ZyXEL Communications ISG50 manual

ISG50

Integrated Service Gateway

Default Login Details		IMPORTANT!

LAN IP	https://192.168.1.1	READ CAREFULLY
Address		READ CAREFULLY
User Name	admin	BEFORE USE.
User Name	admin
Password	1234	KEEP THIS GUIDE
		FOR FUTURE
		REFERENCE.

Version 2.30

Edition 3, 05/2012

www.zyxel.com

Contents

LAN IP https://192.168.1.1 READ CAREFULLY Address User Name •Quick Start Guide •CLI Reference Guide Note: It is recommended you use the Web Configurator to configure the ISG50 • Web Configurator Online Help Read Contents Overview Page Table of Contents Part I: User’s Guide 4.1.1 Internet Access Setup - WAN Interface 4.1.2 Internet Access: Ethernet 4.1.4 Internet Access: PPTP 4.1.6 Internet Access Setup - Second WAN Interface 4.1.7 Internet Access - Finish General Tutorials How to Use a RADIUS Server to Authenticate User Accounts Based on Groups 8.2.1 Configuring the snom VoIP Phones for Auto Provisioning 8.6.3 Example 3: Company with Existing PBX and Expanding Employees 8.7 Using Call Features 8.7.1 Customizing Feature Codes 8.7.2 Using the Voicemail Feature 8.8 Using the Extension Portal 8.8.1 Your Information 10.11.1 Regular Expressions in Searching IPSec SAs Policy and Static Routes 16.1.1 What You Can Do in this Chapter 16.1.2 What You Need to Know 17.1 DDNS Overview 17.1.1 What You Can Do in this Chapter 17.1.2 What You Need to Know Authentication Policy Firewall Global PBX Settings Voice Interfaces Outbound Trunk Group Auto-attendant Group Management Call Services Call Recording Meet-meConference Paging Group Sound Files Auto Provision Voice Mail Phonebook Office Hours User/Group Addresses Services 47.1 Overview 47.2 The Schedule Summary Screen 48.1 Overview 48.2 Active Directory or LDAP Server Summary 48.3 RADIUS Server Summary 50.3.2 The Trusted Certificates Import Screen 52.8.5 Secure Telnet Using SSH Examples 52.10.1 Configuring FTP Page Page Page Page Introducing the ISG50 1.1 Overview Chapter 1 Introducing the ISG50 Figure 1 IP PBX Example Chapter 2 on page Here are some common application scenarios for the ISG50 Use the ISG50 to provide VoIP and security services Figure 2 All-in-oneApplication Scenario Headquarters LAN WAN1 A B 1.2 Rack-mountedInstallation 1.3 Connecting the Frame Ground 1.4 Front Panel 1.5 3G PCMCIA Card Installation 1.6 Management Overview 1.7 Starting and Stopping the ISG50 Table 3 Starting and Stopping the ISG50 METHOD Turning on the power up, checks the hardware, and starts the system processes Rebooting the ISG50 Features and Applications 2.1 Features SIP Servers •Multiple WAN ports and configure load balancing between these ports •A 3G (cellular) connection Figure 14 Applications: Multiple WAN Interfaces Page Page Web Configurator 3.1 Web Configurator Requirements 3.2 Web Configurator Access Chapter 3 Web Configurator 3Type the user name (default: “admin”) and password (default: “1234”) One-Time Login Update Admin Info 3.3 Web Configurator Screens Overview Table 4 Title Bar: Web Configurator Icons (continued) Object Reference object Console Figure 22 Navigation Panel Chapter 9 on page The monitor menu screens display status and statistics information Table 6 Monitor Menu Screens Summary FOLDER OR LINK Table 6 Monitor Menu Screens Summary (continued) BRI Trunk ACD Queue Monitor phone call activity for Automatic Call Distribution (ACD) agents Lists system log entries Table 7 Configuration Menu Screens Summary (continued) Page Page Table 8 Maintenance Menu Screens Summary Figure 23 Warning Message Site MAP Figure 24 Site Map Refresh Table 9 Object References Object Name This field is a sequential value, and it is not associated with any entry display the service’s configuration screen in the main window Priority Page Figure 30 Changing the Column Order Figure 31 Navigating Pages of Table Entries Figure 32 Common Table Icons Here are descriptions for the most common table icons Table 10 Common Table Icons Table 10 Common Table Icons (continued) Inactivate To turn off an entry, select it and click Inactivate To connect an entry, select it and click Connect To disconnect an entry, select it and click Disconnect Figure 34 iNotes Installation Setup Wizard 4.1 Installation Setup Wizard Screens Chapter 4 Installation Setup Wizard Note: Enter the Internet access information exactly as your ISP gave it to you Figure 36 Internet Access: Step I have two ISPs : Choose the Figure 37 Internet Access: Ethernet Encapsulation First WAN Interface Zone: The following fields display if you selected static IP address assignment •IP Subnet Mask: Enter the subnet mask for this WAN connection's IP address Service Name Authentication Type Figure 39 Internet Access: PPTP Encapsulation Base Interface •Type a Base IP Address (static) assigned to you by your ISP •Type the IP Subnet Mask assigned to you by your ISP (if given) •Server IP: Type the IP address of the PPTP server Connection ID Second WAN Interface 4.2 Device Registration Registration > Service Figure 42 Registration new myZyXEL.com account existing myZyXEL.com account User Name Country Code Quick Setup 5.1 Quick Setup Overview 5.2 WAN Interface Quick Setup WAN Type Selection Ethernet PPPoE PPTP Figure 47 WAN Interface Setup: Step Page Figure 49 WAN and ISP Connection Settings: (PPTP Shown) The following table describes the labels in this screen Table 11 WAN and ISP Connection Settings ISP Parameter This section appears if the interface uses a PPPoE or PPTP Internet connection Table 11 WAN and ISP Connection Settings (continued) Retype to Type your password again for confirmation Confirm Nailed-Up This screen displays the WAN interface’s settings Figure 50 Interface Wizard: Summary WAN (PPTP Shown) Table 12 Interface Wizard: Summary WAN Service Name name specified in the ISP account 5.3 VPN Quick Setup 5.4 VPN Setup Wizard: Wizard Type 5.5 VPN Express Wizard - Scenario Figure 54 VPN Express Wizard: Step Pre-Shared Local Policy (IP/Mask) Remote Policy (IP/Mask) Figure 55 VPN Express Wizard: Step •Rule Name: Identifies the VPN gateway policy Local Policy Configuration for Secure Gateway Close Page Figure 58 VPN Advanced Wizard: Phase 1 Settings My Address (interface) Negotiation Mode Main Aggressive NAT Traversal VPN, NAT, and NAT Traversal on page Dead Peer Detection (DPD) Authentication Method : Select This is a read-onlysummary of the VPN tunnel settings Figure 60 VPN Advanced Wizard: Step •Rule Name: Identifies the VPN connection (and the VPN gateway) •Secure Gateway: IP address or domain name of the remote IPSec device •Pre-SharedKey: VPN tunnel password Page Configuration Basics 6.1PBX Features Overview Chapter 6 Configuration Basics Outbound Line Group •ISDN BRI Trunk - This is a connection to your ISDN Service Provider Trusted Peer FXO (Foreign Exchange Office) Trunk AA1 Figure 63 Auto-Attendant extension you AA1 would like to reach ISG The configuration requirement for setting up internal call routing are: Figure 64 Outbound Call Routing - Basic Authority Outbound LCR SALES 6.2 Object-basedConfiguration 6.3 Zones, Interfaces, and Physical Ports Virtual interfaces virtual Ethernet interfaces virtual VLAN interfaces virtual bridge interfaces PORT 6.4 Terminology in the ISG50 6.5 Packet Flow •A policy route can be automatically disabled if the next-hopis dead •You do not need to set up policy routes for IPSec traffic •Policy routes can override direct routes •You do not need to set up policy routes for 1:1 NAT entries •Static and dynamic routes have their own category Policy Routes Chapter 14 on page 1 to 1 and Many 1 to 1 NAT Auto VPN Policy Use Policy Route to control dynamic IPSec rules 6.6Other Features Configuration Overview PREQUISITES Configuration > Licensing > Registration Internet access to myZyXEL.com See Section 6.3 on page 92 for background information Configuration > Network > Interface (except Network > Interface (except Example: 1Create an address object for the FTP server (Object > Address) to go to the policy route configuration screen. Add a policy route 3Name the policy route 4Select the interface that the traffic comes in through (P3 in this example) Network > Zone Configuration > Network > NAT Mapped IP field 6In Mapping Type, select Port Original Configuration > Network > HTTP Redirect 1Click Configuration > Network > HTTP Redirect 2Add an entry 3Name the entry Select the interface from which you want to redirect incoming HTTP requests Configuration > Firewall (source, destination), services, service groups Create a VoIP service object for UDP port 5060 traffic Configuration > Object > Service Create an address object for the VoIP server 6.7 Objects 6.8 System Configuration > System > WWW Accept Page General Tutorials 7.1 How to Configure Interfaces, Port Roles, and Zones 1Click Configuration > Network > Interface > Role dmz (DMZ) Configuration > Network IPSec_VPN 7.2 How to Configure a Cellular Interface Network Selection Auto Home 7.3 How to Configure Load Balancing 1Click Configuration > Network > Interface > Trunk. Click the Add icon Weight 7.4 How to Set Up an IPSec VPN Tunnel Figure 82 VPN Example ISGISG 192.168.1.0/24 172.16.1.0/24 , and then click the Figure 83 Configuration > VPN > IPSec VPN > VPN Gateway > Add 1Click Configuration > Object > Address. Click the Add icon SUBNET Network Netmask 7.5 How to Configure User-awareAccess Control GROUP (USER) WEB MSN LAN1-TO-DMZ SURFING Set up the user groups and assign the users to the user groups 1Click Configuration > Object > User/Group > Group. Click the Add icon Enter the name of the group that is used in the example in Table 18 on page User/Leo required Force User Authentication 7.6How to Use a RADIUS Server to Authenticate User Accounts Based on Groups Configuration > Object > User/Group > User ext-group-user Group Identifier 7.7 How to Use Authentication Policies 7.8 How