ZyXEL Communications USG20W-VPN VPN Firewall User Manual Book

ZyXEL Communications Corporation VPN Firewall Book

UserManual.wiki >

ZyXEL Communications >

USG20W-VPN User Manual >

Users Manual Part 3

USG20(W)-VPN Series User’s Guide255CHAPTER 12NAT12.1 NAT OverviewNAT (Network Address Translation - NAT, RFC 1631) is the translation of the IP address of a host in a packet. For example, the source address of an outgoing packet, used within one network is changed to a different IP address known within another network. Use Network Address Translation (NAT) to make computers on a private network behind the USG available outside the private network. If the USG has only one public IP address, you can make the computers in the private network available by using ports to forward packets to the appropriate private IP address. Suppose you want to assign ports 21-25 to one FTP, Telnet and SMTP server (A in the example), port 80 to another (B in the example) and assign a default server IP address of 192.168.1.35 to a third (C in the example). You assign the LAN IP addresses and the ISP assigns the WAN IP address. The NAT network appears as a single host on the Internet.Figure 167 Multiple Servers Behind NAT Example12.1.1 What You Can Do in this ChapterUse the NAT screens (see Section 12.2 on page 255) to view and manage the list of NAT rules and see their configuration details. You can also create new NAT rules and edit or delete existing ones. 12.1.2 What You Need to KnowNAT is also known as virtual server, port forwarding, or port translation.12.2 The NAT ScreenThe NAT summary screen provides a summary of all NAT rules and their configuration. In addition, this screen allows you to create new NAT rules and edit and delete existing NAT rules. To access this

Chapter 12 NATUSG20(W)-VPN Series User’s Guide256screen, login to the Web Configurator and click Configuration > Network > NAT. The following screen appears, providing a summary of the existing NAT rules.Click on the icons to go to the OneSecurity.com website where there is guidance on configuration walkthroughs, troubleshooting, and other information.Figure 168 Configuration > Network > NAT The following table describes the labels in this screen. Table 104 Configuration > Network > NATLABEL DESCRIPTIONAdd Click this to create a new entry.Edit Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings. Remove To remove an entry, select it and click Remove. The USG confirms you want to remove it before doing so.Activate To turn on an entry, select it and click Activate.Inactivate To turn off an entry, select it and click Inactivate.# This field is a sequential value, and it is not associated with a specific entry.Status This icon is lit when the entry is active and dimmed when the entry is inactive.Name This field displays the name of the entry.Mapping Type This field displays what kind of NAT this entry performs: Virtual Server, 1:1 NAT, or Many 1:1 NAT.Interface This field displays the interface on which packets for the NAT entry are received.Original IP This field displays the original destination IP address (or address object) of traffic that matches this NAT entry. It displays any if there is no restriction on the original destination IP address.Mapped IP This field displays the new destination IP address for the packet.Protocol This field displays the service used by the packets for this NAT entry. It displays any if there is no restriction on the services.Original Port This field displays the original destination port(s) of packets for the NAT entry. This field is blank if there is no restriction on the original destination port.Mapped Port This field displays the new destination port(s) for the packet. This field is blank if there is no restriction on the original destination port.

Chapter 12 NATUSG20(W)-VPN Series User’s Guide25712.2.1 The NAT Add/Edit ScreenThe NAT Add/Edit screen lets you create new NAT rules and edit existing ones. To open this window, open the NAT summary screen. (See Section 12.2 on page 255.) Then, click on an Add icon or Edit icon to open the following screen.Figure 169 Configuration > Network > NAT > Add The following table describes the labels in this screen. Apply Click this button to save your changes to the USG. Reset Click this button to return the screen to its last-saved settings. Table 104 Configuration > Network > NAT (continued)LABEL DESCRIPTIONTable 105 Configuration > Network > NAT > AddLABEL DESCRIPTIONCreate new Object Use to configure any new settings objects that you need to use in this screen.Enable Rule Use this option to turn the NAT rule on or off.Rule Name Type in the name of the NAT rule. The name is used to refer to the NAT rule. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive.

Chapter 12 NATUSG20(W)-VPN Series User’s Guide258Classification Select what kind of NAT this rule is to perform.Virtual Server - This makes computers on a private network behind the USG available to a public network outside the USG (like the Internet). 1:1 NAT - If the private network server will initiate sessions to the outside clients, select this to have the USG translate the source IP address of the server’s outgoing traffic to the same public IP address that the outside clients use to access the server. Many 1:1 NAT - If you have a range of private network servers that will initiate sessions to the outside clients and a range of public IP addresses, select this to have the USG translate the source IP address of each server’s outgoing traffic to the same one of the public IP addresses that the outside clients use to access the server. The private and public ranges must have the same number of IP addresses. One many 1:1 NAT rule works like multiple 1:1 NAT rules, but it eases configuration effort since you only create one rule.Incoming Interface Select the interface on which packets for the NAT rule must be received. It can be an Ethernet, VLAN, bridge, or PPPoE/PPTP interface.Original IP Specify the destination IP address of the packets received by this NAT rule’s specified incoming interface.any - Select this to use all of the incoming interface’s IP addresses including dynamic addresses or those of any virtual interfaces built upon the selected incoming interface. User Defined - Select this to manually enter an IP address in the User Defined field. For example, you could enter a static public IP assigned by the ISP without having to create a virtual interface for it. Host address - select a host address object to use the IP address it specifies. The list also includes address objects based on interface IPs. So for example you could select an address object based on a WAN interface even if it has a dynamic IP address.User Defined Original IPThis field is available if Original IP is User Defined. Type the destination IP address that this NAT rule supports.Original IP Subnet/RangeThis field displays for Many 1:1 NAT. Select the destination IP address subnet or IP address range that this NAT rule supports. The original and mapped IP address subnets or ranges must have the same number of IP addresses.Mapped IP Select to which translated destination IP address this NAT rule forwards packets. User Defined - this NAT rule supports a specific IP address, specified in the User Defined field.HOST address - the drop-down box lists all the HOST address objects in the USG. If you select one of them, this NAT rule supports the IP address specified by the address object.User Defined Original IPThis field is available if Mapped IP is User Defined. Type the translated destination IP address that this NAT rule supports.Mapped IP Subnet/RangeThis field displays for Many 1:1 NAT. Select to which translated destination IP address subnet or IP address range this NAT rule forwards packets. The original and mapped IP address subnets or ranges must have the same number of IP addresses.Table 105 Configuration > Network > NAT > Add (continued)LABEL DESCRIPTION

Chapter 12 NATUSG20(W)-VPN Series User’s Guide259Port Mapping Type Use the drop-down list box to select how many original destination ports this NAT rule supports for the selected destination IP address (Original IP). Choices are:Any - this NAT rule supports all the destination ports.Port - this NAT rule supports one destination port.Ports - this NAT rule supports a range of destination ports. You might use a range of destination ports for unknown services or when one server supports more than one service. Service - this NAT rule supports a service such as FTP (see Object > Service > Service) Service-Group - this NAT rule supports a group of services such as all service objects related to DNS (see Object > Service > Service Group) Protocol Type This field is available if Mapping Type is Port or Ports. Select the protocol (TCP, UDP, or Any) used by the service requesting the connection.Original Port This field is available if Mapping Type is Port. Enter the original destination port this NAT rule supports.Mapped Port This field is available if Mapping Type is Port. Enter the translated destination port if this NAT rule forwards the packet.Original Start Port This field is available if Mapping Type is Ports. Enter the beginning of the range of original destination ports this NAT rule supports.Original End Port This field is available if Mapping Type is Ports. Enter the end of the range of original destination ports this NAT rule supports.Mapped Start Port This field is available if Mapping Type is Ports. Enter the beginning of the range of translated destination ports if this NAT rule forwards the packet.Mapped End Port This field is available if Mapping Type is Ports. Enter the end of the range of translated destination ports if this NAT rule forwards the packet. The original port range and the mapped port range must be the same size.Enable NAT LoopbackEnable NAT loopback to allow users connected to any interface (instead of just the specified Incoming Interface) to use the NAT rule’s specified Original IP address to access the Mapped IP device. For users connected to the same interface as the Mapped IP device, the USG uses that interface’s IP address as the source address for the traffic it sends from the users to the Mapped IP device.For example, if you configure a NAT rule to forward traffic from the WAN to a LAN server, enabling NAT loopback allows users connected to other interfaces to also access the server. For LAN users, the USG uses the LAN interface’s IP address as the source address for the traffic it sends to the LAN server. See NAT Loopback on page 260 for more details.If you do not enable NAT loopback, this NAT rule only applies to packets received on the rule’s specified incoming interface.Security Policy By default the security policy blocks incoming connections from external addresses. After you configure your NAT rule settings, click the Security Policy link to configure a security policy to allow the NAT rule’s traffic to come in.The USG checks NAT rules before it applies To-USG security policies, so To-USG security policies, do not apply to traffic that is forwarded by NAT rules. The USG still checks other security policies, according to the source IP address and mapped IP address.OK Click OK to save your changes back to the USG.Cancel Click Cancel to return to the NAT summary screen without creating the NAT rule (if it is new) or saving any changes (if it already exists).Table 105 Configuration > Network > NAT > Add (continued)LABEL DESCRIPTION

Chapter 12 NATUSG20(W)-VPN Series User’s Guide26012.3 NAT Technical ReferenceHere is more detailed information about NAT on the USG.NAT LoopbackSuppose an NAT 1:1 rule maps a public IP address to the private IP address of a LAN SMTP e-mail server to give WAN users access. NAT loopback allows other users to also use the rule’s original IP to access the mail server. For example, a LAN user’s computer at IP address 192.168.1.89 queries a public DNS server to resolve the SMTP server’s domain name (xxx.LAN-SMTP.com in this example) and gets the SMTP server’s mapped public IP address of 1.1.1.1.Figure 170 LAN Computer Queries a Public DNS Server The LAN user’s computer then sends traffic to IP address 1.1.1.1. NAT loopback uses the IP address of the USG’s LAN interface (192.168.1.1) as the source address of the traffic going from the LAN users to the LAN SMTP server. 192.168.1.21xxx.LAN-SMTP.com = ?LANDNS192.168.1.89xxx.LAN-SMTP.com = 1.1.1.11.1.1.1

Chapter 12 NATUSG20(W)-VPN Series User’s Guide261Figure 171 LAN to LAN Traffic The LAN SMTP server replies to the USG’s LAN IP address and the USG changes the source address to 1.1.1.1 before sending it to the LAN user. The return traffic’s source matches the original destination address (1.1.1.1). If the SMTP server replied directly to the LAN user without the traffic going through NAT, the source would not match the original destination address which would cause the LAN user’s computer to shut down the session. Figure 172 LAN to LAN Return Traffic 192.168.1.21LAN192.168.1.89Source 192.168.1.89SMTPNATSource 192.168.1.1SMTP192.168.1.21LAN192.168.1.89Source 1.1.1.1SMTPNATSource 192.168.1.21SMTP

USG20(W)-VPN Series User’s Guide262CHAPTER 13HTTP Redirect13.1 OverviewHTTP redirect forwards the client’s HTTP request (except HTTP traffic destined for the USG) to a web proxy server. In the following example, proxy server A is connected to the DMZ interface. When a client connected to the LAN1 zone wants to open a web page, its HTTP request is redirected to proxy server A first. If proxy server A cannot find the web page in its cache, a policy route allows it to access the Internet to get them from a server. Proxy server A then forwards the response to the client. Figure 173 HTTP Redirect Example 13.1.1 What You Can Do in this ChapterUse the HTTP Redirect screens (see Section 13.2 on page 263) to display and edit the HTTP redirect rules.13.1.2 What You Need to KnowWeb Proxy ServerA proxy server helps client devices make indirect requests to access the Internet or outside network resources/services. A proxy server can act as a security policy or an ALG (application layer gateway) between the private network and the Internet or other networks. It also keeps hackers from knowing internal IP addresses.LAN1

Chapter 13 HTTP RedirectUSG20(W)-VPN Series User’s Guide263A client connects to a web proxy server each time he/she wants to access the Internet. The web proxy provides caching service to allow quick access and reduce network usage. The proxy checks its local cache for the requested web resource first. If it is not found, the proxy gets it from the specified server and forwards the response to the client. HTTP Redirect, Security Policy and Policy RouteWith HTTP redirect, the relevant packet flow for HTTP traffic is:1Security Policy2HTTP Redirect3Policy Route Even if you set a policy route to the same incoming interface and service as a HTTP redirect rule, the USG checks the HTTP redirect rules first and forwards HTTP traffic to a proxy server if matched. You need to make sure there is no security policy(s) blocking the HTTP requests from the client to the proxy server. You also need to manually configure a policy route to forward the HTTP traffic from the proxy server to the Internet. To make the example in Figure 173 on page 262 work, make sure you have the following settings.For HTTP traffic between lan1 and dmz: • a from LAN1 to DMZ security policy (default) to allow HTTP requests from lan1 to dmz. Responses to this request are allowed automatically.• a HTTP redirect rule to forward HTTP traffic from lan1 to proxy server A. For HTTP traffic between dmz and wan1:• a from DMZ to WAN security policy (default) to allow HTTP requests from dmz to wan1. Responses to these requests are allowed automatically.• a policy route to forward HTTP traffic from proxy server A to the Internet.13.2 The HTTP Redirect ScreenTo configure redirection of a HTTP request to a proxy server, click Configuration > Network > HTTP Redirect. This screen displays the summary of the HTTP redirect rules.Note: You can configure up to one HTTP redirect rule for each (incoming) interface.

