandwidth management is not set to 0. Enter a number between 1 and 7 to set the priority for traffic that matches this policy. The smaller the number, the higher the priority. Traffic with a higher priority is given bandwidth before traffic with a lower priority. The Zyxel Device uses a fairness-based (round-robin) scheduler to divide bandwidth between traffic flows with the same priority. The number in this field is ignored if the incoming and outgoing limits are both set to 0. In this case the traffic is automatically treated as being set to the lowest priority (7) regardless of this fields configuration. This field displays when the inbound or outbound bandwidth management is not set to 0 and the BWM Type is set to Shared. Enable maximize bandwidth usage to let the traffic matching this policy borrow all unused bandwidth on the out-going interface. After each application or type of traffic gets its configured bandwidth rate, the Zyxel Device uses the fairness-based scheduler to divide any unused bandwidth on the out-

going interface among applications and traffic types that need more bandwidth and have maximize bandwidth usage enabled. If you did not enable Maximize Bandwidth Usage, then type the maximum unused bandwidth that traffic matching this policy is allowed to borrow on the out-going interface (in Kbps), here. Use 802.1P to prioritize outgoing traffic from a VLAN interface. This is a 3-bit field within a 802.1Q VLAN tag thats used to prioritize associated outgoing VLAN traffic. "0" is the lowest priority level and "7" is the highest. See Table 179 on page 451. The setting configured here overwrites existing priority settings. Choose a VLAN interface to which to apply the priority level for matching frames. Select whether to have the Zyxel Device generate a log (log), log and alert (log alert) or neither (no) when any traffic matches this policy. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving your changes. ZyWALL ATP Series Users Guide 455 Chapter 23 BWM (Bandwidth Management) 23.2.1.1 Adding Objects for the BWM Policy Objects are parameters to which the Policy rules are built upon. There are three kinds of objects you can add/edit for the BWM policy, they are User, Schedule and Address objects. Click Configuration > BWM >