to Configure Service Control ALL 7.9 How to Allow Incoming H.323 Peer-to-peerCalls Configuration > Object > Address > Add Figure 102 Create Address Objects Classification NAT 1:1 Set the Incoming Interface to wan1 Set the Original IP to the WAN address object (WAN_IP-for-H323) 1Click Configuration > Firewall > Add. In the From field select WAN H.323 7.10 How to Allow Public Access to a Web Server Figure 106 Creating the Address Object for the HTTP Server’s Private IP Address •Set the Incoming Interface to wan1 to the object and the object From DMZ_HTTP allow HTTP 7.11How to Use Multiple Static Public WAN IP Addresses for LAN to WAN Traffic Source Address LAN_SUBNET1 Source Network Address Translation Public-IPs Figure 111 Configuring the Policy Route 7.12 Initial Setup Video PBX Tutorials 8.1 Making Internal Calls In the web configurator, click Click the screen displays. Click to configure multiple SIP accounts at the same time Batch Add SIP Peer Page Edit Authority Group Basic Figure 114 Connect IP Phones IP Figure 115 Example IP Phone SIP Registration Screen EXAMPLE Extension Number of IP Phone IP Address of the ISG50 SIP Password 8.2 Auto Provisioning Configuration > PBX > Auto Provision 8.3 Making PSTN Calls FXO Settings PSTN1 PSTN 1001FXO • Click OK LocalCall Procedure: 1Click Configuration > PBX > Group Management and double-clickthe Basic entry entry 8.4 Making ITSP Calls WAN INFO VALUES Page ITSP1 long_distance_call Figure 3 on page Dial Condition •Click Apply to save your settings Group Management LongDistance Page 8.5 Making ISDN Calls Figure 123 BRI Connection ISDN and click the icon in the section BRI1 Default AA ISDN Figure 124 on page Select the dial condition parameter entry and click ISDN_call 8.6 ISDN Network Configuration Examples ISDN Line DDI/DID Mapping Setting DDI/DID Mask Directory Number Section 8.3 on page Page 8.7 Using Call Features 8.8 Using the Extension Portal Extension Portal SIP Login FEATURE PROCEDURE SIP Auth Password Web/VM PIN Code SIP Auth Password Page Office Hours Mon Fri Sat Sun Received E-mail Attached Voice File Delete Voice Message After Mailed 8.9 Capturing Packets Using the Web Configurator Files bob 8.10 Creating an Automated Menu System 1ST MENU SUBMENUS SKILLS AGENTS Configuration > PBX > Outbound Line Management 1Log into the ISG50, then go to the Configuration > PBX > ACD > Agent screen For each of your agents, click the Agent Settings Agent ID Agent Name To create a new skill: 1Go to the Configuration > ACD > Skill screen Go to the For each skill, click the Add New Skill Number Skill Name Page Page Page Forward to a sub menu ACD Page Page Dashboard 9.1 Overview 9.2The Dashboard Screen Chapter 9 Dashboard Figure 135 Dashboard Table 26 Dashboard Widget Settings (A) Chapter 9 Dashboard Table 26 Dashboard (continued) Virtual Device interface or slot appears grayed out This identifies a device installed in one of the ISG50’s USB ports Current Date Time hh:mm:ss VPN Status page Use this field to get or to update the IP address for the interface Click Renew to send a new DHCP request to a DHCP server displays n/a Click the Disconnect icon to stop a PPPoE/PPTP connection SIP Extension Show CPU Usage Show Memory Usage Table 28 Dashboard > Show Memory Usage Show Active Sessions Figure 138 Dashboard > Show Active Sessions Table 29 Dashboard > Show Active Sessions VPN Status Figure 139 Dashboard > VPN Status Table 30 Dashboard > VPN Status This field is a sequential value, and it is not associated with a specific SA This field displays the name of the IPSec SA Table 31 Dashboard > DHCP Table address. Click the heading cell again to reverse the sort order static DHCP entry by MAC address. Click the heading cell again to reverse the sort order field is blank for dynamic DHCP entries Table 32 Dashboard > Number of Login Users (continued) Monitor 10.1 Overview 10.2The Port Statistics Screen Monitor > System Status > Port Statistics (continued) This field displays the current status of the physical port Down - The physical port is not connected duplex setting (Full or Half) TxPkts 10.3 Interface Status Screen Each field is described in the following table Table 35 Monitor > System Status > Interface Status displayed in light gray text Expand/Close Ethernet interfaces 10.4 The Traffic Statistics Screen Traffic Statistics Figure 145 Monitor > System Status > Traffic Statistics Table 37 on page Table 36 Monitor > System Status > Traffic Statistics Data Collection Table 36 Monitor > System Status > Traffic Statistics (continued) Top Select the type of report to display. Choices are: much traffic has been sent to and from each one for each one 10.5 The Session Monitor Screen Table 38 Monitor > System Status > Session Monitor Select how you want the information to be displayed. Choices are: sessions by users - display all active sessions grouped by user sessions by services sessions by source IP 10.6 The DDNS Status Screen 10.7 IP/MAC Binding Monitor 10.8 The Login Users Screen 10.9 Cellular Status Screen Table 42 Monitor > System Status > Cellular Status (continued) No device - no 3G device is connected to the ISG50 Limited Service Internet Device detected - displays when you connect a 3G device Monitor > System Status > More Information Figure 151 Monitor > System Status > More Information Table 43 Monitor > System Status > More Information Signal Strength This is the Signal Quality measured in dBm 10.10 USB Storage Screen 10.11 The IPSec Monitor Screen Table 45 Monitor > VPN Monitor > IPSec can use a keyword or regular expression. Use up to 30 alphanumeric and _+ .()!$*^:?|{}[]<>/ characters. See Section 10.11.1 on page 212 for more details Policy click Search to find it. You can use a keyword or regular expression. Use up to 10.12 SIP Peer Screen 10.13 FXS Peer Screen 10.14 SIP Trunk Screen 10.15 CTI Peer Screen 10.16 FXO Trunk Screen 10.17 BRI Trunk Screen 10.18 ACD Queue Screen 10.19 Log Screen Table 53 Monitor > Log Show Filter Click this button to show or hide the filter settings Hide Filter fields are available 10.20 Querying Call Recordings 10.21 CDR Backup Screen Table 56 Monitor > Log > CDR (continued) Backup Now Click the Backup Now button to save a CDR backup file on the ISG50 delete from the ISG50 and click the Remove button Filename 10.22 CDR Query Screen Table 57 Monitor > Log > CDR > Query (continued) Call Time hangs up limited by other search criteria Talk Time 10.23 CDR Query Result Screen Page Registration 11.1 Overview 11.2 The Registration Screen 11.3 The Service Screen (license key) in this screen. Click to open the screen as shown next Figure 169 Configuration > Licensing > Registration > Service Table 60 Configuration > Licensing > Registration > Service License Status Interfaces 12.1 Interface Overview •Many interfaces can share the same physical port •An interface belongs to at most one zone •Many interfaces can belong to the same zone •Layer-3virtualization (IP alias, for example) is a kind of interface You can create several types of interfaces in the ISG50 Table 62 Relationships Between Different Types of Interfaces REQUIRED PORT / INTERFACE port group physical port Ethernet interface 12.2 Port Role 12.3 Ethernet Summary Screen Table 64 Configuration > Network > Interface > Ethernet Double-clickan entry or select it and click Edit to open a screen where you can modify the entry’s settings want to remove it before doing so To turn on an interface, select it and click Activate Page Page Page This screen’s fields are described in the table below Table 65 Configuration > Network > Interface > Ethernet > Edit Show Advance Settings / Hide Advance Settings Table 65 Configuration > Network > Interface > Ethernet > Edit (continued) MTU smaller fragments. Allowed values are 576 - 1500. Usually, this value is These fields appear when Interface Properties is external failures are required before the ISG50 stops routing to the gateway. The ISG50 Pool Size limited by the interface’s Subnet Mask. For example, if the Subnet Mask is 255.255.255.0 and IP Pool Start Address is 10.10.10.10, the ISG50 can allocate 10.10.10.10 to 10.10.10.254, or 245 IP addresses and the interface’s IP address Send Version RIP packets. Choices are 1, 2, and 1 and Receive Version V2-Broadcast subnet broadcasting; otherwise, the ISG50 uses multicasting 12.4 PPP Interfaces Configuration Network > Interface > PPP Each field is described in the table below Table 67 Configuration > Network > Interface > PPP The ISG50 comes with the (non-removable) System Default PPP interfaces pre System Default configured. You can create (and delete) User Configuration PPP interfaces Figure 177 Configuration > Network > Interface > PPP > Add Each field is explained in the following table Table 68 Configuration > Network > Interface > PPP > Add Table 68 Configuration > Network > Interface > PPP > Add (continued) Select the interface upon which this PPP interface is built Note: Multiple PPP interfaces can use the same base interface security settings the ISG50 uses for the interface keep the connection up all the time 12.5 Cellular Configuration Screen (3G) 2G, 2.5G, 2.75G, 3G and 3.5G Wireless Technologies NAME MOBILE PHONE AND DATA STANDARDS DATA GSM-BASED Figure 178 Configuration > Network > Interface > Cellular Table 70 Configuration > Network > Interface > Cellular Click this to create a new cellular interface entry’s settings before doing so Page Table 71 Configuration > Network > Interface > Cellular > Add Select this option to turn on this interface Select a name for the interface the security settings the ISG50 uses for the interface This is the USB slot that you are configuring for use with a 3G card Table 71 Configuration > Network > Interface > Cellular > Add (continued) be alphanumeric or -_@$./.Spaces are not allowed exactly as the service