Chapter 13 HTTP RedirectUSG20(W)-VPN Series User’s Guide264Figure 174 Configuration > Network > HTTP Redirect The following table describes the labels in this screen. 13.2.1 The HTTP Redirect Edit ScreenClick Network > HTTP Redirect to open the HTTP Redirect screen. Then click the Add or Edit icon to open the HTTP Redirect Edit screen where you can configure the rule.Figure 175 Network > HTTP Redirect > Edit Table 106 Configuration > Network > HTTP RedirectLABEL DESCRIPTIONAdd Click this to create a new entry.Edit Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings. Remove To remove an entry, select it and click Remove. The USG confirms you want to remove it before doing so.Activate To turn on an entry, select it and click Activate.Inactivate To turn off an entry, select it and click Inactivate.# This field is a sequential value, and it is not associated with a specific entry.Status This icon is lit when the entry is active and dimmed when the entry is inactive.Name This is the descriptive name of a rule.Interface This is the interface on which the request must be received.Proxy Server This is the IP address of the proxy server.Port This is the service port number used by the proxy server.Apply Click Apply to save your changes back to the USG.Reset Click Reset to return the screen to its last-saved settings.

Chapter 13 HTTP RedirectUSG20(W)-VPN Series User’s Guide265The following table describes the labels in this screen. Table 107 Network > HTTP Redirect > EditLABEL DESCRIPTIONEnable Use this option to turn the HTTP redirect rule on or off.Name Enter a name to identify this rule. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive.Interface Select the interface on which the HTTP request must be received for the USG to forward it to the specified proxy server.Proxy Server Enter the IP address of the proxy server.Port Enter the port number that the proxy server uses.OK Click OK to save your changes back to the USG.Cancel Click Cancel to exit this screen without saving.

USG20(W)-VPN Series User’s Guide266CHAPTER 14ALG14.1 ALG OverviewApplication Layer Gateway (ALG) allows the following applications to operate properly through the USG’s NAT.• SIP - Session Initiation Protocol (SIP) - An application-layer protocol that can be used to create voice and multimedia sessions over Internet.• H.323 - A teleconferencing protocol suite that provides audio, data and video conferencing.• FTP - File Transfer Protocol - an Internet file transfer service.The following example shows SIP signaling (1) and audio (2) sessions between SIP clients A and B and the SIP server. Figure 176 SIP ALG Example The ALG feature is only needed for traffic that goes through the USG’s NAT. 14.1.1 What You Need to KnowApplication Layer Gateway (ALG), NAT and Security PolicyThe USG can function as an Application Layer Gateway (ALG) to allow certain NAT un-friendly applications (such as SIP) to operate properly through the USG’s NAT and security policy. The USG dynamically creates an implicit NAT session and security policy session for the application’s traffic from the WAN to the LAN. The ALG on the USG supports all of the USG’s NAT mapping types.FTP ALGThe FTP ALG allows TCP packets with a specified port destination to pass through. If the FTP server is located on the LAN, you must also configure NAT (port forwarding) and security policies if you

Chapter 14 ALGUSG20(W)-VPN Series User’s Guide267want to allow access to the server from the WAN. Bandwidth management can be applied to FTP ALG traffic.H.323 ALG• The H.323 ALG supports peer-to-peer H.323 calls.• The H.323 ALG handles H.323 calls that go through NAT or that the USG routes. You can also make other H.323 calls that do not go through NAT or routing. Examples would be calls between LAN IP addresses that are on the same subnet.• The H.323 ALG allows calls to go out through NAT. For example, you could make a call from a private IP address on the LAN to a peer device on the WAN. • The H.323 ALG operates on TCP packets with a specified port destination.• Bandwidth management can be applied to H.323 ALG traffic.• The USG allows H.323 audio connections. • The USG can also apply bandwidth management to traffic that goes through the H.323 ALG.The following example shows H.323 signaling (1) and audio (2) sessions between H.323 devices A and B.Figure 177 H.323 ALG Example SIP ALG• SIP phones can be in any zone (including LAN, DMZ, WAN), and the SIP server and SIP clients can be in the same network or different networks. The SIP server cannot be on the LAN. It must be on the WAN or the DMZ.• There should be only one SIP server (total) on the USG’s private networks. Any other SIP servers must be on the WAN. So for example you could have a Back-to-Back User Agent such as the IPPBX x6004 or an asterisk PBX on the DMZ or on the LAN but not on both. • Using the SIP ALG allows you to use bandwidth management on SIP traffic. Bandwidth management can be applied to FTP ALG traffic. Use the option in the Configuration > BWM screen to configure the highest bandwidth available for SIP traffic.• The SIP ALG handles SIP calls that go through NAT or that the USG routes. You can also make other SIP calls that do not go through NAT or routing. Examples would be calls between LAN IP addresses that are on the same subnet.• The SIP ALG supports peer-to-peer SIP calls. The security policy (by default) allows peer to peer calls from the LAN zone to go to the WAN zone and blocks peer to peer calls from the WAN zone to the LAN zone.• The SIP ALG allows UDP packets with a specified port destination to pass through.• The USG allows SIP audio connections.• You do not need to use TURN (Traversal Using Relay NAT) for VoIP devices behind the USG when you enable the SIP ALG.

Chapter 14 ALGUSG20(W)-VPN Series User’s Guide268Peer-to-Peer Calls and the USGThe USG ALG can allow peer-to-peer VoIP calls for both H.323 and SIP. You must configure the security policy and NAT (port forwarding) to allow incoming (peer-to-peer) calls from the WAN to a private IP address on the LAN (or DMZ). VoIP Calls from the WAN with Multiple Outgoing CallsWhen you configure the security policy and NAT (port forwarding) to allow calls from the WAN to a specific IP address on the LAN, you can also use policy routing to have H.323 (or SIP) calls from other LAN or DMZ IP addresses go out through a different WAN IP address. The policy routing lets the USG correctly forward the return traffic for the calls initiated from the LAN IP addresses. For example, you configure the security policy and NAT to allow LAN IP address A to receive calls from the Internet through WAN IP address 1. You also use a policy route to have LAN IP address Amake calls out through WAN IP address 1. Configure another policy route to have H.323 (or SIP) calls from LAN IP addresses B and C go out through WAN IP address 2. Even though only LAN IP address Acan receive incoming calls from the Internet, LAN IP addresses B and C can still make calls out to the Internet. Figure 178 VoIP Calls from the WAN with Multiple Outgoing CallsVoIP with Multiple WAN IP AddressesWith multiple WAN IP addresses on the USG, you can configure different security policy and NAT (port forwarding) rules to allow incoming calls from each WAN IP address to go to a specific IP address on the LAN (or DMZ). Use policy routing to have the H.323 (or SIP) calls from each of those LAN or DMZ IP addresses go out through the same WAN IP address that calls come in on. The policy routing lets the USG correctly forward the return traffic for the calls initiated from the LAN IP addresses.For example, you configure security policy and NAT rules to allow LAN IP address A to receive calls through public WAN IP address 1. You configure different security policy and port forwarding rules to allow LAN IP address B to receive calls through public WAN IP address 2. You configure corresponding policy routes to have calls from LAN IP address Ago out through WAN IP address 1 and calls from LAN IP address B go out through WAN IP address 2.

Chapter 14 ALGUSG20(W)-VPN Series User’s Guide269Figure 179 VoIP with Multiple WAN IP Addresses14.1.2 Before You BeginYou must also configure the security policy and enable NAT in the USG to allow sessions initiated from the WAN.14.2 The ALG Screen Click Configuration > Network > ALG to open the ALG screen. Use this screen to turn ALGs off or on, configure the port numbers to which they apply, and configure SIP ALG time outs. Figure 180 Configuration > Network > ALG

Chapter 14 ALGUSG20(W)-VPN Series User’s Guide270The following table describes the labels in this screen. Table 108 Configuration > Network > ALGLABEL DESCRIPTIONEnable SIP ALG Turn on the SIP ALG to detect SIP traffic and help build SIP sessions through the USG’s NAT.Enable SIP TransformationsSelect this to have the USG modify IP addresses and port numbers embedded in the SIP data payload. You do not need to use this if you have a SIP device or server that will modify IP addresses and port numbers embedded in the SIP data payload.Enable Configure SIP Inactivity TimeoutSelect this option to have the USG apply SIP media and signaling inactivity time out limits. SIP Media Inactivity TimeoutUse this field to set how many seconds (1~86400) the USG will allow a SIP session to remain idle (without voice traffic) before dropping it.If no voice packets go through the SIP ALG before the timeout period expires, the USG deletes the audio session. You cannot hear anything and you will need to make a new call to continue your conversation.SIP Signaling Inactivity TimeoutMost SIP clients have an “expire” mechanism indicating the lifetime of signaling sessions. The SIP user agent sends registration packets to the SIP server periodically and keeps the session alive in the USG. If the SIP client does not have this mechanism and makes no calls during the USG SIP timeout, the USG deletes the signaling session after the timeout period. Enter the SIP signaling session timeout value (1~86400).Restrict Peer to Peer Signaling ConnectionA signaling connection is used to set up the SIP connection.Enable this if you want signaling connections to only arrive from the IP address(es) you registered with. Signaling connections from other IP addresses will be dropped.Restrict Peer to Peer Media ConnectionA media connection is the audio transfer in a SIP connection.Enable this if you want media connections to only arrive from the IP address(es) you registered with. Media connections from other IP addresses will be dropped.SIP Signaling Port If you are using a custom UDP port number (not 5060) for SIP traffic, enter it here. Use the Add icon to add fields if you are also using SIP on additional UDP port numbers.Additional SIP Signaling Port (UDP) for TransformationsIf you are also using SIP on an additional UDP port number, enter it here.Enable H.323 ALG Turn on the H.323 ALG to detect H.323 traffic (used for audio communications) and help build H.323 sessions through the USG’s NAT.Enable H.323 TransformationsSelect this to have the USG modify IP addresses and port numbers embedded in the H.323 data payload. You do not need to use this if you have a H.323 device or server that will modify IP addresses and port numbers embedded in the H.323 data payload.H.323 Signaling Port If you are using a custom TCP port number (not 1720) for H.323 traffic, enter it here. Additional H.323 Signaling Port for TransformationsIf you are also using H.323 on an additional TCP port number, enter it here. Enable FTP ALG Turn on the FTP ALG to detect FTP (File Transfer Program) traffic and help build FTP sessions through the USG’s NAT.

Chapter 14 ALGUSG20(W)-VPN Series User’s Guide27114.3 ALG Technical ReferenceHere is more detailed information about the Application Layer Gateway.ALGSome applications cannot operate through NAT (are NAT un-friendly) because they embed IP addresses and port numbers in their packets’ data payload. The USG examines and uses IP address and port number information embedded in the VoIP traffic’s data stream. When a device behind the USG uses an application for which the USG has VoIP pass through enabled, the USG translates the device’s private IP address inside the data stream to a public IP address. It also records session port numbers and allows the related sessions to go through the security policy so the application’s traffic can come in from the WAN to the LAN. ALG and TrunksIf you send your ALG-managed traffic through an interface trunk and all of the interfaces are set to active, you can configure routing policies to specify which interface the ALG-managed traffic uses.You could also have a trunk with one interface set to active and a second interface set to passive. The USG does not automatically change ALG-managed connections to the second (passive) interface when the active interface’s connection goes down. When the active interface’s connection fails, the client needs to re-initialize the connection through the second interface (that was set to passive) in order to have the connection go through the second interface. VoIP clients usually re-register automatically at set intervals or the users can manually force them to re-register.FTPFile Transfer Protocol (FTP) is an Internet file transfer service that operates on the Internet and over TCP/IP networks. A system running the FTP server accepts commands from a system running an FTP client. The service allows users to send commands to the server for uploading and downloading files. Enable FTP TransformationsSelect this option to have the USG modify IP addresses and port numbers embedded in the FTP data payload to match the USG’s NAT environment. Clear this option if you have an FTP device or server that will modify IP addresses and port numbers embedded in the FTP data payload to match the USG’s NAT environment.FTP Signaling Port If you are using a custom TCP port number (not 21) for FTP traffic, enter it here. Additional FTP Signaling Port for TransformationsIf you are also using FTP on an additional TCP port number, enter it here. Apply Click Apply to save your changes back to the USG.Reset Click Reset to return the screen to its last-saved settings. Table 108 Configuration > Network > ALG (continued)LABEL DESCRIPTION

Chapter 14 ALGUSG20(W)-VPN Series User’s Guide272H.323H.323 is a standard teleconferencing protocol suite that provides audio, data and video conferencing. It allows for real-time point-to-point and multipoint communication between client computers over a packet-based network that does not provide a guaranteed quality of service. NetMeeting uses H.323.SIPThe Session Initiation Protocol (SIP) is an application-layer control (signaling) protocol that handles the setting up, altering and tearing down of voice and multimedia sessions over the Internet. SIP is used in VoIP (Voice over IP), the sending of voice signals over the Internet Protocol.SIP signaling is separate from the media for which it handles sessions. The media that is exchanged during the session can use a different path from that of the signaling. SIP handles telephone calls and can interface with traditional circuit-switched telephone networks.RTPWhen you make a VoIP call using H.323 or SIP, the RTP (Real time Transport Protocol) is used to handle voice data transfer. See RFC 1889 for details on RTP.

USG20(W)-VPN Series User’s Guide273CHAPTER 15UPnP15.1 UPnP and NAT-PMP Overview The USG supports both UPnP and NAT-PMP to permit networking devices to discover each other and connect seamlessly.Universal Plug and Play (UPnP) is a distributed, open networking standard that uses TCP/IP for simple peer-to-peer network connectivity between devices. A UPnP device can dynamically join a network, obtain an IP address, convey its capabilities and learn about other devices on the network. In turn, a device can leave a network smoothly and automatically when it is no longer in use. A gateway that supports UPnP is called Internet Gateway Device (IGD). The standardized Device Control Protocol (DCP) is defined by the UPnP Forum for IGDs to configure port mapping automatically.NAT Port Mapping Protocol (NAT-PMP), introduced by Apple and implemented in current Apple products, is used as an alternative NAT traversal solution to the UPnP IGD protocol. NAT-PMP runs over UDP port 5351. NAT-PMP is much simpler than UPnP IGD and mainly designed for small home networks. It allows a client behind a NAT router to retrieve the router’s public IP address and port number and make them known to the peer device with which it wants to communicate. The client can automatically configure the NAT router to create a port mapping to allow the peer to contact it. 15.2 What You Need to KnowUPnP hardware is identified as an icon in the Network Connections folder (Windows XP). Each UPnP compatible device installed on your network will appear as a separate icon. Selecting the icon of a UPnP device will allow you to access the information and properties of that device. 15.2.1 NAT TraversalUPnP NAT traversal automates the process of allowing an application to operate through NAT. UPnP network devices can automatically configure network addressing, announce their presence in the network to other UPnP devices and enable exchange of simple product and service descriptions. NAT traversal allows the following:• Dynamic port mapping• Learning public IP addresses• Assigning lease times to mappingsWindows Messenger is an example of an application that supports NAT traversal and UPnP. See the NAT chapter for more information on NAT.

