ZyXEL Communications P-660H-D Series 112

P-660R/H-D Series User’s Guide

111	Chapter 10 Firewalls

Contents

Page Page Disclaimer Trademarks FCC Caution Certifications Page Note Page Page Page Page Wizard Setup for Media Bandwidth Management Network Address Translation (NAT) Screens Firewall Configuration Content Filtering Remote Management Configuration Universal Plug-and-Play(UPnP) Maintenance Introducing the SMT Menu 1 General Setup Menu 2 WAN Backup Setup Menu 3 LAN Setup Internet Access Static Route Setup Bridging Setup Page Remote Management Call Scheduling Troubleshooting Appendix A Product Specifications Appendix B Appendix F IP Subnetting Appendix G Boot Commands Appendix H Appendix M Page Page Page Page Page Page Figure 236 Red Hat 9.0: KDE: Network Configuration: Activate Page Page Page Page Page Page About This User's Guide Syntax Conventions Related Documentation User Guide Feedback Graphics Icons Key 1.1 Introducing the Prestige 1.2 Features High Speed Internet Access Zero Configuration Internet Access Any IP Firewall Content Filtering Traffic Redirect Media Bandwidth Management Universal Plug and Play (UPnP) PPPoE (RFC2516) 1.3 Applications for the Prestige 1.4 Front Panel LEDs 1.5 Hardware Connection 2.1 Web Configurator Overview 2.1.2.1 Using the Reset Button Maintenance Site Map Logout Page 2.2 Change Login Password Page 3.1 Introduction Next Page Page Page Change LAN Configurations Save Settings Change LAN Configuration Start Diagnose Return to Main Menu Page 4.1 Introduction 4.2 Media Bandwidth Management Setup Page Page 5.1 LAN Overview 5.1.1LANs, WANs and the Prestige 5.1.2.1 IP Pool Setup 5.2LAN TCP/IP 5.2.1.1 Private IP Addresses 5.2.3 Multicast IGMP-v1 IGMP-v2 None 5.2.4 Any IP 5.2.4.1 How Any IP Works 5.3 Configuring LAN Page 6.1 WAN Overview 6.1.1.1 ENET ENCAP 6.1.1.2 PPP over Ethernet 6.1.1.3PPPoA 6.1.1.4 RFC 6.1.2.1 VC-basedMultiplexing 6.1.2.2 LLC-basedMultiplexing 6.1.4.1 IP Assignment with PPPoA or PPPoE Encapsulation 6.1.4.2 IP Assignment with RFC 1483 Encapsulation 6.2 Metric 6.3 PPPoE Encapsulation 6.4 Traffic Shaping 6.5 Zero Configuration Internet Access 6.6The Main WAN Screen 6.7 Configuring WAN Setup Page Page 6.8 Traffic Redirect 6.9 Configuring WAN Backup Figure 27 WAN Backup Page 7.1 NAT Overview 7.1.2 What NAT Does 7.1.3 How NAT Works 7.1.4 NAT Application 7.1.5 NAT Mapping Types One to One Many to One Many to Many Overload 7.2 SUA (Single User Account) Versus NAT 7.3SUA Server 7.3.1 Default Server IP Address Server Set 7.3.2 Port Forwarding: Services and Port Numbers 7.4 Selecting the NAT Mode 7.5 Configuring SUA Server Set Page 7.6 Configuring Address Mapping Rules 7.7 Editing an Address Mapping Rule Page Page 8.1 Dynamic DNS Overview 8.2 Configuring Dynamic DNS Page 9.1 Configuring Time and Date Page 10.1 Firewall Overview 10.2 Types of Firewalls 10.3 Introduction to ZyXEL’s Firewall 10.4 Denial of Service 10.4.2 Types of DoS Attacks Ping of Death Teardrop SYN Flood LAND SYN Attack LAND Attack brute-force 10.4.2.1 ICMP Vulnerability 10.4.2.2 Illegal Commands (NetBIOS and SMTP) 10.4.2.3 Traceroute 10.5 Stateful Inspection 10.5.1 Stateful Inspection Process Default Policy 10.5.2Stateful Inspection and the Prestige 10.5.3 TCP Security 10.6Guidelines for Enhancing Security with Your Firewall 10.6.1Security In General 10.7Packet Filtering Vs Firewall 10.7.1.1When