ZyXEL Communications USG20W-VPN VPN Firewall User Manual Book
ZyXEL Communications Corporation VPN Firewall Book
Contents
- 1. Users Manual Part 1
- 2. Users Manual Part 2
- 3. Users Manual Part 3
- 4. Users Manual Part 4
- 5. Users Manual Part 5
Users Manual Part 1
USG Series USG20-VPN / USG20W-VPN VPN Firewalls Version 4.16 Edition 1, 12/2015 Quick Start Guide User’s Guide Default Login Details LAN Port IP Address https://192.168.1.1 User Name admin Password 1234 www.zyxel.com Copyright © 2015 ZyXEL Communications Corporation Part I: User’s Guide ......................................................................................... 16 Chapter 1 Introduction.........................................................................................................................................18 1.1 Overview ...........................................................................................................................................18 1.1.1 Applications .............................................................................................................................18 1.2 Management Overview .....................................................................................................................20 1.3 Web Configurator ..............................................................................................................................22 1.3.1 Web Configurator Access ........................................................................................................22 1.3.2 Web Configurator Screens Overview ......................................................................................24 1.3.3 Navigation Panel .....................................................................................................................28 1.3.4 Tables and Lists .......................................................................................................................33 Chapter 2 Installation Setup Wizard ...................................................................................................................36 2.1 Installation Setup Wizard Screens ...................................................................................................36 2.1.1 Internet Access Setup - WAN Interface ..................................................................................36 2.1.2 Internet Access: Ethernet .......................................................................................................37 2.1.3 Internet Access: PPPoE ..........................................................................................................38 2.1.4 Internet Access: PPTP ...........................................................................................................40 2.1.5 Internet Access Setup - Second WAN Interface ......................................................................41 2.1.6 Internet Access Succeed ........................................................................................................42 2.1.7 Wireless Settings: SSID & Security ........................................................................................42 2.1.8 Internet Access - Device Registration ....................................................................................43 Chapter 3 Hardware, Interfaces and Zones .......................................................................................................44 3.1 Hardware Overview ...........................................................................................................................44 3.1.1 Front Panels ............................................................................................................................44 3.1.2 Rear Panels .............................................................................................................................45 3.1.3 Wall-mounting ..........................................................................................................................46 3.2 Default Zones, Interfaces, and Ports .................................................................................................47 3.3 Stopping the USG ............................................................................................................................48 Chapter 4 Quick Setup Wizards ..........................................................................................................................49 4.1 Quick Setup Overview .......................................................................................................................49 4.2 WAN Interface Quick Setup ..............................................................................................................50 4.2.1 Choose an Ethernet Interface ..................................................................................................50 4.2.2 Select WAN Type .....................................................................................................................51 4.2.3 Configure WAN IP Settings .....................................................................................................51 4.2.4 ISP and WAN and ISP Connection Settings ............................................................................52 4.2.5 Quick Setup Interface Wizard: Summary ................................................................................54 USG20(W)-VPN Series User’s Guide 4.3 VPN Setup Wizard ............................................................................................................................55 4.3.1 Welcome ..................................................................................................................................56 4.3.2 VPN Setup Wizard: Wizard Type .............................................................................................57 4.3.3 VPN Express Wizard - Scenario .............................................................................................57 4.3.4 VPN Express Wizard - Configuration .....................................................................................59 4.3.5 VPN Express Wizard - Summary ...........................................................................................59 4.3.6 VPN Express Wizard - Finish .................................................................................................60 4.3.7 VPN Advanced Wizard - Scenario .........................................................................................61 4.3.8 VPN Advanced Wizard - Phase 1 Settings .............................................................................62 4.3.9 VPN Advanced Wizard - Phase 2 ...........................................................................................64 4.3.10 VPN Advanced Wizard - Summary ......................................................................................65 4.3.11 VPN Advanced Wizard - Finish .............................................................................................65 4.4 VPN Settings for Configuration Provisioning Wizard: Wizard Type ..................................................66 4.4.1 Configuration Provisioning Express Wizard - VPN Settings ...................................................67 4.4.2 Configuration Provisioning VPN Express Wizard - Configuration ..........................................68 4.4.3 VPN Settings for Configuration Provisioning Express Wizard - Summary .............................69 4.4.4 VPN Settings for Configuration Provisioning Express Wizard - Finish ...................................70 4.4.5 VPN Settings for Configuration Provisioning Advanced Wizard - Scenario ...........................71 4.4.6 VPN Settings for Configuration Provisioning Advanced Wizard - Phase 1 Settings ..............72 4.4.7 VPN Settings for Configuration Provisioning Advanced Wizard - Phase 2 ............................74 4.4.8 VPN Settings for Configuration Provisioning Advanced Wizard - Summary ..........................74 4.4.9 VPN Settings for Configuration Provisioning Advanced Wizard- Finish .................................76 4.5 VPN Settings for L2TP VPN Settings Wizard ...................................................................................77 4.5.1 L2TP VPN Settings ..................................................................................................................78 4.5.2 L2TP VPN Settings ..................................................................................................................79 4.5.3 VPN Settings for L2TP VPN Setting Wizard - Summary ........................................................80 4.5.4 VPN Settings for L2TP VPN Setting Wizard Completed ........................................................81 Chapter 5 Dashboard ...........................................................................................................................................82 5.1 Overview ...........................................................................................................................................82 5.1.1 What You Can Do in this Chapter ............................................................................................82 5.2 Main Dashboard Screen ...................................................................................................................82 5.2.1 Device Information Screen ......................................................................................................84 5.2.2 System Status Screen .............................................................................................................85 5.2.3 VPN Status Screen ..................................................................................................................86 5.2.4 DHCP Table Screen ................................................................................................................87 5.2.5 Number of Login Users Screen ...............................................................................................88 5.2.6 System Resources Screen ......................................................................................................89 5.2.7 CPU Usage Screen .................................................................................................................90 5.2.8 Memory Usage Screen ............................................................................................................91 5.2.9 Active Session Screen .............................................................................................................92 5.2.10 Extension Slot Screen ...........................................................................................................93 USG20(W)-VPN Series User’s Guide 5.2.11 Interface Status Summary Screen .........................................................................................93 5.2.12 Secured Service Status Screen .............................................................................................94 5.2.13 Content Filter Statistics Screen .............................................................................................95 5.2.14 Top 5 IPv4/IPv6 Security Policy Rules that Blocked Traffic Screen .......................................96 5.2.15 The Latest Alert Logs Screen ................................................................................................96 Part II: Technical Reference............................................................................ 98 Chapter 6 Monitor...............................................................................................................................................100 6.1 Overview .........................................................................................................................................100 6.1.1 What You Can Do in this Chapter ..........................................................................................100 6.2 The Port Statistics Screen ..............................................................................................................101 6.2.1 The Port Statistics Graph Screen .........................................................................................102 6.3 Interface Status Screen ...................................................................................................................103 6.4 The Traffic Statistics Screen ............................................................................................................105 6.5 The Session Monitor Screen ..........................................................................................................108 6.6 IGMP Statistics ................................................................................................................................109 6.7 The DDNS Status Screen ............................................................................................................... 110 6.8 IP/MAC Binding ............................................................................................................................... 111 6.9 The Login Users Screen ................................................................................................................ 111 6.10 Cellular Status Screen ................................................................................................................... 112 6.11 The UPnP Port Status Screen ...................................................................................................... 114 6.12 USB Storage Screen ..................................................................................................................... 115 6.13 Ethernet Neighbor Screen ............................................................................................................ 116 6.14 Wireless ....................................................................................................................................... 117 6.14.1 Wireless AP Information: Radio List .................................................................................... 117 6.14.2 Radio List More Information ................................................................................................ 119 6.14.3 Wireless Station Info ............................................................................................................120 6.14.4 Detected Device .................................................................................................................121 6.15 The IPSec Monitor Screen ............................................................................................................122 6.15.1 Regular Expressions in Searching IPSec SAs ....................................................................123 6.16 The SSL Screen ............................................................................................................................123 6.17 The L2TP over IPSec Session Monitor Screen .............................................................................124 6.18 The Content Filter Screen .............................................................................................................125 6.19 The Anti-Spam Screens ................................................................................................................127 6.19.1 Anti-Spam Report ................................................................................................................127 6.19.2 The Anti-Spam Status Screen .............................................................................................129 6.20 Log Screens ..................................................................................................................................130 6.20.1 View Log ..............................................................................................................................130 USG20(W)-VPN Series User’s Guide Chapter 7 Licensing ...........................................................................................................................................133 7.1 Registration Overview .....................................................................................................................133 7.1.1 What you Need to Know ........................................................................................................133 7.1.2 Registration Screen ...............................................................................................................134 7.1.3 Service Screen ......................................................................................................................134 Chapter 8 Wireless .............................................................................................................................................136 8.1 Overview .........................................................................................................................................136 8.1.1 What You Can Do in this Chapter ..........................................................................................136 8.1.2 What You Need to Know ........................................................................................................136 8.2 AP Management Screen ................................................................................................................137 8.3 DCS Screen ...................................................................................................................................138 8.4 Technical Reference ........................................................................................................................138 8.4.1 Dynamic Channel Selection ..................................................................................................138 Chapter 9 Interfaces...........................................................................................................................................140 9.1 Interface Overview ..........................................................................................................................140 9.1.1 What You Can Do in this Chapter ..........................................................................................140 9.1.2 What You Need to Know ........................................................................................................141 9.1.3 What You Need to Do First ....................................................................................................145 9.2 Port Role Screen .............................................................................................................................145 9.3 Ethernet Summary Screen ..............................................................................................................146 9.3.1 Ethernet Edit .........................................................................................................................148 9.3.2 Object References .................................................................................................................163 9.3.3 Add/Edit DHCPv6 Request/Release Options ........................................................................164 9.3.4 Add/Edit DHCP Extended Options ........................................................................................165 9.4 PPP Interfaces ................................................................................................................................166 9.4.1 PPP Interface Summary ........................................................................................................167 9.4.2 PPP Interface Add or Edit .....................................................................................................168 9.5 Cellular Configuration Screen .........................................................................................................173 9.5.1 Cellular Choose Slot .............................................................................................................176 9.5.2 Add / Edit Cellular Configuration ...........................................................................................176 9.6 Tunnel Interfaces ............................................................................................................................182 9.6.1 Configuring a Tunnel .............................................................................................................184 9.6.2 Tunnel Add or Edit Screen .....................................................................................................185 9.7 VLAN Interfaces .............................................................................................................................188 9.7.1 VLAN Summary Screen ........................................................................................................190 9.7.2 VLAN Add/Edit ......................................................................................................................192 9.8 Bridge Interfaces ............................................................................................................................201 9.8.1 Bridge Summary ....................................................................................................................203 USG20(W)-VPN Series User’s Guide 9.8.2 Bridge Add/Edit .....................................................................................................................204 9.9 Virtual Interfaces ............................................................................................................................213 9.9.1 Virtual Interfaces Add/Edit .....................................................................................................213 9.10 Interface Technical Reference .......................................................................................................215 9.11 Trunk Overview ............................................................................................................................218 9.11.1 What You Need to Know ......................................................................................................218 9.12 The Trunk Summary Screen .........................................................................................................221 9.12.1 Configuring a User-Defined Trunk .......................................................................................222 9.12.2 Configuring the System Default Trunk ................................................................................224 Chapter 10 Routing ..............................................................................................................................................226 10.1 Policy and Static Routes Overview ...............................................................................................226 10.1.1 What You Can Do in this Chapter ........................................................................................226 10.1.2 What You Need to Know .....................................................................................................227 10.2 Policy Route Screen ......................................................................................................................228 10.2.1 Policy Route Edit Screen .....................................................................................................230 10.3 IP Static Route Screen ..................................................................................................................235 10.3.1 Static Route Add/Edit Screen ..............................................................................................235 10.4 Policy Routing Technical Reference ..............................................................................................237 10.5 Routing Protocols Overview .........................................................................................................238 10.5.1 What You Need to Know ......................................................................................................238 10.6 The RIP Screen .............................................................................................................................238 10.7 The OSPF Screen .........................................................................................................................240 10.7.1 Configuring the OSPF Screen .............................................................................................243 10.7.2 OSPF Area Add/Edit Screen ..............................................................................................244 10.7.3 Virtual Link Add/Edit Screen ...............................................................................................246 10.8 Routing Protocol Technical Reference ..........................................................................................247 Chapter 11 DDNS................................................................................................................................................249 11.1 DDNS Overview ............................................................................................................................249 11.1.1 What You Can Do in this Chapter ........................................................................................249 11.1.2 What You Need to Know ......................................................................................................249 11.2 The DDNS Screen .........................................................................................................................250 11.2.1 The Dynamic DNS Add/Edit Screen ....................................................................................251 Chapter 12 NAT.....................................................................................................................................................255 12.1 NAT Overview ...............................................................................................................................255 12.1.1 What You Can Do in this Chapter ........................................................................................255 12.1.2 What You Need to Know ......................................................................................................255 12.2 The NAT Screen ............................................................................................................................255 USG20(W)-VPN Series User’s Guide 12.2.1 The NAT Add/Edit Screen ....................................................................................................257 12.3 NAT Technical Reference ..............................................................................................................260 Chapter 13 HTTP Redirect ...................................................................................................................................262 13.1 Overview .......................................................................................................................................262 13.1.1 What You Can Do in this Chapter ........................................................................................262 13.1.2 What You Need to Know ......................................................................................................262 13.2 The HTTP Redirect Screen ...........................................................................................................263 13.2.1 The HTTP Redirect Edit Screen ..........................................................................................264 Chapter 14 ALG ....................................................................................................................................................266 14.1 ALG Overview ...............................................................................................................................266 14.1.1 What You Need to Know ......................................................................................................266 14.1.2 Before You Begin .................................................................................................................269 14.2 The ALG Screen ...........................................................................................................................269 14.3 ALG Technical Reference .............................................................................................................271 Chapter 15 UPnP ..................................................................................................................................................273 15.1 UPnP and NAT-PMP Overview .....................................................................................................273 15.2 What You Need to Know ...............................................................................................................273 15.2.1 NAT Traversal ......................................................................................................................273 15.2.2 Cautions with UPnP and NAT-PMP .....................................................................................274 15.3 UPnP Screen ................................................................................................................................274 15.4 Technical Reference ......................................................................................................................275 15.4.1 Turning on UPnP in Windows 7 Example ............................................................................275 15.4.2 Using UPnP in Windows XP Example .................................................................................277 15.4.3 Web Configurator Easy Access ...........................................................................................279 Chapter 16 IP/MAC Binding.................................................................................................................................282 16.1 IP/MAC Binding Overview .............................................................................................................282 16.1.1 What You Can Do in this Chapter ........................................................................................282 16.1.2 What You Need to Know ......................................................................................................282 16.2 IP/MAC Binding Summary ............................................................................................................283 16.2.1 IP/MAC Binding Edit ............................................................................................................283 16.2.2 Static DHCP Edit .................................................................................................................284 16.3 IP/MAC Binding Exempt List .........................................................................................................285 Chapter 17 Layer 2 Isolation ...............................................................................................................................287 USG20(W)-VPN Series User’s Guide 17.1 Overview .......................................................................................................................................287 17.1.1 What You Can Do in this Chapter ........................................................................................287 17.2 Layer-2 Isolation General Screen ................................................................................................288 17.3 White List Screen ..........................................................................................................................288 17.3.1 Add/Edit White List Rule .....................................................................................................289 Chapter 18 Inbound Load Balancing..................................................................................................................291 18.1 Inbound Load Balancing Overview ...............................................................................................291 18.1.1 What You Can Do in this Chapter ........................................................................................291 18.2 The Inbound LB Screen ................................................................................................................292 18.2.1 The Inbound LB Add/Edit Screen ........................................................................................293 18.2.2 The Inbound LB Member Add/Edit Screen ..........................................................................295 Chapter 19 Web Authentication .........................................................................................................................297 19.1 Web Auth Overview ......................................................................................................................297 19.1.1 What You Can Do in this Chapter ........................................................................................297 19.1.2 What You Need to Know ......................................................................................................298 19.2 Web Authentication Screen ...........................................................................................................298 19.2.1 Creating Exceptional Services .............................................................................................301 19.2.2 Creating/Editing an Authentication Policy ............................................................................301 19.3 SSO Overview ...............................................................................................................................302 19.4 SSO - USG Configuration .............................................................................................................304 19.4.1 Configuration Overview .......................................................................................................304 19.4.2 Configure the USG to Communicate with SSO ...................................................................304 19.4.3 Enable Web Authentication .................................................................................................305 19.4.4 Create a Security Policy ......................................................................................................306 19.4.5 Configure User Information .................................................................................................307 19.4.6 Configure an Authentication Method ...................................................................................308 19.4.7 Configure Active Directory ...................................................................................................309 19.5 SSO Agent Configuration ..............................................................................................................310 Chapter 20 Security Policy ..................................................................................................................................314 20.1 Overview .......................................................................................................................................314 20.2 One Security .................................................................................................................................314 20.3 What You Can Do in this Chapter .................................................................................................318 20.3.1 What You Need to Know ......................................................................................................318 20.4 The Security Policy Screen ...........................................................................................................320 20.4.1 Configuring the Security Policy Control Screen ...................................................................321 20.4.2 The Security Policy Control Add/Edit Screen ......................................................................324 20.5 The Session Control Screen .........................................................................................................326 USG20(W)-VPN Series User’s Guide 20.5.1 The Session Control Add/Edit Screen .................................................................................328 20.6 Security Policy Example Applications ...........................................................................................329 Chapter 21 IPSec VPN..........................................................................................................................................332 21.1 Virtual Private Networks (VPN) Overview .....................................................................................332 21.1.1 What You Can Do in this Chapter ........................................................................................334 21.1.2 What You Need to Know ......................................................................................................335 21.1.3 Before You Begin .................................................................................................................336 21.2 The VPN Connection Screen ........................................................................................................337 21.2.1 The VPN Connection Add/Edit (IKE) Screen .......................................................................338 21.3 The VPN Gateway Screen ............................................................................................................344 21.3.1 The VPN Gateway Add/Edit Screen ....................................................................................346 21.4 VPN Concentrator ........................................................................................................................353 21.4.1 VPN Concentrator Requirements and Suggestions ............................................................353 21.4.2 VPN Concentrator Screen ...................................................................................................354 21.4.3 The VPN Concentrator Add/Edit Screen .............................................................................354 21.5 USG IPSec VPN Client Configuration Provisioning ......................................................................355 21.6 IPSec VPN Background Information .............................................................................................357 Chapter 22 SSL VPN ............................................................................................................................................367 22.1 Overview .......................................................................................................................................367 22.1.1 What You Can Do in this Chapter ........................................................................................367 22.1.2 What You Need to Know ......................................................................................................367 22.2 The SSL Access Privilege Screen ................................................................................................368 22.2.1 The SSL Access Privilege Policy Add/Edit Screen .............................................................369 22.3 The SSL Global Setting Screen ....................................................................................................372 22.3.1 How to Upload a Custom Logo ............................................................................................373 22.4 USG SecuExtender .......................................................................................................................374 22.4.1 Example: Configure USG for SecuExtender .......................................................................375 Chapter 23 SSL User Screens.............................................................................................................................378 23.1 Overview .......................................................................................................................................378 23.1.1 What You Need to Know ......................................................................................................378 23.2 Remote SSL User Login ...............................................................................................................379 23.3 The SSL VPN User Screens .........................................................................................................382 23.4 Bookmarking the USG ..................................................................................................................383 23.5 Logging Out of the SSL VPN User Screens ..................................................................................384 23.6 SSL User Application Screen ........................................................................................................384 23.7 SSL User File Sharing ...................................................................................................................385 23.7.1 The Main File Sharing Screen .............................................................................................385 USG20(W)-VPN Series User’s Guide 23.7.2 Opening a File or Folder ......................................................................................................386 23.7.3 Downloading a File ..............................................................................................................387 23.7.4 Saving a File ........................................................................................................................387 23.7.5 Creating a New Folder .........................................................................................................388 23.7.6 Renaming a File or Folder ...................................................................................................388 23.7.7 Deleting a File or Folder ......................................................................................................389 23.7.8 Uploading a File ...................................................................................................................389 Chapter 24 USG SecuExtender (Windows) ........................................................................................................391 24.1 The USG SecuExtender Icon ........................................................................................................391 24.2 Status ............................................................................................................................................391 24.3 View Log .......................................................................................................................................392 24.4 Suspend and Resume the Connection .........................................................................................393 24.5 Stop the Connection ......................................................................................................................393 24.6 Uninstalling the USG SecuExtender .............................................................................................393 Chapter 25 L2TP VPN...........................................................................................................................................395 25.1 Overview .......................................................................................................................................395 25.1.1 What You Can Do in this Chapter ........................................................................................395 25.1.2 What You Need to Know ......................................................................................................395 25.2 L2TP VPN Screen .........................................................................................................................396 25.2.1 Example: L2TP and USG Behind a NAT Router .................................................................398 Chapter 26 BWM (Bandwidth Management) ...................................................................................................400 26.1 Overview .......................................................................................................................................400 26.1.1 What You Can Do in this Chapter ........................................................................................400 26.1.2 What You Need to Know .....................................................................................................400 26.2 The Bandwidth Management Screen ............................................................................................404 26.2.1 The Bandwidth Management Add/Edit Screen ....................................................................406 Chapter 27 Content Filtering ...............................................................................................................................415 27.1 Overview .......................................................................................................................................415 27.1.1 What You Can Do in this Chapter ........................................................................................415 27.1.2 What You Need to Know ......................................................................................................415 27.1.3 Before You Begin .................................................................................................................416 27.2 Content Filter Profile Screen .........................................................................................................417 27.3 Content Filter Profile Add or Edit Screen ......................................................................................419 27.3.1 Content Filter Add Profile Category Service ........................................................................420 27.3.2 Content Filter Add Filter Profile Custom Service ................................................................427 USG20(W)-VPN Series User’s Guide 10 27.4 Content Filter Trusted Web Sites Screen .....................................................................................430 27.5 Content Filter Forbidden Web Sites Screen .................................................................................431 27.6 Content Filter Technical Reference ...............................................................................................432 Chapter 28 Anti-Spam ..........................................................................................................................................434 28.1 Overview .......................................................................................................................................434 28.1.1 What You Can Do in this Chapter ........................................................................................434 28.1.2 What You Need to Know ......................................................................................................434 28.2 Before You Begin ..........................................................................................................................435 28.3 The Anti-Spam Profile Screen .......................................................................................................436 28.3.1 The Anti-Spam Profile Add or Edit Screen ..........................................................................437 28.4 The Mail Scan Screen ...................................................................................................................439 28.5 The Anti-Spam Black List Screen ..................................................................................................441 28.5.1 The Anti-Spam Black or White List Add/Edit Screen ...........................................................443 28.5.2 Regular Expressions in Black or White List Entries .............................................................444 28.6 The Anti-Spam White List Screen .................................................................................................444 28.7 The DNSBL Screen .......................................................................................................................446 28.8 Anti-Spam Technical Reference ....................................................................................................448 Chapter 29 Object.................................................................................................................................................452 29.1 Zones Overview ............................................................................................................................452 29.1.1 What You Need to Know ......................................................................................................452 29.1.2 The Zone Screen .................................................................................................................453 29.2 User/Group Overview ....................................................................................................................454 29.2.1 What You Need To Know .....................................................................................................455 29.2.2 User/Group User Summary Screen .....................................................................................457 29.2.3 User/Group Group Summary Screen ..................................................................................460 29.2.4 User/Group Setting Screen ................................................................................................461 29.2.5 User/Group MAC Address Summary Screen .....................................................................466 29.2.6 User /Group Technical Reference .......................................................................................467 29.3 AP Profile Overview ......................................................................................................................468 29.3.1 Radio Screen .......................................................................................................................469 29.3.2 SSID Screen .......................................................................................................................475 29.4 MON Profile ..................................................................................................................................484 29.4.1 Overview ..............................................................................................................................484 29.4.2 MON Profile .........................................................................................................................484 29.5 Address Overview .........................................................................................................................487 29.5.1 What You Need To Know .....................................................................................................487 29.5.2 Address Summary Screen ...................................................................................................487 29.6 Service Overview ..........................................................................................................................491 29.6.1 What You Need to Know ......................................................................................................492 USG20(W)-VPN Series User’s Guide 11 29.6.2 The Service Summary Screen .............................................................................................492 29.6.3 The Service Group Summary Screen .................................................................................494 29.7 Schedule Overview ......................................................................................................................496 29.7.1 What You Need to Know ......................................................................................................496 29.7.2 The Schedule Summary Screen ..........................................................................................497 29.7.3 The Schedule Group Screen ...............................................................................................500 29.8 AAA Server Overview .................................................................................................................501 29.8.1 Directory Service (AD/LDAP) ..............................................................................................502 29.8.2 RADIUS Server ...................................................................................................................502 29.8.3 ASAS ...................................................................................................................................502 29.8.4 What You Need To Know .....................................................................................................503 29.8.5 Active Directory or LDAP Server Summary .........................................................................504 29.8.6 RADIUS Server Summary ...................................................................................................508 29.9 Auth. Method Overview ...............................................................................................................510 29.9.1 Before You Begin .................................................................................................................510 29.9.2 Example: Selecting a VPN Authentication Method ..............................................................510 29.9.3 Authentication Method Objects ............................................................................................ 511 29.10 Certificate Overview ...................................................................................................................513 29.10.1 What You Need to Know ....................................................................................................513 29.10.2 Verifying a Certificate .........................................................................................................515 29.10.3 The My Certificates Screen ...............................................................................................516 29.10.4 The Trusted Certificates Screen .......................................................................................523 29.10.5 Certificates Technical Reference .......................................................................................528 29.11 ISP Account Overview ................................................................................................................528 29.11.1 ISP Account Summary .......................................................................................................528 29.12 SSL Application Overview ..........................................................................................................531 29.12.1 What You Need to Know ....................................................................................................531 29.12.2 The SSL Application Screen ..............................................................................................533 Chapter 30 System ...............................................................................................................................................537 30.1 Overview .......................................................................................................................................537 30.1.1 What You Can Do in this Chapter ........................................................................................537 30.2 Host Name ....................................................................................................................................538 30.3 USB Storage .................................................................................................................................538 30.4 Date and Time ...............................................................................................................................539 30.4.1 Pre-defined NTP Time Servers List .....................................................................................542 30.4.2 Time Server Synchronization ...............................................................................................542 30.5 Console Port Speed ......................................................................................................................543 30.6 DNS Overview ...............................................................................................................................544 30.6.1 DNS Server Address Assignment .......................................................................................544 30.6.2 Configuring the DNS Screen ...............................................................................................544 30.6.3 Address Record ..................................................................................................................547 USG20(W)-VPN Series User’s Guide 12 30.6.4 PTR Record .........................................................................................................................548 30.6.5 Adding an Address/PTR Record .........................................................................................548 30.6.6 CNAME Record ...................................................................................................................548 30.6.7 Adding a CNAME Record ....................................................................................................549 30.6.8 Domain Zone Forwarder .....................................................................................................549 30.6.9 Adding a Domain Zone Forwarder ......................................................................................549 30.6.10 MX Record ........................................................................................................................550 30.6.11 Adding a MX Record ..........................................................................................................551 30.6.12 Security Option Control .....................................................................................................551 30.6.13 Editing a Security Option Control ......................................................................................551 30.6.14 Adding a DNS Service Control Rule ..................................................................................552 30.7 WWW Overview ............................................................................................................................553 30.7.1 Service Access Limitations ..................................................................................................553 30.7.2 System Timeout ...................................................................................................................554 30.7.3 HTTPS .................................................................................................................................554 30.7.4 Configuring WWW Service Control .....................................................................................555 30.7.5 Service Control Rules ..........................................................................................................558 30.7.6 Customizing the WWW Login Page ....................................................................................559 30.7.7 HTTPS Example ..................................................................................................................562 30.8 SSH ............................................................................................................................................569 30.8.1 How SSH Works ..................................................................................................................570 30.8.2 SSH Implementation on the USG ........................................................................................571 30.8.3 Requirements for Using SSH ...............................................................................................571 30.8.4 Configuring SSH ..................................................................................................................571 30.8.5 Secure Telnet Using SSH Examples ...................................................................................572 30.9 Telnet ............................................................................................................................................573 30.9.1 Configuring Telnet ................................................................................................................573 30.10 FTP ............................................................................................................................................575 30.10.1 Configuring FTP ................................................................................................................575 30.11 SNMP .........................................................................................................................................576 30.11.1 SNMPv3 and Security ........................................................................................................577 30.11.2 Supported MIBs .................................................................................................................577 30.11.3 SNMP Traps ......................................................................................................................577 30.11.4 Configuring SNMP .............................................................................................................578 30.12 Authentication Server ..................................................................................................................580 30.12.1 Add/Edit Trusted RADIUS Client ......................................................................................581 30.13 CloudCNM Screen ......................................................................................................................582 30.14 Language Screen ........................................................................................................................585 30.15 IPv6 Screen .................................................................................................................................585 30.16 ZyXEL One Network (ZON) Utility ..............................................................................................586 30.16.1 ZyXEL One Network (ZON) System Screen .....................................................................587 Chapter 31 Log and Report .................................................................................................................................589 USG20(W)-VPN Series User’s Guide 13 31.1 Overview .......................................................................................................................................589 31.1.1 What You Can Do In this Chapter ........................................................................................589 31.2 Email Daily Report ........................................................................................................................589 31.3 Log Setting Screens .....................................................................................................................591 31.3.1 Log Settings .........................................................................................................................592 31.3.2 Edit System Log Settings ...................................................................................................593 31.3.3 Edit Log on USB Storage Setting .......................................................................................596 31.3.4 Edit Remote Server Log Settings .......................................................................................598 31.3.5 Log Category Settings Screen .............................................................................................600 Chapter 32 File Manager......................................................................................................................................604 32.1 Overview .......................................................................................................................................604 32.1.1 What You Can Do in this Chapter ........................................................................................604 32.1.2 What you Need to Know ......................................................................................................604 32.2 The Configuration File Screen ......................................................................................................606 32.3 The Firmware Package Screen ....................................................................................................610 32.4 The Shell Script Screen ...............................................................................................................612 Chapter 33 Diagnostics ......................................................................................................................................615 33.1 Overview .......................................................................................................................................615 33.1.1 What You Can Do in this Chapter ........................................................................................615 33.2 The Diagnostic Screen ..................................................................................................................615 33.2.1 The Diagnostics Files Screen ..............................................................................................616 33.3 The Packet Capture Screen ..........................................................................................................617 33.3.1 The Packet Capture Files Screen ........................................................................................620 33.4 The Core Dump Screen ................................................................................................................620 33.4.1 The Core Dump Files Screen .............................................................................................621 33.5 The System Log Screen ................................................................................................................622 33.6 The Network Tool Screen ..............................................................................................................622 33.7 The Wireless Frame Capture Screen ...........................................................................................623 33.7.1 The Wireless Frame Capture Files Screen ........................................................................625 Chapter 34 Packet Flow Explore ........................................................................................................................627 34.1 Overview .......................................................................................................................................627 34.1.1 What You Can Do in this Chapter ........................................................................................627 34.2 The Routing Status Screen ...........................................................................................................627 34.3 The SNAT Status Screen ..............................................................................................................632 Chapter 35 Shutdown...........................................................................................................................................635 USG20(W)-VPN Series User’s Guide 14 35.1 Overview .......................................................................................................................................635 35.1.1 What You Need To Know .....................................................................................................635 35.2 The Shutdown Screen ...................................................................................................................635 Chapter 36 Troubleshooting................................................................................................................................636 36.1 Resetting the USG ........................................................................................................................644 36.2 Getting More Troubleshooting Help ..............................................................................................645 Appendix A Customer Support ........................................................................................................646 Appendix B Legal Information..........................................................................................................652 Appendix C Product Features..........................................................................................................661 Index ..................................................................................................................................................665 USG20(W)-VPN Series User’s Guide 15 P ART I User’s Guide 16 17 C HAPTER Introduction 1.1 Overview “USG” in this User’s Guide refers to all USG models in the series. Table 1 USG Models USG20-VPN USG20W-VPN USG20W-VPN has built-in Wi-Fi functionality • See Table 12 on page 47 for default port / interface name mapping. See Table 13 on page 48 for default interface / zone mapping. See the product’s datasheet for detailed information on a specific model. 1.1.1 Applications These are some USG application scenarios. Security Router Security includes a Stateful Packet Inspection (SPI) firewall, Content Filtering (CF) and Anti-Spam (AS). Figure 1 Applications: Security RouterApplications: Security Router USG20(W)-VPN Series User’s Guide 18 Chapter 1 Introduction IPv6 Routing The USG supports IPv6 Ethernet, PPP, VLAN, and bridge routing. You may also create IPv6 policy routes and IPv6 objects. The USG can also route IPv6 packets through IPv4 networks using different tunneling methods. Figure 2 Applications: IPv6 Routing VPN Connectivity Set up VPN tunnels with other companies, branch offices, telecommuters, and business travelers to provide secure access to your network. You can also purchase the USG OTPv2 One-Time Password System for strong two-factor authentication for Web Configurator, Web access, SSL VPN, and ZyXEL IPSec VPN client user logins. Figure 3 Applications: VPN Connectivity ***** OTP PIN SafeWord 2008 Authentication Server File Server Email Server Web-based Application SSL VPN Network Access SSL VPN lets remote users use their web browsers for a very easy-to-use VPN solution. A user just browses to the USG’s web address and enters his user name and password to securely connect to the USG’s network. Here full tunnel mode creates a virtual connection for a remote user and gives him a private IP address in the same subnet as the local network so he can access network resources in the same way as if he were part of the internal network. USG20(W)-VPN Series User’s Guide 19 Chapter 1 Introduction Figure 4 SSL VPN With Full Tunnel Mode LAN (192.168.1.X) Web Mail https:// File Share Non-Web Web-based Application Application Server User-Aware Access Control Set up security policies to restrict access to sensitive information and shared resources based on the user who is trying to access it. In the following figure user A can access both the Internet and an internal file server. User B has a lower level of access and can only access the Internet. User C is not even logged in, so and cannot access either the Internet or the file server. Figure 5 Applications: User-Aware Access Control Load Balancing Set up multiple connections to the Internet on the same port, or different ports, including cellular interfaces. In either case, you can balance the traffic loads between them. Figure 6 Applications: Multiple WAN Interfaces 1.2 Management Overview You can manage the USG in the following ways. USG20(W)-VPN Series User’s Guide 20 Chapter 1 Introduction Web Configurator The Web Configurator allows easy USG setup and management using an Internet browser. This User’s Guide provides information about the Web Configurator. Figure 7 Managing the USG: Web Configurator Command-Line Interface (CLI) The CLI allows you to use text-based commands to configure the USG. Access it using remote management (for example, SSH or Telnet) or via the physical or Web Configurator console port. See the Command Reference Guide for CLI details. The default settings for the console port are: Table 2 Console Port Default Settings SETTING VALUE Speed 115200 bps Data Bits Parity None Stop Bit Flow Control Off FTP Use File Transfer Protocol for firmware upgrades and configuration backup/restore. SNMP The device can be monitored and/or managed by an SNMP manager. See Section 30.11 on page 576. USG20(W)-VPN Series User’s Guide 21 Chapter 1 Introduction Cloud CNM Use the CloudCNM screen (see Section 30.13 on page 582) to enable and configure management of the USG by a Central Network Management system. 1.3 Web Configurator In order to use the Web Configurator, you must: • Use one of the following web browser versions or later: Internet Explorer 7, Firefox 3.5, Chrome 9.0 • Allow pop-up windows (blocked by default in Windows XP Service Pack 2) • Enable JavaScripts, Java permissions, and cookies The recommended screen resolution is 1024 x 768 pixels. 1.3.1 Web Configurator Access Make sure your USG hardware is properly connected. See the Quick Start Guide. In your browser go to http://192.168.1.1. By default, the USG automatically routes this request to its HTTPS server, and it is recommended to keep this setting. The Login screen appears. Type the user name (default: “admin”) and password (default: “1234”). If you have a OTP (One-Time Password) token generate a number and enter it in the One-Time Password field. The number is only good for one login. You must use the token to generate a new number the next time you log in. Click Login. If you logged in using the default user name and password, the Update Admin Info screen appears. Otherwise, the dashboard appears. USG20(W)-VPN Series User’s Guide 22 Chapter 1 Introduction The Network Risk Warning screen displays any unregistered or disabled security services. Select how often to display the screen and click OK. If you select Never and you later want to bring this screen back, use these commands (note the space before the underscore). Router> enable Router# Router# configure terminal Router(config)# Router(config)# service-register _setremind after-10-days after-180-days after-30-days every-time never Router(config)# service-register _setremind every-time Router(config)# See the Command Line Interface (CLI) Reference Guide (RG) for details on all supported commands. USG20(W)-VPN Series User’s Guide 23 Chapter 1 Introduction Follow the directions in the Update Admin Info screen. If you change the default password, the Login screen appears after you click Apply. If you click Ignore, the Installation Setup Wizard opens if the USG is using its default configuration; otherwise the dashboard appears. 1.3.2 Web Configurator Screens Overview The Web Configurator screen is divided into these parts (as illustrated on page 24): • A - title bar • B - navigation panel • C - main window Title Bar Figure 8 Title Bar USG20(W)-VPN Series User’s Guide 24 Chapter 1 Introduction The title bar icons in the upper right corner provide the following functions. Table 3 Title Bar: Web Configurator Icons LABEL DESCRIPTION Logout Click this to log out of the Web Configurator. Help Click this to open the help page for the current screen. About Click this to display basic information about the USG. Site Map Click this to see an overview of links to the Web Configurator screens. Object Reference Click this to check which configuration items reference an object. Console Click this to open a Java-based console window from which you can run command line interface (CLI) commands. You will be prompted to enter your user name and password. See the Command Reference Guide for information about the commands. CLI Click this to open a popup window that displays the CLI commands sent by the Web Configurator to the USG. About Click About to display basic information about the USG. Figure 9 About Table 4 About LABEL DESCRIPTION Current Version This shows the firmware version of the USG. Released Date This shows the date (yyyy-mm-dd) and time (hh:mm:ss) when the firmware is released. OK Click this to close the screen. Site Map Click Site MAP to see an overview of links to the Web Configurator screens. Click a screen’s link to go to that screen. USG20(W)-VPN Series User’s Guide 25 Chapter 1 Introduction Figure 10 Site Map Object Reference Click Object Reference to open the Object Reference screen. Select the type of object and the individual object and click Refresh to show which configuration settings reference the object. Figure 11 Object Reference The fields vary with the type of object. This table describes labels that can appear in this screen. Table 5 Object References LABEL DESCRIPTION Object Name This identifies the object for which the configuration settings that use it are displayed. Click the object’s name to display the object’s configuration screen in the main window. This field is a sequential value, and it is not associated with any entry. Service This is the type of setting that references the selected object. Click a service’s name to display the service’s configuration screen in the main window. USG20(W)-VPN Series User’s Guide 26 Chapter 1 Introduction Table 5 Object References (continued) LABEL DESCRIPTION Priority If it is applicable, this field lists the referencing configuration item’s position in its list, otherwise N/A displays. Name This field identifies the configuration item that references the object. Description If the referencing configuration item has a description configured, it displays here. Refresh Click this to update the information in this screen. Cancel Click Cancel to close the screen. Console Click Console to open a Java-based console window from which you can run CLI commands. You will be prompted to enter your user name and password. See the Command Reference Guide for information about the commands. Figure 12 Console Window CLI Messages Click CLI to look at the CLI commands sent by the Web Configurator. Open the pop-up window and then click some menus in the web configurator to display the corresponding commands. USG20(W)-VPN Series User’s Guide 27 Chapter 1 Introduction Figure 13 CLI Messages 1.3.3 Navigation Panel Use the navigation panel menu items to open status and configuration screens. Click the arrow in the middle of the right edge of the navigation panel to hide the panel or drag to resize it. The following sections introduce the USG’s navigation panel menus and their screens. Figure 14 Navigation Panel Dashboard The dashboard displays general device information, system status, system resource usage, licensed service status, and interface status in widgets that you can re-arrange to suit your needs. See the Web Help for details on the dashboard. USG20(W)-VPN Series User’s Guide 28 Chapter 1 Introduction Monitor Menu The monitor menu screens display status and statistics information. Table 6 Monitor Menu Screens Summary FOLDER OR LINK TAB FUNCTION System Status Port Statistics Port Statistics Displays packet statistics for each physical port. Interface Status Interface Summary Displays general interface information and packet statistics. Traffic Statistics Traffic Statistics Collect and display traffic statistics. Session Monitor Session Monitor Displays the status of all current sessions. IGMP Statistics IGMP Statistics Collect and display IGMP statistics. DDNS Status DDNS Status Displays the status of the USG’s DDNS domain names. IP/MAC Binding IP/MAC Binding Lists the devices that have received an IP address from USG interfaces using IP/MAC binding. Login Users Login Users Lists the users currently logged into the USG. Cellular Status Cellular Status Displays details about the USG’s mobile broadband connection status. UPnP Port Status Port Statistics Displays details about UPnP connections going through the USG. USB Storage Storage Information Displays details about USB device connected to the USG. Ethernet Neighbor Ethernet Neighbor View and manage the USG’s neighboring devices via Smart Connect (Layer Link Discovery Protocol (LLDP)). Use the ZyXEL One Network (ZON) utility to view and manage the USG’s neighboring devices via the ZyXEL Discovery Protocol (ZDP). WLAN Setting Edit wireless AP information, remove APs, and reboot them. Wireless AP Information DCS Configure dynamic wireless channel selection. VPN Monitor IPSec IPSec Displays and manages the active IPSec SAs. SSL SSL Lists users currently logged into the VPN SSL client portal. You can also log out individual users and delete related session information. L2TP over IPSec Session Monitor Displays details about current L2TP sessions. Content Filter Report Collect and display content filter statistics Anti-Spam Report Collect and display spam statistics. Status Displays how many mail sessions the USG is currently checking and DNSBL (Domain Name Service-based spam Black List) statistics. View Log Lists log entries. View AP Log Lists AP log entries. UTM Statistics Log USG20(W)-VPN Series User’s Guide 29 Chapter 1 Introduction Configuration Menu Use the configuration menu screens to configure the USG’s features. Table 7 Configuration Menu Screens Summary FOLDER OR LINK TAB FUNCTION Quick Setup Quickly configure WAN interfaces or VPN connections. Licensing Registration Registration Register the device and activate trial services. Service View the licensed service status and upgrade licensed services. WLAN Setting Configuration the USG’s general wireless settings. Wireless AP Management DCS Configure dynamic wireless channel selection. Network Interface Port Role Use this screen to set the USG’s flexible ports such as LAN, OPT, WLAN, or DMZ. Ethernet Manage Ethernet interfaces and virtual Ethernet interfaces. PPP Create and manage PPPoE and PPTP interfaces. Cellular Configure a cellular Internet connection for an installed mobile broadband card. Tunnel Configure tunneling between IPv4 and IPv6 networks. VLAN Create and manage VLAN interfaces and virtual VLAN interfaces. Bridge Create and manage bridges and virtual bridge interfaces. Trunk Create and manage trunks (groups of interfaces) for load balancing. Policy Route Create and manage routing policies. Static Route Create and manage IP static routing information. RIP Configure device-level RIP settings. OSPF Configure device-level OSPF settings, including areas and virtual links. DDNS DDNS Define and manage the USG’s DDNS domain names. NAT NAT Set up and manage port forwarding rules. HTTP Redirect HTTP Redirect Set up and manage HTTP redirection rules. ALG ALG Configure SIP, H.323, and FTP pass-through settings. UPnP UPnP Configure interfaces that allow UPnP and NAT-PMP connections. IP/MAC Binding Summary Configure IP to MAC address bindings for devices connected to each supported interface. Exempt List Configure ranges of IP addresses to which the USG does not apply IP/MAC binding. Layer 2 Isolation General Enable layer-2 isolation on the USG and the internal interface(s). White List Enable and configure the white list. DNS Inbound LB DNS Load Balancing Configure DNS Load Balancing. Web Authentication Define a web portal and exempt services from authentication. SSO Configure the USG to work with a Single Sign On agent. Routing Web Authentication Security Policy USG20(W)-VPN Series User’s Guide 30 Chapter 1 Introduction Table 7 Configuration Menu Screens Summary (continued) FOLDER OR LINK TAB FUNCTION Policy Control Policy Create and manage level-3 traffic rules and apply UTM profiles. Session Control Session Control Limit the number of concurrent client NAT/security policy sessions. VPN Connection Configure IPSec tunnels. VPN Gateway Configure IKE tunnels. Concentrator Combine IPSec VPN connections into a single secure network Configuration Provisioning Set who can retrieve VPN rule settings from the USG using the USG IPSec VPN Client. Access Privilege Configure SSL VPN access rights for users and groups. Global Setting Configure the USG’s SSL VPN settings that apply to all connections. SecuExtender Check for the latest version of the SecuExtender VPN client. L2TP VPN Configure L2TP over IPSec tunnels. BWM Enable and configure bandwidth management rules. Profile Create and manage the detailed filtering rules for content filtering profiles and then apply to a traffic flow using a security policy. Trusted Web Sites Create a list of allowed web sites that bypass content filtering policies. Forbidden Web Sites Create a list of web sites to block regardless of content filtering policies. Profile Turn anti-spam on or off and manage anti-spam policies. Create anti-spam template(s) of settings to apply to a traffic flow using a security policy. Mail Scan Configure e-mail scanning details. Black/White List Set up a black list to identify spam and a white list to identify legitimate e-mail. DNSBL Have the USG check e-mail against DNS Black Lists. Zone Zone Configure zone template(s) used to define various policies. User/Group User Create and manage users. Group Create and manage groups of users. Setting Manage default settings for all users, general settings for user sessions, and rules to force user authentication. MAC Address Configure the MAC addresses or OUI (Organizationally Unique Identifier) of wireless clients for MAC authentication using the local user database. Radio Create template(s) of radio settings to apply to policies as an object. SSID Create template(s) of wireless settings to apply to radio profiles or policies as an object. MON Profile MON Profile Create and manage rogue AP monitoring files that can be associated with different APs. Address Address Create and manage host, range, and network (subnet) addresses. Address Group Create and manage groups of addresseto apply to policies as a single objects. VPN IPSec VPN SSL VPN L2TP VPN BWM UTM Profile Content Filter Anti-Spam Object AP Profile USG20(W)-VPN Series User’s Guide 31 Chapter 1 Introduction Table 7 Configuration Menu Screens Summary (continued) FOLDER OR LINK TAB Service Schedule AAA Server FUNCTION Service Create and manage TCP and UDP services. Service Group Create and manage groups of services to apply to policies as a single object. Schedule Create one-time and recurring schedules. Schedule Group Create and manage groups of schedules to apply to policies as a single object. Active Directory Configure the Active Directory settings. LDAP Configure the LDAP settings. RADIUS Configure the RADIUS settings. Auth. Method Authentication Method Create and manage ways of authenticating users. Certificate My Certificates Create and manage the USG’s certificates. Trusted Certificates Import and manage certificates from trusted sources. ISP Account ISP Account Create and manage ISP account information for PPPoE/PPTP interfaces. SSL Application SSL Application Create SSL web application or file sharing objects to apply to policies. DHCPv6 Request Configure IPv6 DHCP request type and interface information. Lease Configure IPv6 DHCP lease type and interface information. Host Name Host Name Configure the system and domain name for the USG. USB Storage Settings Configure the settings for the connected USB devices. Date/Time Date/Time Configure the current date, time, and time zone in the USG. Console Speed Console Speed Set the console speed. DNS DNS Configure the DNS server and address records for the USG. WWW Service Control Configure HTTP, HTTPS, and general authentication. System Login Page Configure how the login and access user screens look. SSH SSH Configure SSH server and SSH service settings. TELNET TELNET Configure telnet server settings for the USG. FTP FTP Configure FTP server settings. SNMP SNMP Configure SNMP communities and services. Auth. Server Auth. Server Configure the USG to act as a RADIUS server. CloudCNM CloudCNM Enable and configure management of the USG by a Central Network Management system. Language Language Select the Web Configurator language. IPv6 IPv6 Enable IPv6 globally on the USG here. ZON ZON Use the ZyXEL One Network (ZON) utility to view and manage the USG’s neighboring devices via the ZyXEL Discovery Protocol (ZDP). Email Daily Report Email Daily Report Configure where and how to send daily reports and what reports to send. Log Settings Log Settings Configure the system log, e-mail logs, and remote syslog servers. Log & Report USG20(W)-VPN Series User’s Guide 32 Chapter 1 Introduction Maintenance Menu Use the maintenance menu screens to manage configuration and firmware files, run diagnostics, and reboot or shut down the USG. Table 8 Maintenance Menu Screens Summary FOLDER OR LINK File Manager TAB FUNCTION Configuration File Manage and upload configuration files for the USG. Firmware Package View the current firmware version and upload firmware. Reboot with your choice of firmware. Shell Script Manage and run shell script files for the USG. Diagnostics Diagnostic Collect diagnostic information. Packet Capture Capture packets for analysis. Core Dump Connect a USB device to the USG and save the USG operating system kernel to it here. System Log Connect a USB device to the USG and archive the USG system logs to it here. Network Tool Identify problems with the connections. You can use Ping or TraceRoute to help you identify problems. Wireless Frame Capture Capture wireless frames from APs for analysis. Packet Flow Explore Routing Status Check how the USG determines where to route a packet. SNAT Status View a clear picture on how the USG converts a packet’s source IP address and check the related settings. Shutdown Shutdown Turn off the USG. 1.3.4 Tables and Lists Web Configurator tables and lists are flexible with several options for how to display their entries. Click a column heading to sort the table’s entries according to that column’s criteria. Figure 15 Sorting Table Entries by a Column’s Criteria Click the down arrow next to a column heading for more options about how to display the entries. The options available vary depending on the type of fields in the column. Here are some examples of what you can do: • Sort in ascending or descending (reverse) alphabetical order • Select which columns to display • Group entries by field • Show entries in groups • Filter by mathematical operators (<, >, or =) or searching for text USG20(W)-VPN Series User’s Guide 33 Chapter 1 Introduction Figure 16 Common Table Column Options Select a column heading cell’s right border and drag to re-size the column. Figure 17 Resizing a Table Column Select a column heading and drag and drop it to change the column order. A green check mark displays next to the column’s title when you drag the column to a valid new location. Figure 18 Moving Columns Use the icons and fields at the bottom of the table to navigate to different pages of entries and control how many entries display at a time. Figure 19 Navigating Pages of Table Entries The tables have icons for working with table entries. You can often use the [Shift] or [Ctrl] key to select multiple entries to remove, activate, or deactivate. USG20(W)-VPN Series User’s Guide 34 Chapter 1 Introduction Figure 20 Common Table Icons Here are descriptions for the most common table icons. Table 9 Common Table Icons LABEL DESCRIPTION Add Click this to create a new entry. For features where the entry’s position in the numbered list is important (features where the USG applies the table’s entries in order like the security policy for example), you can select an entry and click Add to create a new entry after the selected entry. Edit Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings. In some tables you can just click a table entry and edit it directly in the table. For those types of tables small red triangles display for table entries with changes that you have not yet applied. Remove To remove an entry, select it and click Remove. The USG confirms you want to remove it before doing so. Activate To turn on an entry, select it and click Activate. Inactivate To turn off an entry, select it and click Inactivate. Connect To connect an entry, select it and click Connect. Disconnect To disconnect an entry, select it and click Disconnect. Object References Select an entry and click Object References to check which settings use the entry. Move To change an entry’s position in a numbered list, select it and click Move to display a field to type a number for where you want to put that entry and press [ENTER] to move the entry to the number that you typed. For example, if you type 6, the entry you are moving becomes number 6 and the previous entry 6 (if there is one) gets pushed up (or down) one. Working with Lists When a list of available entries displays next to a list of selected entries, you can often just doubleclick an entry to move it from one list to the other. In some lists you can also use the [Shift] or [Ctrl] key to select multiple entries, and then use the arrow button to move them to the other list. Figure 21 Working with Lists USG20(W)-VPN Series User’s Guide 35 C HAPTER Installation Setup Wizard 2.1 Installation Setup Wizard Screens When you log into the Web Configurator for the first time or when you reset the USG to its default configuration, the Installation Setup Wizard screen displays. This wizard helps you configure Internet connection settings and activate subscription services. This chapter provides information on configuring the Web Configurator's installation setup wizard. See the feature-specific chapters in this User’s Guide for background information. Figure 22 Installation Setup Wizard • Click the double arrow in the upper right corner to display or hide the help. • Click Go to Dashboard to skip the installation setup wizard or click Next to start configuring for Internet access. 