Add > Create New Object > Add User to see the following screen. Figure 318 Configuration >BWM > Create New Object > Add User The following table describes the fields in the above screen. Table 181 Configuration > BWM > Create New Object > Add User LABEL User Name User Type DESCRIPTION Type a user or user group object name of the rule. Select a user type from the drop down menu. The user types are Admin, Limited admin, User, Guest, Ext-user, Ext-group-user. ZyWALL ATP Series Users Guide 456 Chapter 23 BWM (Bandwidth Management) Table 181 Configuration > BWM > Create New Object > Add User LABEL Password DESCRIPTION Type a password for the user object. The password can consist of alphanumeric characters, the underscore, and some punctuation marks (+-/*= :; .! @$&%#~ \ () ), and it can be up to eight characters long. Retype the password to confirm. Enter a description for this user object. It is not used elsewhere. You can use alphanumeric and ()+/:=?!*#@$_%- characters, and it can be up to 60 characters long. Choose either Use Default setting option, which shows the default Lease Time of 1,440 minutes and Reauthentication Time of 1,440 minutes or you can enter them manually by choosing Use Manual Settings option. This shows the Lease Time setting for the user, by default it is 1,440 minutes. This shows the Reauthentication Time for the user, by default it is 1,440 minutes. Click OK to save the setting. Click Cancel to abandon this screen. Retype Description Authentication Timeout Settings Lease Time Reauthentication Time OK Cancel ZyWALL ATP Series Users Guide 457 Chapter 23 BWM (Bandwidth Management) Figure 319 Configuration > BWM > Create New Object > Add Schedule The following table describes the fields in the above screen. Table 182 Configuration > BWM > Create New Object > Add Schedule LABEL Name Type DESCRIPTION Enter a name for the schedule object of the rule. Select an option from the drop down menu for the schedule object. It will show One Time or Recurring. Click the icon menu on the right to choose a Start Date for the schedule object. Click the icon menu on the right to choose a Start Time for the schedule object. Click the icon menu on the right to choose a Stop Date for schedule object. Click the icon menu on the right to choose a Stop Time for the schedule object. Start Date Start Time Stop Date Stop Time ZyWALL ATP Series Users Guide 458 Chapter 23 BWM (Bandwidth Management) Figure 320 Configuration > BWM > Create New Object > Add Address The following table describes the fields in the above screen. Table 183 Configuration > BWM > Create New Object > Add Address LABEL Name Address Type DESCRIPTION Enter a name for the Address object of the rule. Select an Address Type from the drop down menu on the right. The Address Types are Host, Range, Subnet, Interface IP, Interface Subnet, and Interface Gateway. Enter an IP address for the Address object. Click OK to save the setting. Click Cancel to abandon the setting. IP Address OK Cancel ZyWALL ATP Series Users Guide 459 CHAPTER 24 Web Authentication 24.1 Web Auth Overview Web authentication can intercept network traffic, according to the authentication policies, until the user authenticates his or her connection, usually through a specifically designated login web page. This means all web page requests can initially be redirected to a special web page that requires users to authenticate their sessions. Once authentication is successful, they can then connect to the rest of the network or Internet. As soon as a user attempt to open a web page, the Zyxel Device reroutes his/her browser to a web portal page that prompts him/her to log in. Figure 321 Web Authentication Example The web authentication page only appears once per authentication session. Unless a user session times out or he/she closes the connection, he or she generally will not see it again during the same session. 24.1.1 What You Can Do in this Chapter Use the Configuration > Web Authentication screens (Section 24.2 on page 461) to create and manage web authentication policies. Use the Configuration > Web Authentication > SSO screen (Section 24.3 on page 477) to configure how the Zyxel Device communicates with a Single Sign-On agent. ZyWALL ATP Series Users Guide 460 Chapter 24 Web Authentication 24.1.2 What You Need to Know Single Sign-On A SSO (Single Sign On) agent integrates Domain Controller and Zyxel Device authentication mechanisms, so that users just need to log in once (single) to get access to permitted resources. Forced User Authentication Instead of making users for which user-aware policies have been configured go to the Zyxel Device Login screen manually, you can configure the Zyxel Device to display the Login screen automatically whenever it routes HTTP traffic for anyone who has not logged in yet. Note: This works with HTTP traffic only. The Zyxel Device does not display the Login screen when users attempt to send other kinds of traffic. The Zyxel Device does not automatically route the request that prompted the login, however, so users have to make this request again. 24.2 Web Authentication General Screen The Web Authentication General screen displays the general web portal settings and web authentication policies you have configured on the Zyxel Device. Use this screen to enable web authentication on the Zyxel Device. ZyWALL ATP Series Users Guide 461 Chapter 24 Web Authentication Figure 322 Configuration > Web Authentication > General The following table gives an overview of the objects you can configure. Table 184 Configuration > Web Authentication > General LABEL Global Setting Enable Web Authentication DESCRIPTION Select the check box to turn on the web authentication feature. Otherwise, clear the check box to turn it off. Once enabled, all network traffic is blocked until a client authenticates with the Zyxel Device through the specifically designated web portal or user agreement page. Web Portal General Setting Enable Session Page Logout IP Select this to display a page showing information on the user session after s/he logs in. It displays remaining time with an option to renew or log out immediately. Specify an IP address that users can use to terminate their sessions manually by entering the IP address in the address bar of the web browser. User Agreement General Setting Enforce data collection Select this to require users to fill in their registration information (name, telephone number, address and email address) on the User Agreement (PC or mobile) page. ZyWALL ATP Series Users Guide 462 Chapter 24 Web Authentication Table 184 Configuration > Web Authentication > General (continued) LABEL Exceptional Services DESCRIPTION Use this table to list services that users can access without logging in. Click Add to change the lists membership. A screen appears. Available services appear on the left. Select any services you want users to be able to access without logging in and click the right arrow button to add them. The member services are on the right. Select any service that you want to remove from the member list, and click the left arrow button to remove them. Keeping DNS as a member allows users computers to resolve domain names into IP addresses. Figure 323 Configuration > Web Authentication > Add Exceptional Service Web Authentication Policy Summary Add Edit Remove Activate Inactivate Move