provider gave it to you Spaces are not allowed SIM Card Setting Configure Policy Route selection Select this option If the ISP assigned a fixed IP address Address Home network is the network to which you are originally subscribed network is down, the ISG50's 3G Internet connection is also unavailable not subscribed when necessary, for example when the home network is down or another 3G base station's signal is stronger. This is recommended if you need of a different network 12.6 VLAN Interfaces Figure 181 Example: After VLAN Traffic inside each VLAN is This approach provides a few advantages In this example, the new switch handles the following types of traffic: •Inside VLAN Note: Each VLAN interface is created on top of only one Ethernet interface Configuration > Network > Interface VLAN Figure 182 Configuration > Network > Interface > VLAN Table 72 Configuration > Network > Interface > VLAN VLAN Summary Page Table 73 Configuration > Network > Interface > VLAN > Edit Select this to turn this interface on. Clear this to disable this interface VLANs you can configure on the ISG50. For example, vlan0, vlan8, and so on Select the zone to which the VLAN interface belongs Base Port Table 73 Configuration > Network > Interface > VLAN > Edit (continued) the gateway the first time the gateway passes the connectivity check The DHCP settings are available for the OPT, LAN and DMZ interfaces to assign a static IP address to a specific computer, click Add Static DHCP infinite - select this if IP addresses never expire only the intended users get to use specific IP addresses attempts to use an IP address that is bound to another device’s MAC address Select this to enable RIP on this interface 12.7 Bridge Interfaces Table 74 Example: Bridge Table After Computer A Sends a Packet to Computer B MAC ADDRESS Table 75 Example: Bridge Table After Computer B Responds to Computer A A bridge interface may consist of the following members: •Zero or one VLAN interfaces (and any associated virtual VLAN interfaces) IP ADDRESS(ES) DESTINATION 210.210.210.0/24 210.211.1.0/24 Table 77 Configuration > Network > Interface > Bridge (continued) STATIC is blank for virtual interfaces Bridge Summary Page Table 78 Configuration > Network > Interface > Bridge > Edit settings such as firewall and remote management bridge interface. An interface is not available in the following situations: • There is a virtual interface on top of it • It is already used in a different bridge interface Table 78 Configuration > Network > Interface > Bridge > Edit (continued) Page Figure 186 Virtual Interface Add Table 79 Virtual Interface Add This field is read-only.It displays the name of the virtual interface, which is 12.8 Interface Technical Reference lan1 wan1 Table 81 Example: Routing Table Entry for a Gateway Table 82 Example: Assigning IP Addresses from a Pool START IP ADDRESS POOL SIZE RANGE OF ASSIGNED IP ADDRESS IP Address Assignment on page Page Page Trunks 13.1 Overview Chapter 13 Trunks • You can define multiple trunks for the same physical interfaces Figure 188 Link Sticking LAN user The ISG50 is using active/active load balancing. So when LAN user Figure 189 Least Load First Example Table 83 Least Load First Example OUTBOUND LOAD BALANCING INDEX AVAILABLE (A) Page 13.2 The Trunk Summary Screen The following table describes the items in this screen Table 84 Configuration > Network > Interface > Trunk Enable Link Sticking accessing server that are incompatible with a user's sessions coming from 13.3 Configuring a Trunk 13.4 Trunk Technical Reference Policy and Static Routes 14.1 Policy and Static Routes Overview Source-Based Cost Savings – IPPR allows organizations to distribute interactive traffic on NAT - The ISG50 performs NAT by default for traffic going to or from the 14.2Policy Route Screen Note: Policy routes do not apply to the routing of PBX traffic Figure 195 Configuration > Network > Routing > Policy Route Table 86 Configuration > Network > Routing > Policy Route Advance Settings Chapter 14 Policy and Static Routes Table 86 Configuration > Network > Routing > Policy Route (continued) Incoming This is the interface on which the packets are received This is the name of the source IP address (group) object. any means all IP Page Table 87 Configuration > Network > Routing > Policy Route > Edit (continued) interface or VPN tunnel connection Select a source IP address object from which the packets are sent configuration here only best-efforttreatment This field displays when you select Interface in the Type field. Select an the specified interface Auto-Disable connection is down this route 14.3 IP Static Route Screen Table 88 Configuration > Network > Routing > Static Route Click this to create a new static route This is the number of an individual static route This is the destination IP address This is the IP subnet mask 14.4 Policy Routing Technical Reference In the following example, you configure two services for port triggering: Incoming service: Game (UDP: 1234) Trigger service: Game-1(UDP: 5670-5678) Computer Game server Page Routing Protocols 15.1 Routing Protocols Overview 15.2 The RIP Screen redistribute Metric Click Configuration > Network > Routing > RIP to open the following screen 15.3 The OSPF Screen Each type of area is illustrated in the following figure Figure 201 OSPF: Types of Areas SOURCE \ TYPE OF AREA NORMAL NSSA STUB OSPF Add/Edit Click Configuration > Network > Routing > OSPF to open the following screen Figure 204 Configuration > Network > Routing > OSPF Table 94 Configuration > Network > Routing Protocol > OSPF Normal NSSA Chapter 15 Routing Protocols Table 94 Configuration > Network > Routing Protocol > OSPF (continued) Type the external cost for routes provided by static routes. The metric represents the “cost” of transmission for routing purposes. The way this is OSPF AS, and it can be between 1 and Table 95 Configuration > Network > Routing > OSPF > Add Area ID Type the unique, 32-bitidentifier for the area in IP address format Select the type of OSPF area AS and about networks outside the OSPF AS 15.4 Routing Protocol Technical Reference •None - no authentication is used Text •MD5 – authentication using an MD5 password and authentication ID The packet’s Same as Area Zones 16.1 Zones Overview 16.2The Zone Screen 16.3 Zone Edit Table 98 Network > Zone > Edit For a system default zone, the name is read only 1-31alphanumeric characters, underscores(_), or dashes (-),but the first character cannot be a number. This value is case-sensitive Select this check box to block network traffic between members in the zone DDNS 17.1 DDNS Overview 17.2 The DDNS Screen Chapter 17 DDNS Table 100 Configuration > Network > DDNS (continued) Backup This field displays the alternate interface to use for updating the IP address mapped to the domain name followed by how the ISG50 determines the IP Table 101 Configuration > Network > DDNS > Add Enable DDNS Select this check box to use this DDNS entry dashes (-),but the first character cannot be a number. This value is case sensitive Table 101 Configuration > Network > DDNS > Add (continued) there are one or more NAT routers between the ISG50 and the DDNS server Enable Wildcard This option is only available with a DynDNS account Enable the wildcard feature to alias subdomains to be aliased to the same IP Page NAT 18.1 NAT Overview 18.2The NAT Screen Table 102 Configuration > Network > NAT (continued) Mapped Port there is no restriction on the original destination port NAT Add/Edit Section 18.2 on page Table 103 Configuration > Network > NAT > Add (continued) Classification Select what kind of NAT this rule is to perform available to a public network outside the ISG50 (like the Internet) 1:1 NAT - If the private network server will initiate sessions to the outside Port Mapping any - this NAT rule supports all the destination ports Service - this NAT rule maps one service to another Port - this NAT rule supports one destination port one service 18.3 NAT Technical Reference Page Page HTTP Redirect 19.1 Overview 19.2 The HTTP Redirect Screen Figure 219 Configuration > Network > HTTP Redirect Table 104 Configuration > Network > HTTP Redirect Network > HTTP Redirect HTTP Redirect Edit Figure 220 Network > HTTP Redirect > Edit Table 105 Network > HTTP Redirect > Edit Use this option to turn the HTTP redirect rule on or off value is case-sensitive forward it to the specified proxy server Enter the IP address of the proxy server ALG 20.1 ALG Overview Chapter 20 ALG Figure 221 H.323 ALG Example Figure 222 VoIP Calls from the WAN with Multiple Outgoing Calls Page 20.2 The ALG Screen 20.3 ALG Technical Reference Page IP/MAC Binding 21.1 IP/MAC Binding Overview 21.2 IP/MAC Binding Summary Figure 227 Configuration > Network > IP/MAC Binding > Edit Table 108 Configuration > Network > IP/MAC Binding > Edit IP address and subnet mask Enable IP Select this option to have this interface enforce links between specific IP Table 108 Configuration > Network > IP/MAC Binding > Edit (continued) screen. Click the Figure 228 Configuration > Network > IP/MAC Binding > Edit > Add Table 109 Configuration > Network > IP/MAC Binding > Edit > Add you may want to list the computer’s owner 21.3 IP/MAC Binding Exempt List Page Authentication Policy 22.1 Overview 22.2 Authentication Policy Screen Click Configuration > Auth. Policy to display the screen The following table gives an overview of the objects you can configure Table 111 Configuration > Auth. Policy Select this to turn on the authentication policy feature Exceptional Use this table to list services that users can access without logging in Table 111 Configuration > Auth. Policy (continued) This displays the destination address object to which this policy applies means the policy is active at all times if