To Use Filtering 10.7.2.1When To Use The Firewall Page Page 11.1 Access Methods 11.2 Firewall Policies Overview 11.3 Rule Logic Overview 11.3.3.1 Action 11.3.3.2 Service 11.3.3.3 Source Address 11.3.3.4 Destination Address 11.4 Connection Direction 11.5 Configuring Default Firewall Policy 11.6 Rule Summary Page 11.6.1 Configuring Firewall Rules Insert Page Page 11.7 Customized Services 11.8 Configuring A Customized Service 11.9 Example Firewall Rule Any Destination Address Delete Customized Service -Config Add Remove Available Services Rule Summary Apply 11.10 Predefined Services Page 11.11 Anti-Probing 11.12 DoS Thresholds 11.12.2.1 TCP Maximum Incomplete and Blocking Time TCP Maximum Incomplete Blocking Time 11.12.3Configuring Firewall Thresholds Threshold Page Page 12.1 Content Filtering Overview 12.2 The Main Content Filter Screen 12.3 Configuring Keyword Blocking 12.4 Configuring the Schedule 12.5 Configuring Trusted Computers Page 13.1 Remote Management Overview 13.2 Telnet 13.3 FTP 13.4 Web 13.5 Configuring Remote Management Page 14.1 Introducing Universal Plug and Play 14.2 UPnP and ZyXEL 14.3 Installing UPnP in Windows Example Communications Universal Plug and Play Add/Remove Programs Properties Next Installing UPnP in Windows XP 1Click Start and Control Panel 2Double-click Network Connections Network Connections Advanced 14.4Using UPnP in Windows XP Example Page Page Page Web Configurator Easy Access 1Click Start and then Control Panel 3Select My Network Places under Other Places Local Network Invoke Page 15.1 Logs Overview 15.2 Configuring Log Settings Page 15.3 Displaying the Logs 15.4 SMTP Error Messages 15.4.1 Example E-mailLog Page 16.1 Media Bandwidth Management Overview 16.2 Bandwidth Classes and Filters 16.3 Proportional Bandwidth Allocation 16.4 Application-basedBandwidth Management 16.5 Subnet-basedBandwidth Management 16.6 Application and Subnet-basedBandwidth Management 16.7 Scheduler 16.7.2 Fairness-basedScheduler 16.7.3 Maximize Bandwidth Usage 16.7.4 Reserving Bandwidth for Non-BandwidthClass Traffic Maximize Bandwidth Usage 16.7.5.1 Priority-basedAllotment of Unused and Unbudgeted Bandwidth 16.7.5.2Fairness-basedAllotment of Unused and Unbudgeted Bandwidth 16.8Bandwidth Borrowing 16.9Maximize Bandwidth Usage With Bandwidth Borrowing 16.10The Main Media Bandwidth Management Screen 16.11 Configuring Summary 16.12 Configuring Class Setup 16.12.1.1 DSCP and Per-HopBehavior 16.12.2 Media Bandwidth Management Class Configuration Class Configuration Media Bandwidth Management - Summary Child-Class Page Page 16.12.3 Media Bandwidth Management Statistics 16.13 Bandwidth Monitor Page 17.1 Maintenance Overview 17.2 System Status Screen Page 17.2.1 System Statistics Show Statistics Poll Interval(s) 17.3 DHCP Table Screen 17.4 Any IP Table Screen 17.5 Diagnostic Screens 17.5.2 DSL Line Diagnostic DSL Line 17.6 Firmware Upgrade Firmware Upload in Process Back Page 18.1 SMT Introduction 18.1.3 Prestige SMT Menus Overview 18.2 Navigating the SMT Interface 18.2.1 System Management Terminal Interface Summary 18.3 Changing the System Password Page 19.1 General Setup 19.2 Procedure to Configure Menu 19.2.1 Procedure to Configure Dynamic DNS Edit Dynamic DNS Menu 1.1— Configure Dynamic DNS Page Page 20.1 Introduction to WAN Backup Setup 20.2 Configuring Dial Backup in Menu 20.2.1 Traffic Redirect Setup