#

Status Priority Incoming Interface Source Destination Schedule In the table, select one or more entries and click Remove to delete it or them. Use this table to manage the Zyxel Devices list of web authentication policies. Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. To turn on an entry, select it and click Activate. To turn off an entry, select it and click Inactivate. To move an entry to a different number in the list, click the Move icon. In the field that appears, specify the number to which you want to move the interface. This field is a sequential value showing the number of the profile. The profile order is not important. This icon is lit when the entry is active and dimmed when the entry is inactive. This is the position of the authentication policy in the list. The priority is important as the policies are applied in order of priority. Default displays for the default authentication policy that the Zyxel Device uses on traffic that does not match any exceptional service or other authentication policy. You can edit the default rule but not delete it. This field displays the interface on which packets for this policy are received. This displays the source address object, including geographic address and FQDN (group) objects, to which this policy applies. This displays the destination address object, including geographic address and FQDN (group) objects, to which this policy applies. This field displays the schedule object that dictates when the policy applies. none means the policy is active at all times if enabled. ZyWALL ATP Series Users Guide 463 Chapter 24 Web Authentication Table 184 Configuration > Web Authentication > General (continued) LABEL Authentication DESCRIPTION This field displays the authentication requirement for users when their traffic matches this policy. unnecessary - Users do not need to be authenticated. required - Users need to be authenticated. They must manually go to the login screen or user agreement page. The Zyxel Device will not redirect them to the login screen. force - Users need to be authenticated. The Zyxel Device automatically displays the login screen or user agreement page whenever it routes HTTP traffic for users who have not logged in yet. This field displays the name of the authentication type profile used in this policy to define how users authenticate their sessions. It shows n/a if Authentication is set to unnecessary. If the entry has a description configured, it displays here. This is n/a for the default policy. Click this button to save your changes to the Zyxel Device. Click this button to return the screen to its last-saved settings. Authentication Type Description Apply Reset Creating Exceptional Services This screen lists services that users can access without logging in. Click Add under Exceptional Services in the previous screen to display this screen. You can change the lists membership here. Available services appear on the left. Select any services you want users to be able to access without logging in and click the right arrow button -> to add them. The member services are on the right. Select any service that you want to remove from the member list, and click the left arrow <- button to remove them. Then click OK to apply the changes and return to the main Web Authentication screen. Alternatively, click Cancel to discard the changes and return to the main Web Authentication screen. Figure 324 Configuration > Web Authentication > General > Add Exceptional Service ZyWALL ATP Series Users Guide 464 Chapter 24 Web Authentication Creating/Editing an Authentication Policy Open the Configuration > Web Authentication > General screen, then click the Add icon or select an entry and click the Edit icon in the Web Authentication Policy Summary section to open the Auth. Policy Add/Edit screen. Use this screen to configure an authentication policy. Figure 325 Configuration > Web Authentication > General > Add Authentication Policy The following table gives an overview of the objects you can configure. Table 185 Configuration > Web Authentication > General > Add Authentication Policy LABEL Create new Object Enable Policy DESCRIPTION Use to configure any new settings objects that you need to use in this screen. Select Address or Schedule. Select this check box to activate the authentication policy. This field is available for user-

configured policies. Enter a descriptive name of up to 60 printable ASCII characters for the policy. Spaces are allowed. This field is available for user-configured policies. Use this section of the screen to determine which traffic requires (or does not require) the senders to be authenticated in order to be routed. Select the interface on which packets for this policy are received. Select a source address or address group, including geographic address and FQDN (group) objects, for whom this policy applies. Select any if the policy is effective for every source. This is any and not configurable for the default policy. Select a destination address or address group, including geographic address and FQDN