2.1.1 Internet Access Setup - WAN Interface Use this screen to set how many WAN interfaces to configure and the first WAN interface’s type of encapsulation and method of IP address assignment. The screens vary depending on the encapsulation type. Refer to information provided by your ISP to know what to enter in each field. Leave a field blank if you don’t have that information. Note: Enter the Internet access information exactly as your ISP gave it to you. USG20(W)-VPN Series User’s Guide 36 Chapter 2 Installation Setup Wizard Figure 23 Internet Access: Step 1 • I have two ISPs: Select this option to configure two Internet connections. Leave it cleared to configure just one. This option appears when you are configuring the first WAN interface. • Encapsulation: Choose the Ethernet option when the WAN port is used as a regular Ethernet. Otherwise, choose PPPoE or PPTP for a dial-up connection according to the information from your ISP. • WAN Interface: This is the interface you are configuring for Internet access. • Zone: This is the security zone to which this interface and Internet connection belong. • IP Address Assignment: Select Auto if your ISP did not assign you a fixed IP address. Select Static if the ISP assigned a fixed IP address. 2.1.2 Internet Access: Ethernet This screen is read-only if you set the previous screen’s IP Address Assignment field to Auto. If you set the previous screen’s IP Address Assignment field to Static, use this screen to configure your IP address settings. Note: Enter the Internet access information exactly as given to you by your ISP or network administrator. USG20(W)-VPN Series User’s Guide 37 Chapter 2 Installation Setup Wizard Figure 24 Internet Access: Ethernet Encapsulation • Encapsulation: This displays the type of Internet connection you are configuring. • First WAN Interface: This is the number of the interface that will connect with your ISP. • Zone: This is the security zone to which this interface and Internet connection will belong. • IP Address: Enter your (static) public IP address. Auto displays if you selected Auto as the IP Address Assignment in the previous screen. The following fields display if you selected static IP address assignment. • IP Subnet Mask: Enter the subnet mask for this WAN connection's IP address. • Gateway IP Address: Enter the IP address of the router through which this WAN connection will send traffic (the default gateway). • First / Second DNS Server: These fields display if you selected static IP address assignment. The Domain Name System (DNS) maps a domain name to an IP address and vice versa. Enter a DNS server's IP address(es). The DNS server is extremely important because without it, you must know the IP address of a computer before you can access it. The USG uses these (in the order you specify here) to resolve domain names for VPN, DDNS and the time server. Leave the field as 0.0.0.0 if you do not want to configure DNS servers. 2.1.3 Internet Access: PPPoE Note: Enter the Internet access information exactly as given to you by your ISP. USG20(W)-VPN Series User’s Guide 38 Chapter 2 Installation Setup Wizard Figure 25 Internet Access: PPPoE Encapsulation 2.1.3.1 ISP Parameters • Type the PPPoE Service Name from your service provider. PPPoE uses a service name to identify and reach the PPPoE server. You can use alphanumeric and -_@$./ characters, and it can be up to 64 characters long. • Authentication Type - Select an authentication protocol for outgoing connection requests. Options are: • CHAP/PAP - Your USG accepts either CHAP or PAP when requested by the remote node. • CHAP - Your USG accepts CHAP only. • PAP - Your USG accepts PAP only. • MSCHAP - Your USG accepts MSCHAP only. • MSCHAP-V2 - Your USG accepts MSCHAP-V2 only. • Type the User Name given to you by your ISP. You can use alphanumeric and -_@$./ characters, and it can be up to 31 characters long. • Type the Password associated with the user name. Use up to 64 ASCII characters except the [] and ?. This field can be blank. • Select Nailed-Up if you do not want the connection to time out. Otherwise, type the Idle Timeout in seconds that elapses before the router automatically disconnects from the PPPoE server. 2.1.3.2 WAN IP Address Assignments • WAN Interface: This is the name of the interface that will connect with your ISP. • Zone: This is the security zone to which this interface and Internet connection will belong. • IP Address: Enter your (static) public IP address. Auto displays if you selected Auto as the IP Address Assignment in the previous screen. USG20(W)-VPN Series User’s Guide 39 Chapter 2 Installation Setup Wizard • First / Second DNS Server: These fields display if you selected static IP address assignment. The Domain Name System (DNS) maps a domain name to an IP address and vice versa. Enter a DNS server's IP address(es). The DNS server is extremely important because without it, you must know the IP address of a computer before you can access it. The USG uses these (in the order you specify here) to resolve domain names for VPN, DDNS and the time server. Leave the field as 0.0.0.0 if you do not want to configure DNS servers. If you do not configure a DNS server, you must know the IP address of a machine in order to access it. 2.1.4 Internet Access: PPTP Note: Enter the Internet access information exactly as given to you by your ISP. Figure 26 Internet Access: PPTP Encapsulation 2.1.4.1 ISP Parameters • Authentication Type - Select an authentication protocol for outgoing calls. Options are: • CHAP/PAP - Your USG accepts either CHAP or PAP when requested by the remote node. • CHAP - Your USG accepts CHAP only. • PAP - Your USG accepts PAP only. • MSCHAP - Your USG accepts MSCHAP only. • MSCHAP-V2 - Your USG accepts MSCHAP-V2 only. • Type the User Name given to you by your ISP. You can use alphanumeric and -_@$./ characters, and it can be up to 31 characters long. • Type the Password associated with the user name. Use up to 64 ASCII characters except the [] and ?. This field can be blank. Re-type your password in the next field to confirm it. • Select Nailed-Up if you do not want the connection to time out. Otherwise, type the Idle Timeout in seconds that elapses before the router automatically disconnects from the PPTP server. USG20(W)-VPN Series User’s Guide 40 Chapter 2 Installation Setup Wizard 2.1.4.2 PPTP Configuration • Base Interface: This identifies the Ethernet interface you configure to connect with a modem or router. • Type a Base IP Address (static) assigned to you by your ISP. • Type the IP Subnet Mask assigned to you by your ISP (if given). • Server IP: Type the IP address of the PPTP server. • Type a Connection ID or connection name. It must follow the “c:id” and “n:name” format. For example, C:12 or N:My ISP. This field is optional and depends on the requirements of your broadband modem or router. You can use alphanumeric and -_: characters, and it can be up to 31 characters long. 2.1.4.3 WAN IP Address Assignments • First WAN Interface: This is the connection type on the interface you are configuring to connect with your ISP. • Zone This is the security zone to which this interface and Internet connection will belong. • IP Address: Enter your (static) public IP address. Auto displays if you selected Auto as the IP Address Assignment in the previous screen. • First / Second DNS Server: These fields display if you selected static IP address assignment. The Domain Name System (DNS) maps a domain name to an IP address and vice versa. Enter a DNS server's IP address(es). The DNS server is extremely important because without it, you must know the IP address of a computer before you can access it. The USG uses these (in the order you specify here) to resolve domain names for VPN, DDNS and the time server. Leave the field as 0.0.0.0 if you do not want to configure DNS servers. 2.1.5 Internet Access Setup - Second WAN Interface If you selected I have two ISPs, after you configure the First WAN Interface, you can configure the Second WAN Interface. The screens for configuring the second WAN interface are similar to the first (see Section 2.1.1 on page 36). Figure 27 Internet Access: Step 3: Second WAN Interface USG20(W)-VPN Series User’s Guide 41 Chapter 2 Installation Setup Wizard 2.1.6 Internet Access Succeed This screen shows your Internet access settings that have been applied successfully. Figure 28 Internet Access Succeed 2.1.7 Wireless Settings: SSID & Security Configure SSID and wireless security in this screen. Figure 29 Wireless Settings: SSID & Security USG20(W)-VPN Series User’s Guide 42 Chapter 2 Installation Setup Wizard SSID Setting • SSID - Enter a descriptive name of up to 32 printable characters for the wireless LAN. • Security Mode - Select Pre-Shared Key to add security on this wireless network. Otherwise, select None to allow any wireless client to associate this network without authentication. • Pre-Shared Key - Enter a pre-shared key of between 8 and 63 case-sensitive ASCII characters (including spaces and symbols) or 64 hexadecimal characters. • Hidden SSID - Select this option if you want to hide the SSID in the outgoing beacon frame. A wireless client then cannot obtain the SSID through scanning using a site survey tool. • Enable Intra-BSS Traffic Blocking - Select this option if you want to prevent crossover traffic from within the same SSID. Wireless clients can still access the wired network but cannot communicate with each other. For Built-in Wireless AP Only • Bridged to: USGs with W in the model name have a built-in AP. Select an interface to bridge with the built-in AP wireless network. Devices connected to this interface will then be in the same broadcast domain as devices in the AP wireless network. 2.1.8 Internet Access - Device Registration Click the link in this screen to register your device at portal.myzyxel.com. Note: The USG must be connected to the Internet in order to register. Figure 30 Internet Access: Device Registration You will need the USG’s serial number and LAN MAC address to register it if you have not already done so. Use the Configuration > Licensing > Registration > Service screen to update your service subscription status. USG20(W)-VPN Series User’s Guide 43 C HAPTER Hardware, Interfaces and Zones 3.1 Hardware Overview USG20-VPN and USG20W-VPN have different housings. 3.1.1 Front Panels The LED indicators are located on the front panel. Figure 31 USG20-VPN Front Panel Figure 32 USG20W-VPN Front Panel The following table describes the LEDs. Table 10 LED Descriptions LED COLOR PWR SYS STATUS DESCRIPTION Off The USG is turned off. Green On The USG is turned on. Red On There is a hardware component failure. Shut down the device, wait for a few minutes and then restart the device (see Section 3.1.3 on page 46). If the LED turns red again, then please contact your vendor. Green Off The USG is not ready or has failed. On The USG is ready and running. Red Blinking The USG is booting. On The USG had an error or has failed. USG20(W)-VPN Series User’s Guide 44 Chapter 3 Hardware, Interfaces and Zones Table 10 LED Descriptions (continued) LED COLOR STATUS DESCRIPTION WLAN Green Off The built-in wireless LAN card is not ready or has failed. On The built-in wireless LAN card is ready. Blinking The built-in wireless LAN card is sending or receiving packets. P1, P2... Green Yellow Off There is no traffic on this port. On This port has a successful 10/100 Mbps connection. Blinking The USG is sending or receiving packets on this port with a 10/100 Mbps connection. Off There is no connection on this port. On This port has a successful 1000 Mbps connection. Blinking The device is sending or receiving packets on this port with a 1000 Mbps connection. 3.1.2 Rear Panels The connection ports are located on the rear panel. Figure 33 USG20-VPN Rear Panel Figure 34 USG20W-VPN Rear Panel The following table describes the items on the rear panel Table 11 Rear Panel Items LABEL DESCRIPTION Power Use the included power cord to connect the power socket to a power outlet. Turn the power switch on if your USG has a power switch. USG20(W)-VPN Series User’s Guide 45 Chapter 3 Hardware, Interfaces and Zones Table 11 Rear Panel Items (continued) LABEL DESCRIPTION WAN/LAN/DMZ/ P1- You have to install an SFP (Small Form-factor Pluggable) transceiver and connect fiber optic cables to it for using a 1Gbps/100Mbps WAN connection. (Gigabit SFP/ Ethernet Port) Console P2~P6 - Connect an Ethernet cable to the port for using a 1Gbps WAN/LAN/DMZ connection. You can use the console port to manage the USG using CLI commands. You will be prompted to enter your user name and password. See the Command Reference Guide for more information about the CLI. When configuring using the console port, you need a computer equipped with communications software configured to the following parameters: • • • • • Speed 115200 bps Data Bits 8 Parity None Stop Bit 1 Flow Control Off Note: Use an 8-wire Ethernet cable to run your Gigabit Ethernet connection at 1000 Mbps. Using a 4-wire Ethernet cable limits your connection to 100 Mbps. Note that the connection speed also depends on what the Ethernet device at the other end can support. 3.1.3 Wall-mounting Both USG20-VPN and USG20W-VPN can be mounted on a wall. Drill two holes 3 mm ~ 4 mm (0.12" ~ 0.16") wide, 20 mm ~ 30 mm (0.79” ~ 1.18”) deep and 150 mm apart, into a wall. Place two screw anchors in the holes. Screw two screws with 6 mm ~ 8 mm (0.24" ~ 0.31") wide heads into the screw anchors. Do not screw the screws all the way in to the wall; leave a small gap between the head of the screw and the wall. The gap must be big enough for the screw heads to slide into the screw slots and the connection cables to run down the back of the USG. Note: Make sure the screws are securely fixed to the wall and strong enough to hold the weight of the USG with the connection cables. Use the holes on the bottom of the USG to hang the USG on the screws. Wall-mount the USG horizontally. The USG's side panels with ventilation slots should not be facing up or down as this position is less safe. USG20(W)-VPN Series User’s Guide 46 Chapter 3 Hardware, Interfaces and Zones Figure 35 Wall Mounting Screw Specifications 3.2 Default Zones, Interfaces, and Ports The default configurations for zones, interfaces, and ports are as follows. References to interfaces may be generic rather than the specific name used in your model. For example, this guide may use “the WAN interface” rather than “wan1” or “wan2”. The following table shows the default physical port and interface mapping for each model at the time of writing. Table 12 Default Physical Port - Interface Mapping PORT / INTERFACE P1 P2 P3 P4 P5 P6 • USG20-VPN sfp wan lan1 lan1 lan1 lan1 • USG20W-VPN sfp wan lan1 lan1 lan1 lan1 USG20(W)-VPN Series User’s Guide 47 Chapter 3 Hardware, Interfaces and Zones The following table shows the default interface and zone mapping for each model at the time of writing. Table 13 Default Zone - Interface Mapping ZONE / INTERFACE • USG20-VPN WAN WAN LAN1 LAN2 DMZ LAN1 LAN2 DMZ LAN1 LAN2 DMZ WAN_PPP SFP SFP_PPP • USG20W-VPN WAN WAN_PPP SFP SFP_PPP 3.3 Stopping the USG Always use Maintenance > Shutdown > Shutdown or the shutdown command before you turn off the USG or remove the power. Not doing so can cause the firmware to become corrupt. USG20(W)-VPN Series User’s Guide 48 C HAPTER Quick Setup Wizards 4.1 Quick Setup Overview The Web Configurator's quick setup wizards help you configure Internet and VPN connection settings. This chapter provides information on configuring the quick setup screens in the Web Configurator. See the feature-specific chapters in this User’s Guide for background information. In the Web Configurator, click Configuration > Quick Setup to open the first Quick Setup screen. Figure 36 Quick Setup • WAN Interface Click this link to open a wizard to set up a WAN (Internet) connection. This wizard creates matching ISP account settings in the USG if you use PPPoE or PPTP. See Section 4.2 on page 50. • VPN SETUP Use VPN Setup to configure a VPN (Virtual Private Network) rule for a secure connection to another computer or network. Use VPN Settings for Configuration Provisioning to set up a VPN rule that can be retrieved with the USG IPSec VPN Client. You only need to enter a user name, password and the IP address of the USG in the IPSec VPN Client to get all VPN settings automatically from the USG. See Section 4.3 on page 55.Use VPN Settings for L2TP VPN Settings to configure the L2TP VPN for clients. USG20(W)-VPN Series User’s Guide 49 Chapter 4 Quick Setup Wizards • Wizard Help If the help does not automatically display when you run the wizard, click teh arrow to display it. 4.2 WAN Interface Quick Setup Click WAN Interface in the main Quick Setup screen to open the WAN Interface Quick Setup Wizard Welcome screen. Use these screens to configure an interface to connect to the Internet. Click Next. Figure 37 WAN Interface Quick Setup Wizard 4.2.1 Choose an Ethernet Interface Select the Ethernet interface (names vary by model) that you want to configure for a WAN connection and click Next. USG20(W)-VPN Series User’s Guide 50 Chapter 4 Quick Setup Wizards Figure 38 Choose an Ethernet Interface 4.2.2 Select WAN Type WAN Type Selection: Select the type of encapsulation this connection is to use. Choose Ethernet when the WAN port is used as a regular Ethernet. Otherwise, choose PPPoE or PPTP for a dial-up connection according to the information from your ISP. Figure 39 WAN Interface Setup: Step 2 The screens vary depending on what encapsulation type you use. Refer to information provided by your ISP to know what to enter in each field. Leave a field blank if you don’t have that information. Note: Enter the Internet access information exactly as your ISP gave it to you. 4.2.3 Configure WAN IP Settings Use this screen to select whether the interface should use a fixed or dynamic IP address. USG20(W)-VPN Series User’s Guide 51 Chapter 4 Quick Setup Wizards Figure 40 WAN Interface Setup: Step 2 Dynamic IP Figure 41 WAN Interface Setup: Step 2 Fixed IP • WAN Interface: This is the interface you are configuring for Internet access. • Zone: This is the security zone to which this interface and Internet connection belong. • IP Address Assignment: Select Auto If your ISP did not assign you a fixed IP address. Select Static if you have a fixed IP address and enter the IP address, subnet mask, gateway IP address (optional) and DNS server IP address(es). 4.2.4 ISP and WAN and ISP Connection Settings Use this screen to configure the ISP and WAN interface settings. This screen is read-only if you select Ethernet and set t the IP Address Assignment to AutoStatic. If you set the IP Address Assignment to static and/or select PPTP or PPPoE, enter the Internet access information exactly as your ISP gave it to you. Note: Enter the Internet access information exactly as your ISP gave it to you. USG20(W)-VPN Series User’s Guide 52 Chapter 4 Quick Setup Wizards Figure 42 WAN and ISP Connection Settings: (PPTP Shown) The following table describes the labels in this screen. Table 14 WAN and ISP Connection Settings LABEL DESCRIPTION ISP Parameter This section appears if the interface uses a PPPoE or PPTP Internet connection. Encapsulation This displays the type of Internet connection you are configuring. Authentication Type Use the drop-down list box to select an authentication protocol for outgoing calls. Options are: CHAP/PAP - Your USG accepts either CHAP or PAP when requested by this remote node. CHAP - Your USG accepts CHAP only. PAP - Your USG accepts PAP only. MSCHAP - Your USG accepts MSCHAP only. MSCHAP-V2 - Your USG accepts MSCHAP-V2 only. User Name Type the user name given to you by your ISP. You can use alphanumeric and -_@$./ characters, and it can be up to 31 characters long. Password Type the password associated with the user name above. Use up to 64 ASCII characters except the [] and ?. This field can be blank. Retype to Confirm Type your password again for confirmation. Nailed-Up Select Nailed-Up if you do not want the connection to time out. USG20(W)-VPN Series User’s Guide 53 Chapter 4 Quick Setup Wizards Table 14 WAN and ISP Connection Settings (continued) LABEL Idle Timeout PPTP Configuration DESCRIPTION Type the time in seconds that elapses before the router automatically disconnects from the PPPoE server. 0 means no timeout. This section only appears if the interface uses a PPPoE or PPTP Internet connection. Base Interface This displays the identity of the Ethernet interface you configure to connect with a modem or router. Base IP Address Type the (static) IP address assigned to you by your ISP. IP Subnet Mask Type the subnet mask assigned to you by your ISP (if given). Server IP Type the IP address of the PPTP server. Connection ID Enter the connection ID or connection name in this field. It must follow the "c:id" and "n:name" format. For example, C:12 or N:My ISP. This field is optional and depends on the requirements of your DSL modem. You can use alphanumeric and -_: characters, and it can be up to 31 characters long. WAN Interface Setup WAN Interface This displays the identity of the interface you configure to connect with your ISP. Zone This field displays to which security zone this interface and Internet connection will belong. IP Address This field is read-only when the WAN interface uses a dynamic IP address. If your WAN interface uses a static IP address, enter it in this field. First DNS Server Second DNS Server These fields only display for an interface with a static IP address. Enter the DNS server IP address(es) in the field(s) to the right. Leave the field as 0.0.0.0 if you do not want to configure DNS servers. If you do not configure a DNS server, you must know the IP address of a machine in order to access it. DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa. The DNS server is extremely important because without it, you must know the IP address of a computer before you can access it. The USG uses a system DNS server (in the order you specify here) to resolve domain names for VPN, DDNS and the time server. Back Next Click Back to return to the previous screen. Click Next to continue. 4.2.5 Quick Setup Interface Wizard: Summary This screen displays the WAN interface’s settings. USG20(W)-VPN Series User’s Guide 54 Chapter 4 Quick Setup Wizards Figure 43 Interface Wizard: Summary WAN (PPTP Shown) The following table describes the labels in this screen. Table 15 Interface Wizard: Summary WAN LABEL DESCRIPTION Encapsulation This displays what encapsulation this interface uses to connect to the Internet. Service Name This field only appears for a PPPoE interface. It displays the PPPoE service name specified in the ISP account. Server IP This field only appears for a PPTP interface. It displays the IP address of the PPTP server. User Name This is the user name given to you by your ISP. Nailed-Up If No displays the connection will not time out. Yes means the USG uses the idle timeout. Idle Timeout This is how many seconds the connection can be idle before the router automatically disconnects from the PPPoE server. 0 means no timeout. Connection ID If you specified a connection ID, it displays here. WAN Interface This identifies the interface you configure to connect with your ISP. Zone This field displays to which security zone this interface and Internet connection will belong. IP Address Assignment This field displays whether the WAN IP address is static or dynamic (Auto). First DNS Server If the IP Address Assignment is Static, these fields display the DNS server IP address(es). Second DNS Server Close Click Close to exit the wizard. 4.3 VPN Setup Wizard Click VPN Setup in the main Quick Setup screen to open the VPN Setup Wizard Welcome screen. USG20(W)-VPN Series User’s Guide 55 Chapter 4 Quick Setup Wizards Figure 44 VPN Setup Wizard 4.3.1 Welcome Use wizards to create Virtual Private Network (VPN) rules. After you complete the wizard, the Phase 1 rule settings appear in the VPN > IPSec VPN > VPN Gateway screen and the Phase 2 rule settings appear in the VPN > IPSec VPN > VPN Connection screen. • VPN Settings configures a VPN tunnel for a secure connection to another computer or network. • VPN Settings for Configuration Provisioning sets up a VPN rule the USG IPSec VPN Client can retrieve. Just enter a user name, password and the IP address of the USG in the IPSec VPN Client to get the VPN settings automatically from the USG. • VPN Settings for L2TP VPN Settings sets up a L2TP VPN rule that the USG IPSec L2TP VPN client can retrieve. Figure 45 VPN Setup Wizard Welcome USG20(W)-VPN Series User’s Guide 56 Chapter 4 Quick Setup Wizards 4.3.2 VPN Setup Wizard: Wizard Type Choose Express to create a VPN rule with the default phase 1 and phase 2 settings to connect to another ZLD-based USG using a pre-shared key. Choose Advanced to change the default settings and/or use certificates instead of a pre-shared key to create a VPN rule to connect to another IPSec device. Figure 46 VPN Setup Wizard: Wizard Type 4.3.3 VPN Express Wizard - Scenario Click the Express radio button as shown in Figure 46 on page 57 to display the following screen. USG20(W)-VPN Series User’s Guide 57 Chapter 4 Quick Setup Wizards Figure 47 VPN Express Wizard: Scenario Rule Name: Type the name used to identify this VPN connection (and VPN gateway). You may use 1-31 alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Select the scenario that best describes your intended VPN connection. The figure on the left of the screen changes to match the scenario you select. • Site-to-site - The remote IPSec device has a static IP address or a domain name. This USG can initiate the VPN tunnel. • Site-to-site with Dynamic Peer - The remote IPSec device has a dynamic IP address. Only the remote IPSec device can initiate the VPN tunnel. • Remote Access (Server Role) - Allow incoming connections from IPSec VPN clients. The clients have dynamic IP addresses and are also known as dial-in users. Only the clients can initiate the VPN tunnel. • Remote Access (Client Role) - Connect to an IPSec server. This USG is the client (dial-in user) and can initiate the VPN tunnel. USG20(W)-VPN Series User’s Guide 58 Chapter 4 Quick Setup Wizards 4.3.4 VPN Express Wizard - Configuration Figure 48 VPN Express Wizard: Configuration • Secure Gateway: Any displays in this field if it is not configurable for the chosen scenario. Otherwise, enter the WAN IP address or domain name of the remote IPSec device (secure gateway) to identify the remote IPSec router by its IP address or a domain name. Use 0.0.0.0 if the remote IPSec router has a dynamic WAN IP address. • Pre-Shared Key: Type the password. Both ends of the VPN tunnel must use the same password. Use 8 to 31 case-sensitive ASCII characters or 8 to 31 pairs of hexadecimal (“0-9”, “A-F”) characters. Proceed a hexadecimal key with “0x”. You will receive a PYLD_MALFORMED (payload malformed) packet if the same pre-shared key is not used on both ends. • Local Policy (IP/Mask): Type the IP address of a computer on your network that can use the tunnel. You can also specify a subnet. This must match the remote IP address configured on the remote IPSec device. • Remote Policy (IP/Mask): Any displays in this field if it is not configurable for the chosen scenario. Otherwise, type the IP address of a computer behind the remote IPSec device. You can also specify a subnet. This must match the local IP address configured on the remote IPSec device. 4.3.5 VPN Express Wizard - Summary This screen provides a read-only summary of the VPN tunnel’s configuration and commands that you can copy and paste into another ZLD-based USG’s command line interface to configure it. USG20(W)-VPN Series User’s Guide 59 Chapter 4 Quick Setup Wizards Figure 49 VPN Express Wizard: Summary • Rule Name: Identifies the VPN gateway policy. • Secure Gateway: IP address or domain name of the remote IPSec device. If this field displays Any, only the remote IPSec device can initiate the VPN connection. • Pre-Shared Key: VPN tunnel password. It identifies a communicating party during a phase 1 IKE negotiation. • Local Policy: IP address and subnet mask of the computers on the network behind your USG that can use the tunnel. • Remote Policy: IP address and subnet mask of the computers on the network behind the remote IPSec device that can use the tunnel. If this field displays Any, only the remote IPSec device can initiate the VPN connection. • Copy and paste the Configuration for Secure Gateway commands into another ZLD-based USG’s command line interface to configure it to serve as the other end of this VPN tunnel. You can also use a text editor to save these commands as a shell script file with a “.zysh” filename extension. Use the file manager to run the script in order to configure the VPN connection. See the commands reference guide for details on the commands displayed in this list. 4.3.6 VPN Express Wizard - Finish Now the rule is configured on the USG. The Phase 1 rule settings appear in the VPN > IPSec VPN > VPN Gateway screen and the Phase 2 rule settings appear in the VPN > IPSec VPN > VPN Connection screen. USG20(W)-VPN Series User’s Guide 60 Chapter 4 Quick Setup Wizards Figure 50 VPN Express Wizard: Finish Click Close to exit the wizard. 