Manuals / Brands / Household Appliance / Home Security System / ZyXEL Communications / Household Appliance / Home Security System

ZyXEL Communications 2WG manual 348

1 784

Download 784 pages, 23.57 Mb

Chapter 14 IPSec VPN

348
348	ZyWALL 2WG User’s Guide

Contents

www.zyxel.com Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Part IV: Advanced Page Page Page Page Page Page Page Page Page Part VIII: Appendices and Index Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page PART Introduction Page 1.2 Ways to Manage the ZyWALL 1.3Good Habits for Managing the ZyWALL 1.4Applications for the ZyWALL 1.4.2 VPN Application 1.4.3 3G WAN Application 1.4.4 Front Panel Lights 2.1 Web Configurator Overview 2.2Accessing the ZyWALL Web Configurator Page 2.3 Resetting the ZyWALL 2.4 Navigating the ZyWALL Web Configurator 2.4.2 Main Window 2.4.3 HOME Screen: Router Mode Page Page Page Page Page 2.4.4 HOME Screen: Bridge Mode Page Page 2.4.5 Navigation Panel Page Page Page 2.4.6 Port Statistics 2.4.7 Show Statistics: Line Chart 2.4.8 DHCP Table Screen 2.4.9 VPN Status 2.4.10 Bandwidth Monitor Page Page 3.1 Wizard Setup Overview 3.2 Internet Access 3.2.1 ISP Parameters Page Page Page 3.2.2 Internet Access Wizard: Second Screen 3.2.3 Internet Access Wizard: Registration Page 3.2.4 Internet Access Wizard: Status 3.3 VPN Wizard Gateway Setting Page 3.4 VPN Wizard Network Setting 3.5 VPN Wizard IKE Tunnel Setting (IKE Phase 1) Page 3.6 VPN Wizard IPSec Setting (IKE Phase 2) 3.7 VPN Wizard Status Summary Page Page 3.8 VPN Wizard Setup Complete Page 4.1 Security Settings for VPN Traffic 4.1.2 Configuring the VPN Rule Page Page 4.1.3 Configuring the Firewall Rules Page Page Page 4.2 Using NAT with Multiple Public IP Addresses 4.2.2 Configuring the WAN Connection with a Static IP Address Page Page 4.2.3 Public IP Address Mapping Page Page Page Page 4.2.4Forwarding Traffic from the WAN to a Local Computer Page 4.2.5 Allow WAN-to-LANTraffic through the Firewall Page Page Page Page Page Page 4.3 Using NAT with Multiple Game Players 4.4How to Manage the ZyWALL’s Bandwidth 4.4.2 Configuring Bandwidth Management Rules Page Page Page 4.5 Configuring Content Filtering 4.5.2 Block Categories of Web Content Page 4.5.3 Assign Bob’s Computer a Specific IP Address 4.5.4 Create a Content Filter Policy for Bob 4.5.5 Set the Content Filter Schedule 4.5.6 Block Categories of Web Content for Bob Page Page 5.1 myZyXEL.com overview 5.2 Registration 5.3 Service Page Network and Wireless Page 6.1 LAN, WAN and the ZyWALL 6.2 IP Address and Subnet Mask 6.2.1 Private IP Addresses 6.3 DHCP 6.4 RIP Setup 6.5 Multicast 6.6 WINS 6.7 LAN Page Page 6.8 LAN Static DHCP 6.9 LAN IP Alias Page 6.10 LAN Port Roles Page Page 7.1 Bridge Loop 7.2 Spanning Tree Protocol (STP) 7.3 Bridge Page 7.4 Bridge Port Roles Page 8.1WAN Overview 8.2Multiple WAN 8.3 Load Balancing Introduction 8.4 Load Balancing Algorithms 8.4.2 Weighted Round Robin 8.4.3 Spillover 8.5 WAN Interface to Local Host Mapping Timeout 8.6 TCP/IP Priority (Metric) 8.7 WAN General Page Page Page 8.8 Configuring Load Balancing 8.8.2 Weighted Round Robin 8.8.3 Spillover 8.9 WAN IP Address Assignment 8.10DNS Server Address Assignment 8.11 WAN MAC Address 8.12 WAN Page Page 