enabled This field displays the authentication requirement for users when their traffic matches this policy. This is n/a for the default policy Table 112 Configuration > Auth. Policy > Add Enable Policy user-configuredpolicies Spaces are allowed. This field is available for user-configuredpolicies Use this section of the screen to determine which traffic requires (or does not Page Firewall 23.1 Overview FROM ZONE TO ZONE BEHAVIOR To Zone From Any To Device from any to any From VPN To-Device USER SOURCE SCHEDULE SERVICE ACTION Page Create new Object > Address 4Click Create new Object > Service 6Select From WAN and To LAN1 7Enter the name of the firewall rule Dest_1 Doom Figure 239 Firewall Example: Edit a Firewall Rule 23.2 The Firewall Screen If you enable Chapter 18 on page •The ordering of your rules is very important as rules are applied in sequence Figure 242 Configuration > Firewall Table 117 Configuration > Firewall Table 117 Configuration > Firewall (continued) From Zone / To and to which zone they go or subnet on the LAN to either another computer or subnet on the LAN1 Zone Table 118 Configuration > Firewall > Add Select this check box to activate the firewall rule rule applies any (Excluding DEVICE) means all interfaces or VPN tunnels Device means packets destined for the ISG50 itself 23.3 The Session Limit Screen Chapter 23 Firewall Table 119 Configuration > Firewall > Session Limit (continued) Rule Summary rule This is the address object to which this session limit rule applies Table 120 Configuration > Firewall > Session Limit > Edit Select this check box to turn on this session limit rule Enter information to help you identify this rule. Use up to 64 printable ASCII characters. Spaces are allowed when the user logs out IPSec VPN 24.1 IPSec VPN Overview Page Table 121 IPSec VPN Application Scenarios SITE-TO-SITE SITE-TO-SITEWITH REMOTE ACCESS DYNAMIC PEER 24.2The VPN Connection Screen Section 24.2.2 on page Section 24.2.1 on page Table 122 Configuration > VPN > IPSec VPN > VPN Connection Select this to be able to use policy routes to manually specify the destination dynamic IPSec Page Table 123 Configuration > VPN > IPSec VPN > VPN Connection > Edit Create new Object Select this check box to activate this VPN connection Connection when the SA life time expires Table 123 Configuration > VPN > IPSec VPN > VPN Connection > Edit (continued) Enforcement for free access between the local and remote networks with source and destination IP addresses that do not match the local and Phase 2 Settings DH1 DH2 DH5 Select the address object that represents the original source address (or source address range (SNAT) the remote network the local network. The size of the original source address range (Source) must be equal to the size of the translated source address range (SNAT) VPN Connection Add/Edit Manual Key VPN Connection summary Manual Key Secure Gateway Type the IP address of the remote IPSec router in the IPSec SA SPI is used to identify the ISG50 during authentication The ISG50 and remote IPSec router must use the same SPI 24.3 The VPN Gateway Screen . The following screen appears Figure 251 Configuration > VPN > IPSec VPN > VPN Gateway Section 24.3.1 on page Table 125 Configuration > VPN > IPSec VPN > VPN Gateway VPN Gateway Add/Edit VPN Gateway summary Table 126 Configuration > VPN > IPSec VPN > VPN Gateway > Edit Type the name used to identify this VPN gateway. You may use alphanumeric characters, underscores(_), or dashes (-),but the first Gateway Settings Select how the IP address of the ISG50 in the IKE SA is defined Table 126 Configuration > VPN > IPSec VPN > VPN Gateway > Edit (continued) Local ID Type ISG50 during authentication. Choices are: IP - the ISG50 is identified by an IP address DNS - the ISG50 is identified by a domain name Peer ID Type ID Type Note: If Peer ID Type is IP, please read the rest of this section Gateway Address Peer ID Page 24.4 IPSec VPN Background Information Figure 253 IKE SA: Main Negotiation Mode, Steps 1 - 2: IKE SA Proposal •MD5 (Message Digest 5) produces a 128-bitdigest to authenticate packet data SHA1 (Secure Hash Algorithm) produces a Diffie-Hellman (DH) Key Exchange on page Page Note: The ISG50 and the remote IPSec router must use the same pre-sharedkey REMOTE IPSEC ROUTER Page •The local and peer ID type and content come from the certificates This section introduces the key components of an IPSec SA Note: The ISG50 and remote IPSec router must use the same active protocol Note: The ISG50 and remote IPSec router must use the same encapsulation These modes are illustrated below Figure 257 VPN: Transport and Tunnel Mode Encapsulation Original Packet Note: The ISG50 and remote IPSec router must use the same SPI Page Page Page Bandwidth Management 25.1 Overview Chapter 25 Bandwidth Management Figure 259 LAN1 to WAN Connection and Packet Directions LAN1 Connection Figure 260 LAN1 to WAN, Outbound 200 kbps, Inbound 500 kbps The ISG50 gives bandwidth to •Then lower-prioritytraffic gets bandwidth The ISG50 uses a Figure 261 Bandwidth Management Behavior Table 129 Configured Rate Effect POLICY CONFIGURED RATE MAX. B. U Table 132 Priority and Over Allotment of Bandwidth Effect for a description of DSCP marking •HTTP traffic needs to be given priority over FTP traffic Figure 262 Bandwidth Management Example SIP: Any to WAN SIP: WAN to Any Priority: Max. B. U Figure 264 HTTP Any to WAN Bandwidth Management Example •Third highest priority (3) 25.2 The Bandwidth Management Screen Click Configuration > Bandwidth Management to open the following screen Figure 267 Configuration > Bandwidth Management Section 25.2.1 on page Table 133 Configuration > Bandwidth Management Select this check box to activate management bandwidth This is the destination zone of the traffic to which this policy applies displays, the policy is effective for every source any displays, the policy is effective for every destination this policy In - Inbound, the traffic the ISG50 sends to a connection’s initiator Management Figure 268 Configuration > Bandwidth Management > Edit Table 134 Configuration > Bandwidth Management Select this check box to turn on this policy zero, if this policy applies for every port number this policy. Inbound refers to the traffic the ISG50 sends to a connection’s initiator number following the “af” identifies one of four classes and one of three drop Inbound kbps Page Page ADP 26.1 Overview 26.2 The ADP General Screen 26.3 The Profile Summary Screen •Delete an existing profile Figure 270 Base Profiles These are the default base profiles at the time of writing Table 136 Base Profiles BASE PROFILE Traffic Anomaly Page Table 138 Configuration > ADP > Profile > Traffic Anomaly value is case-sensitive.These are valid, unique profile names: MyProfile mYProfile Mymy12_3-4 Protocol Anomaly Page Table 139 Configuration > ADP > Profile > Protocol Anomaly This is the name of the profile. You may use 1-31alphanumeric characters HTTP Inspection/TCP Decoder/UDP Decoder/ICMP Decoder have the ISG50 take no action when a packet matches a rule have the ISG50 silently drop a packet that matches a rule. Neither sender nor 26.4 ADP Technical Reference Page Page Figure 276 SYN Flood SYN Flood Table 140 HTTP Inspection and TCP/UDP/ICMP Decoders Table 140 HTTP Inspection and TCP/UDP/ICMP Decoders (continued) ICMP Decoder TRUNCATED-ADDRESS HEADER ATTACK length of less than the ICMP address header length. This may cause some applications to crash Page Global PBX Settings 27.1 Overview Chapter 27 Global PBX Settings Peer to peer Section 27.6 on page QoS Section 27.7 on page 27.2 The SIP Server Screen Table 141 Configuration > PBX > Global > SIP Server must provide for authentication your SIP clients need to use to register with the ISG50 You can also enter up to two different alternate ports Default SIP Client 27.3 The Feature Code Screen Table 142 Configuration > PBX > Global > Feature Code Group Pickup authority group This code is used to transfer calls Direct Pickup 27.4 The E-MailScreen 27.5 The Fake IP Screen 27.6 The Peer to Peer Screen Table 145 Configuration > PBX > Global > Peer to Peer Enable Peer to Peer Local Net for Peer to Peer Local Net for Peer to peer Bridge Peer to Peer and click the Add icon in the Local Net for Peer to Peer Table 146 Configuration > PBX > Global > Peer to Peer > Add IPv4 subnet in CIDR format peer networking Peer-to-peercalls can be made through the ISG50, but with certain limitations: 27.7 The QoS Screen Table 147 Configuration > PBX > Global > QoS SIP When the ISG50 auto provisions phones it sets them to mark outgoing SIP control packets with this DSCP value Audio 27.8 The TAPI Screen Table 148 Configuration > PBX > Global > TAPI (continued) Server1/2 Specify the password for the TAPI server account You can use up to 63 printable ASCII characters (see Download Configure Settings Connect Devices start > Control Panel > Phone and Modem Options 27.9 Network Technical Reference Voice Interfaces 28.1 Overview 28.2The FXS Screen 28.3 The FXO Screen 28.4 The BRI Screen Table 151 Configuration > PBX > Voice Interfaces > BRI (continued) Type of Number Select the type for the prefix number which might be required by your telephone company to make outgoing calls. The options you can select are abbreviated unknown, international, national, network-specific,and subscriber Extension Management 29.1 Overview Figure 290 Authority Group Overview AG1 AG2 Page Page Figure 293 A Click-To-TalkExample Section 29.3 on page Section 29.6 on page 29.2 The Authority Group Screen Table 153 Add Authority Group alphanumeric characters (A-Z, a-z, 0-9)and underscores (_) Type 1-5digits to use as an ID for this authority group Type a brief description for this authority group. You can use 0-63alphanumeric characters (A-Z, a-z, 0-9)and spaces. 