User manual ZYXEL ZYWALL USG ZLD 2.21 SUPPORT NOTES

[. . . ] ZyWALL USG ZLD 2. 21 Support Notes Revision 1. 00 August, 2010 Written by CSO ZyXEL ­ ZyWALL USG Support Notes Table of Contents Scenario 1 -- Connecting your USG to the Internet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 1. 1 Application Scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 1. 2 Configuration Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Scenario 2 -- WAN Load Balancing and Customized Usage of WAN Connection for Specific Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] Click CONFIGURATION > VPN > IPSec VPN > VPN Connection to open the configuration screen to configure the phase-2 rule. Go back to the previous page, to see the newly created IKE rule with the destination Dynamic. Click the Add button to add a Network policy. Step 6. To configure the phase-2 rule, user needs to fill in: VPN connection name VPN gateway selection Policy for Local network side Remote network side Step 5. To configure the network policy, user needs to fill in: Policy name The gateway rule it is applied to Tunnel policy for Local network side Remote network side; "0. 0. 0. 0" means for dynamic access Encapsulation mode Active protocol Encryption algorithm Authentication algorithm Perfect Forward Secrecy Phase-2 setting Active protocol Encapsulation mode Encryption algorithm Authentication algorithm Perfect Forward Secrecy Configure the IPSec proposal All contents copyright (c) 2010 ZyXEL Communications Corporation. 39 ZyXEL ­ ZyWALL USG Support Notes All contents copyright (c) 2010 ZyXEL Communications Corporation. 40 ZyXEL ­ ZyWALL USG Support Notes Step 6. After setting up the network policy, user can see the IPSec VPN configuration is complete. Note that the destination is Any. Step 7. Fill in the Phase-1 configuration. All contents copyright (c) 2010 ZyXEL Communications Corporation. 41 ZyXEL ­ ZyWALL USG Support Notes Step 7. Note that the USG series does not support the "Config Mode" in phase-1 advanced setting, thus users must avoid selecting it when performing configuration. Configure the phase-2 parameters. All contents copyright (c) 2010 ZyXEL Communications Corporation. 42 ZyXEL ­ ZyWALL USG Support Notes Step 8. Because it is a dynamic rule, user MUST enable it from the VPN client. The icon will change to green if established successfully. All contents copyright (c) 2010 ZyXEL Communications Corporation. 43 ZyXEL ­ ZyWALL USG Support Notes Step 9. Because it is a dynamic rule, user MUST enable it from the VPN client. The icon will change to green if established successfully. Step 10. When the VPN tunnel is established, user can find the SA information on MONITOR > VPN MONITOR > IPSec. All contents copyright (c) 2010 ZyXEL Communications Corporation. 44 ZyXEL ­ ZyWALL USG Support Notes Scenario 6 -- Deploying SSL VPN for Tele-workers to Access Company Resources 6. 1 Application Scenario Tele-workers who work out of the office sometimes need to access company resources by a secured way. While building an IPSec tunnel to the company gateway is an option, the Windows VPN client configuration is too complicated, and for an easier way to configure IPSec VPN, it requires installation of additional IPSec VPN client software. The USG ZyWALL provides an SSL VPN function, which enables teleworkers to access company resources through a secured VPN tunnel with little effort. Besides, in SSL VPN, the network administrator can define different access rules to allow different users to access different company resources. For example, the network administrator can set up an SSL VPN rule to allow administrator Tom remotely control company servers by RDP or VNC through SSL VPN tunnel. He can also set up an SSL VPN Full tunnel rule to allow sales Chris to remotely access company file-share resources to conduct his important daily job. NOTE: USG 50 supports RDP, VNC, WEB link application and SSL VPN full tunnel, but doesn't support SSL VPN file-share and OWA applications so far. If the remote clients want to use file-share and OWA through SSL VPN, they can use SSL VPN full tunnel mode (Security Extender) as a workaround. All contents copyright (c) 2010 ZyXEL Communications Corporation. 45 ZyXEL ­ ZyWALL USG Support Notes 6. 2 Configuration Guide Network Conditions: WAN IP: 172. 25. 27. 62 LAN subnet: 192. 168. 1. 0/24 VNC server IP: 192. 168. 1. 5 Goals to achieve: 1) Tom in tele-admin group can VNC to the internal server 192. 168. 1. 5 by SSL VPN application. 2) Chris in sales group can access company fileshare resources in the LAN subnet through SSL VPN full tunnel. All contents copyright (c) 2010 ZyXEL Communications Corporation. 46 ZyXEL ­ ZyWALL USG Support Notes ZLD configuration Step 1. [. . . ] Check the managed categories that you don't want employees to surf during office hours. Select managed websites that you want to prevent the employees from accessing during office hours. All contents copyright (c) 2010 ZyXEL Communications Corporation. 82 ZyXEL ­ ZyWALL USG Support Notes Step 4. Switch to Configuration > Anti-X > Content Filter > General. Make sure the Content Filter service is licensed. [. . . ]