8.12.2 PPPoE Encapsulation Page Page 8.12.3 PPTP Encapsulation Page Page 8.13 WAN 2 (3G WAN) Page Page Page Page Page 8.14 Traffic Redirect 8.15 Configuring Traffic Redirect 8.16 Configuring Dial Backup Page 8.17 Advanced Modem Setup 8.18 Configuring Advanced Modem Setup Page Page 9.1 DMZ 9.2 Configuring DMZ Page Page 9.3 DMZ Static DHCP 9.4 DMZ IP Alias Page 9.5 DMZ Public IP Address Example 9.6 DMZ Private and Public IP Address Example 9.7 DMZ Port Roles Page 10.1 Wireless LAN Introduction 10.2Configuring WLAN Page Page 10.3 WLAN Static DHCP 10.4 WLAN IP Alias Page 10.5 WLAN Port Roles Page 10.6 Wireless Security Overview 10.6.1 SSID 10.6.2 MAC Address Filter 10.6.3 User Authentication 10.6.4 Encryption 10.7 Wireless Card Page Page 10.7.1 SSID Profile 10.8 Configuring Wireless Security 10.8.1No Security 10.8.2 Static WEP 10.8.3 IEEE 802.1x Only 10.8.4 IEEE 802.1x + Static WEP 10.8.5 WPA, WPA2, WPA2-MIX 10.8.6 WPA-PSK, WPA2-PSK, WPA2-PSK-MIX Page 10.9 MAC Filter Page ART Security Page 11.1 Firewall Overview 11.2 Packet Direction Matrix Page 11.3 Packet Direction Examples 11.3.1 To VPN Packet Direction 11.3.2 From VPN Packet Direction Page 11.3.3 From VPN To VPN Packet Direction Page 11.4Security Considerations 11.5 Firewall Rules Example Page 11.6 Asymmetrical Routes 11.7 Firewall Default Rule (Router Mode) Page 11.8 Firewall Default Rule (Bridge Mode) Page 11.9 Firewall Rule Summary Page 11.9.1 Firewall Edit Rule Page Page 11.10 Anti-Probing 11.11 Firewall Thresholds 11.12 Threshold Screen Page 11.13 Service 11.13.1 Firewall Edit Custom Service 11.14 My Service Firewall Rule Example Page Page Page Page 12.1 Content Filtering Overview 12.2 Content Filtering with an External Database 12.3Content Filter General Screen Page Page 12.4 Content Filter Policy Page 12.5 Content Filter Policy: General 12.6 Content Filter Policy: External Database Page Page Page Page Page Page 12.7 Content Filter Policy: Customization Page 12.8 Content Filter Policy: Schedule 12.9 Content Filter Object Page 12.10 Customizing Keyword Blocking URL Checking 12.11 Content Filtering Cache Page 13.1 Checking Content Filtering Activation 13.2Viewing Content Filtering Reports Page Page Page Page 13.3 Web Site Submission Page Page 14.1 IPSec VPN Overview 14.1.1 IKE SA Overview 14.2 VPN Rules (IKE) Page 14.3 IKE SA Setup Page Page Page 14.4 Additional IPSec VPN Topics 14.4.1 SA Life Time 14.4.2IPSec High Availability 14.4.3 Encryption and Authentication Algorithms 14.5 VPN Rules (IKE) Gateway Policy Edit Page Page Page Page Page 14.6 IPSec SA Overview 14.6.2 Virtual Address Mapping 14.6.3 Active Protocol 14.6.4Encapsulation 14.7 VPN Rules (IKE) Network Policy Edit Page Page Page Page 14.8 Network Policy Port Forwarding Page 14.9 Network Policy Move 14.10 Dialing the VPN Tunnel via Web Configurator 14.11 VPN Troubleshooting 14.12 IPSec Debug Page 14.13 IPSec SA Using Manual Keys 14.14 VPN Rules (Manual) Page 14.15 VPN Rules (Manual) Edit Page Page 14.16 VPN SA Monitor 14.17 VPN Global Setting Page Page 14.18 Telecommuter VPN/IPSec Examples 14.18.1 Telecommuters Sharing One VPN Rule Example 14.18.2 Telecommuters Using Unique VPN Rules Example Page 14.19 VPN and Remote Management 14.20 Hub-and-spokeVPN 14.20.1 