Zyxel ZyWALL USG 1000 Инструкция по эксплуатации онлайн [52/150] 154414

Содержание

• Default login details p.1
• Quick start guide p.1
• User s guide p.1
• Unified security gateway p.1
• Zywall usg series p.1
• Read carefully before use p.2
• Related documentation p.2
• Note it is recommended you use the web configurator to configure the zywall p.2
• Keep this guide for future reference p.2
• Important p.2
• Create secure connections across the internet 9 p.3
• How to set up your network 9 p.3
• Protecting your network 3 p.3
• Managing traffic 5 p.3
• Introduction p.3
• Contents p.3
• Appendix a legal information 45 p.4
• Maintenance 25 p.4
• Overview p.5
• Key applications p.5
• Introduction p.5
• Vpn connectivity p.6
• Ipv6 routing p.6
• Load balancing p.7
• Ssl vpn network access p.7
• User aware access control p.7
• Default zones interfaces and ports p.8
• Web configurator p.9
• Management overview p.9
• Web configurator p.10
• Command line interface cli p.10
• Web configurator access p.10
• Vantage cnm p.10
• Web configurator screens overview p.12
• Title bar p.12
• Navigation panel p.12
• Dashboard p.13
• Chapter 1 introduction p.13
• Zywall usg 20 2000 user s guide p.13
• The monitor menu screens display status and statistics information p.13
• The dashboard displays general device information system status system resource usage licensed service status and interface status in widgets that you can re arrange to suit your needs see the web help for details on the dashboard p.13
• Table 4 monitor menu screens summary p.13
• Monitor menu p.13
• Folder or link tab function p.13
• Zywall usg 20 2000 user s guide p.14
• Use the configuration menu screens to configure the zywall s features p.14
• Table 5 configuration menu screens summary p.14
• Folder or link tab function p.14
• Configuration menu p.14
• Chapter 1 introduction p.14
• Table 5 configuration menu screens summary continued p.15
• Folder or link tab function p.15
• Chapter 1 introduction p.15
• Zywall usg 20 2000 user s guide p.15
• Zywall usg 20 2000 user s guide p.16
• Table 5 configuration menu screens summary continued p.16
• Folder or link tab function p.16
• Chapter 1 introduction p.16
• Zywall usg 20 2000 user s guide p.17
• Web configurator tables and lists are flexible with several options for how to display their entries p.17
• Use the maintenance menu screens to manage configuration and firmware files run diagnostics and reboot or shut down the zywall p.17
• Tables and lists p.17
• Table 6 maintenance menu screens summary p.17
• Table 5 configuration menu screens summary continued p.17
• Maintenance menu p.17
• Folder or link tab function p.17
• Figure 11 sorting table entries by a column s criteria p.17
• Click a column heading to sort the table s entries according to that column s criteria p.17
• Chapter 1 introduction p.17
• Zywall usg 20 2000 user s guide p.19
• Working with lists p.19
• When a list of available entries displays next to a list of selected entries you can often just double click an entry to move it from one list to the other in some lists you can also use the shift or ctrl key to select multiple entries and then use the arrow button to move them to the other list p.19
• The tables have icons for working with table entries you can often use the shift or ctrl key to select multiple entries to remove activate or deactivate p.19
• Table 7 common table icons p.19
• Label description p.19
• Here are descriptions for the most common table icons p.19
• Figure 16 common table icons p.19
• Figure 15 navigating pages of table entries p.19
• Chapter 1 introduction p.19
• Stopping the zywall p.20
• Rack mounting p.20
• Note leave 10 cm of clearance at the sides and 20 cm in the rear p.20
• Note failure to use the proper screws may damage the unit p.20
• Wall mounting p.21
• Note make sure the screws are securely fixed to the wall and strong enough to hold the weight of the zywall with the connection cables p.21
• Usg 20w p.22
• Wall mount the zywall horizontally the zywall s side panels with ventilation slots should not be facing up or down as this position is less safe p.22
• Usg 300 p.22
• Usg 2000 p.22
• Usg 1000 p.22
• Front panel p.22
• Usg 20 p.23
• Base t ports p.23
• Usg 50 p.23
• Usg 20w p.23
• Usg 200 p.23
• Usg 100 p.23
• Mini gbic slots p.23
• Dual personality interfaces p.23
• To avoid possible eye injury do not look into an operating fiber optic module s connectors or fiber optic cable p.24
• Fiber optic cable and transceiver removal p.24
• Transceiver and fiber optic cable installation p.24
• Maximizing throughput p.25
• Front panel leds p.25
• Zywall usg 20 2000 user s guide p.26
• Table 9 zywall usg 2000 front panel leds p.26
• Table 8 zywall usg 20 usg 1000 front panel leds continued p.26
• Led color status description p.26
• Chapter 1 introduction p.26
• Led color status description p.27
• Zywall usg 20 2000 user s guide p.27
• Table 9 zywall usg 2000 front panel leds continued p.27
• Chapter 1 introduction p.27
• How to set up your network p.29