(group) objects, for whom this policy applies. Select any if the policy is effective for every destination. This is any and not configurable for the default policy. Select a schedule that defines when the policy applies. Otherwise, select none and the rule is always effective. This is none and not configurable for the default policy. ZyWALL ATP Series Users Guide 465 Description User Authentication Policy Incoming Interface Source Address Destination Address Schedule Chapter 24 Web Authentication Table 185 Configuration > Web Authentication > General > Add Authentication Policy (continued) LABEL Authentication DESCRIPTION Select the authentication requirement for users when their traffic matches this policy. unnecessary - Users do not need to be authenticated. required - Users need to be authenticated. If Force User Authentication is selected, all HTTP traffic from unauthenticated users is redirected to a default or user-defined login page. Otherwise, they must manually go to the login screen. The Zyxel Device will not redirect them to the login screen. This field is available for user-configured policies that require Single Sign-On (SSO). Select this to have the Zyxel Device enable the SSO feature. You can set up this feature in the SSO screen. This field is available for user-configured policies that require authentication. Select this to have the Zyxel Device automatically display the login screen when users who have not logged in yet try to send HTTP traffic. Select an authentication method. default-web-portal: the default login page built into the Zyxel Device. default-user-agreement: the default user agreement page built into the Zyxel Device. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving. Single Sign-on Force User Authentication Authentication Type OK Cancel 24.2.1 User-aware Access Control Example You can configure many policies and security settings for specific users or groups of users. Users can be authenticated locally by the Zyxel Device or by an external (RADIUS) authentication server. In this example the users are authenticated by an external RADIUS server at 172.16.1.200. First, set up the user accounts and user groups in the Zyxel Device. Then, set up user authentication using the RADIUS server. Finally, set up the policies in the table above. 24.2.1.1 Set Up User Accounts Set up user accounts in the RADIUS server. This example uses the Web Configurator. If you can export user names from the RADIUS server to a text file, then you might configure a script to create the user accounts instead. 1 Click Configuration > Object > User/Group > User. Click the Add icon. 2 Enter the same user name that is used in the RADIUS server, and set the User Type to ext-user because this user account is authenticated by an external server. Click OK. ZyWALL ATP Series Users Guide 466 Chapter 24 Web Authentication Figure 326 Configuration > Object > User/Group > User > Add 3 Repeat this process to set up the remaining user accounts. 24.2.1.2 Set Up User Groups Set up the user groups and assign the users to the user groups. 1 Click Configuration > Object > User/Group > Group. Click the Add icon. 2 Enter the name of the group. In this example, it is Finance. Then, select Object/Leo and click the right arrow to move him to the Member list. This example only has one member in this group, so click OK. Of course you could add more members later. Figure 327 Configuration > Object > User/Group > Group > Add 3 Repeat this process to set up the remaining user groups. ZyWALL ATP Series Users Guide 467 Chapter 24 Web Authentication 24.2.1.3 Set Up User Authentication Using the RADIUS Server This step sets up user authentication using the RADIUS server. First, configure the settings for the RADIUS server. Then, set up the authentication method, and configure the Zyxel Device to use the authentication method. Finally, force users to log into the Zyxel Device before it routes traffic for them. 1 Click Configuration > Object > AAA Server > RADIUS. Double-click the radius entry. Configure the RADIUS servers address, authentication port (1812 if you were not told otherwise), and key. Click OK. Figure 328 Configuration > Object > AAA Server > RADIUS > Add 2 Click Configuration > Object > Auth. Method. Double-click the default entry. Click the Add icon. Select group radius because the Zyxel Device should use the specified RADIUS server for authentication. Click OK. Figure 329 Configuration > Object > Auth. method > Edit 3 Click Configuration > Web Authentication. In the Web Authentication > General screen, select Enable Web Authentication to turn on the web authentication feature and click Apply. ZyWALL ATP Series Users Guide 468 Chapter 24 Web Authentication Figure 330 Configuration > Web Authentication 4 5 In the Web Authentication Policy Summary section, click the Add icon to set up a default policy that has priority over other policies and forces every user to log into the Zyxel Device before the Zyxel Device routes traffic for them. Select Enable Policy. Enter a descriptive name, default_policy for example. Set the Authentication field to required, and make sure Force User Authentication is selected. Select an authentication type profile (default-web-portal in this example). Keep the rest of the default settings, and click OK. Note: The users must log in at the Web Configurator login screen before they can use HTTP or MSN. ZyWALL ATP Series Users Guide 469 Chapter 24 Web Authentication Figure 331 Configuration > Web Authentication: General: Add When the users try to browse the web (or use any HTTP application), the login screen appears. They have to log in using the user name and password in the RADIUS server. 24.2.1.4 User Group Authentication Using the RADIUS Server The previous example showed how to have a RADIUS server authenticate individual user accounts. If the RADIUS server has different user groups distinguished by the value of a specific attribute, you can make a couple of slight changes in the configuration to have the RADIUS server authenticate groups of user accounts defined in the RADIUS server. 1 Click Configuration > Object > AAA Server > RADIUS. Double-click the radius entry. Besides configuring the RADIUS servers address, authentication port, and key; set the Group Membership Attribute field to the attribute that the Zyxel Device is to check to determine to which group a user belongs. This example uses Class. This attributes value is called a group identifier; it determines to which group a user belongs. In this example the values are Finance, Engineer, Sales, and Boss. ZyWALL ATP Series Users Guide 470 Chapter 24 Web Authentication Figure 332 Configuration > Object > AAA Server > RADIUS > Add 2 Now you add ext-group-user objects to identify groups based on the group identifier values. Set up one user account for each group of user accounts in the RADIUS server. Click Configuration > Object > User/