4.3.7 VPN Advanced Wizard - Scenario Click the Advanced radio button as shown in Figure 46 on page 57 to display the following screen. USG20(W)-VPN Series User’s Guide 61 Chapter 4 Quick Setup Wizards Figure 51 VPN Advanced Wizard: Scenario Rule Name: Type the name used to identify this VPN connection (and VPN gateway). You may use 1-31 alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Select the scenario that best describes your intended VPN connection. The figure on the left of the screen changes to match the scenario you select. • Site-to-site - The remote IPSec device has a static IP address or a domain name. This USG can initiate the VPN tunnel. • Site-to-site with Dynamic Peer - The remote IPSec device has a dynamic IP address. Only the remote IPSec device can initiate the VPN tunnel. • Remote Access (Server Role) - Allow incoming connections from IPSec VPN clients. The clients have dynamic IP addresses and are also known as dial-in users. Only the clients can initiate the VPN tunnel. • Remote Access (Client Role) - Connect to an IPSec server. This USG is the client (dial-in user) and can initiate the VPN tunnel. 4.3.8 VPN Advanced Wizard - Phase 1 Settings There are two phases to every IKE (Internet Key Exchange) negotiation – phase 1 (Authentication) and phase 2 (Key Exchange). A phase 1 exchange establishes an IKE SA (Security Association). USG20(W)-VPN Series User’s Guide 62 Chapter 4 Quick Setup Wizards Figure 52 VPN Advanced Wizard: Phase 1 Settings • Secure Gateway: Any displays in this field if it is not configurable for the chosen scenario. Otherwise, enter the WAN IP address or domain name of the remote IPSec device (secure gateway) to identify the remote IPSec device by its IP address or a domain name. Use 0.0.0.0 if the remote IPSec device has a dynamic WAN IP address. • My Address (interface): Select an interface from the drop-down list box to use on your USG. • Negotiation Mode: This displays Main or Aggressive: • Main encrypts the USG’s and remote IPSec router’s identities but takes more time to establish the IKE SA • Aggressive is faster but does not encrypt the identities. The USG and the remote IPSec router must use the same negotiation mode. Multiple SAs connecting through a secure gateway must have the same negotiation mode. • Encryption Algorithm: 3DES and AES use encryption. The longer the key, the higher the security (this may affect throughput). Both sender and receiver must use the same secret key, which can be used to encrypt and decrypt the message or to generate and verify a message authentication code. The DES encryption algorithm uses a 56-bit key. Triple DES (3DES) is a variation on DES that uses a 168-bit key. As a result, 3DES is more secure than DES. It also requires more processing power, resulting in increased latency and decreased throughput. AES128 uses a 128-bit key and is faster than 3DES. AES192 uses a 192-bit key, and AES256 uses a 256-bit key. • Authentication Algorithm: MD5 gives minimal security and SHA512 gives the highest security. MD5 (Message Digest 5) and SHA (Secure Hash Algorithm) are hash algorithms used to authenticate packet data. The stronger the algorithm the slower it is. • Key Group: DH5 is more secure than DH1 or DH2 (although it may affect throughput). DH1 (default) refers to Diffie-Hellman Group 1 a 768 bit random number. DH2 refers to Diffie-Hellman Group 2 a 1024 bit (1Kb) random number. DH5 refers to Diffie-Hellman Group 5 a 1536 bit random number. • SA Life Time: Set how often the USG renegotiates the IKE SA. A short SA life time increases security, but renegotiation temporarily disconnects the VPN tunnel. • NAT Traversal: Select this if the VPN tunnel must pass through NAT (there is a NAT router between the IPSec devices). USG20(W)-VPN Series User’s Guide 63 Chapter 4 Quick Setup Wizards Note: The remote IPSec device must also have NAT traversal enabled. See the help in the main IPSec VPN screens for more information. • Dead Peer Detection (DPD) has the USG make sure the remote IPSec device is there before transmitting data through the IKE SA. If there has been no traffic for at least 15 seconds, the USG sends a message to the remote IPSec device. If it responds, the USG transmits the data. If it does not respond, the USG shuts down the IKE SA. • Authentication Method: Select Pre-Shared Key to use a password or Certificate to use one of the USG’s certificates. 4.3.9 VPN Advanced Wizard - Phase 2 Phase 2 in an IKE uses the SA that was established in phase 1 to negotiate SAs for IPSec. Figure 53 VPN Advanced Wizard: Phase 2 Settings • Active Protocol: ESP is compatible with NAT, AH is not. • Encapsulation: Tunnel is compatible with NAT, Transport is not. • Encryption Algorithm: 3DES and AES use encryption. The longer the AES key, the higher the security (this may affect throughput). Null uses no encryption. • Authentication Algorithm: MD5 gives minimal security and SHA512 gives the highest security. MD5 (Message Digest 5) and SHA (Secure Hash Algorithm) are hash algorithms used to authenticate packet data. The stronger the algorithm the slower it is. • SA Life Time: Set how often the USG renegotiates the IKE SA. A short SA life time increases security, but renegotiation temporarily disconnects the VPN tunnel. • Perfect Forward Secrecy (PFS): Disabling PFS allows faster IPSec setup, but is less secure. Select DH1, DH2 or DH5 to enable PFS. DH5 is more secure than DH1 or DH2 (although it may affect throughput). DH1 refers to Diffie-Hellman Group 1 a 768 bit random number. DH2 refers to Diffie-Hellman Group 2 a 1024 bit (1Kb) random number. DH5 refers to Diffie-Hellman Group 5 a 1536 bit random number (more secure, yet slower). • Local Policy (IP/Mask): Type the IP address of a computer on your network. You can also specify a subnet. This must match the remote IP address configured on the remote IPSec device. • Remote Policy (IP/Mask): Type the IP address of a computer behind the remote IPSec device. You can also specify a subnet. This must match the local IP address configured on the remote IPSec device. • Nailed-Up: This displays for the site-to-site and remote access client role scenarios. Select this to have the USG automatically renegotiate the IPSec SA when the SA life time expires. USG20(W)-VPN Series User’s Guide 64 Chapter 4 Quick Setup Wizards 4.3.10 VPN Advanced Wizard - Summary This is a read-only summary of the VPN tunnel settings. Figure 54 VPN Advanced Wizard: Summary • Rule Name: Identifies the VPN connection (and the VPN gateway). • Secure Gateway: IP address or domain name of the remote IPSec device. • Pre-Shared Key: VPN tunnel password. • Certificate: The certificate the USG uses to identify itself when setting up the VPN tunnel. • Local Policy: IP address and subnet mask of the computers on the network behind your USG that can use the tunnel. • Remote Policy: IP address and subnet mask of the computers on the network behind the remote IPSec device that can use the tunnel. • Copy and paste the Configuration for Remote Gateway commands into another ZLD-based USG’s command line interface. • Click Save to save the VPN rule. 4.3.11 VPN Advanced Wizard - Finish Now the rule is configured on the USG. The Phase 1 rule settings appear in the VPN > IPSec VPN > VPN Gateway screen and the Phase 2 rule settings appear in the VPN > IPSec VPN > VPN Connection screen. USG20(W)-VPN Series User’s Guide 65 Chapter 4 Quick Setup Wizards Figure 55 VPN Wizard: Finish Click Close to exit the wizard. 4.4 VPN Settings for Configuration Provisioning Wizard: Wizard Type Use VPN Settings for Configuration Provisioning to set up a VPN rule that can be retrieved with the USG IPSec VPN Client. VPN rules for the USG IPSec VPN Client have certain restrictions. They must not contain the following settings: • AH active protocol • NULL encryption • SHA512 authentication • A subnet or range remote policy USG20(W)-VPN Series User’s Guide 66 Chapter 4 Quick Setup Wizards Choose Express to create a VPN rule with the default phase 1 and phase 2 settings and to use a pre-shared key. Choose Advanced to change the default settings and/or use certificates instead of a pre-shared key in the VPN rule. Figure 56 VPN Settings for Configuration Provisioning Express Wizard: Wizard Type 4.4.1 Configuration Provisioning Express Wizard - VPN Settings Click the Express radio button as shown in the previous screen to display the following screen. USG20(W)-VPN Series User’s Guide 67 Chapter 4 Quick Setup Wizards Figure 57 VPN for Configuration Provisioning Express Wizard: Settings Scenario Rule Name: Type the name used to identify this VPN connection (and VPN gateway). You may use 1-31 alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Application Scenario: Only the Remote Access (Server Role) is allowed in this wizard. It allows incoming connections from the USG IPSec VPN Client. 4.4.2 Configuration Provisioning VPN Express Wizard - Configuration Click Next to continue the wizard. USG20(W)-VPN Series User’s Guide 68 Chapter 4 Quick Setup Wizards Figure 58 VPN for Configuration Provisioning Express Wizard: Configuration • Secure Gateway: Any displays in this field because it is not configurable in this wizard. It allows incoming connections from the USG IPSec VPN Client. • Pre-Shared Key: Type the password. Both ends of the VPN tunnel must use the same password. Use 8 to 31 case-sensitive ASCII characters or 8 to 31 pairs of hexadecimal (“0-9”, “A-F”) characters. Proceed a hexadecimal key with “0x”. You will receive a PYLD_MALFORMED (payload malformed) packet if the same pre-shared key is not used on both ends. • Local Policy (IP/Mask): Type the IP address of a computer on your network. You can also specify a subnet. This must match the remote IP address configured on the remote IPSec device. • Remote Policy (IP/Mask): Any displays in this field because it is not configurable in this wizard. 4.4.3 VPN Settings for Configuration Provisioning Express Wizard Summary This screen has a read-only summary of the VPN tunnel’s configuration and commands you can copy and paste into another ZLD-based USG’s command line interface to configure it. USG20(W)-VPN Series User’s Guide 69 Chapter 4 Quick Setup Wizards Figure 59 VPN for Configuration Provisioning Express Wizard: Summary • Rule Name: Identifies the VPN gateway policy. • Secure Gateway: Any displays in this field because it is not configurable in this wizard. It allows incoming connections from the USG IPSec VPN Client. • Pre-Shared Key: VPN tunnel password. It identifies a communicating party during a phase 1 IKE negotiation. • Local Policy: (Static) IP address and subnet mask of the computers on the network behind your USG that can be accessed using the tunnel. • Remote Policy: Any displays in this field because it is not configurable in this wizard. • The Configuration for Secure Gateway displays the configuration that the USG IPSec VPN Client will get from the USG. • Click Save to save the VPN rule. 4.4.4 VPN Settings for Configuration Provisioning Express Wizard - Finish Now the rule is configured on the USG. The Phase 1 rule settings appear in the VPN > IPSec VPN > VPN Gateway screen and the Phase 2 rule settings appear in the VPN > IPSec VPN > VPN Connection screen. Enter the IP address of the USG in the USG IPSec VPN Client to get all these VPN settings automatically from the USG. USG20(W)-VPN Series User’s Guide 70 Chapter 4 Quick Setup Wizards Figure 60 VPN for Configuration Provisioning Express Wizard: Finish Click Close to exit the wizard. 4.4.5 VPN Settings for Configuration Provisioning Advanced Wizard Scenario Click the Advanced radio button as shown in the screen shown in Figure 56 on page 67 to display the following screen. USG20(W)-VPN Series User’s Guide 71 Chapter 4 Quick Setup Wizards Figure 61 VPN for Configuration Provisioning Advanced Wizard: Scenario Settings Rule Name: Type the name used to identify this VPN connection (and VPN gateway). You may use 1-31 alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Application Scenario: Only the Remote Access (Server Role) is allowed in this wizard. It allows incoming connections from the USG IPSec VPN Client. Click Next to continue the wizard. 4.4.6 VPN Settings for Configuration Provisioning Advanced Wizard - Phase 1 Settings There are two phases to every IKE (Internet Key Exchange) negotiation – phase 1 (Authentication) and phase 2 (Key Exchange). A phase 1 exchange establishes an IKE SA (Security Association). USG20(W)-VPN Series User’s Guide 72 Chapter 4 Quick Setup Wizards Figure 62 VPN for Configuration Provisioning Advanced Wizard: Phase 1 Settings • Secure Gateway: Any displays in this field because it is not configurable in this wizard. It allows incoming connections from the USG IPSec VPN Client. • My Address (interface): Select an interface from the drop-down list box to use on your USG. • Negotiation Mode:This displays Main or Aggressive: • Main encrypts the USG’s and remote IPSec router’s identities but takes more time to establish the IKE SA • Aggressive is faster but does not encrypt the identities. The USG and the remote IPSec router must use the same negotiation mode. Multiple SAs connecting through a secure gateway must have the same negotiation mode. • Encryption Algorithm: 3DES and AES use encryption. The longer the key, the higher the security (this may affect throughput). Both sender and receiver must know the same secret key, which can be used to encrypt and decrypt the message or to generate and verify a message authentication code. The DES encryption algorithm uses a 56-bit key. Triple DES (3DES) is a variation on DES that uses a 168-bit key. As a result, 3DES is more secure than DES. It also requires more processing power, resulting in increased latency and decreased throughput. AES128 uses a 128-bit key and is faster than 3DES. AES192 uses a 192-bit key and AES256 uses a 256-bit key. • Authentication Algorithm: MD5 (Message Digest 5) and SHA (Secure Hash Algorithm) are hash algorithms used to authenticate packet data. MD5 gives minimal security. SHA1 gives higher security and SHA256 gives the highest security. The stronger the algorithm, the slower it is. • Key Group: DH5 is more secure than DH1 or DH2 (although it may affect throughput). DH1 (default) refers to Diffie-Hellman Group 1 a 768 bit random number. DH2 refers to Diffie-Hellman Group 2 a 1024 bit (1Kb) random number. DH5 refers to Diffie-Hellman Group 5 a 1536 bit random number. • SA Life Time: Set how often the USG renegotiates the IKE SA. A short SA life time increases security, but renegotiation temporarily disconnects the VPN tunnel. • Authentication Method: Select Pre-Shared Key to use a password or Certificate to use one of the USG’s certificates. USG20(W)-VPN Series User’s Guide 73 Chapter 4 Quick Setup Wizards 4.4.7 VPN Settings for Configuration Provisioning Advanced Wizard - Phase Phase 2 in an IKE uses the SA that was established in phase 1 to negotiate SAs for IPSec. Figure 63 VPN for Configuration Provisioning Advanced Wizard: Phase 2 Settings • Active Protocol: ESP is compatible with NAT. AH is not available in this wizard. • Encapsulation: Tunnel is compatible with NAT, Transport is not. • Encryption Algorithm: 3DES and AES use encryption. The longer the AES key, the higher the security (this may affect throughput). Null uses no encryption. • Authentication Algorithm: MD5 (Message Digest 5) and SHA (Secure Hash Algorithm) are hash algorithms used to authenticate packet data. MD5 gives minimal security. SHA1 gives higher security and SHA256 gives the highest security. The stronger the algorithm, the slower it is. • SA Life Time: Set how often the USG renegotiates the IKE SA. A short SA life time increases security, but renegotiation temporarily disconnects the VPN tunnel. • Perfect Forward Secrecy (PFS): Disabling PFS allows faster IPSec setup, but is less secure. Select DH1, DH2 or DH5 to enable PFS. DH5 is more secure than DH1 or DH2 (although it may affect throughput). DH1 refers to Diffie-Hellman Group 1 a 768 bit random number. DH2 refers to Diffie-Hellman Group 2 a 1024 bit (1Kb) random number. DH5 refers to Diffie-Hellman Group 5 a 1536 bit random number (more secure, yet slower). • Local Policy (IP/Mask): Type the IP address of a computer on your network. You can also specify a subnet. This must match the remote IP address configured on the remote IPSec device. • Remote Policy (IP/Mask): Any displays in this field because it is not configurable in this wizard. • Nailed-Up: This displays for the site-to-site and remote access client role scenarios. Select this to have the USG automatically renegotiate the IPSec SA when the SA life time expires. 4.4.8 VPN Settings for Configuration Provisioning Advanced Wizard Summary This is a read-only summary of the VPN tunnel settings. USG20(W)-VPN Series User’s Guide 74 Chapter 4 Quick Setup Wizards Figure 64 VPN for Configuration Provisioning Advanced Wizard: Summary Summary • Rule Name: Identifies the VPN connection (and the VPN gateway). • Secure Gateway: Any displays in this field because it is not configurable in this wizard. It allows incoming connections from the USG IPSec VPN Client. • Pre-Shared Key: VPN tunnel password. • Local Policy: IP address and subnet mask of the computers on the network behind your USG that can use the tunnel. • Remote Policy: Any displays in this field because it is not configurable in this wizard. Phase 1 • Negotiation Mode: This displays Main or Aggressive: • Main encrypts the USG’s and remote IPSec router’s identities but takes more time to establish the IKE SA • Aggressive is faster but does not encrypt the identities. The USG and the remote IPSec router must use the same negotiation mode. Multiple SAs connecting through a secure gateway must have the same negotiation mode. USG20(W)-VPN Series User’s Guide 75 Chapter 4 Quick Setup Wizards • Encryption Algorithm: This displays the encryption method used. The longer the key, the higher the security, the lower the throughput (possibly). • DES uses a 56-bit key. • 3DES uses a 168-bit key. • AES128 uses a 128-bit key • AES192 uses a 192-bit key • AES256 uses a 256-bit key. • Authentication Algorithm: This displays the authentication algorithm used. The stronger the algorithm, the slower it is. • MD5 gives minimal security. • SHA1 gives higher security • SHA256 gives the highest security. • Key Group: This displays the Diffie-Hellman (DH) key group used. DH5 is more secure than DH1 or DH2 (although it may affect throughput). • DH1 uses a 768 bit random number. • DH2 uses a 1024 bit (1Kb) random number. • DH5 uses a 1536 bit random number. Phase 2 • Active Protocol: This displays ESP (compatible with NAT) or AH. • Encapsulation: This displays Tunnel (compatible with NAT) or Transport. • Encryption Algorithm: This displays the encryption method used. The longer the key, the higher the security, the lower the throughput (possibly). • DES uses a 56-bit key. • 3DES uses a 168-bit key. • AES128 uses a 128-bit key • AES192 uses a 192-bit key • AES256 uses a 256-bit key. • Null uses no encryption. • Authentication Algorithm: This displays the authentication algorithm used. The stronger the algorithm, the slower it is. • MD5 gives minimal security. • SHA1 gives higher security • SHA256 gives the highest security.. The Configuration for Secure Gateway displays the configuration that the USG IPSec VPN Client will get from the USG. Click Save to save the VPN rule. 4.4.9 VPN Settings for Configuration Provisioning Advanced Wizard- Finish Now the rule is configured on the USG. The Phase 1 rule settings appear in the VPN > IPSec VPN > VPN Gateway screen and the Phase 2 rule settings appear in the VPN > IPSec VPN > VPN USG20(W)-VPN Series User’s Guide 76 Chapter 4 Quick Setup Wizards Connection screen. Enter the IP address of the USG in the USG IPSec VPN Client to get all these VPN settings automatically from the USG. Figure 65 VPN for Configuration Provisioning Advanced Wizard: Finish Click Close to exit the wizard. 4.5 VPN Settings for L2TP VPN Settings Wizard Use VPN Settings for L2TP VPN Settings to set up an L2TP VPN rule. Click Configuration > Quick Setup > VPN Settings and select VPN Settings for L2TP VPN Settings to see the following screen. USG20(W)-VPN Series User’s Guide 77 Chapter 4 Quick Setup Wizards Figure 66 VPN Settings for L2TP VPN Settings Wizard: L2TP VPN Settings Click Next to continue the wizard. 4.5.1 L2TP VPN Settings Figure 67 VPN Settings for L2TP VPN Settings Wizard: L2TP VPN Settings • Rule Name: Type the name used to identify this L2TP VPN connection (and L2TP VPN gateway). You may use 1-31 alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. USG20(W)-VPN Series User’s Guide 78 Chapter 4 Quick Setup Wizards • My Address (interface): Select one of the interfaces from the pull down menu to apply the L2TP VPN rule. • Pre-Shared Key: Type the password. Both ends of the VPN tunnel must use the same password. Use 8 to 31 case-sensitive ASCII characters or 8 to 31 pairs of hexadecimal (“0-9”, “A-F”) characters. Proceed a hexadecimal key with “0x”. You will receive a PYLD_MALFORMED (payload malformed) packet if the same pre-shared key is not used on both ends. Click Next to continue the wizard. 4.5.2 L2TP VPN Settings Figure 68 VPN Settings for L2TP VPN Settings Wizard: L2TP VPN Settings • IP Address Pool: Select Range or Subnet from the pull down menu. This IP address pool is used to assign to the L2TP VPN clients. • Starting IP Address: Enter the starting IP address in the field. • End IP Address: Enter the ending IP address in the field. • First DNS Server (Optional): Enter the first DNS server IP address in the field. Leave the filed as 0.0.0.0 if you do not want to configure DNS servers. If you do not configure a DNS server you must know the IP address of a machine in order to access it. • Second DNS Server (Optional):Enter the second DNS server IP address in the field. Leave the filed as 0.0.0.0 if you do not want to configure DNS servers. If you do not configure a DNS server you must know the IP address of a machine in order to access it. • Allow L2TP traffic Through WAN: Select this check box to allow traffic from L2TP clients to go to the Internet. Click Next to continue the wizard. USG20(W)-VPN Series User’s Guide 79 Chapter 4 Quick Setup Wizards Note: DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa. The DNS server is extremely important because without it, you must know the IP address of a computer before you can access it. The USG uses a system DNS server (in the order you specify here) to resolve domain names for VPN, DDNS and the time server. 4.5.3 VPN Settings for L2TP VPN Setting Wizard - Summary This is a read-only summary of the L2TP VPN settings. Figure 69 VPN Settings for L2TP VPN Settings Advanced Settings Wizard: Summary Summary • Rule Name: Identifies the L2TP VPN connection (and the L2TP VPN gateway). • Secure Gateway: “Any” displays in this field because it is not configurable in this wizard. It allows incoming connections from the L2TP VPN Client. • Pre-Shared Key: L2TP VPN tunnel password. • My Address (Interface): This displays the interface to use on your USG for the L2TP tunnel. • IP Address Pool: This displays the IP address pool used to assign to the L2TP VPN clients. Click Save to complete the L2TP VPN Setting and the following screen will show. USG20(W)-VPN Series User’s Guide 80 Chapter 4 Quick Setup Wizards 4.5.4 VPN Settings for L2TP VPN Setting Wizard Completed Figure 70 VPN Settings for L2TP VPN Settings Wizard: Finish Now the rule is configured on the USG. The L2TP VPN rule settings appear in the VPN > L2TP VPN screen and also in the VPN > IPSec VPN > VPN Connection and VPN Gateway screen. USG20(W)-VPN Series User’s Guide 81 C HAPTER Dashboard 5.1 Overview Use the Dashboard screens to check status information about the USG. 5.1.1 What You Can Do in this Chapter Use the main Dashboard screen to see the USG’s general device information, system status, system resource usage, licensed service status, and interface status. You can also display other status screens for more information. Use the Dashboard screens to view the following. • Device Information Screen on page 84 • System Status Screen on page 85 • VPN Status Screen on page 86 • DHCP Table Screen on page 87 • Number of Login Users Screen on page 88 • System Resources Screen on page 89 • CPU Usage Screen on page 90 • Memory Usage Screen on page 91 • Active Session Screen on page 92 • Extension Slot Screen on page 93 • Interface Status Summary Screen on page 93 • Secured Service Status Screen on page 94 • Content Filter Statistics Screen on page 95 • Top 5 IPv4/IPv6 Security Policy Rules that Blocked Traffic Screen on page 96 • Top 5 IPv4/IPv6 Security Policy Rules that Blocked Traffic Screen on page 96 • Top 5 IPv4/IPv6 Security Policy Rules that Blocked Traffic Screen on page 96 • The Latest Alert Logs Screen on page 96 5.2 Main Dashboard Screen The Dashboard screen displays when you log into the USG or click Dashboard in the navigation panel. The dashboard displays general device information, system status, system resource usage, licensed service status, and interface status in widgets that you can re-arrange to suit your needs. You can also collapse, refresh, and close individual widgets. USG20(W)-VPN Series User’s Guide 82 Chapter 5 Dashboard Click on the icon to go to the OneSecurity.com website where there is guidance on configuration walkthroughs, troubleshooting, and other information. Figure 71 Dashboard The following table describes the labels in this screen. Table 16 Dashboard LABEL DESCRIPTION Widget Settings (A) Use this link to open or close widgets by selecting/clearing the associated checkbox. expand / collapse widget (B) Click this to collapse a widget. It then becomes a down arrow. Click it again to enlarge the widget again. Refresh time setting (C) Set the interval for refreshing the information displayed in the widget. Refresh Now (D) Click this to update the widget’s information immediately. Close widget (E) Click this to close the widget. Use Widget Setting to re-open it. Virtual Device Rear Panel Click this to view details about the USG’s rear panel. Hover your cursor over a connected interface or slot to display status details. USG20(W)-VPN Series User’s Guide 83 Chapter 5 Dashboard Table 16 Dashboard (continued) LABEL Front Panel DESCRIPTION Click this to view details about the status of the USG’s front panel LEDs and connections. See Section 3.1.1 on page 44 for LED descriptions. An unconnected interface or slot appears grayed out. The following front and rear panel labels display when you hover your cursor over a connected interface or slot. Name This field displays the name of each interface. Status This field displays the current status of each interface or device installed in a slot. The possible values depend on what type of interface it is. Inactive - The Ethernet interface is disabled. Down - The Ethernet interface does not have any physical ports associated with it or the Ethernet interface is enabled but not connected. Speed / Duplex - The Ethernet interface is enabled and connected. This field displays the port speed and duplex setting (Full or Half). The status for a WLAN card is none. For cellular (mobile broadband) interfaces, see Section 9.5 on page 173 for the status that can appear. For the auxiliary interface: Inactive - The auxiliary interface is disabled. Connected - The auxiliary interface is enabled and connected. Disconnected - The auxiliary interface is not connected. Zone This field displays the zone to which the interface is currently assigned. IP Address/ Mask This field displays the current IP address and subnet mask assigned to the interface. If the interface is a member of an active virtual router, this field displays the IP address it is currently using. This is either the static IP address of the interface (if it is the master) or the management IP address (if it is a backup). 5.2.1 Device Information Screen The Device Information screen displays USG’s system and model name, serial number, MAC address and firmware version shown in the below screen. Figure 72 Dashboard > Device Information (Example) USG20(W)-VPN Series User’s Guide 84 Chapter 5 Dashboard This tabel describes the fields in the above screen. Table 17 Dashboard > Device Information LABEL DESCRIPTION Device Information This identifies a device installed in one of the USG’s extension slots, the Security Extension Module slot, or USB ports. For an installed SEM (Security Extension Module) card, this field displays what kind of SEM card is installed. SEM-VPN - The VPN accelerator. The SEM-VPN provides 500 Mbps VPN throughput, 2,000 IPSec VPN tunnels, and 750 SSL VPN users. SEM-DUAL - accelerator for both VPN and UTM. The SEM-DUAL provides the benefits of the SEM-VPN. System Name This field displays the name used to identify the USG on any network. Click the link and open the Host Name screen where you can edit and make changes to the system and domain name. Model Name This field displays the model name of this USG. Serial Number This field displays the serial number of this USG. The serial number is used for device tracking and control. MAC Address Range This field displays the MAC addresses used by the USG. Each physical port has one MAC address. The first MAC address is assigned to physical port 1, the second MAC address is assigned to physical port 2, and so on. Firmware Version This field displays the version number and date of the firmware the USG is currently running. Click the link to open the Firmware Package screen where you can upload firmware. 5.2.2 System Status Screen Figure 73 Dashboard > System Status (Example) This table describes the fields in the above screen. Table 18 Dashboard > System Status LABEL DESCRIPTION System Uptime This field displays how long the USG has been running since it last restarted or was turned on. Current Date/Time This field displays the current date and time in the USG. The format is yyyy-mmdd hh:mm:ss. Click on the link to see the Date/Time screen where you can make edits and changes to the date, time and time zone information. VPN Status Click on the link to look at the VPN tunnels that are currently established. See Section 5.2.3 on page 86. Click on the VPN icon to go to the ZyXEL VPN Client product page at the ZyXEL website. SSL VPN Status The first number is the actual number of VPN tunnels up and the second number is the maximum number of SSL VPN tunnels allowed. USG20(W)-VPN Series User’s Guide 85 Chapter 5 Dashboard Table 18 Dashboard > System Status LABEL DESCRIPTION DHCP Table Click this to look at the IP addresses currently assigned to the USG’s DHCP clients and the IP addresses reserved for specific MAC addresses. See Section 5.2.4 on page 87. Current Login User This field displays the user name used to log in to the current session, the amount of reauthentication time remaining, and the amount of lease time remaining. Number of Login Users This field displays the number of users currently logged in to the USG. Click the icon to pop-open a list of the users who are currently logged in to the USG. Boot Status This field displays details about the USG’s startup state. OK - The USG started up successfully. Firmware update OK - A firmware update was successful. Problematic configuration after firmware update - The application of the configuration failed after a firmware upgrade. System default configuration - The USG successfully applied the system default configuration. This occurs when the USG starts for the first time or you intentionally reset the USG to the system default settings. Fallback to lastgood configuration - The USG was unable to apply the startup-config.conf configuration file and fell back to the lastgood.conf configuration file. Fallback to system default configuration - The USG was unable to apply the lastgood.conf configuration file and fell back to the system default configuration file (system-default.conf). Booting in progress - The USG is still applying the system configuration. 