Hub-and-spokeVPN Example 14.20.2 Hub-and-spokeExample VPN Rule Addresses 14.20.3Hub-and-spokeVPN Requirements and Suggestions Page Page 15.1 Certificates Overview 15.2Self-signedCertificates 15.3 Verifying a Certificate 15.4Configuration Summary 15.5 My Certificates Page 15.6 My Certificate Details Page 15.7 My Certificate Export 15.8 My Certificate Import Page 15.9 My Certificate Create Page Page Page Page 15.10 Trusted CAs Page 15.11 Trusted CA Details Page Page 15.12 Trusted CA Import 15.13 Trusted Remote Hosts Page 15.14 Trusted Remote Hosts Import 15.15 Trusted Remote Host Certificate Details Page 15.16 Directory Servers 15.17 Directory Server Add or Edit Page Page 16.1 Authentication Server Overview 16.2 Local User Database Page 16.3 RADIUS Page Advanced Page 17.1 NAT Overview 17.1.2What NAT Does 17.1.3 How NAT Works 17.1.4 NAT Application 17.1.5 Port Restricted Cone NAT 17.1.6 NAT Mapping Types 17.2Using NAT 17.3 NAT Overview Screen 17.4 NAT Address Mapping Page 17.4.2 NAT Address Mapping Edit 17.5 Port Forwarding 17.5.2Port Forwarding: Services and Port Numbers 17.5.3 Configuring Servers Behind Port Forwarding (Example) 17.5.4 NAT and Multiple WAN 17.5.5 Port Translation 17.6 Port Forwarding Screen Page 17.7 Port Triggering Page 18.1 IP Static Route 18.2 IP Static Route 18.2.1 IP Static Route Edit Page 19.1 Policy Route 19.2Benefits 19.3Routing Policy 19.4 IP Routing Policy Setup 19.5 Policy Route Edit Page Page Page 20.1 Bandwidth Management Overview 20.2 Bandwidth Classes and Filters 20.3 Proportional Bandwidth Allocation 20.4 Application-basedBandwidth Management 20.5 Subnet-basedBandwidth Management 20.6 Application and Subnet-basedBandwidth Management 20.7 Scheduler 20.7.5Maximize Bandwidth Usage Example 20.8Bandwidth Borrowing 20.9Maximize Bandwidth Usage With Bandwidth Borrowing 20.10Over Allotment of Bandwidth 20.11 Configuring Summary Page 20.12 Configuring Class Setup 20.12.1 Bandwidth Manager Class Configuration Page Page 20.12.2 Bandwidth Management Statistics Monitor Page Page 21.1 DNS Overview 21.2 DNS Server Address Assignment 21.3DNS Servers 21.4 Address Record 21.5 Name Server Record 21.6System Screen Page 21.6.1 Adding an Address Record 21.6.2 Inserting a Name Server Record 21.7 DNS Cache 21.8 Configure DNS Cache Page 21.9 Configuring DNS DHCP 21.10 Dynamic DNS 21.11 Configuring Dynamic DNS Page 22.1 Remote Management Overview 22.2 WWW (HTTP and HTTPS) 22.3WWW Page 22.4 HTTPS Example 22.4.3 Avoiding the Browser Warning Messages 22.4.4 Login Screen Page 22.5 SSH 22.6 How SSH Works 22.7 SSH Implementation on the ZyWALL 22.8 Configuring SSH 22.9 Secure Telnet Using SSH Examples 22.10Secure FTP Using SSH Example 22.11 Telnet 22.12 Configuring TELNET 22.13 FTP 22.14 SNMP 22.14.1Supported MIBs 22.14.2 SNMP Traps 22.14.3 REMOTE MANAGEMENT: SNMP 22.15 DNS 22.16 Introducing Vantage CNM 22.17 Configuring CNM Page 22.17.1 Additional Configuration for Vantage CNM 23.1 Universal Plug and Play Overview 23.2 Configuring UPnP 23.3 Displaying UPnP Port Mapping 23.4 Installing UPnP in Windows Example 23.4.1 Installing UPnP in Windows Me 23.5Using UPnP in Windows XP Example 23.5.1Auto-discoverYour UPnP-enabledNetwork Device 23.5.2 Web Configurator Easy Access Page Page 24.1 Custom