Introduction
Overview
Zyxel Device refers to these models as outlined below.
• ZyWALL
• ZyWALL USG (Unified Security Gateway)
zywall | zywall usg |
|---|---|
ZyWALL 110 | USG40 |
ZyWALL 310 | USG40W |
ZyWALL 1100 | USG60 |
USG60W | |
USG110 | |
USG210 | |
USG310 | |
USG1100 | |
USG1900 | |
USG2200 |
The next table shows the key feature differences between the models besides performance variance. Note that your Zyxel Device may not support all UTM features.
Feature | ZyWALL | USG | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
110 | 310 | 1100 | 40 | 60 | 40W | 60W | 110 | 210 | 310 | 1100 | 1900 | 2200 | |
Amazon VPC (on Web Configurator) | CLI Only | CLI Only | CLI Only | CLI Only | CLI Only | CLI Only | CLI Only | CLI Only | CLI Only | CLI Only | CLI Only | CLI Only | CLI Only |
Anomaly Detection & Prevention | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
Anti-Spam | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
Anti-Virus | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
AP Controller | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
App Patrol | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
Content Filtering | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
Device HA Pro | YES | YES | YES | NO | NO | NO | NO | YES | YES | YES | YES | YES | YES |
Easy Mode | YES | NO | NO | YES | YES | YES | YES | YES | NO | NO | NO | NO | NO |
Hotspot Management | YES | YES | YES | NO | YES | NO | YES | YES | YES | YES | YES | YES | YES |
IDP | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
IP Exception | NO | NO | NO | NO | NO | NO | NO | NO | NO | NO | NO | NO | NO |
LAG | NO | YES | YES | NO | NO | NO | NO | NO | NO | YES | YES | YES | YES |
Microsoft Azure | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
Port Role | NO | YES | YES | NO | NO | NO | NO | NO | NO | YES | YES | YES | YES |
Port Group | YES | NO | NO | YES | YES | YES | YES | YES | YES | NO | NO | NO | NO |
Reputation Filter (IP and DNS) | NO | NO | NO | NO | NO | NO | NO | NO | NO | NO | NO | NO | NO |
Sandboxing | NO | NO | NO | NO | NO | NO | NO | NO | NO | NO | NO | NO | NO |
SD-WAN mode | NO | NO | NO | NO | NO | NO | NO | NO | NO | NO | NO | NO | NO |
SecuReporter | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
SSL Application | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
SSL Encrypted Traffic Inspection | YES | YES | YES | NO | NO | NO | NO | YES | YES | YES | YES | YES | YES |
URL Threat Filter | NO | NO | NO | NO | NO | NO | NO | NO | NO | NO | NO | NO | NO |
UTM feature License-need to buy | YES | YES | YES | after 1yr | after 1yr | after 1yr | after 1yr | after 1yr | after 1yr | after 1yr | after 1yr | after 1yr | after 1yr |
Built-in AP | NO | NO | NO | NO | NO | YES | YES | NO | NO | NO | NO | NO | NO |
• Not all models support all UTM (Unified Threat Management) features. See ZyWALL USG Key Feature Comparison Table for the specific UTM features that your model supports.
• Application Patrol (AP) | • Intrusion Detection & Prevention (IDP) |
• Anomaly Detection & Prevention (ADP) | • Content Filtering (CF) |
• Anti-Virus (AV) | • Anti-Spam (AS) |
• Secure Socket Layer (SSL) encrypted traffic Inspection |
The following UTM features work without a UTM license:
• Configuration > Content Filter > Trusted Web Sites
• Configuration > IDP > Custom Signatures
• Configuration > Anti-Virus > Black/White List
• Configuration > Anti-Spam > Black/White List
• Models that came with firmware versions 4.10 to 4.25 support both Device HA and Device HA Pro even after upgrading to versions 4.30 and later:
• ZyWALL 110 | • ZyWALL 310 | • ZyWALL 1100 |
• USG110 | • USG210 | • USG310 |
• USG1100 | • USG1900 | • USG2200 |
Some interface names vary by model - see Default Physical Port - Interface Mapping and Default Physical Port - Interface Mapping – USG2200 for default port / interface name mapping. See Default Zone – Interface Mapping and Default Zone – Interface Mapping USG2200 for default interface / zone mapping.
See the product’s datasheet for detailed information on a specific model.
Registration at myZyxel
myZyxel is Zyxel’s online services center where you can register your Zyxel Device and manage subscription services available for your Zyxel Device (see Configuration > Licensing > Registration > Service for services available for your Zyxel Device).
• For Zyxel Devices that already have firmware version 4.25 or later, you have to register your Zyxel Device and activate the corresponding service at myZyxel (through your Zyxel Device).
• For Zyxel Devices upgrading to firmware version 4.25 or later, you may skip registering your Zyxel Device and activating the corresponding service at myZyxel (through your Zyxel Device). However, it is highly recommended to at least register your Zyxel Device. At the time of writing, the Firmware Upgrade license providing Cloud Helper new firmware notifications, is free when you register your Zyxel Device.
