User manual ZYXEL ZYWALL 1050

[. . . ] ZyWALL 1050 Support Notes ZyWALL 1050 Internet Security Appliance Support Notes Revision 2. 01 August. 2006 1 All contents copyright (c) 2006 ZyXEL Communications Corporation. ZyWALL 1050 Support Notes INDEX 1. Deploying VPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 1. 1 Extended Intranets. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] In this step, we have to configure two VPN policies for remote ZyWALL 1050 LAN subnet and DMZ subnet. Login ZyWALL 2 Plus and switch to the VPN configuration page. Fill in the WAN IP in My Address field and put remote 1050 WAN1 and WAN2 IP as Primary and Redundant remote Gateway. Activate the "Fail back to Primary Remote Gateway when possible" option and set the checking interval. Setup the DNS domain name "ZyWALL 2"and "ZyWALL 1050" as Local and Peer ID type. Click Apply to save the configuration. 156 All contents copyright (c) 2006 ZyXEL Communications Corporation. ZyWALL 1050 Support Notes Click the Add icon to edit the VPN Network Policy. Setup the VPN policy for local LAN subnet (192. 168. 1. 0/24) and Remote address type set to "Range Address" and IP is from 192. 168. 10. 0 to 192. 168. 20. 255. Click Apply to save the configuration. 157 All contents copyright (c) 2006 ZyXEL Communications Corporation. ZyWALL 1050 Support Notes We will see the new VPN tunnel listed on the VPN status page after configuring the VPN tunnel. Ping the remote subnet to trigger the VPN tunnel. User can unplug the WAN1 connection cable and test the VPN HA functionality now!Supposedly the VPN connection will switch to WAN2 connection in several seconds. 158 All contents copyright (c) 2006 ZyXEL Communications Corporation. ZyWALL 1050 Support Notes 1. 8 VoIP over VPN Main Office IPSec VPN VoIP call ZyWALL can seamlessly work with VoIP traffic ­ Branch Office VoIP ATA ZyWALL ZyWALL 70 VoIP ATA Server farm VoIP calls can be protected by VPN deployment to provide The VoIP line deployment between different offices is more and more popular. This application can help enterprise to reduce the operation cost especially saving on long distance communication fee. The security issues also rise due to the VoIP public network transmission character. The common VoIP Security issues like call hijacking, identity theft and denial of service. Thus ZyWALL 1050 can protect the VoIP line security by employing advanced VPN technology. What's the benefit of using ZyWALL to protect converged network? Prevent from call hijacking (VoIP over VPN) Prevent from identity theft (VoIP over VPN) Mitigate impact of denial of service We use a simple topology to illustrate and show how ZyWALL 1050 can protect the VoIP line step by step in the following notes. 159 All contents copyright (c) 2006 ZyXEL Communications Corporation. ZyWALL 1050 Support Notes Fix VoIP Line Application Main Office P2002 IP: 192. 168. 10. 37 SIP Number: 850 Branch Office P2002 IP: 192. 168. 22. 35 SIP Number: 880 ZyWALL 1050 WAN: 179. 25. 3. 24 LAN: 192. 168. 10. 0/24 VPN Tunnel VPN Tunnel Internet ZyWALL70 WAN: 220. 123. 97. 7 LAN: 192. 168. 22. 0/24 We used two VoIP ATA (ZyXEL P2002 series) connected to office gateway. Each of the VoIP ATA has a SIP number for remote ATA dialing. This kind of application is called Fix VoIP Line application. User only needs to install and configure VoIP ATA device and doesn't need to register with an external SIP server. We will use VPN tunnel for VoIP traffic transmission to ensure the VoIP security. VoIP ATA P2002 Configuration: The default management IP for P2002 is 192. 168. 5. 1. Login to the P2002 GUI and switch to the Ethernet menu. Set the Ethernet IP setting to "Get IP address Automatically". 160 All contents copyright (c) 2006 ZyXEL Communications Corporation. ZyWALL 1050 Support Notes Switch to the Maintenance menu and check what IP address was granted from ZyWALL 1050. Connect to the other P2002 GUI and repeat the same steps to find out the IP address. 161 All contents copyright (c) 2006 ZyXEL Communications Corporation. ZyWALL 1050 Support Notes 1. [. . . ] When a user has been authenticated by external database (ladp or radius server), it will retrieve the user's attributes (like lease timeout and re-auth timeout value) from the external server. If the external server doesn't define the user's attributes, it will try to check local database on ZyWALL 1050 (at GUI menu Configuration > User/Group > User tab or Group tab) instead. If it still cannot find, it will use the attribute of "ldap-users" and "radius-users" at GUI menu 295 All contents copyright (c) 2006 ZyXEL Communications Corporation. ZyWALL 1050 Support Notes Configuration > User/Group > User tab as below. The default lease time and re-authentication time of ldap-users and radius-users are 1440 minutes. See the flow as shown below. 296 All contents copyright (c) 2006 ZyXEL Communications Corporation. ZyWALL 1050 Support Notes N. [. . . ]