Applicaton 24.2Custom Applicaton Configuration Page 25.1 ALG Introduction 25.2 FTP 25.4 RTP Page 25.5SIP 25.6 ALG Screen Page Logs and Maintenance Page 26.1 Configuring View Log 26.2 Log Description Example 26.2.1 About the Certificate Not Trusted Log 26.3 Configuring Log Settings Page Page 26.4 Configuring Reports Page 26.4.1Viewing Web Site Hits 26.4.2 Viewing Host IP Address 26.4.3 Viewing Protocol/Port Page 26.5 Log Descriptions Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page 26.6 Syslog Logs Page Page 27.1 Maintenance Overview 27.2 General Setup and System Name 27.3 Configuring Password 27.4 Time and Date Page Page 27.5 Pre-definedNTP Time Server Pools 27.6 Introduction To Transparent Bridging 27.7Transparent Firewalls 27.8 Configuring Device Mode (Router) 27.9 Configuring Device Mode (Bridge) Page 27.10 F/W Upload Screen Page 27.11 Backup and Restore 27.11.1 Backup Configuration 27.11.2 Restore Configuration 27.12 Restart Screen 27.13 Diagnostics Page Page SMT Page 28.1 Introduction to the SMT 28.2 Accessing the SMT via the Console Port 28.3 Navigating the SMT Interface 28.3.1 Main Menu Page 28.3.2 SMT Menus Overview Page 28.4 Changing the System Password 28.5 Resetting the ZyWALL 29.1 Introduction to General Setup 29.2 Configuring General Setup Page 29.2.1 Configuring Dynamic DNS Page Page Page 30.1Introduction to WAN, 3G WAN and Dial Backup Setup 30.2 WAN Setup 30.3 Dial Backup 30.3.2Advanced WAN Setup Page 30.3.3 Remote Node Profile (Backup ISP) Page 30.3.4 Editing TCP/IP Options 30.3.5 Editing Login Script Page 30.4 3G WAN Page 30.4.2 Remote Node Profile (3G WAN) Page Page 31.1 Introduction to LAN Setup 31.2 Accessing the LAN Menus 31.3 LAN Port Filter Setup 31.4 TCP/IP and DHCP Ethernet Setup Menu Page Page 31.4.1 IP Alias Setup Page 32.1 Introduction to Internet Access Setup 32.2Ethernet Encapsulation Page 32.3Configuring the PPTP Client 32.4 Configuring the PPPoE Client 32.5 Basic Setup Complete Page 33.1 Configuring DMZ Setup 33.2 DMZ Port Filter Setup 33.3 TCP/IP Setup 33.3.2IP Alias Setup Page 34.1 Configuring Route Setup 34.2 Route Assessment 34.3 Traffic Redirect 34.4 Route Failover Page 35.1 TCP/IP Setup 35.1.2 IP Alias Setup Page Page 36.1 Introduction to Remote Node Setup 36.2 Remote Node Setup 36.3 Remote Node Profile Setup 36.3.1 Ethernet Encapsulation 36.3.2 PPPoE Encapsulation 36.3.3 PPTP Encapsulation 36.4 Edit IP Page 36.5 Remote Node Filter Page 37.1 IP Static Route Setup Page Page Page 38.1Using NAT Page 38.2 NAT Setup 38.2.1Address Mapping Sets Page Page Page 38.3Configuring a Server behind NAT Page Page 38.4 General NAT Examples 38.4.2 Example 2: Internet Access with a Default Server 38.4.3 Example 3: Multiple Public IP Addresses With Inside Servers Page Page 38.4.4 Example 4: NAT Unfriendly Application Programs Page 38.5 Trigger Port Forwarding Page Page 39.1 Using ZyWALL SMT Menus Page 40.1 Introduction to Filters 40.1.1 The Filter Structure of the ZyWALL Page 40.2 Configuring a Filter Set 40.2.1 Configuring a Filter Rule 40.2.2 Configuring a TCP/IP Filter Rule Page 40.2.3 Configuring a Generic Filter Rule Page 40.3 Example Filter Page 40.4Filter Types and NAT 40.5 Firewall Versus Filters 40.6Applying a Filter 40.6.1Applying LAN Filters 