• Wizard overview p.29
• How to configure interfaces port roles and zones p.29
• Configure a wan ethernet interface p.30
• Configure zones p.31
• Configure port roles p.31
• How to configure a cellular interface p.32
• Note the network selection is set to auto by default this means that the 3g usb modem may connect to another 3g network when your service provider is not in range or when necessary select home to have the 3g device connect only to your home network or local service provider this prevents you from being charged using the rate of a different isp p.33
• Set up user accounts p.34
• How to set up a wireless lan p.34
• Create the wlan interface p.34
• Wireless clients import the zywall s certificate p.36
• Wireless clients use the wlan interface p.37
• How to configure ethernet ppp vlan bridge and policy routing p.37
• Note instead of using router advertisement you can use dhcpv6 to pass the network settings to the computers on the lan p.38
• Ipv6 ipv6 p.38
• How to set up ipv6 interfaces for pure ipv6 routing p.38
• Setting up the wan ipv6 interface p.39
• Setting up the lan interface p.39
• Note your isp or uplink router should enable router advertisement p.39
• Prefix delegation and router advertisement settings p.40
• Apply a network prefix from your isp p.40
• Setting up the wan ipv6 interface p.41
• Note your isp or a dhcpv6 server in the same network as the wan should assign an ipv6 ip address for the wan interface p.41
• Ipv6 ipv6 p.41
• Setting up the lan interface p.42
• Note you can configure the ipv6 address prefix length field instead if the delegated prefix is never changed p.42
• What can go wrong p.44
• Ipv6 ipv4 p.44
• How to set up an ipv6 6to4 tunnel p.44
• Setting up the lan ipv6 interface p.45
• Lan1 ipv6 6to4 tunnel wan1 ipv4 p.45
• Configuration concept p.45
• Setting up the 6to4 tunnel p.46
• What can go wrong p.47
• Testing the 6to4 tunnel p.47
• Setting up the ipv6 in ipv4 tunnel p.48
• Policy route wan1 ipv4 tunnel p.48
• Note in the ipv6 in ipv4 tunnel application you must configure the peer gateway s wan ipv4 address as the remote gateway ip p.48
• Lan1 ipv6 p.48
• Ipv6 ipv4 p.48
• Ipv6 in ipv4 p.48
• How to set up an ipv6 in ipv4 tunnel p.48
• Configuration concept p.48
• Setting up the lan ipv6 interface p.49
• Setting up the policy route p.50
• What can go wrong p.51
• Testing the ipv6 in ipv4 tunnel p.51
• Protecting your network p.53
• Firewall p.53
• What can go wrong p.54
• User aware access control p.54
• What can go wrong p.55
• Endpoint security eps p.55
• Device and service registration p.55
• Note you need to first activate your anti virus service license or trial see device and service registration on page 55 p.56
• Anti virus policy configuration p.56
• What can go wrong p.57
• Procedure to create a new profile p.58
• Note you need to first activate your idp service license or trial see device and service registration on page 55 p.58
• Note if internet explorer opens a warning screen about a script making internet explorer run slowly and the computer maybe becoming unresponsive just click no to continue p.58
• Idp profile configuration p.58
• Procedure to create a new adp profile p.59
• Adp profile configuration p.59
• Note if internet explorer opens a warning screen about a script making internet explorer run slowly and the computer maybe becoming unresponsive just click no to continue p.60
• Note you need to first activate your content filter service license or trial to use commtouch or bluecoat content filtering service see device and service registration on page 55 p.61
• Content filter profile configuration p.61
• Viewing content filter reports p.63
• Note you need to first activate your anti spam service license or trial to use the mail scan functions sender reputation mail content analysis and virus outbreak detection see device and service registration on page 55 p.66
• Anti spam policy configuration p.66
• Test the vpn connection p.69
• Ipsec vpn p.69
• Create secure connections across the internet p.69
• Configure security policies for the vpn tunnel p.69
• What can go wrong p.70
• Vpn concentrator example p.71
• Branch office a p.71
• Headquarters p.72
• Branch office b p.72
• What can go wrong p.73
• Hub and spoke ipsec vpn without vpn concentrator p.73
• Branch office a zynos based zywall p.73
• Headquarters zld based zywall p.74
• Branch office b zld based zywall p.74
• What can go wrong p.74
• Zywall ipsec vpn client configuration provisioning p.75
• Overview of what to do p.75
• Configuration steps p.76
• What can go wrong p.77
• Ssl vpn p.77
• What can go wrong p.78
• L2tp vpn with android ios and windows p.79
• L2tp_pool 192 68 0 0 192 68 0 0 lan1_subnet 192 68 x p.79
• L2tp vpn example p.79
• Configuring policy routing p.81
• Configuring l2tp vpn in ios p.83
• Configuring l2tp vpn in android p.83
• Create a connection object p.84
• Configuring l2tp vpn in windows p.84
• Configuring l2tp in windows 7 or windows vista p.84
• Configure the connection object p.85
• Connect using l2tp vpn p.86