5.2.3 VPN Status Screen Click on VPN Status link to look at the VPN tunnels that are currently established. The following screen will show. Figure 74 Dashboard > System Status > VPN Status This table describes the fields in the above screen. USG20(W)-VPN Series User’s Guide 86 Chapter 5 Dashboard Table 19 Dashboard > System Status > VPN Status LABLE DESCRIPTION This field is a sequential value, and it is not associated with a specific SA. Name This field displays the name of the IPSec SA. Encapsulation This field displays how the IPSec SA is encapsulated. Algorithm This field displays the encryption and authentication algorithms used in the SA. Refresh Interval Select how often you want this window to be updated automatically. Refresh Click this to update the information in the window right away. ZyXEL VPN Client Product Page 5.2.4 DHCP Table Screen Click on the DHCP Table link to look at the IP addresses currently assigned to DHCP clients and the IP addresses reserved for specific MAC addresses. The following screen will show. USG20(W)-VPN Series User’s Guide 87 Chapter 5 Dashboard Figure 75 Dashboard > System Status > DHCP Table This table describes the fields in the above screen. Table 20 Dashboard > System Status > DHCP Table LABEL DESCRIPTION This field is a sequential value, and it is not associated with a specific entry. Interface This field identifies the interface that assigned an IP address to a DHCP client. IP Address This field displays the IP address currently assigned to a DHCP client or reserved for a specific MAC address. Click the column’s heading cell to sort the table entries by IP address. Click the heading cell again to reverse the sort order. Host Name This field displays the name used to identify this device on the network (the computer name). The USG learns these from the DHCP client requests. “None” shows here for a static DHCP entry. MAC Address This field displays the MAC address to which the IP address is currently assigned or for which the IP address is reserved. Click the column’s heading cell to sort the table entries by MAC address. Click the heading cell again to reverse the sort order. Description For a static DHCP entry, the host name or the description you configured shows here. This field is blank for dynamic DHCP entries. Reserve If this field is selected, this entry is a static DHCP entry. The IP address is reserved for the MAC address. If this field is clear, this entry is a dynamic DHCP entry. The IP address is assigned to a DHCP client. To create a static DHCP entry using an existing dynamic DHCP entry, select this field, and then click Apply. To remove a static DHCP entry, clear this field, and then click Apply. 5.2.5 Number of Login Users Screen Click the Number of Login Users link to see the following screen. USG20(W)-VPN Series User’s Guide 88 Chapter 5 Dashboard Figure 76 Dashboard > System Status > Number of Login Users This table describes the fields in the above screen. Table 21 Dashboard > System Status > Number of Login Users LABEL DESCRIPTION This field is a sequential value and is not associated with any entry. User ID This field displays the user name of each user who is currently logged in to the USG. Reauth Lease T. This field displays the amount of reauthentication time remaining and the amount of lease time remaining for each user. Type This field displays the way the user logged in to the USG. IP address This field displays the IP address of the computer used to log in to the USG. User Info This field displays the types of user accounts the USG uses. If the user type is ext-user (external user), this field will show its external-group information when you move your mouse over it. If the external user matches two external-group objects, both external-group object names will be shown. Force Logout Click this icon to end a user’s session. 5.2.6 System Resources Screen Hover your mouse over an item and click the arrow on the right to see more details on that resource. USG20(W)-VPN Series User’s Guide 89 Chapter 5 Dashboard Figure 77 Dashboard > System Resources This table describes the fields in the above screen. Table 22 .Dashboard > System Resources LABEL DESCRIPTION CPU Usage This field displays what percentage of the USG’s processing capability is currently being used. Hover your cursor over this field to display the Show CPU Usage icon that takes you to a chart of the USG’s recent CPU usage. Memory Usage This field displays what percentage of the USG’s RAM is currently being used. Hover your cursor over this field to display the Show Memory Usage icon that takes you to a chart of the USG’s recent memory usage. Flash Usage This field displays what percentage of the USG’s onboard flash memory is currently being used. USB Storage Usage This field shows how much storage in the USB device connected to the USG is in use. Active Sessions This field shows how many sessions, established and non-established, that pass through/from/to/within the USG. Hover your cursor over this field to display icons. Click the Detail icon to go to the Session Monitor screen to see details about the active sessions. Click the Show Active Sessions icon to display a chart of USG’s recent session usage. 5.2.7 CPU Usage Screen Use the below screen to look at a chart of the USG’s recent CPU usage. To access this screen, click CPU Usage in the dashboard. USG20(W)-VPN Series User’s Guide 90 Chapter 5 Dashboard Figure 78 Dashboard > CPU Usage screen This table describes the fields in the above screen. Table 23 Dashboard > CPU Usage LABEL DESCRIPTION The y-axis represents the percentage of CPU usage. The x-axis shows the time period over which the CPU usage occurred Refresh Interval Enter how often you want this window to be automatically updated. Refresh Now Click this to update the information in the window right away. 5.2.8 Memory Usage Screen Use the below screen to look at a chart of the USG’s recent memory (RAM) usage. To access this screen, click Memory Usage in the dashboard. Figure 79 Dashboard > Memory Usage screen USG20(W)-VPN Series User’s Guide 91 Chapter 5 Dashboard This table describes the fields in the above screen. Table 24 Dashboard > Memory Usage screen. LABEL DESCRIPTION The y-axis represents the percentage of RAM usage. The x-axis shows the time period over which the RAM usage occurred Refresh Interval Enter how often you want this window to be automatically updated. Refresh Now Click this to update the information in the window right away. 5.2.9 Active Session Screen To see the details of Active Sessions, move the cursor to the far right of the Active Sessions box and the Detail and the Show Active Session icons appear. Click the Show Active Session icon. Figure 80 Dashboard > Active Sessions > Show Active Session This table describes the fields in the above screen. Table 25 Dashboard > Active Sessions > Show Active Session Sessions The y-axis represents the number of session. Refresh Interval Enter how often you want this window to be automatically updated. Refresh Now Click this to update the information in the window right away. The x-axis shows the time period over which the session usage occurred USG20(W)-VPN Series User’s Guide 92 Chapter 5 Dashboard 5.2.10 Extension Slot Screen Figure 81 Dashboard > Extension Slot This table describes the fields in the above screen. Table 26 Dashboard > Extension Slot LABEL DESCRIPTION Extension Slot This field displays the name of each extension slot. Device This field displays the name of the device connected to the extension slot (or none if no device is detected). For an installed SEM (Security Extension Module) card, this field displays what kind of SEM card is installed. SEM-VPN - The VPN accelerator. The SEM-VPN provides 500 Mbps VPN throughput, 2,000 IPSec VPN tunnels, and 750 SSL VPN users. SEM-DUAL - accelerator for both VPN and UTM. The SEM-DUAL provides the benefits of the SEM-VPN. USB Flash Drive - Indicates a connected USB storage device and the drive’s storage capacity. Status The status for an installed WLAN card is none. For cellular (mobile broadband) interfaces, see Section 6.10 on page 112 for the status that can appear. For an installed SEM (Security Extension Module) card, this field displays one of the following: Active - The SEM card is working properly. Ready to activate - The SEM was inserted while the USG was operating. Restart the USG to use the SEM. Driver load failed - An error occurred during the USG’s attempt to activate the SEM card. Make sure the SEM is installed properly and the thumbscrews are tightened. If this status still displays, contact your vendor. Ready - A USB storage device connected to the USG is ready for the USG to use. Unused - The USG is unable to mount a USB storage device connected to the USG. 5.2.11 Interface Status Summary Screen Interfaces per USG model vary. Figure 82 Dashboard > Interface Status Summary USG20(W)-VPN Series User’s Guide 93 Chapter 5 Dashboard This table describes the fields in the above screen. Table 27 Dashboard > Interface Status Summary LABEL DESCRIPTION Name This field displays the name of each interface. Status This field displays the current status of each interface. The possible values depend on what type of interface it is. For Ethernet interfaces: Inactive - The Ethernet interface is disabled. Down - The Ethernet interface does not have any physical ports associated with it or the Ethernet interface is enabled but not connected. Speed / Duplex - The Ethernet interface is enabled and connected. This field displays the port speed and duplex setting (Full or Half). For cellular (mobile broadband) interfaces, see Section 6.10 on page 112 for the status that can appear. For the auxiliary interface: Inactive - The auxiliary interface is disabled. Connected - The auxiliary interface is enabled and connected. Disconnected - The auxiliary interface is not connected. For PPP interfaces: Connected - The PPP interface is connected. Disconnected - The PPP interface is not connected. If the PPP interface is disabled, it does not appear in the list. For WLAN interfaces: Up - The WLAN interface is enabled. Down - The WLAN interface is disabled. Zone This field displays the zone to which the interface is currently assigned. IP Addr/Netmask This field displays the current IP address and subnet mask assigned to the interface. If the IP address is 0.0.0.0/0.0.0.0, the interface is disabled or did not receive an IP address and subnet mask via DHCP. If this interface is a member of an active virtual router, this field displays the IP address it is currently using. This is either the static IP address of the interface (if it is the master) or the management IP address (if it is a backup). IP Assignment This field displays the interface’s IP assignment. It will show DHCP or Static. Action Use this field to get or to update the IP address for the interface. Click Renew to send a new DHCP request to a DHCP server. Click the Connect icon to have the USG try to connect a PPPoE/PPTP interface. If the interface cannot use one of these ways to get or to update its IP address, this field displays n/a. Click the Disconnect icon to stop a PPPoE/PPTP connection. 5.2.12 Secured Service Status Screen This part shows what security services are available and enabled. USG20(W)-VPN Series User’s Guide 94 Chapter 5 Dashboard Figure 83 Dashboard > Secured Service Status This table describes the fields in the above screen. Table 28 Dashboard > Secured Service Status LABEL DESCRIPTION This field is a sequential value, and it is not associated with a specific status. Status This field displays the status of the USG’s security services. It will show these types of status: Licensed, Unlicensed, Disabled or Enabled. Name This field displays the name of security services supported by this model. Status will show Licensed for Premium Service after you register the device at myZyXEL.com. You can then activate security service licenses such as AntiSpam, Content Filter and so on. Version This field displays the version number of the services. Expiration This field displays the number of days remaining before the license expires. 5.2.13 Content Filter Statistics Screen Configure Configuration > UTM Profile > Content Filter and then view results here. Figure 84 Dashboard > Content Filter Statistics This table describes the fields in the above screen. Table 29 Dashboard > Content Filter Statistics LABEL DESCRIPTION Web Request Statistics Total Web Pages Inspected This is the number of web pages the USG has checked to see whether they belong to the categories you selected in the content filter screen. USG20(W)-VPN Series User’s Guide 95 Chapter 5 Dashboard Table 29 Dashboard > Content Filter Statistics LABEL DESCRIPTION Blocked This is the number of web pages that the USG blocked access. Warned This is the number of web pages for which the USG has displayed a warning message to the access requesters. Passed This is the number of web pages that the USG allowed access. Category Hit Summary Security Threat (unsafe) This is the number of requested web pages that belong to the unsafe categories you have selected in the content filter screen. Managed Web pages This is the number of requested web pages that belong to the managed categories you have selected in the content filter screen. 5.2.14 Top 5 IPv4/IPv6 Security Policy Rules that Blocked Traffic Screen Figure 85 Dashboard > Top 5 IPv4/IPv6 Security Policy Rules that Blocked Traffic This table describes the fields in the above screen. Table 30 Dashboard > Top 5 IPv4/IPv6 Security Policy Rules that Blocked Traffic LABEL DESCRIPTION This is the entry’s rank in the list of the most commonly triggered security policies. From This shows the zone packets came from that the triggered security policy. To This shows the zone packets went to that the triggered security policy. Description This field displays the descriptive name (if any) of the triggered security policy. Hits This field displays how many times the security policy was triggered. 5.2.15 The Latest Alert Logs Screen Figure 86 Dashboard > The Latest Alert Logs USG20(W)-VPN Series User’s Guide 96 Chapter 5 Dashboard This table describes the fields in the above screen. Table 31 Dashboard > The Latest Alert Logs LABEL DESCRIPTION This is the entry’s rank in the list of alert logs. Time This field displays the date and time the log was created. Priority This field displays the severity of the log. Category This field displays the type of log generated. Message This field displays the actual log message. Source This field displays the source address (if any) in the packet that generated the log. Destination This field displays the destination address (if any) in the packet that generated the log. Source Interface This field displays the incoming interface of the packet that generated the log. USG20(W)-VPN Series User’s Guide 97 P ART II Technical Reference 98 99 C HAPTER Monitor 6.1 Overview Use the Monitor screens to check status and statistics information. 6.1.1 What You Can Do in this Chapter Use the Monitor screens for the following. • Use the System Status > Port Statistics screen (see Section 6.2 on page 101) to look at packet statistics for each physical port. • Use the System Status > Port Statistics > Graph View screen (see Section 6.2 on page 101) to look at a line graph of packet statistics for each physical port. • Use the System Status > Interface Status screen (Section 6.3 on page 103) to see all of the USG’s interfaces and their packet statistics. • Use the System Status > Traffic Statistics screen (see Section 6.4 on page 105) to start or stop data collection and view statistics. • Use the System Status > Session Monitor screen (see Section 6.5 on page 108) to view sessions by user or service. • Use the System Status > IGMP Statistics screen (see Section 6.6 on page 109) to view multicasting details. • Use the System Status > DDNS Status screen (see Section 6.7 on page 110) to view the status of the USG’s DDNS domain names. • Use the System Status > IP/MAC Binding screen (Section 6.8 on page 111) to view a list of devices that have received an IP address from USG interfaces with IP/MAC binding enabled. • Use the System Status > Login Users screen (Section 6.9 on page 111) to look at a list of the users currently logged into the USG. • Use the System Status > Cellular Status screen (Section 6.10 on page 112) to check your mobile broadband connection status. • Use the System Status > UPnP Port Status screen (see Section 6.11 on page 114) to look at a list of the NAT port mapping rules that UPnP creates on the USG. • Use the System Status > USB Storage screen (Section 6.12 on page 115) to view information about a connected USB storage device. • Use the System Status > Ethernet Neighbor screen (Section 6.13 on page 116) to view and manage the USG’s neighboring devices via Layer Link Discovery Protocol (LLDP). • Use the Wireless > AP Information screen (Section 6.14.1 on page 117) to view information on connected APs. • Use the Wireless > Station Info screen (Section 6.14.3 on page 120) to view information on connected wireless stations. • Use the Wireless > Detected Device screen (Section 6.14.3 on page 120) to view information about suspected rogue APs. USG20(W)-VPN Series User’s Guide 100 Chapter 6 Monitor • Use the VPN Monitor > IPSec screen (Section 6.15 on page 122) to display and manage active IPSec SAs. • Use the VPN Monitor > SSL screen (see Section 6.16 on page 123) to list the users currently logged into the VPN SSL client portal. You can also log out individual users and delete related session information. • Use the VPN Monitor > L2TP over IPSec screen (see Section 6.17 on page 124) to display and manage the USG’s connected L2TP VPN sessions. • Use the UTM Statistics > Content Filter screen (Section 6.18 on page 125) to start or stop data collection and view content filter statistics. • Use the UTM Statistics > Anti-Spam screen (Section 6.19 on page 127) to start or stop data collection and view spam statistics. • Use the UTM Statistics > Anti-Spam > Status screen (Section 6.19.2 on page 129) to see how many mail sessions the USG is currently checking and DNSBL statistics. • Use the Log screens (Section 6.20 on page 130) to view the USG’s current log messages. You can change the way the log is displayed, you can e-mail the log, and you can also clear the log in this screen. 6.2 The Port Statistics Screen Use this screen to look at packet statistics for each Gigabit Ethernet port. To access this screen, click Monitor > System Status > Port Statistics. Figure 87 Monitor > System Status > Port Statistics The following table describes the labels in this screen. Table 32 Monitor > System Status > Port Statistics LABEL DESCRIPTION Poll Interval Enter how often you want this window to be updated automatically, and click Set Interval. Set Interval Click this to set the Poll Interval the screen uses. Stop Click this to stop the window from updating automatically. You can start it again by setting the Poll Interval and clicking Set Interval. Switch to Graphic View Click this to display the port statistics as a line graph. USG20(W)-VPN Series User’s Guide 101 Chapter 6 Monitor Table 32 Monitor > System Status > Port Statistics (continued) LABEL DESCRIPTION This field is a sequential value, and it is not associated with a specific port. Port This field displays the physical port number. Status This field displays the current status of the physical port. Down - The physical port is not connected. Speed / Duplex - The physical port is connected. This field displays the port speed and duplex setting (Full or Half). TxPkts This field displays the number of packets transmitted from the USG on the physical port since it was last connected. RxPkts This field displays the number of packets received by the USG on the physical port since it was last connected. Collisions This field displays the number of collisions on the physical port since it was last connected. Tx B/s This field displays the transmission speed, in bytes per second, on the physical port in the one-second interval before the screen updated. Rx B/s This field displays the reception speed, in bytes per second, on the physical port in the one-second interval before the screen updated. Up Time This field displays how long the physical port has been connected. System Up Time This field displays how long the USG has been running since it last restarted or was turned on. 6.2.1 The Port Statistics Graph Screen Use this screen to look at a line graph of packet statistics for each physical port. To access this screen, click Port Statistics in the Status screen and then the Switch to Graphic View Button. Figure 88 Monitor > System Status > Port Statistics > Switch to Graphic View USG20(W)-VPN Series User’s Guide 102 Chapter 6 Monitor The following table describes the labels in this screen. Table 33 Monitor > System Status > Port Statistics > Switch to Graphic View LABEL DESCRIPTION Refresh Interval Enter how often you want this window to be automatically updated. Refresh Now Click this to update the information in the window right away. Port Selection Select the number of the physical port for which you want to display graphics. Switch to Grid View Click this to display the port statistics as a table. bps The y-axis represents the speed of transmission or reception. time The x-axis shows the time period over which the transmission or reception occurred TX This line represents traffic transmitted from the USG on the physical port since it was last connected. RX This line represents the traffic received by the USG on the physical port since it was last connected. Last Update This field displays the date and time the information in the window was last updated. System Up Time This field displays how long the USG has been running since it last restarted or was turned on. 6.3 Interface Status Screen This screen lists all of the USG’s interfaces and gives packet statistics for them. Click Monitor > System Status > Interface Status to access this screen. Figure 89 Monitor > System Status > Interface Status USG20(W)-VPN Series User’s Guide 103 Chapter 6 Monitor Each field is described in the following table. Table 34 Monitor > System Status > Interface Status LABEL DESCRIPTION Interface Status If an Ethernet interface does not have any physical ports associated with it, its entry is displayed in light gray text. Name This field displays the name of each interface. If there is an Expand icon (plus-sign) next to the name, click this to look at the status of virtual interfaces on top of this interface. Port This field displays the physical port number. Status This field displays the current status of each interface. The possible values depend on what type of interface it is. For Ethernet interfaces: • • • Inactive - The Ethernet interface is disabled. Down - The Ethernet interface does not have any physical ports associated with it or the Ethernet interface is enabled but not connected. Speed / Duplex - The Ethernet interface is enabled and connected. This field displays the port speed and duplex setting (Full or Half). For cellular (mobile broadband) interfaces, see Section 6.12 on page 115 the Web Help for the status that can appear. For the auxiliary interface: • • • Inactive - The auxiliary interface is disabled. Connected - The auxiliary interface is enabled and connected. Disconnected - The auxiliary interface is not connected. For virtual interfaces, this field always displays Up. If the virtual interface is disabled, it does not appear in the list. For VLAN and bridge interfaces, this field always displays Up. If the VLAN or bridge interface is disabled, it does not appear in the list. For PPP interfaces: • • Connected - The PPP interface is connected. Disconnected - The PPP interface is not connected. If the PPP interface is disabled, it does not appear in the list. For WLAN interfaces: • • Up - The WLAN interface is enabled. Down - The WLAN interface is disabled. Zone This field displays the zone to which the interface is assigned. IP Addr/Netmask This field displays the current IP address and subnet mask assigned to the interface. If the IP address and subnet mask are 0.0.0.0, the interface is disabled or did not receive an IP address and subnet mask via DHCP. If this interface is a member of an active virtual router, this field displays the IP address it is currently using. This is either the static IP address of the interface (if it is the master) or the management IP address (if it is a backup). IP Assignment This field displays how the interface gets its IP address. • • Services Static - This interface has a static IP address. DHCP Client - This interface gets its IP address from a DHCP server. This field lists which services the interface provides to the network. Examples include DHCP relay, DHCP server, DDNS, RIP, and OSPF. This field displays n/a if the interface does not provide any services to the network. USG20(W)-VPN Series User’s Guide 104 Chapter 6 Monitor Table 34 Monitor > System Status > Interface Status (continued) LABEL DESCRIPTION Action Use this field to get or to update the IP address for the interface. Click Renew to send a new DHCP request to a DHCP server. Click Connect to try to connect a PPPoE/PPTP interface. If the interface cannot use one of these ways to get or to update its IP address, this field displays n/a. Tunnel Interface Status This displays the details of the USG’s configured tunnel interfaces. Name This field displays the name of the interface. Status The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. Zone This field displays the zone to which the interface is assigned. IP Address This is the IP address of the interface. If the interface is active (and connected), the USG tunnels local traffic sent to this IP address to the Remote Gateway Address. My Address This is the interface or IP address uses to identify itself to the remote gateway. The USG uses this as the source for the packets it tunnels to the remote gateway. Remote Gateway Address This is the IP address or domain name of the remote gateway to which this interface tunnels traffic. Mode This field displays the tunnel mode that you are using. Interface Statistics This table provides packet statistics for each interface. Refresh Click this button to update the information in the screen. Name This field displays the name of each interface. If there is a Expand icon (plus-sign) next to the name, click this to look at the statistics for virtual interfaces on top of this interface. Status This field displays the current status of the interface. • • Down - The interface is not connected. Speed / Duplex - The interface is connected. This field displays the port speed and duplex setting (Full or Half). This field displays Connected and the accumulated connection time (hh:mm:ss) when the PPP interface is connected. TxPkts This field displays the number of packets transmitted from the USG on the interface since it was last connected. RxPkts This field displays the number of packets received by the USG on the interface since it was last connected. Tx B/s This field displays the transmission speed, in bytes per second, on the interface in the onesecond interval before the screen updated. Rx B/s This field displays the reception speed, in bytes per second, on the interface in the onesecond interval before the screen updated. 