0 means this field can be left blank Figure 296 Authority Group Edit Table 154 Authority Group Edit This field displays the name of the authority group you are configuring after the selected entry 29.3 Extension Features •Your extension is busy Unconditionally, forwards all calls to a specific extension or your voice mail There is no answer at your extension. This also allows you to set up a Find Me List Call Blocking Table 155 Extension Add/Edit: Basic (continued) 10 digits. This is configurable when adding an extension Web/VM PIN Code web portal or Voice Mail SIP Auth. User Page Table 156 Extension Add/Edit: Call Forward call forwarding during those office hours this screen for this extension Day of Week Table 156 Extension Add/Edit: Call Forward (continued) No Answer Forward List Edit, and Remove icons to create, modify, or delete Find Me List entries After Office Hours Figure 299 Extension Add/Edit: Voice Mail Table 157 Extension Add/Edit: Voice Mail Received E-mail this email address Attached Voice File Figure 300 Extension Add/Edit: Advanced Table 158 Extension Add/Edit: Advanced Codec ISG50: • G.711 alaw (typically used in Europe) Table 158 Extension Add/Edit: Advanced (continued) Codec List Extra use the same mode as your VoIP service provider. The choices are: rfc2833 Table 159 Batch Add SIP Extensions Select the authority group you want these extensions to belong to Start Number digits long Step/Interval 29.4 The Group Access Code Screen 29.5 The Click To Talk Group Screen Table 162 Click To Talk Group Settings when adding a CTT group 0-9) Extensions List This section lists the extensions that belong to this CTT group WEB_SERVER_ADDR 29.6 Authority Group Technical Reference Table 164 Video Codecs Supported H.261 coding standards H.263 as low as 20 kbps to 24 kbps Outbound Trunk Group 30.1 Overview Note: Use AA if you do not have multiple ISDN numbers Please AAdial extension 6012 ISG DDI Mask This example also shows three call examples A - When an outsider calls 555-123457,the call is mapped to the extension Figure 309 Direct Example Figure 310 MSN Example MSN Example 30.2Outbound Trunk Group Screen Table 165 Outbound Line Management > Outbound Trunk Group SIP Trunk / Trust Peer / FXO / BRI configured: service provider SIP Trunk Settings Outbound Trunk Group Figure 312 SIP Trunk Add/Edit Table 166 SIP Trunk Add/Edit 0-9)and underscores (_). The first character must be a letter blank Representative ASCII characters Chapter 30 Outbound Trunk Group Table 166 SIP Trunk Add/Edit (continued) seconds uses this value instead certain period of inactivity Codec Setting quality order) are supported by the ISG50: See Video Codecs on page 475 for more information on video codecs Chapter 31 on page Figure 313 SIP Auto Attendant and DDI Setup Table 167 SIP Auto Attendant and DDI Setup outbound line trunk extension’s settings group of agents associated with a specific skill name SIP "To" Header do the DDI/DID mapping. If this SIP trunk outbound line group has DDI/DID mode mapping settings and sets the DDI/DID Mask to Clear this to use the SIP request URI to do the DDI/DID mapping DDI/DID Mask Table 168 Add DDI/DID Number The number of digits you can enter in this field depends on what you set in the Representative Number DDI/DID Mask field separated by a hyphen). For example, 5783900 or Select Extension Number and enter the extension number to which the DDI/DID Trust Peer Settings Table 169 Trusted Peer Trunk Add/Edit 9) and underscores (_). The first character must be a letter Table 169 Trusted Peer Trunk Add/Edit (continued) make external calls through this trunk connection. The default is “zyxel” Select the caller ID display format you want to use when you make calls Page Figure 316 Trusted Peer Auto Attendant and DDI Setup Table 170 Trusted Peer Auto Attendant and DDI Setup the Fax machine you want to forward calls to Option Select DDI/DID to map a dialed number through this outbound line group to an Enable Routing by and sets the DDI/DID Mask to mapping FXO Trunk Figure 317 Add/Edit FXO Trunk Table 171 Add/Edit FXO Trunk (A-Z, a-z, 0-9)and underscores (_). The first character must be a letter and click the Right icon if you want to add it to this outbound line group Used Interface outbound line group Table 172 AA for FXO or BRI Trunk This field displays the name of the outbound line trunk Apply AA Type group to an Auto-Attendantsystem first display Settings Page Figure 322 BRI Trunk - Add/Edit: Direct Table 173 BRI Trunk Add/Edit a-z, 0-9)and underscores (_). The first character must be a letter Specify the service type for this BRI trunk be required by your telephone company for outgoing calls using DDI/DID. See DDI Table 173 BRI Trunk Add/Edit (continued) Direct outbound group the outbound group This field displays for MSN. There the MSN number the interface is to use BRI Trunk - Add Figure 323 Add BRI Trunk DDI/DID Mapping Table 174 Add BRI Trunk DDI/DID Mapping 5783900 or Section 30.2.7 on page Auto-attendant 31.1 Overview Incoming Call Menu1 Sales Incoming Call 31.2 The Default Auto-AttendantScreen Figure 328 Auto-Attendant> Default Table 175 Auto-Attendant> Default Greeting Upload Audio File and Upload to copy it to the ISG50 31.3 The Customized Auto-AttendantScreen Table 176 Auto-Attendant> Customized (continued) your computer Upload Select an entry and click Upload to upload a backup audio file for it This field displays the name assigned to an auto-attendant Figure 331 Office Hours Setting Table 178 Office Hours Setting and Upload to copy it to IP-PBX Enable Dial the Options table below Table 178 Office Hours Setting (continued) Forward to a specific extension extension, ACD, page group, hunt group, or user defined number directly Options Figure 332 Add/Edit Option Setting Table 179 Add/Edit Option Setting length Specify the action for this auto-attendantoption. The choices are: Night Service sub-menu Figure 333 Auto-AttendantSub Menu Table 180 Auto-AttendantSub Menu action you specify. The choices are: screen click the icon for an item in the auto-attendant list and select the tab to view a screen as shown next Table 181 Night Service Setting (continued) Section 31.3.3 on page Temporary Greeting Schedule Greeting 31.4 Technical Reference Start > All Programs > Accessories > Entertainment > Sound Recorder Record Stop File name: Change Sound Selection PCM Format Attributes to 16,000 kHz, 16 Bit, Mono LCR 32.1 Overview Chapter 32 LCR Research Figure 342 LCR Components Example Research Section 32.2 on page 32.2LCR Page Chapter 32 LCR (LCR) column Pool column to specify the priority of the outbound line groups Page is sent out from the ISG50 Postfix sent out from the ISG50 This field displays the number to which a dial parameter applies Group Management 33.1 Overview AG A OG Trunk SIP FXO Chapter 33 Group Management Section 33.2 on page Other Authority Groups Figure 347 Group Management - Authority Group to Authority Group AG3 AG2 Figure 349 Group Management - Outbound Line Group to Authority Group LCRs PSTN/ISDN Figure 350 Group Management - Outbound Line Group to LCR / ISDN 33.2Group Management Screen Configuration > PBX > Group Management Figure 352 Configuration > PBX > Group Management > Edit Table 187 Configuration > PBX > Group Management > Edit link This field identifies whether you are creating a link to: Call Services 34.1 Overview 34.2 The Auto Callback Screen 34.3 The Call Park Screen 5. The ISG50 parks the call and informs caller B of the number to call to reconnect to the call. This is called the parking slot number 6. Caller B walks to another 34.4 The Call Waiting Screen Busy Forward Configuration > PBX > Call Services > Call Waiting 34.5 The Emergency Call Screen 34.6 The Music on Hold Screen Table 195 Configuration > PBX > Call Service > Music On Hold Default Music On Hold Selection hold profile or a customized music on hold profile that you created Customized 34.7 The Call Transfer Screen 34.8 The Call Block Screen Table 198 Configuration > PBX > Call Service > Call Block Enable Anonymous block allow any incoming calls routed by the ISG50 Black list Call Recording 35.1 Overview 35.2Configuring the Call Recording Screen Table 199 Configuration > PBX > Call Recording Set the maximum number of minutes of call recording on the ISG50 Quota Recording calls that it records Meet-meConference Conference Room Edit Edit Conference Room List Paging Group 37.1 Overview 37.2 The Paging Group Screen Chapter 37 Paging Group Table 202 Configuration > PBX > Paging Group Paging Group Figure 369 Add Paging Group Table 203 Add Paging Group number can be from 3 to 10 digits long have to dial a PIN code to call the extensions in this page group Max Paging Time Type the maximum number of seconds that a person can page a group of Page ACD 38.1 Overview Chapter 38 ACD Skill Menu Section 38.6 on page ***03 ***04 Page 38.2 The ACD Global Screen 38.3 The Agent Screen Table 205 ACD > Agent List modify it This indicates the identification number of the agent This indicates the name of the agent This displays a brief description about the agent 38.4 The Skill Screen Click Add or Edit in the Skill screen to display this screen Figure 375 Add Skill Add Skill Table 208 Add Skill Skill Setting 3~10 digits (0-9).No spaces, underscores, or hyphens are allowed When this screen is in Edit mode, this number cannot be changed Enter a name for this skill. It can be any combination of 1~32 alphanumeric Table 208 Add Skill (continued) Waiting Timeout Enter the duration in seconds (up to 99999) that the call to the agents associated with the skill rings before timing out Once a call times out, the action defined in Timeout Action applies. This 38.5 The Hunt Group Screen Figure 377 Add Hunt Group Table 210 Add Hunt Group 38.6 The Skill Menu Screen Periodic Announce