Chapter 15 UPnPUSG20(W)-VPN Series User’s Guide27415.2.2 Cautions with UPnP and NAT-PMPThe automated nature of NAT traversal applications in establishing their own services and opening security policy ports may present network security issues. Network information and configuration may also be obtained and modified by users in some network environments. When a UPnP or NAT-PMP device joins a network, it announces its presence with a multicast message. For security reasons, the USG allows multicast messages on the LAN only.All UPnP-enabled or NAT-PMP-enabled devices may communicate freely with each other without additional configuration. Disable UPnP or NAT-PMP if this is not your intention. 15.3 UPnP Screen Use this screen to enable UPnP and NAT-PMP on your USG.Click Configuration > Network > UPnP to display the screen shown next. Figure 181 Configuration > Network > UPnP

Chapter 15 UPnPUSG20(W)-VPN Series User’s Guide275The following table describes the fields in this screen. 15.4 Technical ReferenceThe sections show examples of using UPnP. 15.4.1 Turning on UPnP in Windows 7 ExampleThis section shows you how to use the UPnP feature in Windows 7. UPnP server is installed in Windows 7. Activate UPnP on the USG.Make sure the computer is connected to a LAN port of the USG. Turn on your computer and the USG. 1Click the start icon, Control Panel and then the Network and Sharing Center.Table 109 Configuration > Network > UPnPLABEL DESCRIPTIONEnable UPnP Select this check box to activate UPnP on the USG. Be aware that anyone could use a UPnP application to open the web configurator's login screen without entering the USG's IP address (although you must still enter the password to access the web configurator).Enable NAT-PMP NAT Port Mapping Protocol (NAT-PMP) automates port forwarding to allow a computer in a private network (behind the USG) to automatically configure the USG to allow computers outside the private network to contact it.Select this check box to activate NAT-PMP on the USG. Be aware that anyone could use a NAT-PMP application to open the web configurator's login screen without entering the USG's IP address (although you must still enter the password to access the web configurator).Allow UPnP or NAT-PMP to pass through FirewallSelect this check box to allow traffic from UPnP-enabled or NAT-PMP-enabled applications to bypass the security policy. Clear this check box to have the security policy block all UPnP or NAT-PMP application packets (for example, MSN packets).Outgoing WAN Interface Select through which WAN interface(s) you want to send out traffic from UPnP-enabled or NAT-PMP-enabled applications. If the WAN interface you select loses its connection, the USG attempts to use the other WAN interface. If the other WAN interface also does not work, the USG drops outgoing packets from UPnP-enabled or NAT-PMP-enabled applications.Support LAN List The Available list displays the name(s) of the internal interface(s) on which the USG supports UPnP and/or NAT-PMP. To enable UPnP and/or NAT-PMP on an interface, you can double-click a single entry to move it or use the [Shift] or [Ctrl] key to select multiple entriess and click the right arrow button to add to the Member list. To remove an interface, select the name(s) in the Member list and click the left arrow button.Apply Click Apply to save your changes back to the USG.Reset Click Reset to return the screen to its last-saved settings.

Chapter 15 UPnPUSG20(W)-VPN Series User’s Guide2762Click Change Advanced Sharing Settings.3Select Turn on network discovery and click Save Changes. Network discovery allows your computer to find other computers and devices on the network and other computers on the network to find your computer. This makes it easier to share files and printers.

Chapter 15 UPnPUSG20(W)-VPN Series User’s Guide27715.4.2 Using UPnP in Windows XP ExampleThis section shows you how to use the UPnP feature in Windows XP. You must already have UPnP installed in Windows XP and UPnP activated on the USG.Make sure the computer is connected to a LAN port of the USG. Turn on your computer and the USG. 15.4.2.1 Auto-discover Your UPnP-enabled Network Device1Click start and Control Panel. Double-click Network Connections. An icon displays under Internet Gateway.2Right-click the icon and select Properties. Figure 182 Network Connections3In the Internet Connection Properties window, click Settings to see the port mappings there were automatically created. Figure 183 Internet Connection Properties 4You may edit or delete the port mappings or click Add to manually add port mappings.

Chapter 15 UPnPUSG20(W)-VPN Series User’s Guide278Figure 184 Internet Connection Properties: Advanced SettingsFigure 185 Internet Connection Properties: Advanced Settings: AddNote: When the UPnP-enabled device is disconnected from your computer, all port mappings will be deleted automatically.5Select Show icon in notification area when connected option and click OK. An icon displays in the system tray. Figure 186 System Tray Icon6Double-click on the icon to display your current Internet connection status.

Chapter 15 UPnPUSG20(W)-VPN Series User’s Guide279Figure 187 Internet Connection Status15.4.3 Web Configurator Easy AccessWith UPnP, you can access the web-based configurator on the USG without finding out the IP address of the USG first. This comes helpful if you do not know the IP address of the USG.Follow the steps below to access the web configurator.1Click Start and then Control Panel. 2Double-click Network Connections. 3Select My Network Places under Other Places.

Chapter 15 UPnPUSG20(W)-VPN Series User’s Guide280Figure 188 Network Connections4An icon with the description for each UPnP-enabled device displays under Local Network. 5Right-click on the icon for your USG and select Invoke. The web configurator login screen displays. Figure 189 Network Connections: My Network Places6Right-click on the icon for your USG and select Properties. A properties window displays with basic information about the USG.

Chapter 15 UPnPUSG20(W)-VPN Series User’s Guide281Figure 190 Network Connections: My Network Places: Properties: Example

USG20(W)-VPN Series User’s Guide282CHAPTER 16IP/MAC Binding16.1 IP/MAC Binding OverviewIP address to MAC address binding helps ensure that only the intended devices get to use privileged IP addresses. The USG uses DHCP to assign IP addresses and records the MAC address it assigned to each IP address. The USG then checks incoming connection attempts against this list. A user cannot manually assign another IP to his computer and use it to connect to the USG. Suppose you configure access privileges for IP address 192.168.1.27 and use static DHCP to assign it to Tim’s computer’s MAC address of 12:34:56:78:90:AB. IP/MAC binding drops traffic from any computer trying to use IP address 192.168.1.27 with another MAC address.Figure 191 IP/MAC Binding Example 16.1.1 What You Can Do in this Chapter•Use the Summary and Edit screens (Section 16.2 on page 283) to bind IP addresses to MAC addresses.•Use the Exempt List screen (Section 16.3 on page 285) to configure ranges of IP addresses to which the USG does not apply IP/MAC binding.16.1.2 What You Need to KnowDHCPIP/MAC address bindings are based on the USG’s dynamic and static DHCP entries.MAC: 12:34:56:78:90:ABTim IP: 192.168.1.27MAC: AB:CD:EF:12:34:56JimIP: 192.168.1.27

Chapter 16 IP/MAC BindingUSG20(W)-VPN Series User’s Guide283Interfaces Used With IP/MAC BindingIP/MAC address bindings are grouped by interface. You can use IP/MAC binding with Ethernet, bridge, VLAN, and WLAN interfaces. You can also enable or disable IP/MAC binding and logging in an interface’s configuration screen.16.2 IP/MAC Binding SummaryClick Configuration > Network > IP/MAC Binding to open the IP/MAC Binding Summary screen. This screen lists the total number of IP to MAC address bindings for devices connected to each supported interface.Figure 192 Configuration > Network > IP/MAC Binding > Summary The following table describes the labels in this screen. 16.2.1 IP/MAC Binding EditClick Configuration > Network > IP/MAC Binding > Edit to open the IP/MAC Binding Edit screen. Use this screen to configure an interface’s IP to MAC address binding settings. Table 110 Configuration > Network > IP/MAC Binding > Summary LABEL DESCRIPTIONEdit Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings. Activate To turn on an entry, select it and click Activate.Inactivate To turn off an entry, select it and click Inactivate.# This field is a sequential value, and it is not associated with a specific entry.Status This icon is lit when the entry is active and dimmed when the entry is inactive.Interface This is the name of an interface that supports IP/MAC binding.Number of BindingThis field displays the interface’s total number of IP/MAC bindings and IP addresses that the interface has assigned by DHCP. Apply Click Apply to save your changes back to the USG.

Chapter 16 IP/MAC BindingUSG20(W)-VPN Series User’s Guide284Figure 193 Configuration > Network > IP/MAC Binding > Edit The following table describes the labels in this screen.16.2.2 Static DHCP EditClick Configuration > Network > IP/MAC Binding > Edit to open the IP/MAC Binding Edit screen. Click the Add or Edit icon to open the following screen. Use this screen to configure an interface’s IP to MAC address binding settings.Table 111 Configuration > Network > IP/MAC Binding > Edit LABEL DESCRIPTIONIP/MAC Binding SettingsInterface Name This field displays the name of the interface within the USG and the interface’s IP address and subnet mask.Enable IP/MAC Binding Select this option to have this interface enforce links between specific IP addresses and specific MAC addresses. This stops anyone else from manually using a bound IP address on another device connected to this interface. Use this to make use only the intended users get to use specific IP addresses.Enable Logs for IP/MAC Binding Violation Select this option to have the USG generate a log if a device connected to this interface attempts to use an IP address not assigned by the USG.Static DHCP Bindings This table lists the bound IP and MAC addresses. The USG checks this table when it assigns IP addresses. If the computer’s MAC address is in the table, the USG assigns the corresponding IP address. You can also access this table from the interface’s edit screen.Add Click this to create a new entry.Edit Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings. Remove To remove an entry, select it and click Remove. The USG confirms you want to remove it before doing so.#This is the index number of the static DHCP entry.IP Address This is the IP address that the USG assigns to a device with the entry’s MAC address.MAC Address This is the MAC address of the device to which the USG assigns the entry’s IP address.Description This helps identify the entry. OK Click OK to save your changes back to the USG.Cancel Click Cancel to exit this screen without saving.

Chapter 16 IP/MAC BindingUSG20(W)-VPN Series User’s Guide285Figure 194 Configuration > Network > IP/MAC Binding > Edit > Add The following table describes the labels in this screen. 16.3 IP/MAC Binding Exempt ListClick Configuration > Network > IP/MAC Binding > Exempt List to open the IP/MACBinding Exempt List screen. Use this screen to configure ranges of IP addresses to which the USG does not apply IP/MAC binding. Figure 195 Configuration > Network > IP/MAC Binding > Exempt List The following table describes the labels in this screen.Table 112 Configuration > Network > IP/MAC Binding > Edit > Add LABEL DESCRIPTIONInterface Name This field displays the name of the interface within the USG and the interface’s IP address and subnet mask.IP Address Enter the IP address that the USG is to assign to a device with the entry’s MAC address.MAC Address Enter the MAC address of the device to which the USG assigns the entry’s IP address.Description Enter up to 64 printable ASCII characters to help identify the entry. For example, you may want to list the computer’s owner.OK Click OK to save your changes back to the USG.Cancel Click Cancel to exit this screen without saving.Table 113 Configuration > Network > IP/MAC Binding > Exempt List LABEL DESCRIPTIONAdd Click this to create a new entry.Edit Click an entry or select it and click Edit to modify the entry’s settings. Remove To remove an entry, select it and click Remove. The USG confirms you want to remove it before doing so.

Chapter 16 IP/MAC BindingUSG20(W)-VPN Series User’s Guide286#This is the index number of the IP/MAC binding list entry.Name Enter a name to help identify this entry.Start IP Enter the first IP address in a range of IP addresses for which the USG does not apply IP/MAC binding.End IP Enter the last IP address in a range of IP addresses for which the USG does not apply IP/MAC binding.Add icon Click the Add icon to add a new entry.Click the Remove icon to delete an entry. A window displays asking you to confirm that you want to delete it. Apply Click Apply to save your changes back to the USG.Table 113 Configuration > Network > IP/MAC Binding > Exempt List (continued)LABEL DESCRIPTION

USG20(W)-VPN Series User’s Guide287CHAPTER 17Layer 2 Isolation17.1 OverviewLayer-2 isolation is used to prevent connected devices from communicating with each other in the USG’s local network(s), except for the devices in the white list, when layer-2 isolation is enabled on the USG and the local interface(s).Note: The security policy control must be enabled before you can use layer-2 isolation. In the following example, layer-2 isolation is enabled on the USG’s interface Vlan1. A printer, PC and AP are in the Vlan1. The IP address of network printer (C) is added to the white list. With this setting, the connected AP then cannot communicate with the PC (D), but can access the network printer (C), server (B), wireless client (A) and the Internet.Figure 196 Layer-2 Isolation Application17.1.1 What You Can Do in this Chapter•Use the General screen (Section 17.2 on page 288) to enable layer-2 isolation on the USG and the internal interface(s).•Use the White List screen (Section 17.3 on page 288) to enable and configures the white list.

Chapter 17 Layer 2 IsolationUSG20(W)-VPN Series User’s Guide28817.2 Layer-2 Isolation General Screen This screen allows you to enable Layer-2 isolation on the USG and specific internal interface(s). To access this screen click Configuration > Network > Layer 2 Isolation.Figure 197 Configuration > Network > Layer 2 Isolation The following table describes the labels in this screen. 17.3 White List ScreenIP addresses that are not listed in the white list are blocked from communicating with other devices in the layer-2-isolation-enabled internal interface(s) except for broadcast packets. To access this screen click Configuration > Network > Layer 2 Isolation > White List.Table 114 Configuration > Network > Layer 2 IsolationLABEL DESCRIPTIONEnable Layer2 IsolationSelect this option to turn on the layer-2 isolation feature on the USG. Note: You can enable this feature only when the security policy is enabled.Member List The Available list displays the name(s) of the internal interface(s) on which you can enable layer-2 isolation. To enable layer-2 isolation on an interface, you can double-click a single entry to move it or use the [Shift] or [Ctrl] key to select multiple entriess and click the right arrow button to add to the Member list. To remove an interface, select the name(s) in the Member list and click the left arrow button.Apply Click Apply to save your changes back to the USG.Reset Click Reset to return the screen to its last-saved settings.