6.4 The Traffic Statistics Screen Click Monitor > System Status > Traffic Statistics to display the Traffic Statistics screen. This screen provides basic information about the following for example: • Most-visited Web sites and the number of times each one was visited. This count may not be accurate in some cases because the USG counts HTTP GET packets. Please see Table 35 on page 106 for more information. • Most-used protocols or service ports and the amount of traffic on each one USG20(W)-VPN Series User’s Guide 105 Chapter 6 Monitor • LAN IP with heaviest traffic and how much traffic has been sent to and from each one You use the Traffic Statistics screen to tell the USG when to start and when to stop collecting information for these reports. You cannot schedule data collection; you have to start and stop it manually in the Traffic Statistics screen. Figure 90 Monitor > System Status > Traffic Statistics There is a limit on the number of records shown in the report. Please see Table 36 on page 107 for more information. The following table describes the labels in this screen. Table 35 Monitor > System Status > Traffic Statistics LABEL DESCRIPTION Data Collection Collect Statistics Select this to have the USG collect data for the report. If the USG has already been collecting data, the collection period displays to the right. The progress is not tracked here real-time, but you can click the Refresh button to update it. Apply Click Apply to save your changes back to the USG. Reset Click Reset to return the screen to its last-saved settings. Statistics Interface Select the interface from which to collect information. You can collect information from Ethernet, VLAN, bridge and PPPoE/PPTP interfaces. Sort By Select the type of report to display. Choices are: • • • Host IP Address/User - displays the IP addresses or users with the most traffic and how much traffic has been sent to and from each one. Service/Port - displays the most-used protocols or service ports and the amount of traffic for each one. Web Site Hits - displays the most-visited Web sites and how many times each one has been visited. Each type of report has different information in the report (below). Refresh Flush Data Click this button to update the report display. Click this button to discard all of the screen’s statistics and update the report display. These fields are available when the Traffic Type is Host IP Address/User. This field is the rank of each record. The IP addresses and users are sorted by the amount of traffic. USG20(W)-VPN Series User’s Guide 106 Chapter 6 Monitor Table 35 Monitor > System Status > Traffic Statistics (continued) LABEL DESCRIPTION Direction This field indicates whether the IP address or user is sending or receiving traffic. • • Ingress- traffic is coming from the IP address or user to the USG. Egress - traffic is going from the USG to the IP address or user. IP Address/User This field displays the IP address or user in this record. The maximum number of IP addresses or users in this report is indicated in Table 36 on page 107. Amount This field displays how much traffic was sent or received from the indicated IP address or user. If the Direction is Ingress, a red bar is displayed; if the Direction is Egress, a blue bar is displayed. The unit of measure is bytes, Kbytes, Mbytes or Gbytes, depending on the amount of traffic for the particular IP address or user. The count starts over at zero if the number of bytes passes the byte count limit. See Table 36 on page 107. This field is the rank of each record. The protocols and service ports are sorted by the amount of traffic. Service/Port This field displays the service and port in this record. The maximum number of services and service ports in this report is indicated in Table 36 on page 107. These fields are available when the Traffic Type is Service/Port. Protocol This field indicates what protocol the service was using. Direction This field indicates whether the indicated protocol or service port is sending or receiving traffic. • • Amount Ingress - traffic is coming into the router through the interface Egress - traffic is going out from the router through the interface This field displays how much traffic was sent or received from the indicated service / port. If the Direction is Ingress, a red bar is displayed; if the Direction is Egress, a blue bar is displayed. The unit of measure is bytes, Kbytes, Mbytes, Gbytes, or Tbytes, depending on the amount of traffic for the particular protocol or service port. The count starts over at zero if the number of bytes passes the byte count limit. See Table 36 on page 107. These fields are available when the Traffic Type is Web Site Hits. This field is the rank of each record. The domain names are sorted by the number of hits. Web Site This field displays the domain names most often visited. The USG counts each page viewed on a Web site as another hit. The maximum number of domain names in this report is indicated in Table 36 on page 107. Hits This field displays how many hits the Web site received. The USG counts hits by counting HTTP GET packets. Many Web sites have HTTP GET references to other Web sites, and the USG counts these as hits too. The count starts over at zero if the number of hits passes the hit count limit. See Table 36 on page 107. The following table displays the maximum number of records shown in the report, the byte count limit, and the hit count limit. Table 36 Maximum Values for Reports LABEL DESCRIPTION Maximum Number of Records 20 Byte Count Limit 264 bytes; this is just less than 17 million terabytes. Hit Count Limit 264 hits; this is over 1.8 x 1019 hits. USG20(W)-VPN Series User’s Guide 107 Chapter 6 Monitor 6.5 The Session Monitor Screen The Session Monitor screen displays all established sessions that pass through the USG for debugging or statistical analysis. It is not possible to manage sessions in this screen. The following information is displayed. • User who started the session • Protocol or service port used • Source address • Destination address • Number of bytes received (so far) • Number of bytes transmitted (so far) • Duration (so far) You can look at all established sessions that passed through the USG by user, service, source IP address, or destination IP address. You can also filter the information by user, protocol / service or service group, source address, and/or destination address and view it by user. Click Monitor > System Status > Session Monitor to display the following screen. Figure 91 Monitor > System Status > Session Monitor The following table describes the labels in this screen. Table 37 Monitor > System Status > Session Monitor LABEL DESCRIPTION View Select how you want the established sessions that passed through the USG to be displayed. Choices are: • • • • • Refresh sessions by sessions by sessions by sessions by address all sessions Destination users - display all active sessions grouped by user services - display all active sessions grouped by service or protocol source IP - display all active sessions grouped by source IP address destination IP - display all active sessions grouped by destination IP - filter the active sessions by the User, Service, Source Address, and Address, and display each session individually (sorted by user). Click this button to update the information on the screen. The screen also refreshes automatically when you open and close the screen. The User, Service, Source Address, and Destination Address fields display if you view all sessions. Select your desired filter criteria and click the Refresh button to filter the list of sessions. User This field displays when View is set to all sessions. Type the user whose sessions you want to view. It is not possible to type part of the user name or use wildcards in this field; you must enter the whole user name. USG20(W)-VPN Series User’s Guide 108 Chapter 6 Monitor Table 37 Monitor > System Status > Session Monitor (continued) LABEL DESCRIPTION Service This field displays when View is set to all sessions. Select the service or service group whose sessions you want to view. The USG identifies the service by comparing the protocol and destination port of each packet to the protocol and port of each services that is defined. Source This field displays when View is set to all sessions. Type the source IP address whose sessions you want to view. You cannot include the source port. Destination This field displays when View is set to all sessions. Type the destination IP address whose sessions you want to view. You cannot include the destination port. Rx This field displays the amount of information received by the source in the active session. Tx This field displays the amount of information transmitted by the source in the active session. Duration This field displays the length of the active session in seconds. Active Sessions This is the total number of established sessions that passed through the USG which matched the search criteria. Show Select the number of active sessions displayed on each page. You can use the arrow keys on the right to change pages. User This field is the rank of each record. The names are sorted by the name of user in active session. You can use the pull down menu on the right to choose sorting method. This field displays the user in each active session. If you are looking at the sessions by users (or all sessions) report, click + or - to display or hide details about a user’s sessions. Service This field displays the protocol used in each active session. If you are looking at the sessions by services report, click + or - to display or hide details about a protocol’s sessions. Source This field displays the source IP address and port in each active session. If you are looking at the sessions by source IP report, click + or - to display or hide details about a source IP address’s sessions. Destination This field displays the destination IP address and port in each active session. If you are looking at the sessions by destination IP report, click + or - to display or hide details about a destination IP address’s sessions. Rx This field displays the amount of information received by the source in the active session. Tx This field displays the amount of information transmitted by the source in the active session. Duration This field displays the length of the active session in seconds. 6.6 IGMP Statistics The Internet Group Management Protocol (IGMP) Statistics is used by USG IP hosts to inform adjacent router about multicast group memberships. It can also be used for one-to-many networking applications such as online streaming video and gaming, distribution of company newsletters, updating address book of mobile computer users in the field allowing more efficient use of resources when supporting these types of applications. Click Monitor > System Status > IGMP Statistics to open the following screen. USG20(W)-VPN Series User’s Guide 109 Chapter 6 Monitor Figure 92 Monitor > System Status > IGMP Statistics The following table describes the labels in this screen. Table 38 Monitor > System Status > IGMP Statistics LABEL DESCRIPTION This field is a sequential value, and it is not associated with a specific I GMP Statistics. Group This field displays the group of devices in the IGMP. Source IP This field displays the host source IP information of the IGMP. Incoming Interface This field displays the incoming interface that’s connected on the IGMP. Packet Count This field displays the packet size of the data being transferred. Bytes This field displays the size of the data being transferred in Byes. Outgoing Interface This field displays the outgoing interface that’s connected on the IGMP. 6.7 The DDNS Status Screen The DDNS Status screen shows the status of the USG’s DDNS domain names. Click Monitor > System Status > DDNS Status to open the following screen. Figure 93 Monitor > System Status > DDNS Status The following table describes the labels in this screen. Table 39 Monitor > System Status > DDNS Status LABEL DESCRIPTION Update Click this to have the USG update the profile to the DDNS server. The USG attempts to resolve the IP address for the domain name. This field is a sequential value, and it is not associated with a specific DDNS server. Profile Name This field displays the descriptive profile name for this entry. Domain Name This field displays each domain name the USG can route. Effective IP This is the (resolved) IP address of the domain name. USG20(W)-VPN Series User’s Guide 110 Chapter 6 Monitor Table 39 Monitor > System Status > DDNS Status (continued) LABEL DESCRIPTION Last Update Status This shows whether the last attempt to resolve the IP address for the domain name was successful or not. Updating means the USG is currently attempting to resolve the IP address for the domain name. Last Update Time This shows when the last attempt to resolve the IP address for the domain name occurred (in year-month-day hour:minute:second format). 6.8 IP/MAC Binding Click Monitor > System Status > IP/MAC Binding to open the IP/MAC Binding screen. This screen lists the devices that have received an IP address from USG interfaces with IP/MAC binding enabled and have ever established a session with the USG. Devices that have never established a session with the USG do not display in the list. Figure 94 Monitor > System Status > IP/MAC Binding The following table describes the labels in this screen. Table 40 Monitor > System Status > IP/MAC Binding LABEL DESCRIPTION Interface Select a USG interface that has IP/MAC binding enabled to show to which devices it has assigned an IP address. This field is a sequential value, and it is not associated with a specific IP/MAC binding entry. IP Address This is the IP address that the USG assigned to a device. Host Name This field displays the name used to identify this device on the network (the computer name). The USG learns these from the DHCP client requests. MAC Address This field displays the MAC address to which the IP address is currently assigned. Last Access This is when the device last established a session with the USG through this interface. Description This field displays the description of the IP/MAC binding. 6.9 The Login Users Screen Use this screen to look at a list of the users currently logged into the USG. To access this screen, click Monitor > System Status > Login Users. USG20(W)-VPN Series User’s Guide 111 Chapter 6 Monitor Figure 95 Monitor > System Status > Login Users The following table describes the labels in this screen. Table 41 Monitor > System Status > Login Users LABEL DESCRIPTION Force Logout Select a user ID and click this icon to end a user’s session. This field is a sequential value and is not associated with any entry. User ID This field displays the user name of each user who is currently logged in to the USG. Reauth Lease T. This field displays the amount of reauthentication time remaining and the amount of lease time remaining for each user. Type This field displays the way the user logged in to the USG. IP Address This field displays the IP address of the computer used to log in to the USG. MAC This field displays the MAC address of the computer used to log in to the USG. User Info This field displays the types of user accounts the USG uses. If the user type is extuser (external user), this field will show its external-group information when you move your mouse over it. If the external user matches two external-group objects, both external-group object names will be shown. Refresh Click this button to update the information in the screen. 6.10 Cellular Status Screen This screen displays your mobile broadband connection status. Click Monitor > System Status > Cellular Status to display this screen. Figure 96 Monitor > System Status > Cellular Status USG20(W)-VPN Series User’s Guide 112 Chapter 6 Monitor The following table describes the labels in this screen. Table 42 Monitor > System Status > Cellular Status LABEL DESCRIPTION Refresh Click this button to update the information in the screen. More Information Click this to display more information on your mobile broadband, such as the signal strength, IMEA/ESN and IMSI. This is only available when the mobile broadband device attached and activated on your USG. Refer to Section 6.11 on page 114. This field is a sequential value, and it is not associated with any interface. Extension Slot This field displays where the entry’s cellular card is located. Connected Device This field displays the model name of the cellular card. Status • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • No device - no mobile broadband device is connected to the USG. No Service - no mobile broadband network is available in the area; you cannot connect to the Internet. Limited Service - returned by the service provider in cases where the SIM card is expired, the user failed to pay for the service and so on; you cannot connect to the Internet. Device detected - displays when you connect a mobile broadband device. Device error - a mobile broadband device is connected but there is an error. Probe device fail - the USG’s test of the mobile broadband device failed. Probe device ok - the USG’s test of the mobile broadband device succeeded. Init device fail - the USG was not able to initialize the mobile broadband device. Init device ok - the USG initialized the mobile broadband card. Check lock fail - the USG’s check of whether or not the mobile broadband device is locked failed. Device locked - the mobile broadband device is locked. SIM error - there is a SIM card error on the mobile broadband device. SIM locked-PUK - the PUK is locked on the mobile broadband device’s SIM card. SIM locked-PIN - the PIN is locked on the mobile broadband device’s SIM card. Unlock PUK fail - Your attempt to unlock a WCDMA mobile broadband device’s PUK failed because you entered an incorrect PUK. Unlock PIN fail - Your attempt to unlock a WCDMA mobile broadband device’s PIN failed because you entered an incorrect PIN. Unlock device fail - Your attempt to unlock a CDMA2000 mobile broadband device failed because you entered an incorrect device code. Device unlocked - You entered the correct device code and unlocked a CDMA2000 mobile broadband device. Get dev-info fail - The USG cannot get cellular device information. Get dev-info ok - The USG succeeded in retrieving mobile broadband device information. Searching network - The mobile broadband device is searching for a network. Get signal fail - The mobile broadband device cannot get a signal from a network. Network found - The mobile broadband device found a network. Apply config - The USG is applying your configuration to the mobile broadband device. Inactive - The mobile broadband interface is disabled. Active - The mobile broadband interface is enabled. Incorrect device - The connected mobile broadband device is not compatible with the USG. Correct device - The USG detected a compatible mobile broadband device. Set band fail - Applying your band selection was not successful. Set band ok - The USG successfully applied your band selection. Set profile fail - Applying your ISP settings was not successful. Set profile ok - The USG successfully applied your ISP settings. PPP fail - The USG failed to create a PPP connection for the cellular interface. Need auth-password - You need to enter the password for the mobile broadband card in the cellular edit screen. Device ready - The USG successfully applied all of your configuration and you can use the mobile broadband connection. USG20(W)-VPN Series User’s Guide 113 Chapter 6 Monitor Table 42 Monitor > System Status > Cellular Status (continued) LABEL DESCRIPTION Service Provider This displays the name of your network service provider. This shows Limited Service if the service provider has stopped service to the mobile broadband card. For example if the bill has not been paid or the account has expired. Cellular System This field displays what type of cellular network the mobile broadband connection is using. The network type varies depending on the mobile broadband card you inserted and could be UMTS, UMTS/HSDPA, GPRS or EDGE when you insert a GSM mobile broadband card, or 1xRTT, EVDO Rev.0 or EVDO Rev.A when you insert a CDMA mobile broadband card. Signal Quality This displays the strength of the signal. The signal strength mainly depends on the antenna output power and the distance between your USG and the service provider’s base station. 6.11 The UPnP Port Status Screen Use this screen to look at the NAT port mapping rules that UPnP creates on the USG. To access this screen, click Monitor > System Status > UPnP Port Status. Figure 97 Monitor > System Status > UPnP Port Status The following table describes the labels in this screen. Table 43 Monitor > System Status > UPnP Port Status LABEL DESCRIPTION Remove Select an entry and click this button to remove it from the list. This is the index number of the UPnP-created NAT mapping rule entry. Remote Host This field displays the source IP address (on the WAN) of inbound IP packets. Since this is often a wildcard, the field may be blank. When the field is blank, the USG forwards all traffic sent to the External Port on the WAN interface to the Internal Client on the Internal Port. When this field displays an external IP address, the NAT rule has the USG forward inbound packets to the Internal Client from that IP address only. External Port This field displays the port number that the USG “listens” on (on the WAN port) for connection requests destined for the NAT rule’s Internal Port and Internal Client. The USG forwards incoming packets (from the WAN) with this port number to the Internal Client on the Internal Port (on the LAN). If the field displays “0”, the USG ignores the Internal Port value and forwards requests on all external port numbers (that are otherwise unmapped) to the Internal Client. Protocol This field displays the protocol of the NAT mapping rule (TCP or UDP). USG20(W)-VPN Series User’s Guide 114 Chapter 6 Monitor Table 43 Monitor > System Status > UPnP Port Status (continued) LABEL DESCRIPTION Internal Port This field displays the port number on the Internal Client to which the USG should forward incoming connection requests. Internal Client This field displays the DNS host name or IP address of a client on the LAN. Multiple NAT clients can use a single port simultaneously if the internal client field is set to 255.255.255.255 for UDP mappings. Internal Client Type This field displays the type of the client application on the LAN. Description This field displays a text explanation of the NAT mapping rule. Delete All Click this to remove all mapping rules from the NAT table. Refresh Click this button to update the information in the screen. 6.12 USB Storage Screen This screen displays information about a connected USB storage device. Click Monitor > System Status > USB Storage to display this screen. Figure 98 Monitor > System Status > USB Storage The following table describes the labels in this screen. Table 44 Monitor > System Status > USB Storage LABEL DESCRIPTION Device description This is a basic description of the type of USB device. Usage This field displays how much of the USB storage device’s capacity is currently being used out of its total capacity and what percentage that makes. Filesystem This field displays what file system the USB storage device is formatted with. This field displays Unknown if the file system of the USB storage device is not supported by the USG, such as NTFS. Speed This field displays the connection speed the USB storage device supports. USG20(W)-VPN Series User’s Guide 115 Chapter 6 Monitor Table 44 Monitor > System Status > USB Storage (continued) LABEL DESCRIPTION Status Ready - you can have the USG use the USB storage device. Click Remove Now to stop the USG from using the USB storage device so you can remove it. Unused - the connected USB storage device was manually unmounted by using the Remove Now button or for some reason the USG cannot mount it. Click Use It to have the USG mount a connected USB storage device. This button is grayed out if the file system is not supported (unknown) by the USG. none - no USB storage device is connected. Detail This field displays any other information the USG retrieves from the USB storage device. • • • • • Deactivated - the use of a USB storage device is disabled (turned off) on the USG. OutofSpace - the available disk space is less than the disk space full threshold. Mounting - the USG is mounting the USB storage device. Removing - the USG is unmounting the USB storage device. none - the USB device is operating normally or not connected. 6.13 Ethernet Neighbor Screen The Ethernet Neighbor screen allows you to view the USG’s neighboring devices in one place. It uses Smart Connect, that is Link Layer Discovery Protocol (LLDP) for discovering and configuring LLDP-aware devices in the same broadcast domain as the USG that you’re logged into using the web configurator. LLDP is a layer-2 protocol that allows a network device to advertise its identity and capabilities on the local network. It also allows the device to maintain and store information from adjacent devices which are directly connected to the network device. This helps you discover network changes and perform necessary network reconfiguration and management. Note: Enable Smart Connect in the System > ZON screen. See also System > ZON for more information on the ZyXEL One Network (ZON) utility that uses the ZyXEL Discovery Protocol (ZDP) for discovering and configuring ZDP-aware ZyXEL devices in the same network as the computer on which the ZON utility is installed. Click Monitor > System Status > Ethernet Neighbor to see the following screen Figure 99 Monitor > System Status > Ethernet Neighbor USG20(W)-VPN Series User’s Guide 116 Chapter 6 Monitor The following table describes the fields in the previous screen. Table 45 Monitor > System Status > Ethernet Neighbor LABEL DESCRIPTION Local Port (Description) This field displays the port of the USG, on which the neighboring device is discovered. For USGs that support Port Role, if ports 3 to 5 are grouped together and there is a connection to P5 only, the USG will display P3 as the interface port number (even though there is no connection to that port). Model Name This field displays the model name of the discovered device. System Name This field displays the system name of the discovered device. Firmware Version This field displays the firmware version of the discovered device. Port (Description) This field displays the first internal port on the discovered device. Internal is an interface type displayed in the Network > Interface > Ethernet > Edit screen. For example, if P1 and P2 are WAN, P3 to P5 are LAN, and P6 is DMZ, then USG will display P3 as the first internal interface port number. For USGs that support Port Role, if ports 3 to 5 are grouped together and there is a connection to P5 only, the USG will display P3 as the first internal interface port number (even though there is no connection to that port). IP Address This field displays the IP address of the discovered device. MAC Address This field displays the MAC address of the discovered device. Refresh Click this button to update the information in the screen. 6.14 Wireless Wireless contains AP information and Station Info menus. 6.14.1 Wireless AP Information: Radio List Click Monitor > Wireless > AP Information > Radio List to display the Radio List screen. Figure 100 Monitor > Wireless > Radio List The following table describes the labels in this screen. Table 46 Monitor > Wireless > Radio List LABEL DESCRIPTION More Information Click this icon to see the traffic statistics, station count, SSID, Security Mode and VLAN ID information on the AP. This field is a sequential value, and it is not associated with a specific radio. AP Description This field displays the description of the AP. USG20(W)-VPN Series User’s Guide 117 Chapter 6 Monitor Table 46 Monitor > Wireless > Radio List LABEL DESCRIPTION Model This field displays the AP’s hardware model information. It displays N/A (not applicable) only when the AP disconnects from the USG and the information is unavailable as a result. MAC Address This field displays the MAC address of the AP. Radio This field displays the Radio number. For example 1. OP Mode This field displays the operating mode of the AP. It displays n/a for the profile for a radio not using an AP profile. AP Mode means the AP can receive connections from wireless clients and pass their data traffic through to the USG to be managed (or subsequently passed on to an upstream gateway for managing). MON Mode means the AP monitors the broadcast area for other APs, then passes their information on to the USG. If an AP is set to this mode it cannot receive connections from wireless clients. Profile This field displays the AP Profile for the Radio. It displays n/A for the radio profile not using an AP profile. It displays default if using a default profile. Frequency Band This field displays the WLAN frequency band using the IEEE 802.11 a/b/g/n/ac standard of 2.4 or 5 GHz. Channel ID This field displays the WLAN channels using the IEEE 802.11 protocols. Tx Power This field displays the transmission power the USG is using. Station This field displays the station count information. Rx PKT This field displays the data packets of incoming traffic on the AP. Tx PKT This field displays the data packet of outgoing traffic on the AP. Rx FCS Error Count This field displays the erroneous data packet count received and detected by Frame Check Sequence (FCS) Tx Retry Count This field displays the data packet count that were transmitted for retry. USG20(W)-VPN Series User’s Guide 118 Chapter 6 Monitor 6.14.2 Radio List More Information This screen allows you to view detailed information about a selected radio’s SSID(s), wireless traffic and wireless clients for the preceding 24 hours. To access this window, select an entry and click the More Information button in the Radio List screen. Figure 101 Monitor > Wireless > AP Information > Radio List > More Information USG20(W)-VPN Series User’s Guide 119 Chapter 6 Monitor The following table describes the labels in this screen. Table 47 Monitor > Wireless > AP Info > Radio List > More Information LABEL MBSSID Detail DESCRIPTION This list shows information about the SSID(s) that is associated with the radio. This is the items sequential number in the list. It has no bearing on the actual data in this list. SSID Name This displays an SSID associated with this radio. There can be up to eight maximum. BSSID This displays the MAC address associated with the SSID. Security Mode This displays the security mode in which the SSID is operating. VLAN This displays the VLAN ID associated with the SSID. Traffic Statistics y-axis x-axis Station Count This graph displays the overall traffic information about the radio over the preceding 24 hours. This axis represents the amount of data moved across this radio per second. This axis represents the amount of time over which the data moved across this radio. This graph displays information about all the wireless clients that have connected to the radio over the preceding 24 hours. y-axis The y-axis represents the number of connected wireless clients. x-axis The x-axis shows the time over which a wireless client was connected. Last Update This field displays the date and time the information in the window was last updated. OK Click this to close this window. Cancel Click this to close this window. 6.14.3 Wireless Station Info This screen displays information about connected wireless stations. Click Monitor > Wireless > Station Information to display this screen. Figure 102 Monitor > Wireless > Station List The following table describes the labels in this screen. Table 48 Monitor > Wireless > Station List LABEL DESCRIPTION This field is a sequential value, and it is not associated with a specific station. MAC Address This field displays the MAC address of the station. Associated AP This field displays the AP that is associated with the station. SSID Name This indicates the name of the wireless network to which the station is connected. A single AP can have multiple SSIDs or networks. Security Mode This field displays the security mode the station is using. USG20(W)-VPN Series User’s Guide 120 Chapter 6 Monitor Table 48 Monitor > Wireless > Station List LABEL DESCRIPTION Signal Strength This field displays the signal strength of the station. The signal strength mainly depends on the antenna output power and the distance between the station and the AP. Channel This indicates the number the channel used by the station to connect to the network. Band This indicates the frequency band which is currently being used by the station. IP Address This field displays the IP address of the station. An 169.x.x.x IP address is a private IP address that means the station didn't get the IP address from a DHCP server. Tx Rate This field displays the transmit data rate of the station. Rx Rate This field displays the receive data rate of the station. Tx This field displays the number of packets transmitted from the station. Rx This field displays the number of packets received by the station. Association Time This field displays the time duration the station was online and offline. Refresh Click this to refresh the items displayed on this page. 6.14.4 Detected Device Use this screen to view information about wireless devices detected by the AP. Click Monitor > Wireless > Detected Device to access this screen. Note: At least one radio of the APs connected to the USG must be set to monitor mode (in the Configuration > Wireless > AP Management screen) in order to detect other wireless devices in its vicinity. Figure 103 Monitor > Wireless > Detected Device The following table describes the labels in this screen. Table 49 Monitor > Wireless > Detected Device LABEL DESCRIPTION This is the station’s index number in this list. Status This indicates the detected device’s status. Device This indicates the detected device’s network type (such as infrastructure or ad-hoc). MAC Address This indicates the detected device’s MAC address. SSID Name This indicates the detected device’s SSID. Channel ID This indicates the detected device’s channel ID. 802.11 Mode This indicates the 802.11 mode (a/b/g/n/ac) transmitted by the detected device. USG20(W)-VPN Series User’s Guide 121 Chapter 6 Monitor Table 49 Monitor > Wireless > Detected Device (continued) LABEL DESCRIPTION Security This indicates the encryption method (if any) used by the detected device. Description This displays the detected device’s description. For more on managing friendly and rogue APs, see the Configuration > Wireless > MON Mode screen. Last Seen This indicates the last time the device was detected by the USG. Refresh Click this to refresh the items displayed on this page. 6.15 The IPSec Monitor Screen You can use the IPSec Monitor screen to display and to manage active IPSec To access this screen, click Monitor > VPN Monitor > IPSec. The following screen appears. SAs. Click a column’s heading cell to sort the table entries by that column’s criteria. Click the heading cell again to reverse the sort order. Figure 104 Monitor > VPN Monitor > IPSec Each field is described in the following table. Table 50 Monitor > VPN Monitor > IPSec LABEL DESCRIPTION Name Type the name of a IPSec SA here and click Search to find it (if it is associated). You can use a keyword or regular expression. Use up to 30 alphanumeric and _+.