Skill Settings Click Configuration > PBX > ACD > Skill Menu to open this screen Figure 378 ACD > Skill Menu Table 211 ACD > Skill Menu Table 212 Add Skill Menu Configuration > PBX > ACD > Skill screen Use this screen to create or edit a skill menu action Skill Menu Add Sound Files 39.1 Overview 39.2The System Sound Screen Chapter 39 Sound Files Click Configuration > PBX > Sound File to open this screen Figure 381 Configuration > PBX > Sound File > System Sound Table 214 Configuration > PBX > Sound File > System Sound Default Language 39.3 The Specific Sound File Screen 39.4 The Record Peer Screen Table 218 Configuration > PBX > Sound File > Record Peer Auto Provision 40.1 Overview Auto Provision Advance Note: The auto discovery process is limited to your LAN 40.2 Auto Provision Setup Table 219 Configuration > PBX > Auto Provision (continued) remove any custom configuration for it Config View Config File the configuration file for it or save a copy of the configuration file Figure 387 Configuration > PBX > Auto Provision > Edit Table 220 Configuration > PBX > Auto Provision > Edit from the ISG50 for this extension Select how to apply auto provisioning to this extension • Update automatically - Automatically update this extension’s firmware 40.3 Auto Provision Advanced Screen This list corresponds to the snom products supported by the ISG50 Upgrade File Location Settings Page Voice Mail 41.1 Overview 41.2 The Voice Mail Screen 41.3 Accessing Voice Mail Page Voice Message Menu Voice Mail Main Voice Message Menu Play Previous Message 5 Repeat Current Message 6 Play Next Message 7 Delete Current Message Mail Box Options Menu Voice Mail Main Figure 393 Personal Voice Mail: Mail Box Options Menu Mail Box Options Menu Record Your Unavailable Message Record Your Busy Message Record Your Temporary Greeting Message Phonebook 42.1 Overview 42.2The Phonebook General Screen 42.3 The LDAP Phonebook Summary Screen 42.4 The LDAP Phonebook Settings Screen >LDAP Phonebook > Settings Figure 396 Configuration > PBX > Phonebook > LDAP Phonebook > Settings Table 225 Configuration > PBX > Phonebook > LDAP Phonebook > Settings Enable LDAP Check this box to enable LDAP based phonebook on the ISG50 42.5 The Local Phonebook Screen Table 226 Configuration > PBX > Phonebook > Local Phonebook Phonebook File location on your network File Path Then click Upload to upload the phonebook file to the ISG50 Figure 398 Local Phonebook Add/Edit Screen Table 227 Local Phonebook Add/Edit Screen Ext country Page Office Hours 43.1 Overview 43.2 Office Hour Screen Chapter 43 Office Hours Figure 399 Configuration > PBX > Office Hour Table 228 Configuration > PBX > Office Hour end time “13:00” for 1 PM) Chapter 43 Office Hours Table 228 Configuration > PBX > Office Hour (continued) 9th.) Enter a description of the holiday Select an auto-attendantpolicy to be used for office hours: Page User/Group 44.1 Overview ext-user 44.2User Summary Screen User Add/Edit Table 231 Configuration > User/Group > User > Add Type the user name for this user account. You may use 1-31alphanumeric User Type Select what type of user this is. Choices are: • admin - this user can look at and change the configuration of the ISG50 44.3 User Group Summary Screen 44.4 Setting Screen Configuration > Object > User/ Group > Setting Table 234 Configuration > Object > User/Group > Setting (continued) guest lease time automatically User idle timeout Page Page 44.5 User /Group Technical Reference Ext-User Page Addresses 45.1 Overview 45.2Address Summary Screen Chapter 45 Addresses Configuration > Object Address > Address Figure 409 Configuration > Object > Address > Address Section 45.2.1 on page 45.3 Address Group Summary Screen Section 45.3.1 on page Table 240 Configuration > Object > Address > Address Group This field displays the name of each address group This field displays the description of each address group, if any Figure 412 Configuration > Object > Address > Address Group > Add Table 241 Configuration > Object > Address > Address Group > Add (continued) Page Services 46.1 Overview 46.2The Service Summary Screen Figure 413 Configuration > Object > Service > Service Table 242 Configuration > Object > Service > Service This field displays the name of each service This field displays a description of each service 46.3 The Service Group Summary Screen >Service Group Figure 415 Configuration > Object > Service > Service Group Section 46.3.1 on page Table 244 Configuration > Object > Service > Service Group This field displays the name of each service group Service Group Add/Edit Section 46.3 on page Figure 416 Configuration > Object > Service > Service Group > Add Table 245 Configuration > Object > Service > Service Group > Add Schedules 47.1 Overview 47.2 The Schedule Summary Screen Table 246 Configuration > Object > Schedule (continued) One Time Figure 418 Configuration > Object > Schedule > Add (One Time) Table 247 Configuration > Object > Schedule > Add (One Time) Year Table 247 Configuration > Object > Schedule > Add (One Time) (continued) Recurring Figure 419 Configuration > Object > Schedule > Add (Recurring) Year Month Table 248 Configuration > Object > Schedule > Add (Recurring) (continued) Page AAA Server 48.1 Overview Chapter 48 AAA Server Figure 421 RADIUS Server Network Example See the documentation included on the ASAS’ CD for details 1Install the ASAS server software on a computer 2Create user accounts on the ISG50 and in the ASAS server Page 48.2Active Directory or LDAP Server Summary ) screen. Click the icon or an purposes Enter the address of the AD or LDAP server Backup Server 48.3 RADIUS Server Summary Page Table 252 Configuration > Object > AAA Server > RADIUS > Add Enter the address of the RADIUS server Specify the port number on the RADIUS server to which the ISG50 sends If the RADIUS server has a backup server, enter its address here disconnects from the RADIUS server. In this case, user authentication fails Authentication Method 49.1 Overview 49.2Authentication Method Objects Follow the steps below to create an authentication method object 1Click Configuration > Object > Auth. Method 2Click Add Specify a descriptive name for identification purposes in the 4Click Add to insert an authentication method in the table Table 254 Configuration > Object > Auth. Method > Add (continued) the authentication methods in the order they appear in this screen The ISG50 authenticates the users using the databases (in the local user specify, the ISG50 does not continue the search on the second authentication the first authentication server Certificates 50.1 Overview Chapter 50 Certificates Certificates offer the following benefits Any certificate that you want to import has to be in one of these file formats: Binary X.509: This is an •See Section 50.4 on page 659 for certificate background information 1Browse to where you have the certificate saved on your computer Make sure that the certificate has a “.cer” or “.crt” file name extension 50.2The My Certificates Screen Table 255 Configuration > Object > Certificate > My Certificates PKI Storage This bar displays the percentage of the ISG50’s PKI storage space that is Space in Use currently in use. When the storage space is almost full, you should consider Page Table 256 Configuration > Object > Certificate > My Certificates > Add and ;‘~!@#$%^&()_+[]{}’,.=- characters Subject Information Use these fields to record information that identifies the owner of the Host IP Address, Host Domain Name, or E-Mail.The certification to a certification authority for a certificate a certificate immediately online Trusted Certificates screen When you select this option, you must select the certification authority’s Page Table 257 Configuration > Object > Certificate > My Certificates > Edit alphanumeric and ;‘~!@#$%^&()_+[]{}’,.=- characters Certification Path This field displays for a certificate, not a certification request of certification authorities that validate the certificate (and the certificate Chapter 50 Certificates Key Usage This field displays for what functions the certificate’s key can be used. For example, “DigitalSignature” means that the key can be used to sign text 50.3 The Trusted Certificates Screen Figure 436 Configuration > Object > Certificate > Trusted Certificates Table 259 Configuration > Object > Certificate > Trusted Certificates This field displays the name used to identify this certificate Click Import to open a screen where you can save the certificate of a certification authority that you trust, from your computer to the ISG50 Page Table 260 Configuration > Object > Certificate > Trusted Certificates > Edit name. You can use up to 31 alphanumeric and ;‘~!