Chapter 17 Layer 2 IsolationUSG20(W)-VPN Series User’s Guide289Figure 198 Configuration > Network > Layer 2 Isolation > White List The following table describes the labels in this screen. 17.3.1 Add/Edit White List Rule This screen allows you to create a new rule in the white list or edit an existing one. To access this screen, click the Add button or select an entry from the list and click the Edit button.Note: You can configure up to 100 white list rules on the USG.Note: You need to know the IP address of each connected device that you want to allow to be accessed by other devices when layer-2 isolation is enabled.Table 115 Configuration > Network > Layer 2 Isolation > White ListLABEL DESCRIPTIONEnable White List Select this option to turn on the white list on the USG. Note: You can enable this feature only when the security policy is enabled.Add Click this to add a new rule.Edit Click this to edit the selected rule.Remove Click this to remove the selected rule.Activate To turn on an entry, select it and click Activate.Inactivate To turn off an entry, select it and click Inactivate.# This field is a sequential value, and it is not associated with a specific rule.Status This icon is lit when the rule is active and dimmed when the rule is inactive.IP Address This field displays the IP address of device that can be accessed by the devices connected to an internal interface on which layer-2 isolation is enabled.Description This field displays the description for the IP address in this rule.Apply Click Apply to save your changes back to the USG.Reset Click Reset to return the screen to its last-saved settings.

Chapter 17 Layer 2 IsolationUSG20(W)-VPN Series User’s Guide290Figure 199 Configuration > Network > Layer 2 Isolation > White List > Add/EditThe following table describes the labels in this screen. Table 116 Configuration > Network > Layer 2 Isolation > White List > Add/EditLABEL DESCRIPTIONEnable Select this option to turn on the rule.Host IP Address Enter an IPv4 address associated with this rule.Description Specify a description for the IP address associated with this rule. Enter up to 60 characters, spaces and underscores allowed.OK Click OK to save your changes back to the USG.Cancel Click Cancel to exit this screen without saving your changes.

USG20(W)-VPN Series User’s Guide291CHAPTER 18Inbound Load Balancing18.1 Inbound Load Balancing OverviewInbound load balancing enables the USG to respond to a DNS query message!with a different IP address for DNS name resolution. The USG checks which member interface has the least load and responds to the DNS query message with the interface’s IP address.In the following figure, an Internet host (A) sends a DNS query message to the DNS server (D) in order to resolve a domain name of www.example.com. DNS server D redirects it to the USG (Z)’s WAN1 with an IP address of 1.1.1.1. The USG receives the DNS query message and responds to it with the WAN2’s IP address, 2.2.2.2, because the WAN2 has the least load at that moment.Another Internet host (B) also sends a DNS query message to ask where www.example.com is. The USG responds to it with the WAN1’s IP address, 1.1.1.1, since WAN1 has the least load this time.Figure 200 DNS Load Balancing Example18.1.1 What You Can Do in this Chapter•Use the Inbound LB screen (see Section 18.2 on page 292) to view a list of the configured DNS load balancing rules.•Use the Inbound LB Add/Edit screen (see Section 18.2.1 on page 293) to add or edit a DNS load balancing rule.InternetWhere is www.example.com?Ask 1.1.1.1.A:D:AD1.1.1.12.2.2.2WZWhere is www.example.com?It’s 2.2.2.2.A:Z:123InternetBD1.1.1.12.2.2.2WZ123Where is www.example.com?Ask 1.1.1.1.B:D:Where is www.example.com?It’s 1.1.1.1B:Z:

Chapter 18 Inbound Load BalancingUSG20(W)-VPN Series User’s Guide29218.2 The Inbound LB ScreenThe Inbound LB screen provides a summary of all DNS load balancing rules and the details. You can also use this screen to add, edit, or remove the rules. Click Configuration > Network > Inbound LB to open the following screen.Note: After you finish the inbound load balancing settings, go to security policy and NAT screens to configure the corresponding rule and virtual server to allow the Internet users to access your internal servers.Figure 201 Configuration > Network > DNS Inbound LB The following table describes the labels in this screen. Table 117 Configuration > Network > Inbound LBLABEL DESCRIPTIONGlobal SettingEnable DNS Load BalancingSelect this to enable DNS load balancing.ConfigurationAdd Click this to create a new entry.Edit Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings. Remove To remove an entry, select it and click Remove. The USG confirms you want to remove it before doing so.Activate To turn on an entry, select it and click Activate.Inactivate To turn off an entry, select it and click Inactivate.Move To move an entry to a different number in the list, click the Move icon. In the field that appears, specify the number to which you want to move the entry.Status This icon is lit when the entry is active and dimmed when the entry is inactive.Priority This field displays the order in which the USG checks the member interfaces of this DNS load balancing rule.Query Domain Name This field displays the domain name for which the USG manages load balancing between the specified interfaces.Query From Address This field displays the source IP address of the DNS query messages to which the USG applies the DNS load balancing rule.Query From Zone The USG applies the DNS load balancing rule to the query messages received from this zone.

Chapter 18 Inbound Load BalancingUSG20(W)-VPN Series User’s Guide29318.2.1 The Inbound LB Add/Edit ScreenThe Add DNS Load Balancing screen allows you to add a domain name for which the USG manages load balancing between the specified interfaces. You can configure the USG to apply DNS load balancing to some specific hosts only by configuring the Query From settings. Click Configuration > Network > Inbound LB and then the Add or Edit icon to open this screen.Figure 202 Configuration > Network > Inbound LB > Add Load Balancing Member This field displays the member interfaces which the USG manages for load balancing.Algorithm This field displays the load balancing method the USG uses for this DNS load balancing rule.Weighted Round Robin - Each member interface is assigned a weight. An interface with a larger weight gets more chances to transmit traffic than an interface with a smaller weight. For example, if the weight ratio of wan1 and wan2 interfaces is 2:1, the USG chooses wan1 for 2 sessions’ traffic and wan2 for 1 session’s traffic in each round of 3 new sessions.Least Connection - The USG chooses choose a member interface which is handling the least number of sessions.Least Load - Outbound - The USG chooses a member interface which is handling the least amount of outgoing traffic.Least Load - Inbound - The USG chooses a member interface which is handling the least amount of incoming traffic.Least Load - Total - The USG chooses a member interface which is handling the least amount of outgoing and incoming traffic.Apply Click this button to save your changes to the USG. Reset Click this button to return the screen to its last-saved settings. Table 117 Configuration > Network > Inbound LB (continued)LABEL DESCRIPTION

Chapter 18 Inbound Load BalancingUSG20(W)-VPN Series User’s Guide294The following table describes the labels in this screen. Table 118 Configuration > Network > Inbound LB > Add/EditLABEL DESCRIPTIONCreate New Object Use this to configure any new setting objects that you need to use in this screen.General SettingsEnable Select this to enable this DNS load balancing rule.DNS SettingQuery Domain Name Type up to 255 characters for a domain name for which you want the USG to manage DNS load balancing. You can use a wildcard (*) to let multiple domains match the name. For example, use *.example.com to specify any domain name that ends with “example.com” would match.Time to Live Enter the number of seconds the USG recommends DNS request hosts to keep the DNS entry in their caches before removing it. Enter 0 to have the USG not recommend this so the DNS request hosts will follow their DNS server’s TTL setting.Query From SettingIP Address Enter the IP address of a computer or a DNS server which makes the DNS queries upon which to apply this rule.DNS servers process client queries using recursion or iteration:• In recursion, DNS servers make recursive queries on behalf of clients. So you have to configure this field to the DNS server’s IP address when recursion is used.• In iteration, a client asks the DNS server and expects the best and immediate answer without the DNS server contacting other DNS servers. If the primary DNS server cannot provide the best answer, the client makes iteration queries to other configured DNS servers to resolve the name. You have to configure this field to the client’s IP address when iteration is used.Zone Select the zone of DNS query messages upon which to apply this rule.Load Balancing MemberLoad Balancing Algorithm Select a load balancing method to use from the drop-down list box.Select Weighted Round Robin to balance the traffic load between interfaces based on their respective weights. An interface with a larger weight gets more chances to transmit traffic than an interface with a smaller weight. For example, if the weight ratio of wan1 and wan2 interfaces is 2:1, the USG chooses wan1 for 2 sessions’ traffic and wan2 for every session’s traffic in each round of 3 new sessions. Select Least Connection to have the USG choose the member interface which is handling the least number of sessions.Select Least Load - Outbound to have the USG choose the member interface which is handling the least amount of outgoing traffic.Select Least Load - Inbound to have the USG choose the member interface which is handling the least amount of incoming traffic.Select Least Load - Total to have the USG choose the member interface which is handling the least amount of outgoing and incoming traffic.Failover IP Address Enter an alternate IP address with which the USG will respond to a DNS query message when the load balancing algorithm cannot find any available interface.Add Click this to create a new member interface for this rule.Edit Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings.

Chapter 18 Inbound Load BalancingUSG20(W)-VPN Series User’s Guide29518.2.2 The Inbound LB Member Add/Edit ScreenThe Add Load Balancing Member screen allows you to add a member interface for the DNS load balancing rule. Click Configuration > Network > Inbound LB > Add or Edit and then an Add or Edit icon to open this screen.Figure 203 Configuration > Network > Inbound LB > Add/Edit > Add The following table describes the labels in this screen. Remove To remove an entry, select it and click Remove. The USG confirms you want to remove it before doing so.# This field displays the order in which the USG checks this rule’s member interfaces.IP Address This field displays the IP address of the member interface.Monitor Interface This field displays the name of the member interface. The USG manages load balancing between the member interfaces.Weight This field is available if you selected Weighted Round Robin as the load balancing algorithm. This field displays the weight of the member interface. An interface with a larger weight gets more chances to transmit traffic than an interface with a smaller weight.OK Click OK to save your changes back to the USG.Cancel Click Cancel to exit this screen without saving.Table 118 Configuration > Network > Inbound LB > Add/Edit (continued)LABEL DESCRIPTIONTable 119 Configuration > Network > Inbound LB > Add/Edit > Add/EditLABEL DESCRIPTIONMember The USG checks each member interface’s loading in the order displayed here.Monitor Interface Select an interface to associate it with the DNS load balancing rule. This field also displays whether the IP address is a static IP address (Static), dynamically assigned (Dynamic) or obtained from a DHCP server (DHCP Client), as well as the IP address and subnet mask.Weight This field is available if you selected Weighted Round Robin for the load balancing algorithm. Specify the weight of the member interface. An interface with a larger weight gets more chances to transmit traffic than an interface with a smaller weight.IP Address

Chapter 18 Inbound Load BalancingUSG20(W)-VPN Series User’s Guide296Same as Monitor InterfaceSelect this to send the IP address displayed in the Monitor Interface field to the DNS query senders.Custom Select this and enter another IP address to send to the DNS query senders.OK Click OK to save your changes back to the USG.Cancel Click Cancel to exit this screen without saving.Table 119 Configuration > Network > Inbound LB > Add/Edit > Add/Edit (continued)LABEL DESCRIPTION

USG20(W)-VPN Series User’s Guide297CHAPTER 19Web Authentication19.1 Web Auth Overview Web authentication can intercept network traffic, according to the authentication policies, until the user authenticates his or her connection, usually through a specifically designated login web page. This means all web page requests can initially be redirected to a special web page that requires users to authenticate their sessions. Once authentication is successful, they can then connect to the rest of the network or Internet. As soon as a user attempt to open a web page, the USG reroutes his/her browser to a web portal page that prompts him/her to log in.Figure 204 Web Authentication ExampleThe web authentication page only appears once per authentication session. Unless a user session times out or he/she closes the connection, he or she generally will not see it again during the same session.19.1.1 What You Can Do in this Chapter•Use the Configuration > Web Authentication screens (Section 19.2 on page 298) to create and manage web authentication policies.•Use the Configuration > Web Authentication > SSO screen (Section 19.3 on page 302) to configure how the USG communictates with a Single Sign-On agent.

Chapter 19 Web AuthenticationUSG20(W)-VPN Series User’s Guide29819.1.2 What You Need to KnowSingle Sign-OnA SSO (Single Sign On) agent integrates Domain Controller and USG authentication mechanisms, so that users just need to log in once (single) to get access to permitted resources.Forced User AuthenticationInstead of making users for which user-aware policies have been configured go to the USG Login screen manually, you can configure the USG to display the Login screen automatically whenever it routes HTTP traffic for anyone who has not logged in yet. Note: This works with HTTP traffic only. The USG does not display the Login screen when users attempt to send other kinds of traffic.The USG does not automatically route the request that prompted the login, however, so users have to make this request again.19.2 Web Authentication ScreenThe Web Authentication screen displays the web portal settings and web authentication policies you have configured on the USG. The screen differs depending on what you select in the Authentication field.Click Configuration > Web Authentication to display the screen.

Chapter 19 Web AuthenticationUSG20(W)-VPN Series User’s Guide299Figure 205 Configuration > Web Authentication (Web Portal) The following table gives an overview of the objects you can configure. Table 120 Configuration > Web Authentication LABEL DESCRIPTIONEnable Web Authentication Select Enable Web Authentication to turn on the web authentication feature. Once enabled, all network traffic is blocked until a client authenticates with the USG through the specifically designated web portal.Internal Web PortalSelect this to use the default login page built into the USG. If you later assign a custom login page, you can still return to the USG’s default page as it is saved indefinitely.The login page appears whenever the web portal intercepts network traffic, preventing unauthorized users from gaining access to the network.You can customize the login page built into the USG in the System > WWW > Login Page screen.External Web PortalSelect this to use a custom login page from an external web portal instead of the default one built into the USG. You can configure the look and feel of the web portal page.Login URL Specify the login page’s URL; for example, http://IIS server IP Address/login.html. The Internet Information Server (IIS) is the web server on which the web portal files are installed.Logout URL Specify the logout page’s URL; for example, http://IIS server IP Address/logout.html. The Internet Information Server (IIS) is the web server on which the web portal files are installed.Welcome URL Specify the welcome page’s URL; for example, http://IIS server IP Address/welcome.html. The Internet Information Server (IIS) is the web server on which the web portal files are installed.