Menu 2.1 — Traffic Redirect Setup Page Page 21.1 LAN Setup 21.3TCP/IP Ethernet Setup and DHCP Page Page 22.1 Internet Access Overview 22.2 IP Policies 22.3 IP Alias 22.4 IP Alias Setup 22.5 Route IP Setup 22.6 Internet Access Configuration Page Page 23.1 Remote Node Setup Overview 23.2.1Remote Node Profile 23.2.2.1 Scenario 1: One VC, Multiple Protocols 23.2.2.2 Scenario 2: One VC, One Protocol (IP) 23.2.2.3 Scenario 3: Multiple VCs Menu 11.1 – Remote Node Profile 23.3 Remote Node Network Layer Options Route Edit IP/Bridge Yes Menu 11.3 – Remote Node Network Layer Options 23.3.1 My WAN Addr Sample IP Addresses My WAN Addr Rem IP Addr 23.4 Remote Node Filter 23.4.1 Web Configurator Internet Security Filter Rules Security protocol filters Input Filter Sets Internet Security Page 23.5 Editing ATM Layer Options 23.5.3 Advance Setup Options PPPoE Edit Advance Options Menu 11.8 – Advance Setup Options Page 24.1 IP Static Route Overview 24.2 Configuration Menu 12.1 — IP Static Route Setup Menu 12.1.1 – Edit IP Static Route Setup Page 25.1 Bridging in General 25.2.1Remote Node Bridging Setup Edit IP/Bridge Yes and press [ENTER] to edit Menu 11.3 – Remote Node Network Layer Options 25.2.2 Bridge Static Route Setup Edit Bridge Static Route Page 26.1 Using NAT 26.2Applying NAT Menu 11.3 - Remote Node Network Layer Options 26.3 NAT Setup 26.3.1Address Mapping Sets 26.3.1.1SUA Address Mapping Set 26.3.1.2 User-DefinedAddress Mapping Sets 26.3.1.3 Ordering Your Rules 26.4 Configuring a Server behind NAT 26.5 General NAT Examples 26.5.1 Example 1: Internet Access Only Network Address Translation Many-to-One 26.5.2 Example 2: Internet Access with an Inside Server 26.5.3 Example 3: Multiple Public IP Addresses With Inside Servers 1 : Many : Menu 15.1 - Address Mapping Sets Full Feature Network Address Translation Edit Action Page 2Enter 2 in Menu 15 - NAT Setup 26.5.4 Example 4: NAT Unfriendly Application Programs No Overload One-to-One Page Page 27.1 Remote Management and the Firewall 27.2Access Methods Page 28.1 About Filtering 28.1.1 The Filter Structure of the Prestige 28.2 Configuring a Filter Set for the Prestige 28.3 Filter Rules Summary Menus 28.4 Configuring a Filter Rule 28.4.1 TCP/IP Filter Rule Menu 21.1.x.1 – TCP/IP Filter Rule Page 28.4.2 Generic Filter Rule Offset Length Mask Value Generic Filter Rule Menu 21.1.5.1 – Generic Filter Rule Generic Filter Rule 28.5 Filter Types and NAT 28.6 Example Filter 1Enter 1 in the menu 21 to display Menu 21.1 — Filter Set Configuration Menu 21.1.6 — Filter Rules Summary 28.7 Applying Filters and Factory Defaults 28.7.1 Ethernet Traffic 28.7.2 Remote Node Filters Call Filter Sets Page 29.1 About SNMP 29.2Supported MIBs 29.3 SNMP Configuration 29.4 SNMP Traps Page 30.1 Overview 30.2 System Status Menu 24.1 - System Maintenance - Status 30.3 System Information 30.3.2 Console Port Speed Menu 24.2.2 - System Maintenance - Console Port Speed 30.4 Log and Trace 30.4.2 Syslog and Accounting Menu 24.3.2 - System Maintenance - UNIX Syslog Page 30.5 Diagnostic Page Page 31.1 Filename Conventions 31.2 Backup Configuration 31.2.2 Using the FTP Command from the Command Line 31.2.3Example of FTP Commands from the Command Line 31.2.4 GUI-basedFTP Clients 31.2.5 TFTP and FTP over WAN Management Limitations 31.2.6 Backup Configuration Using TFTP 31.2.7 TFTP Command Example 31.2.8 