()!$*^:?|{}[]<>/ characters. See Section 6.15.1 on page 123 for more details. Policy Type the IP address(es) or names of the local and remote policies for an IPSec SA and click Search to find it. You can use a keyword or regular expression. Use up to 30 alphanumeric and _+-.()!$*^:?|{}[]<>/ characters. See Section 6.15.1 on page 123 for more details. Search Click this button to search for an IPSec SA that matches the information you specified above. Disconnect Select an IPSec SA and click this button to disconnect it. This field is a sequential value, and it is not associated with a specific SA. Name This field displays the name of the IPSec SA. Policy This field displays the content of the local and remote policies for this IPSec SA. The IP addresses, not the address objects, are displayed. IKE Name This field displays the Internet Key Exchange (IKE) name. Cookies This field displays the cookies information that initiates the IKE. My Address This field displays the IP address of local computer. USG20(W)-VPN Series User’s Guide 122 Chapter 6 Monitor Table 50 Monitor > VPN Monitor > IPSec (continued) LABEL DESCRIPTION Secure Gateway This field displays the secure gateway information. Up Time This field displays how many seconds the IPSec SA has been active. This field displays N/A if the IPSec SA uses manual keys. Timeout This field displays how many seconds remain in the SA life time, before the USG automatically disconnects the IPSec SA. This field displays N/A if the IPSec SA uses manual keys. Inbound (Bytes) This field displays the amount of traffic that has gone through the IPSec SA from the remote IPSec router to the USG since the IPSec SA was established. Outbound (Bytes) This field displays the amount of traffic that has gone through the IPSec SA from the USG to the remote IPSec router since the IPSec SA was established. 6.15.1 Regular Expressions in Searching IPSec SAs A question mark (?) lets a single character in the VPN connection or policy name vary. For example, use “a?c” (without the quotation marks) to specify abc, acc and so on. Wildcards (*) let multiple VPN connection or policy names match the pattern. For example, use “*abc” (without the quotation marks) to specify any VPN connection or policy name that ends with “abc”. A VPN connection named “testabc” would match. There could be any number (of any type) of characters in front of the “abc” at the end and the VPN connection or policy name would still match. A VPN connection or policy name named “testacc” for example would not match. A * in the middle of a VPN connection or policy name has the USG check the beginning and end and ignore the middle. For example, with “abc*123”, any VPN connection or policy name starting with “abc” and ending in “123” matches, no matter how many characters are in between. The whole VPN connection or policy name has to match if you do not use a question mark or asterisk. 6.16 The SSL Screen The USG keeps track of the users who are currently logged into the VPN SSL client. Click Monitor > VPN Monitor > SSL to display the user list. Use this screen to do the following: • View a list of active SSL VPN connections. • Log out individual users and delete related session information. Once a user logs out, the corresponding entry is removed from the screen. USG20(W)-VPN Series User’s Guide 123 Chapter 6 Monitor Figure 105 Monitor > VPN Monitor > SSL The following table describes the labels in this screen. Table 51 Monitor > VPN Monitor > SSL LABEL DESCRIPTION Disconnect Select a connection and click this button to terminate the user’s connection and delete corresponding session information from the USG. Refresh Click Refresh to update this screen. This field is a sequential value, and it is not associated with a specific SSL. User This field displays the account user name used to establish this SSL VPN connection. Access This field displays the name of the SSL VPN application the user is accessing. Login Address This field displays the IP address the user used to establish this SSL VPN connection. Connected Time This field displays the time this connection was established. Inbound (Bytes) This field displays the number of bytes received by the USG on this connection. Outbound (Bytes) This field displays the number of bytes transmitted by the USG on this connection. 6.17 The L2TP over IPSec Session Monitor Screen Click Monitor > VPN Monitor > L2TP over IPSec to open the following screen. Use this screen to display and manage the USG’s connected L2TP VPN sessions. Figure 106 Monitor > VPN Monitor > L2TP over IPSec The following table describes the fields in this screen. Table 52 Monitor > VPN Monitor > L2TP over IPSec LABEL DESCRIPTION Disconnect Select a connection and click this button to disconnect it. Refresh Click Refresh to update this screen. This field is a sequential value, and it is not associated with a specific L2TP VPN session. User Name This field displays the remote user’s user name. USG20(W)-VPN Series User’s Guide 124 Chapter 6 Monitor Table 52 Monitor > VPN Monitor > L2TP over IPSec (continued) LABEL DESCRIPTION Hostname This field displays the name of the computer that has this L2TP VPN connection with the USG. Assigned IP This field displays the IP address that the USG assigned for the remote user’s computer to use within the L2TP VPN tunnel. Public IP This field displays the public IP address that the remote user is using to connect to the Internet. 6.18 The Content Filter Screen Click Monitor > UTM Statistics > Content Filter to display the following screen. This screen displays content filter statistics. Figure 107 Monitor > UTM Statistics > Content Filter USG20(W)-VPN Series User’s Guide 125 Chapter 6 Monitor The following table describes the labels in this screen. Table 53 Monitor > UTM Statistics > Content Filter LABEL DESCRIPTION General Settings Collect Statistics Select this check box to have the USG collect content filtering statistics. The collection starting time displays after you click Apply. All of the statistics in this screen are for the time period starting at the time displayed here. The format is year, month, day and hour, minute, second. All of the statistics are erased if you restart the USG or click Flush Data. Collecting starts over and a new collection start time displays. Apply Click Apply to save your changes back to the USG. Reset Click Reset to return the screen to its last-saved settings. Refresh Click this button to update the report display. Flush Data Click this button to discard all of the screen’s statistics and update the report display. Web Request Statistics Total Web Pages Inspected This field displays the number of web pages that the USG’s content filter feature has checked. Blocked This is the number of web pages that the USG blocked access. Warned This is the number of web pages for which the USG displayed a warning message to the access requesters. Passed This is the number of web pages to which the USG allowed access. Category Hit Summary Security Threat (unsafe) This is the number of requested web pages that the USG’s content filtering service identified as posing a threat to users. Managed Web Pages This is the number of requested web pages that the USG’s content filtering service identified as belonging to a category that was selected to be managed. Block Hit Summary Web Pages Warned by Category Service This is the number of web pages that matched an external database content filtering category selected in the USG and for which the USG displayed a warning before allowing users access. Web Pages Blocked by Custom Service This is the number of web pages to which the USG did not allow access due to the content filtering custom service configuration. Restricted Web Features This is the number of web pages to which the USG limited access or removed cookies due to the content filtering custom service's restricted web features configuration. Forbidden Web Sites This is the number of web pages to which the USG did not allow access because they matched the content filtering custom service’s forbidden web sites list. URL Keywords This is the number of web pages to which the USG did not allow access because they contained one of the content filtering custom service’s list of forbidden keywords. Web Pages Blocked Without Policy This is the number of web pages to which the USG did not allow access because they were not rated by the external database content filtering service. Report Server Click this link to go to http://www.myZyXEL.com where you can view content filtering reports after you have activated the category-based content filtering subscription service. USG20(W)-VPN Series User’s Guide 126 Chapter 6 Monitor 6.19 The Anti-Spam Screens The Anti-Spam menu contains the Report and Status screens. 6.19.1 Anti-Spam Report Click Monitor > UTM Statistics > Anti-Spam to display the following screen. This screen displays spam statistics. Figure 108 Monitor > UTM Statistics > Anti-Spam The following table describes the labels in this screen. Table 54 Monitor > UTM Statistics > Anti-Spam LABEL DESCRIPTION Collect Statistics Select this check box to have the USG collect anti-spam statistics. The collection starting time displays after you click Apply. All of the statistics in this screen are for the time period starting at the time displayed here. The format is year, month, day and hour, minute, second. All of the statistics are erased if you restart the USG or click Flush Data. Collecting starts over and a new collection start time displays. Apply Click Apply to save your changes back to the USG. Reset Click Reset to return the screen to its last-saved settings. Refresh Click this button to update the report display. USG20(W)-VPN Series User’s Guide 127 Chapter 6 Monitor Table 54 Monitor > UTM Statistics > Anti-Spam (continued) LABEL DESCRIPTION Flush Data Click this button to discard all of the screen’s statistics and update the report display. Total Mails Scanned This field displays the number of e-mails that the USG’s anti-spam feature has checked. Clear Mails This is the number of e-mails that the USG has determined to not be spam. Clear Mails Detected by Whitelist This is the number of e-mails that matched an entry in the USG’s anti-spam white list. Spam Mails This is the number of e-mails that the USG has determined to be spam. Spam Mails Detected by Black List This is the number of e-mails that matched an entry in the USG’s anti-spam black list. Spam Mails Detected by IP Reputation This is the number of e-mails that the USG has determined to be spam by IP Reputation. Spam or Unwanted Bulk Email is determined by the sender’s IP address. Spam Mails Detected by Mail Content This is the number of e-mails that the USG has determined to have malicious contents. Spam Mails Detected by DNSBL The USG can check the sender and relay IP addresses in an e-mail’s header against DNS (Domain Name Service)-based spam Black Lists (DNSBLs). This is the number of e-mails that had a sender or relay IP address in the header which matched one of the DNSBLs that the USG uses. Spam Mails with Virus Detected by Mail Content This is the number of e-mails that the USG has determined to have malicious contents and attached with virus. Virus Mails This is the number of e-mails that the USG has determined to be attached with virus. Query Timeout This is how many queries that were sent to the USG’s configured list of DNSBL domains or Mail Scan services and did not receive a response in time. Mail Sessions Forwarded This is how many e-mail sessions the USG allowed because they exceeded the maximum number of e-mail sessions that the anti-spam feature can check at a time. You can see the USG’s threshold of concurrent e-mail sessions in the Anti-Spam > Status screen. Use the Anti-Spam > General screen to set whether the USG forwards or drops sessions that exceed this threshold. Mail Sessions Dropped This is how many e-mail sessions the USG dropped because they exceeded the maximum number of e-mail sessions that the anti-spam feature can check at a time. You can see the USG’s threshold of concurrent e-mail sessions in the Anti-Spam > Status screen. Use the Anti-Spam > General screen to set whether the USG forwards or drops sessions that exceed this threshold. Top Sender By Use this field to list the top e-mail or IP addresses from which the USG has detected the most spam. Select Sender IP to list the source IP addresses from which the USG has detected the most spam. Select Sender Email Address to list the top e-mail addresses from which the USG has detected the most spam. This field displays the entry’s rank in the list of the top entries. Sender IP This column displays when you display the entries by Sender IP. It shows the source IP address of spam e-mails that the USG has detected. USG20(W)-VPN Series User’s Guide 128 Chapter 6 Monitor Table 54 Monitor > UTM Statistics > Anti-Spam (continued) LABEL DESCRIPTION Sender Email Address This column displays when you display the entries by Sender Email Address. This column displays the e-mail addresses from which the USG has detected the most spam. Occurrence This field displays how many spam e-mails the USG detected from the sender. 6.19.2 The Anti-Spam Status Screen Click Monitor > UTM Statistics > Anti-Spam > Status to display the Anti-Spam Status screen. Use the Anti-Spam Status screen to see how many e-mail sessions the anti-spam feature is scanning and statistics for the DNSBLs. Figure 109 Monitor > UTM Statistics > Anti-Spam > Status The following table describes the labels in this screen. Table 55 Monitor > UTM Statistics > Anti-Spam > Status LABEL DESCRIPTION Refresh Click this button to update the information displayed on this screen. Flush Click this button to clear the DNSBL statistics. This also clears the concurrent mail session scanning bar’s historical high. Concurrent Mail Session Scanning The darker shaded part of the bar shows how much of the USG’s total spam checking capability is currently being used. The lighter shaded part of the bar and the pop-up show the historical high. The first number to the right of the bar is how many e-mail sessions the USG is presently checking for spam. The second number is the maximum number of email sessions that the USG can check at once. An e-mail session is when an email client and e-mail server (or two e-mail servers) connect through the USG. Mail Scan Statistics These are the statistics for the service the USG uses. These statistics are for when the USG actually queries the service servers. This is the entry’s index number in the list. Service This displays the name of the service. Total Queries This is the total number of queries the USG has sent to this service. USG20(W)-VPN Series User’s Guide 129 Chapter 6 Monitor Table 55 Monitor > UTM Statistics > Anti-Spam > Status (continued) LABEL DESCRIPTION Avg. Response Time (sec) This is the average for how long it takes to receive a reply from this service. No Response This is how many queries the USG sent to this service without receiving a reply. DNSBL Statistics These are the statistics for the DNSBL the USG uses. These statistics are for when the USG actually queries the DNSBL servers. Matches for DNSBL responses stored in the cache do not affect these statistics. This is the entry’s index number in the list. DNSBL Domain These are the DNSBLs the USG uses to check sender and relay IP addresses in emails. Total Queries This is the total number of DNS queries the USG has sent to this DNSBL. Avg. Response Time (sec) This is the average for how long it takes to receive a reply from this DNSBL. No Response This is how many DNS queries the USG sent to this DNSBL without receiving a reply. 6.20 Log Screens Log messages are stored in two separate logs, one for regular log messages and one for debugging messages. In the regular log, you can look at all the log messages by selecting All Logs, or you can select a specific category of log messages (for example, security policy or user). You can also look at the debugging log by selecting Debug Log. All debugging messages have the same priority. 6.20.1 View Log To access this screen, click Monitor > Log. The log is displayed in the following screen. Note: When a log reaches the maximum number of log messages, new log messages automatically overwrite existing log messages, starting with the oldest existing log message first. • The maximum possible number of log messages in the USG varies by model. Events that generate an alert (as well as a log message) display in red. Regular logs display in black. Click a column’s heading cell to sort the table entries by that column’s criteria. Click the heading cell again to reverse the sort order. The Web Configurator saves the filter settings if you leave the View Log screen and return to it later. USG20(W)-VPN Series User’s Guide 130 Chapter 6 Monitor Figure 110 Monitor > Log > View Log The following table describes the labels in this screen. Table 56 Monitor > Log > View Log LABEL DESCRIPTION Show Filter Click this button to show or hide the filter settings. If the filter settings are hidden, the Display, Email Log Now, Refresh, and Clear Log fields are available. If the filter settings are shown, the Display, Priority, Source Address, Destination Address, Service, Keyword, and Search fields are available. Display Select the category of log message(s) you want to view. You can also view All Logs at one time, or you can view the Debug Log. Email Log Now Click this button to send log message(s) to the Active e-mail address(es) specified in the Send Log To field on the Log Settings page. Refresh Click this button to update the information in the screen. Clear Log Click this button to clear the whole log, regardless of what is currently displayed on the screen. This field is a sequential value, and it is not associated with a specific log message. Time This field displays the time the log message was recorded. Priority This displays when you show the filter. Select the priority of log messages to display. The log displays the log messages with this priority or higher. Choices are: any, emerg, alert, crit, error, warn, notice, and info, from highest priority to lowest priority. This field is read-only if the Category is Debug Log. Category This field displays the log that generated the log message. It is the same value used in the Display and (other) Category fields. Message This field displays the reason the log message was generated. The text “[count=x]”, where x is a number, appears at the end of the Message field if log consolidation is turned on and multiple entries were aggregated to generate into this one. Source This displays when you show the filter. Type the source IP address of the incoming packet that generated the log message. Do not include the port in this filter. Destination This displays when you show the filter. Type the IP address of the destination of the incoming packet when the log message was generated. Do not include the port in this filter. Protocol This displays when you show the filter. Select a service protocol whose log messages you would like to see. Search This displays when you show the filter. Click this button to update the log using the current filter settings. USG20(W)-VPN Series User’s Guide 131 Chapter 6 Monitor Table 56 Monitor > Log > View Log (continued) LABEL DESCRIPTION Priority This field displays the priority of the log message. It has the same range of values as the Priority field above. Source This field displays the source IP address and the port number in the event that generated the log message. Destination This field displays the destination IP address and the port number of the event that generated the log message. Note This field displays any additional information about the log message. USG20(W)-VPN Series User’s Guide 132 C HAPTER Licensing 7.1 Registration Overview Use the Configuration > Licensing > Registration screens to register your USG and manage its service subscriptions. • • Use the Registration screen (see Section 7.1.2 on page 134) to go to portal.myzyxel.com to register your USG and activate a service, such as content filtering. Use the Service screen (see Section 7.1.3 on page 134) to display the status of your service registrations and upgrade licenses. Note: The USG models need a license for UTM (Unified Threat management) functionality. 7.1.1 What you Need to Know This section introduces the topics covered in this chapter. myZyXEL.com myZyXEL.com is ZyXEL’s online services center where you can register your USG and manage subscription services available for the USG. To update signature files or use a subscription service, you have to register the USG and activate the corresponding service at myZyXEL.com (through the USG). Note: You need to create a myZyXEL.com account before you can register your device and activate the services at myZyXEL.com. You need your USG’s serial number and LAN MAC address to register it. Refer to the web site’s online help for details. Subscription Services Available The USG can use anti-spam, SSL VPN, and content filtering subscription services. The USG models need a license for UTM (Unified Threat Management) functionality - see Section 1.1 on page 18 for details. You can purchase an iCard and enter the license key from it, at www.myzyxel.com to have the USG use UTM services or have the USG use more SSL VPN tunnels. See below the respective chapters in this guide for more information about UTM features. USG20(W)-VPN Series User’s Guide 133 Chapter 7 Licensing 7.1.2 Registration Screen Click the link in this screen to register your USG at myZyXEL.com. The USG should already have Internet access before you can access it. Click Configuration > Licensing > Registration in the navigation panel to open the screen as shown next. Click on the icon to go to the OneSecurity.com website where there is guidance on configuration walkthrough and other information. Figure 111 Configuration > Licensing > Registration > portal.myzyxel.com 7.1.3 Service Screen Use this screen to display the status of your service registrations and upgrade licenses. To activate or extend a standard service subscription, purchase an iCard and enter the iCard’s PIN number (license key) in this screen. Click Configuration > Licensing > Registration > Service to open the screen as shown next. Figure 112 Configuration > Licensing > Registration > Service The following table describes the labels in this screen. Table 57 Configuration > Licensing > Registration > Service LABEL DESCRIPTION License Status This is the entry’s position in the list. Service This lists the services that available on the USG. Status This field displays whether a service is activated (Licensed) or not (Not Licensed) or expired (Expired). Registration Type This field displays whether you applied for a trial application (Trial) or registered a service with your iCard’s PIN number (Standard). This field is blank when a service is not activated. USG20(W)-VPN Series User’s Guide 134 Chapter 7 Licensing Table 57 Configuration > Licensing > Registration > Service (continued) LABEL DESCRIPTION Expiration Date This field displays the date your service expires. Count This field displays how many VPN tunnels you can use with your current license. This field does not apply to the other services. Service License Refresh Click this button to renew service license information (such as the registration status and expiration day). USG20(W)-VPN Series User’s Guide 135 C HAPTER Wireless 8.1 Overview Use the Wireless screens to configure how the USG manages the Access Points (APs) that are connected to it. 8.1.1 What You Can Do in this Chapter • The AP Management screen (Section 8.2 on page 137) manages all of the APs connected to the USG. • The DCS screen (Section 8.2 on page 137) configures dynamic radio channel selection. 8.1.2 What You Need to Know The following terms and concepts may help as you read this chapter. Station / Wireless Client A station or wireless client is any wireless-capable device that can connect to an AP using a wireless signal. Dynamic Channel Selection (DCS) Dynamic Channel Selection (DCS) is a feature that allows an AP to automatically select the radio channel upon which it broadcasts by scanning the area around it and determining what channels are currently being used by other devices. USG20(W)-VPN Series User’s Guide 136 Chapter 8 Wireless 8.2 AP Management Screen Use this screen to manage the USG’s general wireless settings. Click Configuration > Wireless > AP Management to access this screen. Figure 113 Configuration > Wireless > AP Management Each field is described in the following table. Table 58 Configuration > Wireless > AP Management LABEL DESCRIPTION Radio Setting Radio OP Mode Select the operating mode. AP Mode means the radio can receive connections from wireless clients and pass their data traffic through to the USG to be managed (or subsequently passed on to an upstream gateway for managing). MON Mode means the radio monitors the broadcast area for other APs, then passes their information on to the USG where it can be determined if those APs are friendly or rogue. If a radio is set to this mode it cannot receive connections from wireless clients. Radio Profile Select the radio profile the radio uses. Max Output Power Enter the output power (between 0 to 30 dBm) of the USG in this field. If there is a high density of APs in an area, decrease the output power of the USG to reduce interference with other APs. Note: Reducing the output power also reduces the USG’s effective broadcast radius. MBSSID Settings Edit Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings. In some tables you can just click a table entry and edit it directly in the table. For those types of tables small red triangles display for table entries with changes that you have not yet applied. This field shows the index number of the SSID SSID Profile This field displays the SSID profile that is associated with the radio profile. USG20(W)-VPN Series User’s Guide 137 Chapter 8 Wireless Table 58 Configuration > Wireless > AP Management (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the USG. Reset Click Reset to close the window with changes unsaved. 8.3 DCS Screen Use this screen to configure dynamic radio channel selection. Click Configuration > Wireless > DCS to access this screen. Figure 114 Configuration > Wireless > DCS Each field is described in the following table. Table 59 Configuration > Wireless > DCS LABEL DESCRIPTION Select Now Click this to have the USG scan for and select an available channel immediately. 8.4 Technical Reference The following section contains additional technical information about the features described in this chapter. 8.4.1 Dynamic Channel Selection When numerous APs broadcast within a given area, they introduce the possibility of heightened radio interference, especially if some or all of them are broadcasting on the same radio channel. If the interference becomes too great, then the network administrator must open his AP configuration options and manually change the channel to one that no other AP is using (or at least a channel that has a lower level of interference) in order to give the connected stations a minimum degree of interference. Dynamic channel selection frees the network administrator from this task by letting the AP do it automatically. The AP can scan the area around it looking for the channel with the least amount of interference. In the 2.4 GHz spectrum, each channel from 1 to 13 is broken up into discrete 22 MHz segments that are spaced 5 MHz apart. Channel 1 is centered on 2.412 GHz while channel 13 is centered on 2.472 GHz. USG20(W)-VPN Series User’s Guide 138 Chapter 8 Wireless Figure 115 An Example Three-Channel Deployment Three channels are situated in such a way as to create almost no interference with one another if used exclusively: 1, 6 and 11. When an AP broadcasts on any of these three channels, it should not interfere with neighboring APs as long as they are also limited to same trio. Figure 116 An Example Four-Channel Deployment However, some regions require the use of other channels and often use a safety scheme with the following four channels: 1, 4, 7 and 11. While they are situated sufficiently close to both each other and the three so-called “safe” channels (1,6 and 11) that interference becomes inevitable, the severity of it is dependent upon other factors: proximity to the affected AP, signal strength, activity, and so on. Finally, there is an alternative four channel scheme for ETSI, consisting of channels 1, 5, 9, 13. This offers significantly less overlap that the other one. Figure 117 An Alternative Four-Channel Deployment USG20(W)-VPN Series User’s Guide 139
Source Exif Data:
File Type : PDF File Type Extension : pdf MIME Type : application/pdf PDF Version : 1.6 Linearized : Yes Encryption : Standard V2.3 (128-bit) User Access : Print, Copy, Extract XMP Toolkit : Adobe XMP Core 4.0-c316 44.253921, Sun Oct 01 2006 17:14:39 Modify Date : 2016:02:02 11:57:19+08:00 Create Date : 2016:02:01 17:33:47+08:00 Metadata Date : 2016:02:02 11:57:19+08:00 Creator Tool : FrameMaker 9.0 Format : application/pdf Title : Book.book Creator : ZT01650 Document ID : uuid:c4fb1b8f-d071-4b8a-b759-27fc3b94f489 Instance ID : uuid:60763c08-2de3-4b1c-b02d-cfe6898f41c2 Producer : Acrobat Distiller 8.1.0 (Windows) Page Count : 139 Author : ZT01650EXIF Metadata provided by EXIF.tools