Chapter 19 Web AuthenticationUSG20(W)-VPN Series User’s Guide300Session URL Specify the session page’s URL; for example, http://IIS server IP Address/session.html. The Internet Information Server (IIS) is the web server on which the web portal files are installed.Error URL Specify the error page’s URL; for example, http://IIS server IP Address/error.html. The Internet Information Server (IIS) is the web server on which the web portal files are installed.Download Click this to download an example web portal file for your reference.Exceptional ServicesUse this table to list services that users can access without logging in. In the list, select one or more entries and click Remove to delete it or them. Keeping DNS as a member allows users’ computers to resolve domain names into IP addresses. Click Add to add new services that users can access without logging in. Web Authentication Policy SummaryUse this table to manage the USG’s list of web authentication policies. Add Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry.Edit Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings. Remove To remove an entry, select it and click Remove. The USG confirms you want to remove it before doing so.Activate To turn on an entry, select it and click Activate.Inactivate To turn off an entry, select it and click Inactivate.Move To move an entry to a different number in the list, click the Move icon. In the field that appears, specify the number to which you want to move the interface.Status This icon is lit when the entry is active and dimmed when the entry is inactive.Priority This is the position of the authentication policy in the list. The priority is important as the policies are applied in order of priority. Default displays for the default authentication policy that the USG uses on traffic that does not match any exceptional service or other authentication policy. You can edit the default rule but not delete it.Source This displays the source address object to which this policy applies.Destination This displays the destination address object to which this policy applies.Schedule This field displays the schedule object that dictates when the policy applies. none means the policy is active at all times if enabled.Authentication This field displays the authentication requirement for users when their traffic matches this policy. unnecessary - Users do not need to be authenticated.required - Users need to be authenticated. They must manually go to the login screen. The USG will not redirect them to the login screen.force - Users need to be authenticated. The USG automatically displays the login screen whenever it routes HTTP traffic for users who have not logged in yet. Description If the entry has a description configured, it displays here. This is n/a for the default policy.Apply Click this button to save your changes to the USG. Reset Click this button to return the screen to its last-saved settings. Table 120 Configuration > Web Authentication (continued) LABEL DESCRIPTION

Chapter 19 Web AuthenticationUSG20(W)-VPN Series User’s Guide30119.2.1 Creating Exceptional ServicesThis screen lists services that users can access without logging in. Click Add under ExceptionalServices in the previous screen to display this screen. You can change the list’s membership here. Available services appear on the left. Select any services you want users to be able to access without logging in and click the right arrow button -> to add them. The member services are on the right. Select any service that you want to remove from the member list, and click the left arrow <- button to remove them. Then click OK to apply the changes and return to the main WebAuthentication screen. Alternatively, click Cancel to discard the changes and return to the main Web Authentication screen.Figure 206 Configuration > Web Authentication > Add Exceptional Service19.2.2 Creating/Editing an Authentication PolicyClick Configuration > Web Authentication and then the Add (or Edit) icon in the WebAuthentication Policy Summary section to open the Auth. Policy Add/Edit screen. Use this screen to configure an authentication policy.Figure 207 Configuration > Web Authentication > Add Authentication Policy

Chapter 19 Web AuthenticationUSG20(W)-VPN Series User’s Guide302The following table gives an overview of the objects you can configure. 19.3 SSO OverviewThe SSO (Single Sign-On) function integrates Domain Controller and USG authentication mechanisms, so that users just need to log in once (single login) to get access to permitted resources.In the following figure, U user logs into a Domain Controller (DC) which passes the user’s login credentials to the SSO agent. The SSO agent checks that these credentials are correct with the AD server, and if the AD server confirms so, the SSO then notifies the USG to allow access for the user to the permitted resource (Internet access, for example).Table 121 Configuration > Web Authentication > Add Authentication Policy LABEL DESCRIPTIONCreate new ObjectUse to configure any new settings objects that you need to use in this screen. Select Address or Schedule.Enable Policy Select this check box to activate the authentication policy. This field is available for user-configured policies.Description Enter a descriptive name of up to 60 printable ASCII characters for the policy. Spaces are allowed. This field is available for user-configured policies.User Authentication PolicyUse this section of the screen to determine which traffic requires (or does not require) the senders to be authenticated in order to be routed.Source Address Select a source address or address group for whom this policy applies. Select any if the policy is effective for every source. This is any and not configurable for the default policy.Destination AddressSelect a destination address or address group for whom this policy applies. Select any if the policy is effective for every destination. This is any and not configurable for the default policy.Schedule Select a schedule that defines when the policy applies. Otherwise, select none and the rule is always effective. This is none and not configurable for the default policy.Authentication Select the authentication requirement for users when their traffic matches this policy. unnecessary - Users do not need to be authenticated.required - Users need to be authenticated. If Force User Authentication is selected, all HTTP traffic from unauthenticated users is redirected to a default or user-defined login page. Otherwise, they must manually go to the login screen. The USG will not redirect them to the login screen.Single Sign-on This field is available for user-configured policies that require Single Sign-On (SSO). Select this to have the USG enable the SSO feature. You can set up this feature in the SSO screen. Force User AuthenticationThis field is available for user-configured policies that require authentication. Select this to have the USG automatically display the login screen when users who have not logged in yet try to send HTTP traffic. OK Click OK to save your changes back to the USG.Cancel Click Cancel to exit this screen without saving.

Chapter 19 Web AuthenticationUSG20(W)-VPN Series User’s Guide303Note: The USG, the DC, the SSO agent and the AD server must all be in the same domain and be able to communicate with each other.SSO does not support IPv6, LDAP or RADIUS; you must use it in an IPv4 network environment with Windows AD (Active Directory) authentication database.You must enable Web Authentication in the Configuration > Web Authentication screen.Figure 208 SSO Overview Install the SSO Agent on one of the following platforms: • Windows 7 Professional (32-bit and 64-bit)• Windows Server 2008 Enterprise (32-bit and 64-bit)• Windows 2008 R2 (64-bit)• Windows Server 2012 (64-bit)UUserDC Domain ControllerSSO Single Sign-On agentAD Active Directory

Chapter 19 Web AuthenticationUSG20(W)-VPN Series User’s Guide30419.4 SSO - USG ConfigurationThis section shows what you have to do on the USG in order to use SSO.19.4.1 Configuration OverviewThese are the screens you need to configure:•Configure the USG to Communicate with SSO on page 304•Enable Web Authentication on page 305•Create a Security Policy on page 306•Configure User Information on page 307•Configure an Authentication Method on page 308•Configure Active Directory on page 309 or Configure Active Directory on page 30919.4.2 Configure the USG to Communicate with SSOUse Configuration > Web Authentication > SSO to configure how the USG communicates with the Single Sign-On (SSO) agent.Table 122 USG - SSO Agent Field MappingUSG SSOSCREEN FIELD SCREEN FIELDWeb Authentication > SSOListen Port Agent Configuration Page > Gateway SettingGateway PortWeb Authentication > SSOPrimary Agent Port Agent Configuration PageAgent Listening PortObject > User/Group > User > AddGroup Identifier Agent Configuration Page > Configure LDAP/AD ServerGroup MembershipObject > AAA Server > Active Directory > AddBase DN Agent Configuration Page > Configure LDAP/AD ServerBase DNObject > AAA Server > Active Directory > AddBind DN Agent Configuration Page > Configure LDAP/AD ServerBind DNObject > User/Group > User > AddUser Name Agent Configuration Page > Configure LDAP/AD ServerLogin Name AttributeObject > AAA Server > Active Directory > AddServer Address Agent Configuration Page > Configure LDAP/AD ServerServer AddressNetwork > Interface > Ethernet > wan (IPv4)IP address Agent Configuration Page > Gateway SettingGateway IP

Chapter 19 Web AuthenticationUSG20(W)-VPN Series User’s Guide305Figure 209 Configuration > Web Authentication > SSOThe following table gives an overview of the objects you can configure. 19.4.3 Enable Web AuthenticationEnable Web Authentication and add a web authentication policy. Table 123 Configuration > Web Authentication > SSOLABEL DESCRIPTIONListen Port The default agent listening port is 2158. If you change it on the USG, then change it to the same number in the Gateway Port field on the SSO agent too. Type a number ranging from 1025 to 65535.Agent PreShareKey Type 8-32 printable ASCII characters or exactly 32 hex characters (0-9; a-f). The Agent PreShareKey is used to encrypt communications between the USG and the SSO agent.Primary Agent Address Type the IPv4 address of the SSO agent. The USG and the SSO agent must be in the same domain and be able to communicate with each other.Primary Agent Port Type the same port number here as in the Agent Listening Port field on the SSO agent. Type a number ranging from 1025 to 65535.Secondary Agent Address (Optional)Type the IPv4 address of the backup SSO agent if there is one. The USG and the backup SSO agent must be in the same domain and be able to communicate with each other.Secondary Agent Port (Optional)Type the same port number here as in the Agent Listening Port field on the backup SSO agent if there is one. Type a number ranging from 1025 to 65535.Apply Click this button to save your changes to the USG.Reset Click this button to return the screen to its last-saved settings

Chapter 19 Web AuthenticationUSG20(W)-VPN Series User’s Guide306Make sure you select Enable Policy, Single Sign-On and choose required in Authentication.Do NOT select any as the source address unless you want all incoming connections to be authenticated!See Table 120 on page 299 and Table 121 on page 302 for more information on configuring these screens.19.4.4 Create a Security PolicyConfigure a Security Policy for SSO traffic source and destination direction in order to prevent the security policy from blocking this traffic. Go to Configuration > Security Policy > Policy and add a new policy if a default one does not cover the SSO web authentication traffic direction.

Chapter 19 Web AuthenticationUSG20(W)-VPN Series User’s Guide307Configure the fields as shown in the following screen. Configure the source and destination addresses according to the SSO web authrntication traffic in your network.19.4.5 Configure User InformationConfigure a User account of the ext-group-user type.

Chapter 19 Web AuthenticationUSG20(W)-VPN Series User’s Guide308Configure Group Identifier to be the same as Group Membership on the SSO agent.19.4.6 Configure an Authentication MethodConfigure Active Directory (AD) for authentication with SSO.Choose group ad as the authentication server for SSO.

Chapter 19 Web AuthenticationUSG20(W)-VPN Series User’s Guide30919.4.7 Configure Active DirectoryYou must configure an Active Directory (AD) server in AAA Setup to be the same as AD configured on the SSO agent.The default AD server port is 389. If you change this, make sure you make the same changes on the SSO. Configure the Base DN exactly the same as on the Domain Controller and SSO. Bind DN is a user name and password that allows the USG to join the domain with administrative privileges. It is a required field.

Chapter 19 Web AuthenticationUSG20(W)-VPN Series User’s Guide31019.5 SSO Agent ConfigurationThis section shows what you have to do on the SSO agent in order to work with the USG.After you install the SSO agent, you will see an icon in the system tray (bottom right of the screen)

Chapter 19 Web AuthenticationUSG20(W)-VPN Series User’s Guide311Right-click the SSO icon and select Configure ZyXEL SSO Agent.Configure the Agent Listening Port, AD server exactly as you have done on the USG. Add the USG IP address as the Gateway. Make sure the USG and SSO agent are able to communicate with each other.

Chapter 19 Web AuthenticationUSG20(W)-VPN Series User’s Guide312Configure the Server Address, Port, Base DN, Bind DN, Login Name Attribute and Group Membership for the AD server settings exactly as you have done on the USG. Group Membership is called Group Identifier on the USG.LDAP/AD Server Configuration

Chapter 19 Web AuthenticationUSG20(W)-VPN Series User’s Guide313Configure the Gateway IP address, Gateway Port and PreShareKey exactly as you have done in the USG Configuration > Web Authentication > SSO screen. If you want to use Generate Key to have the SSO create a random password, select Check to show PreShareKey as clear Text so as to see the password, then copy and paste it to the USG. After all SSO agent configurations are done, right-click the SSO icon in the system tray and select Enable ZyXEL SSO Agent.