Group > User. Click the Add icon. Enter a user name and set the User Type to ext-group-user. In the Group Identifier field, enter Finance, Engineer, Sales, or Boss and set the Associated AAA Server Object to radius. ZyWALL ATP Series Users Guide 471 Chapter 24 Web Authentication Figure 333 Configuration > Object > User/Group > User > Add 3 Repeat this process to set up the remaining groups of user accounts. 24.2.2 Authentication Type Screen Use this screen to view, create and manage the authentication type profiles on the Zyxel Device. An authentication type profile decides which type of web authentication pages to be used for user authentication. Go to Configuration > Web Authentication and then select the Authentication Type tab to display the screen. Figure 334 Configuration > Web Authentication > Authentication Type The following table describes the labels in this screen. Table 186 Configuration > Web Authentication > Authentication Type LABEL Add DESCRIPTION Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry. Double-click an entry or select it and click Edit to open a screen where you can modify the entrys settings. To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. Edit Remove ZyWALL ATP Series Users Guide 472 Chapter 24 Web Authentication Table 186 Configuration > Web Authentication > Authentication Type (continued) LABEL

#

Name DESCRIPTION This field is a sequential value, and it is not associated with a specific entry. This field displays the name of the profile. default-web-portal: the default login page built into the Zyxel Device. Note: You can also customize the default login page built into the Zyxel Device in the System > WWW > Login Page screen. Type Web Page Reset default-user-agreement: the default user agreement page built into the Zyxel Device. This field displays the type of the web authentication page used by this profile. This field displays whether this profile uses the default web authentication page built into the Zyxel Device (System Default Page) or custom web authentication pages from an external web server (External Page). Click Reset to return the screen to its last-saved settings. Add/Edit an Authentication Type Profile Click the Add icon or select an entry in the Web Authentication > Authentication Type screen and click the Edit icon to display the screen. The screen differs depending on what you select in the Type field. Figure 335 Configuration > Web Authentication > Authentication Type: Add/Edit (Web Portal) ZyWALL ATP Series Users Guide 473 Chapter 24 Web Authentication Figure 336 Configuration > Web Authentication > Authentication Type: Add/Edit (User Agreement) The following table describes the labels in this screen. Table 187 Configuration > Web Authentication > Authentication Type: Add/Edit LABEL Type DESCRIPTION Select the type of the web authentication page through which users authenticate their connections. If you select User Agreement, by agreeing to the policy of user agreement, users can access the Internet without a guest account. Enter a name for the profile. Profile Name You can use up to 31 alphanumeric characters (A-Z, a-z, 0-9) and underscores (_). Spaces are not allowed. The first character must be a letter. The following fields are available if you set Type to Web Portal. Internal Web Portal Select this to use the web portal pages uploaded to the Zyxel Device. The login page appears whenever the web portal intercepts network traffic, preventing unauthorized users from gaining access to the network. Select to display the page you uploaded to the Zyxel Device in a new frame. Preview Note: You must select a custom file uploaded to the Zyxel Device before you can preview the pages. Customize file Select the file name of the web portal file in the Zyxel Device. Note: You can upload zipped custom web portal files to the Zyxel Device using the Configuration > Web Authentication > Web Portal Customize File screen. ZyWALL ATP Series Users Guide 474 Chapter 24 Web Authentication Table 187 Configuration > Web Authentication > Authentication Type: Add/Edit (continued) LABEL External Web Portal DESCRIPTION Select this to use a custom login page from an external web portal instead of the one uploaded to the Zyxel Device. You can configure the look and feel of the web portal page. Specify the login pages URL; for example, http://IIS server IP Address/login.html. Login URL Logout URL The Internet Information Server (IIS) is the web server on which the web portal files are installed. Specify the logout pages URL; for example, http://IIS server IP Address/logout.html. Welcome URL The Internet Information Server (IIS) is the web server on which the web portal files are installed. Specify the welcome pages URL; for example, http://IIS server IP Address/welcome.html. Users will be redirected to the welcome page after authentication. This field is optional. Session URL Error URL Download The Internet Information Server (IIS) is the web server on which the web portal files are installed. Specify the session pages URL; for example, http://IIS server IP Address/session.html. The Internet Information Server (IIS) is the web server on which the web portal files are installed. Specify the error pages URL; for example, http://IIS server IP Address/error.html. The Internet Information Server (IIS) is the web server on which the web portal files are installed. Click this to download an example external web portal file for your reference. The following fields are available if you set Type to User Agreement. Enable Idle Detection This is applicable for access users. Select this check box if you want the Zyxel Device to monitor how long each access user is logged in and idle (in other words, there is no traffic for this access user). The Zyxel Device automatically logs out the access user once the Idle timeout has been reached. This is applicable for access users. This field is effective when Enable Idle Detection is checked. Type the number of minutes each access user can be logged in and idle before the Zyxel Device automatically logs out the access user. Enter the number of minutes the user can be logged into the Zyxel Device in one session before having to log in again. Select this to use the user agreement pages in the Zyxel Device. The user agreement page appears whenever the Zyxel Device intercepts network traffic, preventing unauthorized users from gaining access to the network. Select to display the page you uploaded to the Zyxel Device in a new frame. Idle timeout Reauthentication Time Internal User Agreement Preview Note: You must select a custom file uploaded to the Zyxel Device before you can preview the pages. Customize file Select the file name of the user agreement file in the Zyxel Device. External User Agreement Agreement URL Note: You can upload zipped custom user agreement files to the Zyxel Device using the Configuration > Web Authentication > User Agreement Customize File screen. Select this to use custom user agreement pages from an external web server instead of the default one built into the Zyxel Device. You can configure the look and feel of the user agreement page. Specify the user agreement pages URL; for example, http://IIS server IP Address/logout.html. The Internet Information Server (IIS) is the web server on which the user agreement files are installed. ZyWALL ATP Series Users Guide 475 Chapter 24 Web Authentication Table 187 Configuration > Web Authentication > Authentication Type: Add/Edit (continued) LABEL DESCRIPTION Specify the welcome pages URL; for example, http://IIS server IP Address/welcome.html. Welcome URL The Internet Information Server (IIS) is the web server on which the user agreement files are installed. Download OK Cancel If you leave this field blank, the Zyxel Device will use the welcome page of internal user agreement file. Click this to download an example external user agreement file for your reference. Click OK to save your changes back to the Zyxel Device. Click Cancel to exit this screen without saving. 24.2.3 Custom Web Portal / User Agreement File Screen Use this screen to upload the zipped custom web portal or user agreement files to the Zyxel Device. You can also download the custom files to your computer. Click Configuration > Web Authentication and then select the Custom Web Portal File or Custom User Agreement File tab to display the screen. Figure 337 Configuration > Web Authentication > Custom Web Portal File ZyWALL ATP Series Users Guide 476 Chapter 24 Web Authentication Figure 338 Configuration > Web Authentication > Custom User Agreement File The following table describes the labels in this screen. Table 188 Configuration > Web Authentication > Custom Web Portal / User Agreement File LABEL Remove Download