• Configuring l2tp in windows xp p.87
• What can go wrong p.92
• One time password version 2 otpv2 p.92
• What can go wrong p.93
• Managing traffic p.95
• How to configure bandwidth management p.95
• Sip bandwidth management p.96
• Sip any to wan and wan to any bandwidth management example p.96
• Setting the interface s bandwidth p.96
• Bandwidth allocation example p.96
• Note use app patrol service for the services classified by the zywall s idp packet inspection signatures use service object for pre defined services p.97
• Http any to wan bandwidth management example p.97
• Ftp wan to dmz bandwidth management example p.99
• Ftp lan to dmz bandwidth management example p.100
• What can go wrong p.102
• Set up available bandwidth on ethernet interfaces p.102
• How to configure a trunk for wan load balancing p.102
• Configure the wan trunk p.103
• How to use multiple static public wan ip addresses for lan to wan traffic p.104
• Create the public ip address range object p.104
• How to use device ha to backup your zywall p.105
• Configure the policy route p.105
• Active passive mode and legacy mode p.105
• Synchronization p.106
• Management access ip addresses p.106
• Active passive mode device ha example p.106
• Configure device ha on the master zywall p.107
• Before you start p.107
• Configure the backup zywall p.108
• Check your device ha setup p.110
• How to configure dns inbound load balancing p.110
• Deploy the backup zywall p.110
• What can go wrong p.111
• How to allow public access to a web server p.112
• Configure nat p.112
• Set up a firewall rule p.113
• What can go wrong p.114
• Turn on the alg p.114
• How to manage voice traffic p.114
• How to allow incoming h 23 peer to peer calls p.114
• 192 68 6 p.114
• Set up a nat policy for h 23 p.115
• Set up a firewall rule for h 23 p.116
• Turn on the alg p.117
• How to use an ippbx on the dmz p.117
• Set up a nat policy for the ippbx p.118
• Set up a wan to dmz firewall rule for sip p.118
• What can go wrong p.119
• Set up a dmz to lan firewall rule for sip p.119
• Set up web surfing policies p.120
• How to limit web surfing and msn to specific people p.120
• Set up msn policies p.121
• What can go wrong p.124
• Maintenance p.125
• How to allow management service from wan p.125
• Check service control p.125
• Check firewall settings p.126
• How to use a radius server to authenticate user accounts based on groups p.128
• How to use ssh for secure telnet access p.129
• Example 1 microsoft windows p.129
• How to manage zywall configuration files p.130
• Example 2 linux p.130
• What can go wrong p.131
• How to manage zywall firmware p.131
• What can go wrong p.132
• How to download and upload a shell script p.132
• What can go wrong p.133
• How to change a power module p.133
• Note you can check the remaining memory space in the dashboard screen p.135
• Note system logs saved on the zywall cannot be transferred to a usb device directly connected to the zywall the zywall saves new system logs to the connected usb storage after you complete the settings shown here p.135
• Note make sure the usb device s file system is supported by the zywall it should not display unknown p.135
• How to save system logs to a usb storage device p.135
• What can go wrong p.138
• How to get the zywall s diagnostic file p.138
• Packet capture screen p.139
• How to capture packets on the zywall p.139
• Packet capture screen p.141
• Example of viewing a packet capture cap file p.142
• How to use packet flow explore for troubleshooting p.143
• Ppendi p.145
• Legal information p.145
• Zyxel limited warranty p.146
• Zywall usg 20 2000 user s guide p.146
• Viewing certifications p.146
• Taiwanese bsmi bureau of standards metrology and inspection a warning p.146
• Registration p.146
• Open source licenses p.146
• Notices p.146
• Federal communications commission fcc interference statement p.146
• Fcc warning p.146
• Certifications class a for zywall usg 300 1000 and 2000 p.146
• Ce mark warning p.146
• Appendix a legal information p.146
• Appendix a legal information p.147
• Zywall usg 20 2000 user s guide p.147
• Regulatory information p.147
• National restrictions p.147
• European union p.147
• Declaration of conformity with regard to eu directive 1999 5 ec r tte directive p.147
• Zywall usg 20 2000 user s guide p.148
• Safety warnings p.148
• Appendix a legal information p.148
• Zywall usg 20w antenna warning this device meets etsi and fcc certification requirements when using the included antenna s only use the included antenna s zywall usg 20 20w if you wall mount your device make sure that no electrical lines gas or water pipes will be damaged p.149
• Zywall usg 20 2000 user s guide p.149
• Your product is marked with this symbol which is known as the weee mark weee stands for waste electronics and electrical equipment it means that used electrical and electronic products should not be mixed with general waste used electrical and electronic equipment should be treated separately p.149
• Appendix a legal information p.149