Chapter 20 Security PolicyUSG20(W)-VPN Series User’s Guide315Note: Note that the walkthroughs do not perform the actual configuring, but just show you how to do it.This is an example of a port forwarding configuration walkthrough.Figure 211 Example of a Port Forwarding Configuration Walkthrough. This is an example of L2TP over IPSec VPN Troubleshooting troubleshooting.1234

Chapter 20 Security PolicyUSG20(W)-VPN Series User’s Guide316Figure 212 Example of L2TP over IPSec Troubleshooting - 1 1223

Chapter 20 Security PolicyUSG20(W)-VPN Series User’s Guide31820.3 What You Can Do in this Chapter•Use the Security Policy Control screens (Section 20.4 on page 320) to enable or disable policies, asymmetrical routes, and manage and configure policies. •Use the Session Control screens (see Section 20.5 on page 326) to limit the number of concurrent NAT/security policies traffic sessions a client can use. 20.3.1 What You Need to KnowStateful InspectionThe USG uses stateful inspection in its security policies. The USG restricts access by screening data packets against defined access rules. It also inspects sessions. For example, traffic from one zone is not allowed unless it is initiated by a computer in another zone first.ZonesA zone is a group of interfaces. Group the USG’s interfaces into different zones based on your needs. You can configure security policies for data passing between zones or even between interfaces. Click this icon for more information on IPSec and SSL VPN. Internet Protocol Security (IPSec) VPN connects IPSec routers or remote users using IPSec client software. SSL VPN allows users to use a web browser for secure remote user login without need of a VPN router or VPN client software.• VPN > IPSec VPN•VPN > SSL VPNClick this icon to download VPN client software.• VPN > IPSec VPN•VPN > SSL VPNClick this icon for more information on the Wireless AP Controller which sets how the USG allows APs to connect to the wireless network.• Wireless > AP Management > Mgnt. AP ListTable 124 OneSecurity Icons (continued)ONESECURITY ICON SCREEN

Chapter 20 Security PolicyUSG20(W)-VPN Series User’s Guide320User Specific Security PoliciesYou can specify users or user groups in Security Policies. For example, to allow a specific user from any computer to access a zone by logging in to the USG, you can set up a policy based on the user name only. If you also apply a schedule to the Security Policy, the user can only access the network at the scheduled time. A user-aware Security Policy is activated whenever the user logs in to the USG and will be disabled after the user logs out of the USG.Session LimitsAccessing the USG or network resources through the USG requires a NAT session and corresponding Security Policy session. Peer to peer applications, such as file sharing applications, may use a large number of NAT sessions. A single client could use all of the available NAT sessions and prevent others from connecting to or through the USG. The USG lets you limit the number of concurrent NAT/Security Policy sessions a client can use.20.4 The Security Policy ScreenAsymmetrical RoutesIf an alternate gateway on the LAN has an IP address in the same subnet as the USG’s LAN IP address, return traffic may not go through the USG. This is called an asymmetrical or “triangle” route. This causes the USG to reset the connection, as the connection has not been acknowledged.You can have the USG permit the use of asymmetrical route topology on the network (not reset the connection). However, allowing asymmetrical routes may let traffic from the WAN go directly to the LAN without passing through the USG. A better solution is to use virtual interfaces to put the USG and the backup gateway on separate subnets. Virtual interfaces allow you to partition your network into logical sections over the same interface. See the chapter about interfaces for more information.By putting LAN 1 and the alternate gateway (A in the figure) in different subnets, all returning network traffic must pass through the USG to the LAN. The following steps and figure describe such a scenario.1A computer on the LAN1 initiates a connection by sending a SYN packet to a receiving server on the WAN.2The USG reroutes the packet to gateway A, which is in Subnet 2. 3The reply from the WAN goes to the USG. 4The USG then sends it to the computer on the LAN1 in Subnet 1.

Chapter 20 Security PolicyUSG20(W)-VPN Series User’s Guide321Figure 214 Using Virtual Interfaces to Avoid Asymmetrical Routes 20.4.1 Configuring the Security Policy Control ScreenClick Configuration > Security Policy > Policy Control to open the Security Policy screen. Use this screen to enable or disable the Security Policy and asymmetrical routes, set a maximum number of sessions per host, and display the configured Security Policies. Specify from which zone packets come and to which zone packets travel to display only the policies specific to the selected direction. Note the following.• Besides configuring the Security Policy, you also need to configure NAT rules to allow computers on the WAN to access LAN devices. • The USG applies NAT (Destination NAT) settings before applying the Security Policies. So for example, if you configure a NAT entry that sends WAN traffic to a LAN IP address, when you configure a corresponding Security Policy to allow the traffic, you need to set the LAN IP address as the destination. • The ordering of your policies is very important as policies are applied in sequence.The following screen shows the Security Policy summary screen.

Chapter 20 Security PolicyUSG20(W)-VPN Series User’s Guide322Figure 215 Configuration > Security Policy > Policy Control The following table describes the labels in this screen. Table 126 Configuration > Security Policy > Policy ControlLABEL DESCRIPTIONShow Filter/Hide FilterClick Show Filter to display IPv4 and IPv6 (if enabled) security policy search filters.IPv4 / IPv6 ConfigurationUse IPv4 / IPv6 search filters to find specific IPv4 and IPv6 (if enabled) security policies based on direction, application, user, source, destination and/or schedule.From / To Select a zone to view all security policies from a particular zone and/or to a particular zone. any means all zones.IPv4 / IPv6 Source Type an IPv4 or IPv6 IP address to view all security policies based on the IPv4 / IPv6 source address object used. • An IPv4 IP address is written as four integer blocks separated by periods. This is an example IPv4 address: 172.16.6.7.• An 128-bit IPv6 address is written as eight 16-bit hexadecimal blocks separated by colons (:). This is an example IPv6 address: 2001:0db8:1a2b:0015:0000:0000:1a2f:0000.

Chapter 20 Security PolicyUSG20(W)-VPN Series User’s Guide323IPv4 / IPv6 Destination Type an IPv4 or IPv6 IP address to view all security policies based on the IPv4 / IPv6 destination address object used. • An IPv4 IP address is written as four integer blocks separated by periods. This is an example IPv4 address: 172.16.6.7.• An 128-bit IPv6 address is written as eight 16-bit hexadecimal blocks separated by colons (:). This is an example IPv6 address: 2001:0db8:1a2b:0015:0000:0000:1a2f:0000.Service View all security policies based the service object used.User View all security policies based on user or user group object used.Schedule View all security policies based on the schedule object used.General Settings Enable or disable the Security Policy feature on the USG.Enable Policy ControlSelect this to activate Security Policy on the USG to perform access control.IPv4/IPv6 Policy ManagementUse the following items to manage IPv4 and IPv6 policies.Allow Asymmetrical RouteIf an alternate gateway on the LAN has an IP address in the same subnet as the USG’s LAN IP address, return traffic may not go through the USG. This is called an asymmetrical or “triangle” route. This causes the USG to reset the connection, as the connection has not been acknowledged.Select this check box to have the USG permit the use of asymmetrical route topology on the network (not reset the connection). Note: Allowing asymmetrical routes may let traffic from the WAN go directly to the LAN without passing through the USG. A better solution is to use virtual interfaces to put the USG and the backup gateway on separate subnets. Add Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry.Edit Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings. Remove To remove an entry, select it and click Remove. The USG confirms you want to remove it before doing so.Activate To turn on an entry, select it and click Activate.Inactivate To turn off an entry, select it and click Inactivate.Move To change a policy’s position in the numbered list, select the policy and click Move to display a field to type a number for where you want to put that policy and press [ENTER] to move the policy to the number that you typed.The ordering of your policies is important as they are applied in order of their numbering.Clone Use Clone to create a new entry by modifying an existing one.• Select an existing entry. •Click Clone, type a number where the new entry should go and then press [ENTER]. • A configuration copy of the selected entry pops up. You must at least change the name as duplicate entry names are not allowed.The following read-only fields summarize the policies you have created that apply to traffic traveling in the selected packet direction. Priority This is the position of your Security Policy in the global policy list (including all through-USG and to-USG policies). The ordering of your policies is important as policies are applied in sequence. Default displays for the default Security Policy behavior that the USG performs on traffic that does not match any other Security Policy. Status This icon is lit when the entry is active and dimmed when the entry is inactive.Table 126 Configuration > Security Policy > Policy Control (continued)LABEL DESCRIPTION

Chapter 20 Security PolicyUSG20(W)-VPN Series User’s Guide325Figure 216 Configuration > Security Policy > Policy Control > Add The following table describes the labels in this screen. Table 127 Configuration > Security Policy > Policy Control > AddLABEL DESCRIPTIONCreate new ObjectUse to configure any new settings objects that you need to use in this screen.Enable Select this check box to activate the Security policy. Name Type a name to identify the policyDescription Enter a descriptive name of up to 60 printable ASCII characters for the Policy. Spaces are allowed. FromToFor through-USG policies, select the direction of travel of packets to which the policy applies.any means all interfaces.Device means packets destined for the USG itself.Source Select an IPv4 / IPv6 address or address group object to apply the policy to traffic coming from it. Select any to apply the policy to all traffic coming from IPv4 / IPv6 addresses. Destination Select an IPv4 / IPv6 address or address group to apply the policy to traffic going to it. Select any to apply the policy to all traffic going to IPv4 / IPv6 addresses. Service Select a service or service group from the drop-down list box. User This field is not available when you are configuring a to-USG policy.Select a user name or user group to which to apply the policy. The Security Policy is activated only when the specified user logs into the system and the policy will be disabled when the user logs out.Otherwise, select any and there is no need for user logging.Note: If you specified a source IP address (group) instead of any in the field below, the user’s IP address should be within the IP address range.Schedule Select a schedule that defines when the policy applies. Otherwise, select none and the policy is always effective.

Chapter 20 Security PolicyUSG20(W)-VPN Series User’s Guide327Figure 217 Configuration > Security Policy > Session ControlThe following table describes the labels in this screen. Table 128 Configuration > Security Policy > Session ControlLABEL DESCRIPTIONGeneral SettingsUDP Session Time OutSet how many seconds the USG will allow a UDP session to remain idle (without UDP traffic) before closing it.Session Limit SettingsEnable Session limitSelect this check box to control the number of concurrent sessions hosts can have. IPv4 / IPv6 Rule SummaryThis table lists the rules for limiting the number of concurrent sessions hosts can have.Default Session per HostThis field is configurable only when you enable session limit.Use this field to set a common limit to the number of concurrent NAT/Security Policy sessions each client computer can have.If only a few clients use peer to peer applications, you can raise this number to improve their performance. With heavy peer to peer application use, lower this number to ensure no single client uses too many of the available NAT sessions.Create rules below to apply other limits for specific users or addresses.Add Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry.Edit Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings.

Chapter 20 Security PolicyUSG20(W)-VPN Series User’s Guide32820.5.1 The Session Control Add/Edit ScreenClick Configuration > Security Policy > Session Control and the Add or Edit icon to display the Add or Edit screen. Use this screen to configure rules that define a session limit for specific users or addresses.Figure 218 Configuration > Security Policy > Session Control > EditThe following table describes the labels in this screen. Remove To remove an entry, select it and click Remove. The USG confirms you want to remove it before doing so.Activate To turn on an entry, select it and click Activate.Inactivate To turn off an entry, select it and click Inactivate.Move To change a rule’s position in the numbered list, select the rule and click Move to display a field to type a number for where you want to put that rule and press [ENTER] to move the rule to the number that you typed.The ordering of your rules is important as they are applied in order of their numbering.Status This icon is lit when the entry is active and dimmed when the entry is inactive.# This is the index number of a session limit rule. It is not associated with a specific rule. User This is the user name or user group name to which this session limit rule applies.IPv4 / IPv6 AddressThis is the IPv4 / IPv6 address object to which this session limit rule applies.Description This is the information configured to help you identify the rule. Limit This is how many concurrent sessions this user or address is allowed to have.Apply Click Apply to save your changes back to the USG.Reset Click Reset to return the screen to its last-saved settings. Table 128 Configuration > Security Policy > Session Control (continued)LABEL DESCRIPTIONTable 129 Configuration > Security Policy > Session Control > Add / EditLABEL DESCRIPTIONCreate new ObjectUse to configure new settings for User or Address objects that you need to use in this screen.Click on the down arrow to see the menu.Enable Rule Select this check box to turn on this session limit rule. Description Enter information to help you identify this rule. Use up to 60 printable ASCII characters. Spaces are allowed.

USG20(W)-VPN Series User’s Guide332CHAPTER 21IPSec VPN21.1 Virtual Private Networks (VPN) OverviewA virtual private network (VPN) provides secure communications between sites without the expense of leased site-to-site lines. A secure VPN is a combination of tunneling, encryption, authentication, access control and auditing. It is used to transport traffic over the Internet or any insecure network that uses TCP/IP for communication.IPSec VPNInternet Protocol Security (IPSec) VPN connects IPSec routers or remote users using IPSec client software. This standards-based VPN offers flexible solutions for secure data communications across a public network. IPSec is built around a number of standardized cryptographic techniques to provide confidentiality, data integrity and authentication at the IP layer. The USG can also combine multiple IPSec VPN connections into one secure network. Here local USG X uses an IPSec VPN tunnel to remote (peer) USG Y to connect the local (A) and remote (B) networks.Figure 221 IPSec VPN ExampleInternet Key Exchange (IKE): IKEv1 and IKEv2The USG supports IKEv1 and IKEv2 for IPv4 and IPv6 traffic. IKE (Internet Key Exchange) is a protocol used in setting up security associations that allows two parties to send data securely.IKE uses certificates or pre-shared keys for authentication and a Diffie–Hellman key exchange to set up a shared session secret from which encryption keys are derived. A security policy for each peer must be manually created.IPSec VPN consists of two phases: Phase 1 and Phase 2. Phase 1's purpose is to establish a secure authenticated communication channel by using the Diffie–Hellman key exchange algorithm to generate a shared secret key to encrypt IKE communications. This negotiation results in one single bi-directional ISAKMP Security Association (SA). The authentication can be performed using either pre-shared key (shared secret), signatures, or public key encryption. Phase 1 operates in either

Chapter 21 IPSec VPNUSG20(W)-VPN Series User’s Guide333Main Mode or Aggressive Mode. Main Mode protects the identity of the peers, but Aggressive Mode does not.During Phase 2, the remote IPSec routers use the secure channel established in Phase 1 to negotiate Security Associations for IPsec. The negotiation results in a minimum of two unidirectional security associations (one inbound and one outbound). Phase 2 uses Quick Mode (only). Quick mode occurs after IKE has established the secure tunnel in Phase 1. It negotiates a shared IPSec policy, derives shared secret keys used for the IPSec security algorithms, and establishes IPSec SAs. Quick mode is also used to renegotiate a new IPSec SA when the IPSec SA lifetime expires.In the USG, use the VPN Connection tab to set up Phase 2 and the VPN Gateway tab to set up Phase 1.Some differences between IKEv1 and IKEv2 include:• IKEv2 uses less bandwidth than IKEv1. IKEv2 uses one exchange procedure with 4 messages. IKEv1 uses two phases with Main Mode (9 messages) or Aggressive Mode (6 messages) in phase 1. • IKEv2 supports Extended Authentication Protocol (EAP) authentication, and IKEv1 supports X-Auth. EAP is important when connecting to existing enterprise authentication systems. • IKEv2 always uses NAT traversal and Dead Peer Detection (DPD), but they can be disabled in IKEv1 using USG firmware (the default is on).• Configuration payload (includes the IP address pool in the VPN setup data) is supported in IKEv2 (off by default), but not in IKEv1.• Narrowed (has the SA apply only to IP addresses in common between the USG and the remote IPSec router) is supported in IKEv2, but not in IKEv1.• The IKEv2 protocol supports connectivity checks which is used to detect whether the tunnel is still up or not. If the check fails (the tunnel is down), IKEv2 can re-establish the connection automatically. The USG uses firmware to perform connectivity checks when using IKEv1.SSL VPNSSL VPN uses remote users’ web browsers to provide the easiest-to-use of the USG’s VPN solutions. A user just browses to the USG’s web address and enters his user name and password to securely connect to the USG’s network. Remote users do not need to configure security settings. Here a user uses his browser to securely connect to network resources in the same way as if he were part of the internal network. See Chapter 22 on page 367 for more on SSL VPN.