GUI-basedTFTP Clients 31.3 Restore Configuration 31.3.2Restore Using FTP Session Example 31.4 Uploading Firmware and Configuration Files 31.4.3 FTP File Upload Command from the DOS Prompt Example 31.4.4 FTP Session Example of Firmware File Upload 31.4.5 TFTP File Upload 31.4.6 TFTP Upload Command Example Page 32.1 Command Interpreter Mode 32.2 Call Control Support 32.3 Time and Date Setting 32.3.1Resetting the Time Page Page 33.1 Remote Management Overview 33.2 Remote Management 33.2.2 Remote Management Limitations 33.3 Remote Management and NAT 33.4System Timeout Page 34.1 IP Policy Routing Overview 34.2 Benefits of IP Policy Routing 34.3 Routing Policy 34.4 IP Routing Policy Setup Menu 25.1.1 – IP Routing Policy Page 34.5 Applying an IP Policy 34.6 IP Policy Routing Example Menu 25.1.1 - IP Routing Policy Menu 25.1 — IP Routing Policy Setup Menu 25.1 - IP Routing Policy Setup Page Page 35.1 Introduction Menu 26.1 - Schedule Set Setup Duration Main Menu PPPoA Page 36.1 Problems Starting Up the Prestige 36.2 Problems with the LAN 36.3 Problems with the WAN 36.4 Problems Accessing the Prestige 36.4.1.1 Internet Explorer Pop-upBlockers Privacy Internet Options pop-ups 2Select Settings…to open the Pop-upBlocker Settings screen Allowed sites 36.4.1.2JavaScripts Custom Level Scripting Active scripting Scripting of Java applets 36.4.1.3 Java Permissions 2make sure that Use Java 2 for <applet> under Java (Sun) is selected 36.4.2 ActiveX Controls in Internet Explorer 2In the Internet Options window, click Custom Level Page Page Specification Tables Table 115 Firmware Page Page Introduction to DSL ADSL Overview Advantages of ADSL Page Page Page Page Page Windows 95/98/Me Installing Components Adapter Protocol Microsoft manufacturers Configuring Obtain an IP address automatically Specify an IP address Subnet Mask Disable DNS Windows 2000/NT/XP 3Right-click Local Area Connection and then click Properties Internet Protocol (TCP/IP) Use the following IP Address Subnet mask Default gateway •Click Advanced IP Settings TCP/IP Address Default gateways TCP/IP Gateway Address Use the following DNS server addresses Preferred DNS server Alternate DNS server Macintosh OS 8/9 2Select Ethernet built-in from the Connect via list Using DHCP Server Configure: Macintosh OS Linux Using the K Desktop Environment (KDE) System Setting Ethernet Device General Automatically obtain IP address settings with dhcp Using Configuration Files Page Page IP Addressing IP Classes Subnet Masks Subnetting Example: Two Subnets Page Example: Four Subnets Example Eight Subnets Subnetting With Class A and Class B Networks Page Firmware and Configuration File Maintenance Page Command Syntax Command Usage Page Page Page Page Page Page Page Connecting a POTS Splitter Telephone Microfilters Prestige With ISDN PPPoE in Action Benefits of PPPoE Traditional Dial-upScenario How PPPoE Works Prestige as a PPPoE Client Internal SPTGEN Overview The Configuration Text File Format Internal SPTGEN FTP Download Example Internal SPTGEN FTP Upload Example Example Internal SPTGEN Screens Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Command Examples Page Page Page Table 147 ICMP Logs Table 148 CDR Logs Table 149 PPP Logs Table 150 UPnP Logs Page Table 153 IPSec Logs Table 154 IKE Logs Page Page Table 155 PKI Logs Page Page Page Page Log Commands Log Command Example Numerics