@#$%^&()_+[]{}’ Click the Refresh button to have this read-onlytext box display the end the hierarchy of certification authorities that validate the end entity’s the path has expired or been revoked Name field Some certification authorities use rsa-pkcs1-sha1(RSA public-privatekey encryption algorithm and the SHA1 hash algorithm). Other certification authorities may use rsa-pkcs1-md5(RSA public-privatekey encryption algorithm and the MD5 hash algorithm) 50.4 Certificates Technical Reference Page ISP Accounts 51.1 Overview 51.2 ISP Account Summary Chapter 51 ISP Accounts the ISP Account Add/Edit section Table 262 Configuration > Object > ISP Account This field displays the profile name of the ISP account. This name is used to identify the ISP account Table 263 Configuration > Object > ISP Account > Edit the first character cannot be a number. This value is case-sensitive used by the ISP account. Options are: pppoe - This ISP account uses the PPPoE protocol pptp - This ISP account uses the PPTP protocol Table 263 Configuration > Object > ISP Account > Edit (continued) Click OK to save your changes back to the ISG50. If there are no errors, the explains the error, and the program stays in the ISP Account Edit screen it is new) or saving any changes to the profile (if it already exists) System 52.1 Overview 52.2 Host Name 52.3 USB Storage 52.4 Date and Time Configuration > System > Date/Time Figure 443 Configuration > System > Date and Time Table 266 Configuration > System > Date and Time Current Time and Current Time Chapter 52 System Table 266 Configuration > System > Date and Time (continued) Get from Time time server under the following circumstances • When the ISG50 starts up Synchronize Now Time Server Address Please Wait Current Time Current Date 52.5Console Port Speed 52.6 DNS Overview Table 269 Configuration > System > DNS Address/PTR an IP address. An FQDN consists of a host and domain name. For example the top level domain to remove it before doing so. Note that subsequent entries move up by one Table 269 Configuration > System > DNS (continued) This is the index number of the MX record This is the domain name where the mail is destined for IP/FQDN that handles the mail for the domain specified in the field above Address/PTR Record Figure 447 Configuration > System > DNS > Address/PTR Record Add Table 270 Configuration > System > DNS > Address/PTR Record Add host name and continues all the way up to the top-leveldomain name. For “tw” is the top level domain. Underscores are not allowed Table 271 Configuration > System > DNS > Domain Zone Forwarder Add Enter * if all domain zones are served by the specified DNS server(s) the ISP does not assign an IP address DNS server's IP address in the field to the right. The ISG50 must be able to DNS queries to a DNS server Click the Add icon in the MX Record table to add a MX record Figure 449 Configuration > System > DNS > MX Record Add Table 272 Configuration > System > DNS > MX Record Add Enter the domain name where the mail is destined for IP Address/FQDN 52.7 WWW Overview HTTP WWW Admin Service Control User Service Control Table 274 Configuration > System > WWW > Service Control HTTPS ISG50 Web Configurator using secure HTTPs connections “https://ISG50 IP Address:8443” as the URL Authenticate Client Table 274 Configuration > System > WWW > Service Control (continued) ISG50 Web Configurator using HTTP connections HTTP to manage the ISG50 (using the Web Configurator). You can also can access the ISG50 Client Authentication in the table in a screen to add a service control rule Figure 453 Configuration > System > Service Control Rule > Edit Table 275 Configuration > System > Service Control Rule > Edit Page Logo Title (color of all text) Logo Title Color Enter a pound sign (#) followed by the The following table describes the labels in the screen Table 276 Configuration > System > WWW > Login Page Select Type customize in the rest of this screen View Certificate Security Alert Trusted CA Install Certificate File name Browse Place all certificates in the following store Finish 52.8 SSH Page Configuration > System > SSH Table 277 Configuration > System > SSH using this service must use the same port number in order to use that service for remote management This specifies from which computers you can access which ISG50 zones A window displays prompting you to store the host key in you computer. Click Enter the password to log in to the ISG50. The CLI screen displays next 1Test whether the SSH service is available on the ISG50 $ telnet 192.168.1.1 22 Trying Connected to 192.168.1.1. Escape character is '^]'. SSH-1.5-1.0.0 52.9 Telnet 52.10 FTP 52.11 SNMP Figure 478 SNMP Management Model •Get - Allows the manager to retrieve an object variable from the agent •Set - Allows the manager to set values for object variables within an agent •Trap - Used by the agent to inform the manager of some events Table 280 SNMP Traps OBJECT LABEL OBJECT ID Configuration > System > SNMP Table 281 Configuration > System > SNMP Get Community Enter the Get Community, which is the password for the incoming Get and all requests Set Community 52.12 Language Screen Log and Report 53.1 Overview 53.2 Email Daily Report Page 53.3 Log Setting Screens Active Log Summary To access this screen, click Configuration > Log & Report > Log Setting Figure 482 Configuration > Log & Report > Log Setting Table 284 Configuration > Log & Report > Log Setting This field is a sequential value, and it is not associated with a specific log Table 284 Configuration > Log & Report > Log Setting (continued) Log Format This field displays the format of the log Internal - system log; you can view the log on the View Log tab VRPT/Syslog - ZyXEL’s Vantage Report, syslog-compatibleformat Log Settings Edit Log Settings Summary Table 285 Configuration > Log & Report > Log Setting > Edit (System Log) E-MailServer 1/2 what kinds of log messages are included in alerts in the Active Log and Alert section Type the subject line for the outgoing e-mail e-mailserver 2 for all log categories 2 settings This field displays each category of messages. It is the same value used in the debugging messages generated by open source software disable all logs (red X) - do not log any information from this category Edit Log on USB Storage Setting Log Setting Summary USB storage Edit Figure 484 Configuration > Log & Report > Log Setting > Edit (USB Storage) Table 286 Configuration > Log & Report > Log Setting > Edit (USB Storage) below). Choices are: alerts, and debugging information from this category Page Table 287 Configuration > Log & Report > Log Setting > Edit (Remote Server) Log Settings for Remote Server This field displays the format of the log information. It is read-only information Figure 486 Active Log Summary Section 53.3.2 on page Table 288 Configuration > Log & Report > Log Setting > Active Log Summary or e-mailany logs to e-mailserver 1 or enable normal logs (green check mark) - create log messages and alerts for all server 1 for all log categories server 2 for all log categories of the log categories Select which events you want to log by Log Category. There are three choices: information, however, even if this setting is selected (except All Logs; see below). Choices are: Call Detail Record (CDR) 54.1 Overview 54.2 The CDR Configuration Screen Table 289 CDR > Configuration CDR Setting Database Usage field to specify how to deal with the compressed file containing the CDRs Generate CDR Page Page File Manager 55.1 Overview Chapter 55 File Manager Figure 488 Configuration File / Shell Script: Example #enter configuration mode configure terminal #change administrator password username admin password 4321 user-typeadmin 55.2 The Configuration File Screen If there is not a system-default.conf If there is a lastgood.conf startup-config-bad.conf Table 291 Maintenance > File Manager > Configuration File only rename manually saved configuration files. You cannot rename the lastgood.conf, system-default.conf and startup-config.conf files files File screen Table 291 Maintenance > File Manager > Configuration File (continued) Use this button to have the ISG50 use a specific configuration file that configuration file. The ISG50 does not have to restart in order to use a the system reconfigures an error in the configuration file 55.3 The Firmware Package Screen Figure 493 Maintenance > File Manager > Firmware Package Table 292 Maintenance > File Manager > Firmware Package Boot This is the version of the boot module that is currently on the ISG50 Module 55.4 The Shell Script Screen Table 293 Maintenance > File Manager > Shell Script Use this button to change the label of a shell script file on the ISG50 Rename Rename File Figure 498 Maintenance > File Manager > Shell Script > Rename Chapter 55 File Manager Table 293 Maintenance > File Manager > Shell Script (continued) script file from your computer to your ISG50 Click Browse... to find the .zysh file you want to upload Page Diagnostics 56.1 Overview 56.2 The Diagnostic Screen Chapter 56 Diagnostics Table 294 Maintenance > Diagnostics This is the name of the most recently created diagnostic file Last modified This is the date and time that the last diagnostic file was created. The 56.3 The Packet Capture Screen File Suffix Table 296 Maintenance > Diagnostics > Packet Capture (continued) available Note: The ISG50 reserves some USB storage space as a buffer Note: If you have existing capture files and have not selected the Continuously capture and overwrite old ones option, you may Chapter 56 Diagnostics Capture Click this button to have the ISG50 capture packets according to the settings configured in this screen you cannot modify the packet capture settings 56.4 Core Dump Screen Click Maintenance > Diagnostics > Core Dump to open the following screen 56.5 The System Log Screen Packet Flow Explore 57.1 Overview 57.2 The Routing Status Screen Page Page Figure 515 Maintenance > Packet Flow Explore > Routing Status (Main Route) Table 301 Maintenance > Packet Flow Explore > Routing Status Routing Flow function box to display the related settings in the Routing Table section Routing Table Table 301 Maintenance > Packet Flow Explore > Routing Status (continued) This is the route’s priority among the displayed routes Flags This indicates additional information for the route. The possible flags are: • A - this route is currently activated 57.3 The SNAT Status Screen Page Table 302 Maintenance > Packet Flow Explore > SNAT Status SNAT Flow related settings in the SNAT Table section SNAT Table Flow section Reboot 58.1 Overview 58.2 The Reboot Screen Chapter 58 Reboot Shutdown 59.1 Overview 59.2 The Shutdown Screen Chapter 59 Shutdown Extension Portal 60.1 Overview Location 60.2 Web Phone 60.3 Peer Info 60.4 Call Forwarding and Blocking Table 305 Forward/Block Use this section to configure call forwarding settings for your extension hours. For