Chapter 21 IPSec VPNUSG20(W)-VPN Series User’s Guide334Figure 222 SSL VPN L2TP VPNL2TP VPN uses the L2TP and IPSec client software included in remote users’ Android, iOS, or Windows operating systems for secure connections to the network behind the USG. The remote users do not need their own IPSec gateways or third-party VPN client software. For example, configure sales representatives’ laptops, tablets, or smartphones to securely connect to the USG’s network. See Chapter 25 on page 395 for more on L2TP over IPSec.Figure 223 L2TP VPN 21.1.1 What You Can Do in this Chapter•Use the VPN Connection screens (see Section 21.2 on page 337) to specify which IPSec VPN gateway an IPSec VPN connection policy uses, which devices behind the IPSec routers can use the VPN tunnel, and the IPSec SA settings (phase 2 settings). You can also activate or deactivate and connect or disconnect each VPN connection (each IPSec SA).•Use the VPN Gateway screens (see Section 21.2.1 on page 338) to manage the USG’s VPN gateways. A VPN gateway specifies the IPSec routers at either end of a VPN tunnel and the IKE SA settings (phase 1 settings). You can also activate and deactivate each VPN gateway.•Use the VPN Concentrator screens (see Section 21.4 on page 353) to combine several IPSec VPN connections into a single secure network.•Use the Configuration Provisioning screen (see Section 21.5 on page 355) to set who can retrieve VPN rule settings from the USG using the USG IPSec VPN Client.Web Mail File ShareWeb-based Applicationhttps://Application ServerNon-WebLAN (192.168.1.X)

Chapter 21 IPSec VPNUSG20(W)-VPN Series User’s Guide33521.1.2 What You Need to KnowAn IPSec VPN tunnel is usually established in two phases. Each phase establishes a security association (SA), a contract indicating what security parameters the USG and the remote IPSec router will use. The first phase establishes an Internet Key Exchange (IKE) SA between the USG and remote IPSec router. The second phase uses the IKE SA to securely establish an IPSec SA through which the USG and remote IPSec router can send data between computers on the local network and remote network. This is illustrated in the following figure.Figure 224 VPN: IKE SA and IPSec SA In this example, a computer in network A is exchanging data with a computer in network B. Inside networks A and B, the data is transmitted the same way data is normally transmitted in the networks. Between routers X and Y, the data is protected by tunneling, encryption, authentication, and other security features of the IPSec SA. The IPSec SA is secure because routers X and Y established the IKE SA first.

Chapter 21 IPSec VPNUSG20(W)-VPN Series User’s Guide336Application ScenariosThe USG’s application scenarios make it easier to configure your VPN connection settings. Finding Out More•See Section 21.6 on page 357 for IPSec VPN background information.• See the help in the IPSec VPN quick setup wizard screens.21.1.3 Before You BeginThis section briefly explains the relationship between VPN tunnels and other features. It also gives some basic suggestions for troubleshooting.You should set up the following features before you set up the VPN tunnel.Table 133 IPSec VPN Application ScenariosSITE-TO-SITE SITE-TO-SITE WITH DYNAMIC PEER REMOTE ACCESS (SERVER ROLE) REMOTE ACCESS (CLIENT ROLE) Choose this if the remote IPSec router has a static IP address or a domain name. This USG can initiate the VPN tunnel. The remote IPSec router can also initiate the VPN tunnel if this USG has a static IP address or a domain name. Choose this if the remote IPSec router has a dynamic IP address. You don’t specify the remote IPSec router’s address, but you specify the remote policy (the addresses of the devices behind the remote IPSec router).This USG must have a static IP address or a domain name.Only the remote IPSec router can initiate the VPN tunnel. Choose this to allow incoming connections from IPSec VPN clients. The clients have dynamic IP addresses and are also known as dial-in users. You don’t specify the addresses of the client IPSec routers or the remote policy.This creates a dynamic IPSec VPN rule that can let multiple clients connect.Only the clients can initiate the VPN tunnel. Choose this to connect to an IPSec server.This USG is the client (dial-in user). Client role USGs initiate IPSec VPN connections to a server role USG.This USG can have a dynamic IP address. The IPSec server doesn’t configure this USG’s IP address or the addresses of the devices behind it.Only this USG can initiate the VPN tunnel.

Chapter 21 IPSec VPNUSG20(W)-VPN Series User’s Guide337• In any VPN connection, you have to select address objects to specify the local policy and remote policy. You should set up the address objects first.• In a VPN gateway, you can select an Ethernet interface, virtual Ethernet interface, VLAN interface, or virtual VLAN interface to specify what address the USG uses as its IP address when it establishes the IKE SA. You should set up the interface first. • In a VPN gateway, you can enable extended authentication. If the USG is in server mode, you should set up the authentication method (AAA server) first. The authentication method specifies how the USG authenticates the remote IPSec router. • In a VPN gateway, the USG and remote IPSec router can use certificates to authenticate each other. Make sure the USG and the remote IPSec router will trust each other’s certificates.21.2 The VPN Connection ScreenClick Configuration > VPN > IPSec VPN to open the VPN Connection screen. The VPNConnection screen lists the VPN connection policies and their associated VPN gateway(s), and various settings. In addition, it also lets you activate or deactivate and connect or disconnect each VPN connection (each IPSec SA). Click a column’s heading cell to sort the table entries by that column’s criteria. Click the heading cell again to reverse the sort order.Click on the icons to go to the OneSecurity.com website where there is guidance on configuration walkthroughs, troubleshooting and other information.Figure 225 Configuration > VPN > IPSec VPN > VPN Connection

Chapter 21 IPSec VPNUSG20(W)-VPN Series User’s Guide338Each field is discussed in the following table. 21.2.1 The VPN Connection Add/Edit (IKE) ScreenThe VPN Connection Add/Edit Gateway screen allows you to create a new VPN connection policy or edit an existing one. To access this screen, go to the Configuration > VPN Connection screen (see Section 21.2 on page 337), and click either the Add icon or an Edit icon. Table 134 Configuration > VPN > IPSec VPN > VPN ConnectionLABEL DESCRIPTIONGlobal Setting The following two fields are for all IPSec VPN policies. Click on the VPN icon to go to the ZyXEL VPN Client product page at the ZyXEL website.Use Policy Route to control dynamic IPSec rulesSelect this to be able to use policy routes to manually specify the destination addresses of dynamic IPSec rules. You must manually create these policy routes. The USG automatically obtains source and destination addresses for dynamic IPSec rules that do not match any of the policy routes. Clear this to have the USG automatically obtain source and destination addresses for all dynamic IPSec rules.Ignore "Don't Fragment" setting in packet headerSelect this to fragment packets larger than the MTU (Maximum Transmission Unit) that have the "Don't Fragment" bit in the IP header turned on. When you clear this the USG drops packets larger than the MTU that have the "Don't Fragment" bit in the header turned on.IPv4 / IPv6 ConfigurationAdd Click this to create a new entry.Edit Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings. Remove To remove an entry, select it and click Remove. The USG confirms you want to remove it before doing so.Activate To turn on an entry, select it and click Activate.Inactivate To turn off an entry, select it and click Inactivate.Connect To connect an IPSec SA, select it and click Connect.Disconnect To disconnect an IPSec SA, select it and click Disconnect.Object ReferenceSelect an entry and click Object Reference to open a screen that shows which settings use the entry. See Section 9.3.2 on page 163 for an example.# This field is a sequential value, and it is not associated with a specific connection.Status The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive.The connect icon is lit when the interface is connected and dimmed when it is disconnected.Name This field displays the name of the IPSec SA.VPN Gateway This field displays the VPN gateway in use for this VPN connection. Gateway IP VersionThis field displays what IP version the associated VPN gateway(s) is using. An IPv4 gateway may use an IKEv1 or IKEv2 SA. An IPv6 gateway may use IKEv2 only.Policy This field displays the local policy and the remote policy, respectively.Apply Click Apply to save your changes back to the USG.Reset Click Reset to return the screen to its last-saved settings.

Chapter 21 IPSec VPNUSG20(W)-VPN Series User’s Guide339Figure 226 Configuration > VPN > IPSec VPN > VPN Connection > Edit (IKE)

Chapter 21 IPSec VPNUSG20(W)-VPN Series User’s Guide340Each field is described in the following table. Table 135 Configuration > VPN > IPSec VPN > VPN Connection > EditLABEL DESCRIPTIONShow Advanced Settings / Hide Advanced SettingsClick this button to display a greater or lesser number of configuration fields.Create new Object Use to configure any new settings objects that you need to use in this screen.General SettingsEnable Select this check box to activate this VPN connection.Connection Name Type the name used to identify this IPSec SA. You may use 1-31 alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a number. This value is case-sensitive.Nailed-Up Select this if you want the USG to automatically renegotiate the IPSec SA when the SA life time expires.Enable Replay Detection Select this check box to detect and reject old or duplicate packets to protect against Denial-of-Service attacks.Enable NetBIOS Broadcast over IPSecSelect this check box if you the USG to send NetBIOS (Network Basic Input/Output System) packets through the IPSec SA. NetBIOS packets are TCP or UDP packets that enable a computer to connect to and communicate with a LAN. It may sometimes be necessary to allow NetBIOS packets to pass through IPSec SAs in order to allow local computers to find computers on the remote network and vice versa.MSS Adjustment Select Custom Size to set a specific number of bytes for the Maximum Segment Size (MSS) meaning the largest amount of data in a single TCP segment or IP datagram for this VPN connection.Some VPN clients may not be able to use a custom MSS size if it is set too small. In that case those VPN clients will ignore the size set here and use the minimum size that they can use.Select Auto to have the USG automatically set the MSS for this VPN connection.Narrowed If the IP range on the USG (local policy) and the local IP range on the remote IPSec router overlap in an IKEv2 SA, then you may select Narrowed to have the SA only apply to the IP addresses in common.Here are some examples.USG (local policy) Remote IPSec routerIKEv2 SA-1 192.168.20.0/24 192.168.20.1 ~ 192.168.20.20Narrowed 192.168.20.1 ~ 192.168.20.20IKEv2 SA- 2 192.168.30.50 ~ 192.168.30.70 192.168.30.60 ~ 192.168.30.80Narrowed 192.168.30.60 ~ 192.168.30.70VPN GatewayApplication Scenario Select the scenario that best describes your intended VPN connection. Site-to-site - Choose this if the remote IPSec router has a static IP address or a domain name. This USG can initiate the VPN tunnel. Site-to-site with Dynamic Peer - Choose this if the remote IPSec router has a dynamic IP address. Only the remote IPSec router can initiate the VPN tunnel. Remote Access (Server Role) - Choose this to allow incoming connections from IPSec VPN clients. The clients have dynamic IP addresses and are also known as dial-in users. Only the clients can initiate the VPN tunnel. Remote Access (Client Role) - Choose this to connect to an IPSec server. This USG is the client (dial-in user) and can initiate the VPN tunnel.

Chapter 21 IPSec VPNUSG20(W)-VPN Series User’s Guide341VPN Gateway Select the VPN gateway this VPN connection is to use or select Create Object to add another VPN gateway for this VPN connection to use.PolicyLocal Policy Select the address corresponding to the local network. Use Create new Object if you need to configure a new one. Remote Policy Select the address corresponding to the remote network. Use Create new Object if you need to configure a new one. Enable GRE over IPSec Select this to allow traffic using the Generic Routing Encapsulation (GRE) tunneling protocol through an IPSec tunnel.Policy Enforcement Clear this to allow traffic with source and destination IP addresses that do not match the local and remote policy to use the VPN tunnel. Leave this cleared for free access between the local and remote networks. Selecting this restricts who can use the VPN tunnel. The USG drops traffic with source and destination IP addresses that do not match the local and remote policy.Configuration Payload This is only available when you have created an IKEv2 Gateway and are using Remote Access (Server Role).Enable Configuration PayloadSelect this to have at least have the IP address pool included in the VPN setup data.IP Address Pool: Select an address object from the drop-down list box.First DNS Server (optional) The Domain Name System (DNS) maps a domain name to an IP address and vice versa. The USG uses these (in the order you specify here) to resolve domain names for VPN. Enter a DNS server's IP address.Second DNS Server (Optional) Enter a secondary DNS server's IP address that is checked if the first one is unavailable.First WINS Server (Optional) Type the IP address of the WINS (Windows Internet Naming Service) server that you want to send to the DHCP clients. The WINS server keeps a mapping table of the computer names on your network and the IP addresses that they are currently using.Second WINS Server (Optional) Enter a secondary WINS server's IP address that is checked if the first one is unavailable.Phase 2 SettingsSA Life Time Type the maximum number of seconds the IPSec SA can last. Shorter life times provide better security. The USG automatically negotiates a new IPSec SA before the current one expires, if there are users who are accessing remote resources.Active Protocol Select which protocol you want to use in the IPSec SA. Choices are:AH (RFC 2402) - provides integrity, authentication, sequence integrity (replay resistance), and non-repudiation but not encryption. If you select AH, you must select an Authentication algorithm.ESP (RFC 2406) - provides encryption and the same services offered by AH, but its authentication is weaker. If you select ESP, you must select an Encryption algorithm and Authentication algorithm.Both AH and ESP increase processing requirements and latency (delay).The USG and remote IPSec router must use the same active protocol.Encapsulation Select which type of encapsulation the IPSec SA uses. Choices areTunnel - this mode encrypts the IP header information and the data.Transport - this mode only encrypts the data.The USG and remote IPSec router must use the same encapsulation.Table 135 Configuration > VPN > IPSec VPN > VPN Connection > Edit (continued)LABEL DESCRIPTION

