User manual ZYXEL ZYWALL 2 PLUS

[. . . ] ZyWALL 2 Plus Internet Security Appliance User's Guide Version 4. 02 3/2007 Edition 1 www. zyxel. com About This User's Guide About This User's Guide Intended Audience This manual is intended for people who want to configure the ZyWALL using the web configurator or System Management Terminal (SMT). You should have at least a basic knowledge of TCP/IP networking concepts and topology. Related Documentation · Quick Start Guide The Quick Start Guide is designed to help you get up and running right away. It contains information on setting up your network and configuring for Internet access. [. . . ] Select User-Defined and specify a size from 0~1460 bytes. Select this check box to send packets destined for overlapping local and remote IP addresses to the local network (you can access the local devices but not the remote devices). Clear this check box to send packets destined for overlapping local and remote IP addresses to the remote network (you can access the remote devices but not the local devices. ) If the remote IPSec router also supports NAT over IPSec, it is recommended that you use NAT over IPSec (see Section 14. 6. 2 on page 252) if the local and remote IP addresses overlap. If a VPN rule's local and remote network settings are both set to 0. 0. 0. 0 (any), no traffic goes through the VPN tunnel if you select this check box. Click Apply to save your changes back to the ZyWALL. Click Reset to begin configuring this screen afresh. Input Idle Timer Gateway Domain Name Update Timer Adjust TCP Maximum Segment Size VPN rules skip applying to the overlap range of local and remote IP addresses Apply Reset 268 ZyWALL 2 Plus User's Guide Chapter 14 IPSec VPN 14. 15 Telecommuter VPN/IPSec Examples The following examples show how multiple telecommuters can make VPN connections to a single ZyWALL at headquarters. The telecommuters use IPSec routers with dynamic WAN IP addresses. The ZyWALL at headquarters has a static public IP address. 14. 15. 1 Telecommuters Sharing One VPN Rule Example See the following figure and table for an example configuration that allows multiple telecommuters (A, B and C in the figure) to use one VPN rule to simultaneously access a ZyWALL at headquarters (HQ in the figure). The telecommuters do not have domain names mapped to the WAN IP addresses of their IPSec routers. The telecommuters must all use the same IPSec parameters but the local IP addresses (or ranges of addresses) should not overlap. Figure 175 Telecommuters Sharing One VPN Rule Example Table 73 Telecommuters Sharing One VPN Rule Example FIELDS My ZyWALL: Remote Gateway Address: Local Network - Single IP Address: Remote Network Single IP Address: TELECOMMUTERS 0. 0. 0. 0 (dynamic IP address assigned by the ISP) Public static IP address HEADQUARTERS Public static IP address 0. 0. 0. 0 With this IP address only the telecommuter can initiate the IPSec tunnel. 192. 168. 1. 10 Telecommuter A: 192. 168. 2. 12 Telecommuter B: 192. 168. 3. 2 Telecommuter C: 192. 168. 4. 15 192. 168. 1. 10 Not Applicable 14. 15. 2 Telecommuters Using Unique VPN Rules Example In this example the telecommuters (A, B and C in the figure) use IPSec routers with domain names that are mapped to their dynamic WAN IP addresses (use Dynamic DNS to do this). ZyWALL 2 Plus User's Guide 269 Chapter 14 IPSec VPN With aggressive negotiation mode (see Section 14. 3. 1. 4 on page 242), the ZyWALL can use the ID types and contents to distinguish between VPN rules. Telecommuters can each use a separate VPN rule to simultaneously access a ZyWALL at headquarters. They can use different IPSec parameters. The local IP addresses (or ranges of addresses) of the rules configured on the ZyWALL at headquarters can overlap. The local IP addresses of the rules configured on the telecommuters' IPSec routers should not overlap. See the following table and figure for an example where three telecommuters each use a different VPN rule for a VPN connection with a ZyWALL located at headquarters. The ZyWALL at headquarters (HQ in the figure) identifies each incoming SA by its ID type and content and uses the appropriate VPN rule to establish the VPN connection. The ZyWALL at headquarters can also initiate VPN connections to the telecommuters since it can find the telecommuters by resolving their domain names. Figure 176 Telecommuters Using Unique VPN Rules Example Table 74 Telecommuters Using Unique VPN Rules Example TELECOMMUTERS All Telecommuter Rules: My ZyWALL 0. 