information, see Chapter 43 on page Use the Add, Edit, and Remove icons to create, modify, or delete entries ISG50 will forward all incoming calls to that extension 60.5 Voice Mail Settings 60.6 Call Recording Troubleshooting Chapter 61 Troubleshooting CONSOLE I cannot access the Internet I cannot use the web phone •You must use Internet Explorer to use the extension portal and web phone My rules and settings that apply to a particular interface no longer work I cannot set up a PPP interface You have to set up an ISP account before you create a PPPoE or PPTP interface I created a cellular interface but cannot connect through it •Make sure you have the cellular interface enabled The ISG50 is not applying an interface’s configured ingress bandwidth limit The ISG50’s performance seems slower after configuring ADP Interface Type Internal External You may need to configure the DDNS entry’s IP Address setting to I cannot create a second HTTP redirect rule for an incoming interface You can configure up to one HTTP redirect rule for each (incoming) interface The ISG50 keeps resetting the connection Asymmetrical Routes on page •The ISG50 and remote IPSec router must use the same active protocol •The ISG50 and remote IPSec router must use the same encapsulation •The ISG50 and remote IPSec router must use the same SPI Check the configuration for the following ISG50 features Make sure the The ISG50 fails to authentication the ext-useruser accounts I configured I cannot add the admin users to a user group with access users You cannot put access users and admin users in the same user group I cannot add the default admin account to a user group You cannot put the default admin account into any user group I cannot access the ISG50 from a computer connected to the Internet Check the service control rules and to-ISG50firewall rules Make sure the logo file is a GIF, JPG, or PNG of 100 kilobytes or less Data collection may decrease the ISG50’s traffic throughput rate I can only see newer logs. Older logs are missing The commands in my configuration file or shell script are not working properly I cannot get the firmware uploaded using the commands My packet capture captured less than I wanted or failed File Size Duration 61.1 Resetting the ISG50 61.2Getting More Troubleshooting Help The PBX call service logs deal with call service errors Table 308 PBX Call Service Logs LOG MESSAGE The call from extension emergency call is Table 308 PBX Call Service Logs (continued) The call was reject due to there are % memebrs in conference in conference room %s The PBX dialplan logs deal with dialplan information and errors Table 310 PBX Dialplan Logs ACD agent %s called to extension %s has failed busy Table 310 PBX Dialplan Logs (continued) no caller ID was blocked due to block list been forwarded to number The incoming call does not presses any number The find-melist is no number inputing PIN code is incorrect logoff successfully Mobile Extension %s Mobile extension auto The PBX SIP logs deal with SIP information and errors Table 311 PBX SIP Logs The call %s peer '%s was rejected due to the limit of %d Table 311 PBX SIP Logs (continued) Call rejected due to acceptable here") unacceptable codecs callee does not support Page The PBX trunk logs deal with the SIP trunk being disconnected or recovered Table 312 PBX Trunk Logs The SIP trunk %s is disconnected over %d minutes Table 314 PBX Physical Port Logs (continued) FXS initialization has Table 315 PBX Default Logs call to extension '%s the Max. Call Time Table 315 PBX Default Logs (continued) Base DN is empty LDAP phonebook refresh not activate Phonebook LDAP server Table 316 ZySH Logs Table 316 ZySH Logs (continued) can't get reference count: %s can't print entry name: Table OPS Table 317 ADP Logs ADP Logs from <zone> to <zone , Action: <action Severity: <severity Table 318 User Logs User Logs %s %s from %s has logged in ISG50 logged out ISG50 Table 318 User Logs (continued) ISG50 from %s (reach simultaneous logon) access from %s Table 319 myZyXEL.com Logs Table 319 myZyXEL.com Logs (continued) Trial service Because of lack must Standard service check has failed:%s certificate has Send download request Send update request to Update has failed now. File download check has failed Do expiration daily Expiration daily interface. Do self System bootup. Do Certification Depth: %d, Error Number(%d):%s name:%s The wrong format for Table 320 IKE Logs (continued) Phase 2 Remote ID Remote IP mismatch [SA] : Malformed IPSec SA proposal [SA] : Tunnel [%s] SA sequence size mismatch [XCHG] exchange type is not IP, AGGR, or INFO The cookie pair is : 0x%08x%08x The IPSec tunnel "%s is already established Tunnel [%s] built Sending IKE request disconnected Tunnel [%s] rekeyed Table 321 IPSec Logs IPSec Logs Table 322 Firewall Logs priority:%lu, from %s to %s, service %s, %s been moved to %d Firewall rule %d has Table 324 Policy Route Logs Cannot get handle from UAM, user-awarePR is mblock: allocate memory failed Table 324 Policy Route Logs (continued) Interface %s alive rules will be re Interface %s dead rules will be disabled Table 325 Built-inServices Logs (continued) TELNET port has been FTP certificate:%s does not exist FTP port has been appended modified rule %u has been moved to %d The default record of Access control rule %u of %s was appended of %s was inserted of %s was modified of %s was deleted Table 326 System Logs (continued) DHCP Server executed with cautious mode Received packet is not an ARP response packet NTP update failed Device is rebooted by administrator Insufficient memory feature requested is only available to donators has failed because of error response been renamed as %s DDNS profile %s has DDNS Initialization All DDNS profiles are deleted Table 327 Connectivity Check Logs (continued) The connectivity %s interface of %s interface function of %s module The %s routing status seted ACTIVATE by connectivity-check Table 328 Routing Protocol Logs have been stopped RIP on interface %s has been activated Table 328 Routing Protocol Logs (continued) RIP v2-broadcaston RIP send-versionon RIP receive-versionon reset to current link %s authentication of area %s Invalid OSPF md5 interface %s Invalid OSPF text Table 330 PKI Logs PKI Logs Generate certificate "%s failed, errno %d Table 330 PKI Logs (continued) Import PKCS#7 "Trusted Certificate Decode imported Export PKCS#12 Table 331 Certificate Path Verification Failure Reason Codes CODE Interface Logs Interface %s has been Create interface %s Table 332 Interface Logs (continued) added Interface %s is %s may not work correctly failed: MS-CHAP failed: CHAP responding failed: PAP Interface %s create successfully unlocked by PUK code on interface cellular%d Please check the PUK code setting %s] has been removed from %s Interface cellular%d password in cellular%d edit page prefix Duplicated interface name This Interface can not be renamed RxPkts=%u,Colli.=%u,T '%s Table 333 Account Logs Account %s %s has been Table 334 Port Grouping Logs Table 335 Force Authentication Logs Force User enabled due to http server is enabled disabled due to http Table 337 DHCP Logs DHCP Logs Table 338 E-mailDaily Report Logs Email Daily Report has been activated Table 339 IP-MACBinding Logs Table 340 Auth. Policy Logs Page USER-DEFINED Port(s Port(s) •If the Protocol is TCP, UDP, or TCP/UDP, this is the IP port number •If the Protocol is USER, this is the IP protocol number Appendix B Common Services Table 341 Commonly Used Services (continued) Page Page In this appendix, you can import a public key certificate for: •Internet Explorer on page •Firefox on page •Opera on page •Konqueror on page 2Click Continue to this website (not recommended) 3In the Address Bar, click Certificate Error > View certificates 4In the Certificate dialog box, click Install Certificate 5In the Certificate Import Wizard, click Next Select Certificate Store 9In the Completing the Certificate Import Wizard screen, click Finish Security Warning Website Identification 1Open Internet Explorer and click Tools > Internet Options 2In the Internet Options dialog box, click Content > Certificates Certificates Root Certificate Store 2Select Accept this certificate permanently and click OK Page Info > Security 1Open Firefox and click Tools > Options 2In the Options dialog box, click Advanced > Encryption > View Certificates Select File Page Certificate Manager Web Sites 4In the Delete Web Site Certificates dialog box, click OK Install Security information Page 3In the Certificates Manager, click Authorities > Import Import certificate Open 5In the Install authority certificate dialog box, click Install Page Certificates manager Authorities 2Click Continue Forever Click the padlock in the address bar to open the KDE SSL Information Figure 572 Konqueror 3.5: KDE SSL Information Figure 573 Konqueror 3.5: Public Key Certificate File 2In the Certificate Import Result - Kleopatra dialog box, click OK Kleopatra 1Open Konqueror and click Settings > Configure Konqueror Configure Crypto Peer SSL Certificates Remove Page Copyright Disclaimer Trademarks Certifications Federal Communications Commission (FCC) Interference Statement Appendix D Legal Information Registration Open Source Licenses Safety Warnings AA 479, 497 AD 631, 633, 634, 635 port 635 DN 633, 634, 635 LDAP 631 SIP 335 412 102 466 374 Page BRI 447 647 109 208 468 470 Page ESP 374 293, 295, 430, 447 468, 469, 470, 484 fax 89 433, 468 125 88 88, 144, 156 757 Page 355 37 ITSP 27, 88 LCR 88, 89 526 587, 591 categories 712, 713, 716, 717 MOH 532 221 MWI 468 NAT 299 NBNS 244, 266, 273 Page 550 PBX 27 336 295, 405 and users 294, 295, 405 QoS 290, 397, 430, 431 486 649, 652 340, 430 351, 363, 405 469 SIP 37 quality 430, 447 431 411 281 145 766 144, 151 Page 234 38, 433, 467, 581 WINS 244, 266, 273 59