Chapter 21 IPSec VPNUSG20(W)-VPN Series User’s Guide342Proposal Use this section to manage the encryption algorithm and authentication algorithm pairs the USG accepts from the remote IPSec router for negotiating the IPSec SA.Add Click this to create a new entry. Edit Select an entry and click this to be able to modify it. Remove Select an entry and click this to delete it. # This field is a sequential value, and it is not associated with a specific proposal. The sequence of proposals should not affect performance significantly.Encryption This field is applicable when the Active Protocol is ESP. Select which key size and encryption algorithm to use in the IPSec SA. Choices are:NULL - no encryption key or algorithmDES - a 56-bit key with the DES encryption algorithm3DES - a 168-bit key with the DES encryption algorithmAES128 - a 128-bit key with the AES encryption algorithmAES192 - a 192-bit key with the AES encryption algorithmAES256 - a 256-bit key with the AES encryption algorithmThe USG and the remote IPSec router must both have at least one proposal that uses use the same encryption and the same key. Longer keys are more secure, but require more processing power, resulting in increased latency and decreased throughput.Authentication Select which hash algorithm to use to authenticate packet data in the IPSec SA. Choices are SHA1, SHA256, SHA512 and MD5. SHA is generally considered stronger than MD5, but it is also slower.The USG and the remote IPSec router must both have a proposal that uses the same authentication algorithm. Perfect Forward Secrecy (PFS) Select whether or not you want to enable Perfect Forward Secrecy (PFS) and, if you do, which Diffie-Hellman key group to use for encryption. Choices are:none - disable PFSDH1 - enable PFS and use a 768-bit random numberDH2 - enable PFS and use a 1024-bit random numberDH5 - enable PFS and use a 1536-bit random numberPFS changes the root key that is used to generate encryption keys for each IPSec SA. The longer the key, the more secure the encryption, but also the longer it takes to encrypt and decrypt information. Both routers must use the same DH key group.PFS is ignored in initial IKEv2 authentication but is used when reauthenticating.Related SettingsZone Select the security zone into which to add this VPN connection policy. Any security rules or settings configured for the selected zone apply to this VPN connection policy.Connectivity Check The USG can regularly check the VPN connection to the gateway you specified to make sure it is still available. Enable Connectivity Check Select this to turn on the VPN connection check.Table 135 Configuration > VPN > IPSec VPN > VPN Connection > Edit (continued)LABEL DESCRIPTION

Chapter 21 IPSec VPNUSG20(W)-VPN Series User’s Guide343Check Method Select how the USG checks the connection. The peer must be configured to respond to the method you select. Select icmp to have the USG regularly ping the address you specify to make sure traffic can still go through the connection. You may need to configure the peer to respond to pings. Select tcp to have the USG regularly perform a TCP handshake with the address you specify to make sure traffic can still go through the connection. You may need to configure the peer to accept the TCP connection. Check Port This field displays when you set the Check Method to tcp. Specify the port number to use for a TCP connectivity check.Check Period Enter the number of seconds between connection check attempts.Check Timeout Enter the number of seconds to wait for a response before the attempt is a failure.Check Fail Tolerance Enter the number of consecutive failures allowed before the USG disconnects the VPN tunnel. The USG resumes using the first peer gateway address when the VPN connection passes the connectivity check.Check this Address Select this to specify a domain name or IP address for the connectivity check. Enter that domain name or IP address in the field next to it.Check the First and Last IP Address in the Remote PolicySelect this to have the USG check the connection to the first and last IP addresses in the connection’s remote policy. Make sure one of these is the peer gateway’s LAN IP address. Log Select this to have the USG generate a log every time it checks this VPN connection. Inbound/Outbound traffic NATOutbound TrafficSource NAT This translation hides the source address of computers in the local network. It may also be necessary if you want the USG to route packets from computers outside the local network through the IPSec SA.Source Select the address object that represents the original source address (or select Create Object to configure a new one). This is the address object for the computer or network outside the local network. The size of the original source address range (Source) must be equal to the size of the translated source address range (SNAT). Destination Select the address object that represents the original destination address (or select Create Object to configure a new one). This is the address object for the remote network.SNAT Select the address object that represents the translated source address (or select Create Object to configure a new one). This is the address object for the local network. The size of the original source address range (Source) must be equal to the size of the translated source address range (SNAT).Inbound TrafficSource NAT This translation hides the source address of computers in the remote network.Source Select the address object that represents the original source address (or select Create Object to configure a new one). This is the address object for the remote network. The size of the original source address range (Source) must be equal to the size of the translated source address range (SNAT).Destination Select the address object that represents the original destination address (or select Create Object to configure a new one). This is the address object for the local network.Table 135 Configuration > VPN > IPSec VPN > VPN Connection > Edit (continued)LABEL DESCRIPTION

Chapter 21 IPSec VPNUSG20(W)-VPN Series User’s Guide34421.3 The VPN Gateway ScreenThe VPN Gateway summary screen displays the IPSec VPN gateway policies in the USG, as well as the USG’s address, remote IPSec router’s address, and associated VPN connections for each one. In addition, it also lets you activate and deactivate each VPN gateway. To access this screen, click Configuration > VPN > Network > IPSec VPN > VPN Gateway. The following screen appears.SNAT Select the address object that represents the translated source address (or select Create Object to configure a new one). This is the address that hides the original source address. The size of the original source address range (Source) must be equal to the size of the translated source address range (SNAT).Destination NAT This translation forwards packets (for example, mail) from the remote network to a specific computer (for example, the mail server) in the local network.Add Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry.Edit Select an entry and click this to be able to modify it. Remove Select an entry and click this to delete it. Move To change an entry’s position in the numbered list, select it and click Move to display a field to type a number for where you want to put that entry and press [ENTER] to move the entry to the number that you typed.# This field is a sequential value, and it is not associated with a specific NAT record. However, the order of records is the sequence in which conditions are checked and executed.Original IP Select the address object that represents the original destination address. This is the address object for the remote network.Mapped IP Select the address object that represents the desired destination address. For example, this is the address object for the mail server.Protocol Select the protocol required to use this translation. Choices are: TCP, UDP, or All.Original Port Start / Original Port End These fields are available if the protocol is TCP or UDP. Enter the original destination port or range of original destination ports. The size of the original port range must be the same size as the size of the mapped port range.Mapped Port Start / Mapped Port End These fields are available if the protocol is TCP or UDP. Enter the translated destination port or range of translated destination ports. The size of the original port range must be the same size as the size of the mapped port range.OK Click OK to save the changes. Cancel Click Cancel to discard all changes and return to the main VPN screen. Table 135 Configuration > VPN > IPSec VPN > VPN Connection > Edit (continued)LABEL DESCRIPTION

Chapter 21 IPSec VPNUSG20(W)-VPN Series User’s Guide345Figure 227 Configuration > VPN > IPSec VPN > VPN Gateway Each field is discussed in the following table. See Section 21.3.1 on page 346 for more information. Table 136 Configuration > VPN > IPSec VPN > VPN GatewayLABEL DESCRIPTIONAdd Click this to create a new entry.Edit Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings. Remove To remove an entry, select it and click Remove. The USG confirms you want to remove it before doing so.Activate To turn on an entry, select it and click Activate.Inactivate To turn off an entry, select it and click Inactivate.Object References Select an entry and click Object References to open a screen that shows which settings use the entry. See Section 9.3.2 on page 163 for an example.# This field is a sequential value, and it is not associated with a specific VPN gateway.Status The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive.Name This field displays the name of the VPN gatewayMy address This field displays the interface or a domain name the USG uses for the VPN gateway. Secure Gateway This field displays the IP address(es) of the remote IPSec routers.VPN Connection This field displays VPN connections that use this VPN gateway.IKE Version This field displays whether the gateway is using IKEv1 or IKEv2. IKEv1 applies to IPv4 traffic only. IKEv2 applies to both IPv4 and IPv6 traffic. IKE (Internet Key Exchange) is a protocol used in setting up security associations that allows two parties to send data securely. See Section 21.1 on page 332 for more information on IKEv1 and IKEv2.Apply Click Apply to save your changes back to the USG.Reset Click Reset to return the screen to its last-saved settings.

Chapter 21 IPSec VPNUSG20(W)-VPN Series User’s Guide34621.3.1 The VPN Gateway Add/Edit ScreenThe VPN Gateway Add/Edit screen allows you to create a new VPN gateway policy or edit an existing one. To access this screen, go to the VPN Gateway summary screen (see Section 21.3 on page 344), and click either the Add icon or an Edit icon.

Chapter 21 IPSec VPNUSG20(W)-VPN Series User’s Guide347Figure 228 Configuration > VPN > IPSec VPN > VPN Gateway > Add/Edit

Chapter 21 IPSec VPNUSG20(W)-VPN Series User’s Guide348Each field is described in the following table. Table 137 Configuration > VPN > IPSec VPN > VPN Gateway > Add/EditLABEL DESCRIPTIONShow Advanced Settings / Hide Advanced SettingsClick this button to display a greater or lesser number of configuration fields.Create New Object Use to configure any new settings objects that you need to use in this screen.General SettingsEnable Select this to activate the VPN Gateway policy.VPN Gateway Name Type the name used to identify this VPN gateway. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive.IKE VersionIKEv1 / IKEv2 Select IKEv1 or IKEv2. IKEv1 applies to IPv4 traffic only. IKEv2 applies to both IPv4 and IPv6 traffic. IKE (Internet Key Exchange) is a protocol used in setting up security associations that allows two parties to send data securely. See Section 21.1 on page 332 for more information on IKEv1 and IKEv2.Gateway SettingsMy Address Select how the IP address of the USG in the IKE SA is defined. If you select Interface, select the Ethernet interface, VLAN interface, virtual Ethernet interface, virtual VLAN interface or PPPoE/PPTP interface. The IP address of the USG in the IKE SA is the IP address of the interface.If you select Domain Name / IP, enter the domain name or the IP address of the USG. The IP address of the USG in the IKE SA is the specified IP address or the IP address corresponding to the domain name. 0.0.0.0 is not generally recommended as it has the USG accept IPSec requests destined for any interface address on the USG.Peer Gateway Address Select how the IP address of the remote IPSec router in the IKE SA is defined. Select Static Address to enter the domain name or the IP address of the remote IPSec router. You can provide a second IP address or domain name for the USG to try if it cannot establish an IKE SA with the first one.Fall back to Primary Peer Gateway when possible: When you select this, if the connection to the primary address goes down and the USG changes to using the secondary connection, the USG will reconnect to the primary address when it becomes available again and stop using the secondary connection. Users will lose their VPN connection briefly while the USG changes back to the primary connection. To use this, the peer device at the secondary address cannot be set to use a nailed-up VPN connection. In the Fallback Check Interval field, set how often to check if the primary address is available. Select Dynamic Address if the remote IPSec router has a dynamic IP address (and does not use DDNS). Authentication Note: The USG and remote IPSec router must use the same authentication method to establish the IKE SA.

$Chapter 21 IPSec VPNUSG20(W)-VPN Series User’s Guide349Pre-Shared Key Select this to have the USG and remote IPSec router use a pre-shared key (password) to identify each other when they negotiate the IKE SA. Type the pre-shared key in the field to the right. The pre-shared key can be:• alphanumeric characters or ,;.|`~!@#$%^&*()_+\{}':./<>=-"• pairs of hexadecimal (0-9, A-F) characters, preceded by “0x”.Type “0x” at the beginning of a hexadecimal key. For example, "0x0123456789ABCDEF" is in hexadecimal format; “0123456789ABCDEF” is in ASCII format. If you use hexadecimal, you must enter twice as many characters since you need to enter pairs.The USG and remote IPSec router must use the same pre-shared key.Select unmasked to see the pre-shared key in readable plain text.Certificate Select this to have the USG and remote IPSec router use certificates to authenticate each other when they negotiate the IKE SA. Then select the certificate the USG uses to identify itself to the remote IPsec router. This certificate is one of the certificates in My Certificates. If this certificate is self-signed, import it into the remote IPsec router. If this certificate is signed by a CA, the remote IPsec router must trust that CA.Note: The IPSec routers must trust each other’s certificates. The USG uses one of its Trusted Certificates to authenticate the remote IPSec router’s certificate. The trusted certificate can be a self-signed certificate or that of a trusted CA that signed the remote IPSec router’s certificate.User-based PSK User-based PSK (IKEv1 only) generates and manages separate pre-shared keys for every user. This enables multiple users, each with a unique key, to access the same VPN gateway policy with one-to-one authentication and strong encryption. Access can be denied on a per-user basis thus allowing VPN SA user-based policies. Click User-Based PSK then select a user or group object who is allowed VPN SA access using this VPN gateway policy. This is for IKEv1 only.Local ID Type This field is read-only if the USG and remote IPSec router use certificates to identify each other. Select which type of identification is used to identify the USG during authentication. Choices are:IPv4 or IPv6 - the USG is identified by an IP addressDNS - the USG is identified by a domain nameE-mail - the USG is identified by the string specified in this fieldContent This field is read-only if the USG and remote IPSec router use certificates to identify each other. Type the identity of the USG during authentication. The identity depends on the Local ID Type.IP - type an IP address; if you type 0.0.0.0, the USG uses the IP address specified in the My Address field. This is not recommended in the following situations:• There is a NAT router between the USG and remote IPSec router.• You want the remote IPSec router to be able to distinguish between IPSec SA requests that come from IPSec routers with dynamic WAN IP addresses.In these situations, use a different IP address, or use a different Local ID Type.DNS - type the fully qualified domain name (FQDN). This value is only used for identification and can be any string that matches the peer ID string.E-mail - the USG is identified by the string you specify here; you can use up to 63 ASCII characters including spaces, although trailing spaces are truncated. This value is only used for identification and can be any string.Table 137 Configuration > VPN > IPSec VPN > VPN Gateway > Add/Edit (continued)LABEL DESCRIPTION$

ZyXEL Communications USG20W-VPN VPN Firewall User Manual Book

ZyXEL Communications Corporation VPN Firewall Book

Contents

Users Manual Part 3

Navigation menu

Namespaces

Views

Navigation