#

DESCRIPTION Click a files row to select it and click Remove to delete it from the Zyxel Device. Click a files row to select it and click Download to save the zipped file to your computer. This column displays the index number for each file entry. This field is a sequential value, and it is not associated with a specific entry. This column displays the label that identifies a web portal or user agreement file. This column displays the size (in KB) of a file. This column displays the date and time that the individual files were last changed or saved. Click Browse... to find the zipped file you want to upload, then click the Upload button to put it on the Zyxel Device. Click this to download an example external web portal or user agreement file for your reference. File Name Size Last Modified Browse / Upload Download 24.3 SSO Overview The SSO (Single Sign-On) function integrates Domain Controller and Zyxel Device authentication mechanisms, so that users just need to log in once (single login) to get access to permitted resources. In the following figure, U user logs into a Domain Controller (DC) which passes the users login credentials to the SSO agent. The SSO agent checks that these credentials are correct with the AD server, and if the AD server confirms so, the SSO then notifies the Zyxel Device to allow access for the user to the permitted resource (Internet access, for example). ZyWALL ATP Series Users Guide 477 Chapter 24 Web Authentication Note: The Zyxel Device, the DC, the SSO agent and the AD server must all be in the same domain and be able to communicate with each other. SSO does not support IPv6, LDAP or RADIUS; you must use it in an IPv4 network environment with Windows AD (Active Directory) authentication database. You must enable Web Authentication in the Configuration > Web Authentication screen. Figure 339 SSO Overview U DC SSO AD User Domain Controller Single Sign-On agent Active Directory Install the SSO Agent on one of the following platforms:

Windows 7 Professional (32-bit and 64-bit) Windows Server 2008 Enterprise (32-bit and 64-bit) Windows 2008 R2 (64-bit) Windows Server 2012 (64-bit) ZyWALL ATP Series Users Guide 478 Chapter 24 Web Authentication 24.4 SSO - Zyxel Device Configuration This section shows what you have to do on the Zyxel Device in order to use SSO. Table 189 Zyxel Device - SSO Agent Field Mapping ZYXEL DEVICE FIELD Listen Port SCREEN Web Authentication >