40.6.2 Applying DMZ Filters 40.6.3 Applying Remote Node Filters Page 41.1 SNMP Configuration 41.2 SNMP Traps 42.1 Introduction to System Status 42.2 System Status Page 42.3 System Information and Console Port Speed 42.3.2 Console Port Speed 42.4 Log and Trace 42.4.2 Syslog Logging Page Page 42.4.3 Call-TriggeringPacket 42.5 Diagnostic 42.5.1 WAN DHCP Page 43.1 Introduction 43.2 Filename Conventions 43.3Backup Configuration 43.3.2 Using the FTP Command from the Command Line 43.3.3Example of FTP Commands from the Command Line 43.3.4 GUI-basedFTP Clients 43.3.5 File Maintenance Over WAN 43.3.6Backup Configuration Using TFTP 43.3.7 TFTP Command Example 43.3.8 GUI-basedTFTP Clients 43.3.9 Backup Via Console Port 43.4Restore Configuration 43.4.1Restore Using FTP 43.4.2Restore Using FTP Session Example 43.4.3 Restore Via Console Port 43.5 Uploading Firmware and Configuration Files 43.5.2 Configuration File Upload 43.5.3 FTP File Upload Command from the DOS Prompt Example 43.5.4FTP Session Example of Firmware File Upload 43.5.5 TFTP File Upload 43.5.6 TFTP Upload Command Example 43.5.7 Uploading Via Console Port 43.5.8Uploading Firmware File Via Console Port 43.5.9Example Xmodem Firmware Upload Using HyperTerminal 43.5.10Uploading Configuration File Via Console Port 43.5.11Example Xmodem Configuration Upload Using HyperTerminal 44.1 Command Interpreter Mode 44.1.1 Command Syntax 44.1.2 Command Usage 44.2 Call Control Support 44.2.2 Call History 44.3 Time and Date Setting Page Page Page 45.1 Remote Management Page 45.1.1 Remote Management Limitations Page 46.1 IP Routing Policy Summary 46.2 IP Routing Policy Setup Page 46.2.1 Applying Policy to Packets 46.3 IP Policy Routing Example Page Page Page 47.1 Introduction to Call Scheduling Page Page Page Troubleshooting and Specifications Page 48.1Power, Hardware Connections, and LEDs 48.2 ZyWALL Access and Login Page 48.3 Internet Access Page Page 49.1 General ZyWALL Specifications Page Page 49.2 Compatible 3G Cards 49.33G Card Installation 49.4Wall-mountingInstructions Page 49.5 Power Adaptor Specifications 49.6 Cable Pin Assignments Page Page Appendices and Index Page Internet Explorer Pop-upBlockers Page Page JavaScripts Java Permissions Mozilla Firefox Page Page Windows 95/98/Me Page Page Windows 2000/NT/XP Page Page Page Page Macintosh OS 8/9 Page Macintosh OS Linux Page Page Page Page Introduction to IP Addresses Structure Subnet Masks Notation Subnetting Example: Four Subnets Example: Eight Subnets Subnet Planning Configuring IP Addresses Page Page Page Page Wireless LAN Topologies Page Channel RTS/CTS Fragmentation Threshold Preamble Type IEEE 802.11g Wireless LAN Wireless Security Overview IEEE RADIUS Types of EAP Authentication Page Dynamic WEP Key Exchange WPA and WPA2 Page Page Security Parameters Summary Antenna Overview Antenna Characteristics Types of Antennas for WLAN Positioning Antennas Import ZyWALL Certificates into Netscape Navigator Importing the ZyWALL’s Certificate into Internet Explorer Page Page Page Enrolling and Importing SSL Client Certificates Page Page Page Page Using a Certificate When Accessing the ZyWALL Example Copyright Certifications Page ZyXEL Limited Warranty Page Page Page Page Page Page Page Numerics