0. 0. 0 Remote Gateway Address: bigcompanyhq. com Remote Network - Single IP Address: 192. 168. 1. 10 Peer ID Type: E-mail Peer ID Content: bob@bigcompanyhq. com Telecommuter A (telecommutera. dydns. org) Local ID Type: IP Local ID Content: 192. 168. 2. 12 Local IP Address: 192. 168. 2. 12 Headquarters ZyWALL Rule 1: Peer ID Type: IP Peer ID Content: 192. 168. 2. 12 Remote Gateway Address: telecommutera. dydns. org Remote Address 192. 168. 2. 12 Telecommuter B (telecommuterb. dydns. org) Headquarters ZyWALL Rule 2: HEADQUARTERS All Headquarters Rules: My ZyWALL: bigcompanyhq. com Local Network - Single IP Address: 192. 168. 1. 10 Local ID Type: E-mail Local ID Content: bob@bigcompanyhq. com 270 ZyWALL 2 Plus User's Guide Chapter 14 IPSec VPN Table 74 Telecommuters Using Unique VPN Rules Example TELECOMMUTERS Local ID Type: DNS Local ID Content: telecommuterb. com Local IP Address: 192. 168. 3. 2 HEADQUARTERS Peer ID Type: DNS Peer ID Content: telecommuterb. com Remote Gateway Address: telecommuterb. dydns. org Remote Address 192. 168. 3. 2 Telecommuter C (telecommuterc. dydns. org) Local ID Type: E-mail Local ID Content: myVPN@myplace. com Local IP Address: 192. 168. 4. 15 Headquarters ZyWALL Rule 3: Peer ID Type: E-mail Peer ID Content: myVPN@myplace. com Remote Gateway Address: telecommuterc. dydns. org Remote Address 192. 168. 4. 15 14. 16 VPN and Remote Management You can allow someone to use a service (like Telnet or HTTP) through a VPN tunnel to manage the ZyWALL. One of the ZyWALL's ports must be part of the VPN rule's local network. This can be the ZyWALL's LAN port if you do not want to allow remote management on the WAN port. You also have to configure remote management (REMOTE MGMT) to allow management access for the service through the specific port. In the following example, the VPN rule's local network (A) includes the ZyWALL's LAN IP address of 192. 168. 1. 7. [. . . ] managing subscription services 117 managing the device good habits 47 using FTP. Max Age 137 maximum incomplete high 202 maximum incomplete low 202 Media Access Control. menu overview 449 metric 141, 327, 465, 491, 494, 498 MIB 370 multicast 125, 173, 466, 472, 494 myZyXEL. com 117 N nailed-up connection 490, 492 NAT 124, 309, 318, 319, 465, 476, 493, 530, 622 and VPN 243 application 311 configuring 501 default server IP address 318 definitions 309 examples 508 how NAT works 310 in the SMT 499 674 ZyWALL 2 Plus User's Guide Index inside global address 309 inside local address 309 Many to Many No Overload 312 Many to Many Overload 312 Many to One 312 mapping types 312 NAT unfriendly applications 513 One to One 312 ordering rules 504 port forwarding 317 port restricted cone 311 Server 312 server set 501 Single User Account 313 trigger port forwarding 515 what NAT does 310, 315 NAT traversal 243, 377 navigation panel 58 NBNS 126, 128 NetBIOS 128 NetBIOS Name Server. NTP time protocol 431 LAN 469 port forwarding 317 port restricted cone NAT 311 port statistics 62 Power Specification 589 PPPoE client 477 encapsulation 69, 147, 475, 478, 488, 489, 490 idle timeout 478 PPTP 70, 150 Client 477 configuring a client 477 encapsulation 70, 150, 491 idle timeout 477 private 327, 465, 494, 498 private IP address 124, 143 product overview 45 product registration 665 protocol filter 473 incoming 473 outgoing 473 R O one minute high 202 one minute low 202 online services center 117 outgoing protocol filter 473 RADIUS 301 and IKE SA 242 Shared Secret Key 302 RADIUS Message Types 301 RADIUS Messages 301 Rapid Spanning Tree Protocol. [. . . ]