SSO Web Authentication >

SSO Object > User/Group >

User > Add Primary Agent Port Group Identifier Object > AAA Server >

Active Directory > Add Base DN Object > AAA Server >

Active Directory > Add Bind DN Object > User/Group >

User > Add User Name Object > AAA Server >

Active Directory > Add Server Address Network > Interface >

Ethernet > wan (IPv4) IP address SSO FIELD Gateway Port Agent Listening Port Group Membership Base DN Bind DN Login Name Attribute Server Address Gateway IP SCREEN Agent Configuration Page > Gateway Setting Agent Configuration Page Agent Configuration Page > Configure LDAP/AD Server Agent Configuration Page > Configure LDAP/AD Server Agent Configuration Page > Configure LDAP/AD Server Agent Configuration Page > Configure LDAP/AD Server Agent Configuration Page > Configure LDAP/AD Server Agent Configuration Page > Gateway Setting 24.4.1 Configuration Overview These are the screens you need to configure:

Configure the Zyxel Device to Communicate with SSO on page 479 Enable Web Authentication on page 480 Create a Security Policy on page 482 Configure User Information on page 483 Configure an Authentication Method on page 484 Configure Active Directory on page 485 or Configure Active Directory on page 485 24.4.2 Configure the Zyxel Device to Communicate with SSO Use Configuration > Web Authentication > SSO to configure how the Zyxel Device communicates with the Single Sign-On (SSO) agent. ZyWALL ATP Series Users Guide 479 Chapter 24 Web Authentication Figure 340 Configuration > Web Authentication > SSO The following table gives an overview of the objects you can configure. Table 190 Configuration > Web Authentication > SSO LABEL Listen Port DESCRIPTION The default agent listening port is 2158. If you change it on the Zyxel Device, then change it to the same number in the Gateway Port field on the SSO agent too. Type a number ranging from 1025 to 65535. Type 8-32 printable ASCII characters or exactly 32 hex characters (0-9; a-f). The Agent PreShareKey is used to encrypt communications between the Zyxel Device and the SSO agent. Type the IPv4 address of the SSO agent. The Zyxel Device and the SSO agent must be in the same domain and be able to communicate with each other. Type the same port number here as in the Agent Listening Port field on the SSO agent. Type a number ranging from 1025 to 65535. Type the IPv4 address of the backup SSO agent if there is one. The Zyxel Device and the backup SSO agent must be in the same domain and be able to communicate with each other. Type the same port number here as in the Agent Listening Port field on the backup SSO agent if there is one. Type a number ranging from 1025 to 65535. Click this button to save your changes to the Zyxel Device. Click this button to return the screen to its last-saved settings Agent PreShareKey Primary Agent Primary Agent Port Secondary Agent Address

(Optional) Secondary Agent Port

(Optional) Apply Reset 24.4.3 Enable Web Authentication Enable Web Authentication and add a web authentication policy. ZyWALL ATP Series Users Guide 480

 

 

CONSTRUCTION PHOTOS OF EUT Brand Name: ZYXEL / Model Name: ATP100W Reference No.: 190822C14-2 Page 1 / 10 Reference No.: 190822C14-2 Page 2 / 10 1st DDR Reference No.: 190822C14-2 Page 3 / 10 Reference No.: 190822C14-2 Page 4 / 10 Reference No.: 190822C14-2 Page 5 / 10 Reference No.: 190822C14-2 Page 6 / 10 2nd DDR Reference No.: 190822C14-2 Page 7 / 10 Reference No.: 190822C14-2 Page 8 / 10 Reference No.: 190822C14-2 Page 9 / 10 Reference No.: 190822C14-2 Page 10 / 10

 

 

CONSTRUCTION PHOTOS OF EUT Brand Name: ZYXEL / Model Name: ATP100W Reference No.: 190822C14-1 Page 1 / 8 Reference No.: 190822C14-1 Page 2 / 8 Reference No.: 190822C14-1 Page 3 / 8 Reference No.: 190822C14-1 Page 4 / 8 Reference No.: 190822C14-1 Page 5 / 8 NCC ID Reference No.: 190822C14-1 Page 6 / 8 Reference No.: 190822C14-1 Page 7 / 8 Reference No.: 190822C14-1 Page 8 / 8

 

 

ZYXEL Communications Corporation SHMRESRO] | slit Model Number(Q} ATPIOOW Power Rating(MEiE Mi): 147524 This device comples with Port 16 ofthe FCC Rules Operation is subject to the HASH 2) WALLATP Ril Power Congumetion: 19Watt max. following two conditions) this device may not couse harmful interference, a and (2) this daviee must accept any interference received, including CONICS SEO SF interference that may couse undesired operation.

= RECON C

(( 133 a |

EL Importer: 2yxel Communications A/$, Gladsaveve) 378, 2 th. 2860 Saborg, Denmark US Importer Zyxel Communications, Inc, 190 North Millar Street Anaheim, CA92806-2001, www.uazyxeLeom ,

; e aa a ZYXEL Communications Corporation S#HIRARABIRBD 5. neipy zycclintowan ase Model Number (#88): ATPIOOW Power Rating (S82 %EH#):12V==24 This device complies with Part 15 of the FCC Rules. Operation is subject to the ERB ZYWALL ATP BAGH Power Consumption: 19 Watt max. following two conditions.) this device may not cause harmful interference, and (2) this device must accept any interference received, including 00000000000 aunts EU Importer: Zyxel Communications A/S, Gladsaxevej 378, 2. th. 2860 Saborg, Denmark US Importer: Zyxel Communications, Inc, 1130 North Miller Street Anaheim, CA92806-2001, www.us2yxelcom CAN ICES-3(B)/NMB-3(B)

 

 

Zyxel Communications Corporation No.2, Industry East Road IX, Science Park Hsinchu Taiwan TEL: 886 3 578-3942 FAX: 886 3 578-2439 Date: 2019-10-18 FCC ID: I88ATP100W To Whom It May Concern:

A U T H O R I Z A T I O N L E T T E R Zyxel Communications Corporation hereby authorizes Andrea Hsia / Supervisor of Bureau Veritas Consumer Products Services (H.K.) Ltd., Taoyuan Branch (BV CPS Taoyuan), to act on its behalf in all matters relating to the Federal Communication Commission (FCC) application for equipment authorization in connection with the FCC ID listed above, including signing of all documents relating to these matters. Any and all acts carried out by Andrea Hsia / Supervisor of BV CPS Taoyuan on Zyxel Communications Corporations behalf, within the scope of the powers granted herein, shall have the same effect as acts of its own. If you have any questions regarding the authorization, please dont hesitate to contact us. Sincerely yours,

Emma Bao / Section Manager Zyxel Communications Corporation Tel: 886 3 578-3942 Ext. 88582 Fax: 886 3 578-2439 E-mail: Emma.bao@zyxel.com.tw

 

 

Zyxel Communications Corporation No.2, Industry East Road IX, Science Park Hsinchu Taiwan TEL: 886 3 578-3942 FAX: 886 3 578-2439 Date: 2019-10-18 FCC ID: I88ATP100W To the attention of Federal Communications Commission Authorization and Evaluation Division Permanent Confidentiality Request Pursuant to Sections 0.457 and 0.459 of the Commissions Rules, the Applicant hereby requests confidential treatment of information accompanying this Application as outlined below:

Schematics Block Diagram Operational Description Software Operational Description The above materials contain trade secrets and proprietary information not customarily released to the public. The public disclosure of these matters might be harmful to the Applicant and provide unjustified benefits to its competitors. The Applicant understands that pursuant to Rule 0.457, disclosure of this Application and all accompanying documentation will not be made before the date of the Grant for this application. Sincerely yours,

Emma Bao / Section Manager Zyxel Communications Corporation Tel: 886 3 578-3942 Ext. 88582 Fax: 886 3 578-2439 E-mail: Emma.bao@zyxel.com.tw

 

 

Zyxel Communications Corporation No.2, Industry East Road IX, Science Park Hsinchu Taiwan TEL: 886 3 578-3942 FAX: 886 3 578-2439 Date: October 18, 2019 We, Zyxel Communications Corporation declare that the device does not support channel 12 ~

13 in 2.4GHz band and any non-US channels in all the operational mode(s) for the following product. FCC ID: I88ATP100W If you should have any question(s) regarding this declaration, please dont hesitate to contact us. Thank you!

Emma Bao / Section Manager Zyxel Communications Corporation Tel: 886 3 578-3942 Ext. 88582 Fax: 886 3 578-2439 E-mail: Emma.bao@zyxel.com.tw