You need to create a myZyxel account at http://portal.myZyxel.com before you can register your device and activate the services at myZyxel.You may need your Zyxel Device’s serial number and LAN MAC address to register it at myZyxel. See the label at the back of the Zyxel Device’s for details.
Grace Period
UTM licenses have a 15-day grace period after a license expires. Services will continue to work in this period during which you will receive notifications to renew your license(s). New license(s) are valid for 1 year from the date of purchase.
Applications
These are some Zyxel Device application scenarios.
Security Router
Security includes a Stateful Packet Inspection (SPI) firewall, and UTM (Unified Threat Management). All models need a license to use UTM (Unified Threat Management) features.
IPv6 Routing
The Zyxel Device supports IPv6 Ethernet, PPP, VLAN, and bridge routing. You may also create IPv6 policy routes and IPv6 objects. The Zyxel Device can also route IPv6 packets through IPv4 networks using different tunneling methods.
VPN Connectivity
Set up VPN tunnels with other companies, branch offices, telecommuters, and business travelers to provide secure access to your network. AS is an Authentication Server in the below figure.
SSL VPN Network Access
SSL VPN lets remote users use their web browsers for a very easy-to-use VPN solution. A user just browses to the Zyxel Device’s web address and enters his user name and password to securely connect to the Zyxel Device’s network. Here full tunnel mode creates a virtual connection for a remote user and gives him a private IP address in the same subnet as the local network so he can access network resources in the same way as if he were part of the internal network.
User-Aware Access Control
Set up security policies to restrict access to sensitive information and shared resources based on the user who is trying to access it. In the following figure user A can access both the Internet and an internal file server. User B has a lower level of access and can only access the Internet. User C is not even logged in, so and cannot access either the Internet or the file server.
Load Balancing
Set up multiple connections to the Internet on the same port, or different ports, including cellular interfaces. In either case, you can balance the traffic loads between them.
Management Overview
Web Configurator
If you log into the Zyxel Device for the first time, the Choose A Mode To Start screen appears.
Select Easy Moder to go to the Initial Setup Wizard in Easy Mode, and enter Easy Mode every time you log in. Choose Expert Mode to go to the Initial Setup Wizard in Expert Mode, and enter Expert Mode every time you log in.
This screen is only available for models that support Easy Mode and Expert Mode. See Chapter 1 on page 28 to see which models support Easy Mode.You can still switch between modes after selecting a mode in this screen.The Web Configurator allows easy Zyxel Device setup and management using an Internet browser.
Command-Line Interface (CLI)
The CLI allows you to use text-based commands to configure the Zyxel Device. Access it using remote management (for example, SSH or Telnet) or via the physical or Web Configurator console port. See the Command Reference Guide for CLI details. The default settings for the console port are:
Setting | Value |
|---|---|
Speed | 115200 bps |
Data Bits | 8 |
Parity | None |
Stop Bit | 1 |
Flow Control | Off |
Web Configurator
The Web Configurator is an HTML-based management interface that allows easy system setup and management through Internet browser. Use a browser that supports HTML5, such as Microsoft Edge, Mozilla Firefox, or Google Chrome.
In order to use the Web Configurator you need to allow:
• Web browser pop-up windows from your device.
• JavaScript (enabled by default).
• Java permissions (enabled by default).
The recommended screen resolution is 1024 x 768 pixels.
Screenshots and graphics in this book may differ slightly from your product due to differences in product features or Web Configurator brand style. Most screen shots in this guide come from the USG110 and USG60W.Web Configurator Access
1 Make sure your Zyxel Device hardware is properly connected. See the Quick Start Guide.
2 In your browser go to http://192.168.1.1. By default, the Zyxel Device automatically routes this request to its HTTPS server, and it is recommended to keep this setting. The Login screen appears.
3 Type the user name (default: “admin”) and password (default: “1234”).
If you have a OTP (One-Time Password) token generate a number and enter it in the One-Time Password field. The number is only good for one login. You must use the token to generate a new number the next time you log in.
4 Click Login. After you log in for the first time using the default user name and password, you must change the default admin password in the Update Admin Info screen. Enter a new password of from 1 to 64 characters.
In Configuration > Object > User/Group > Setting, you can enable Password Complexity to require a new password to consist of at least 8 characters and at most 64, where at least 1 character must be a number, at least 1 a lower case letter, at least 1 an upper case letter and at least 1 a special character from the keyboard, such as !@#$%^&*()_+. You can also require periodic changing of the password in that screen by configuring Password must changed every (days).
Make a note of your new password, enter it in the following screen, then click Apply.
5 A Terms of Use screen displays. Read the statement, select the checkbox, and then click Acknowledge to proceed.
6 The Network Risk Warning screen displays any unregistered or disabled security services. If your Zyxel Device is not registered, you will see a prompt to register it. Select how often to display the screen and click OK.
7 Follow the directions in the Update Admin Info screen. If you change the default password, the Login screen appears after you click Apply. If you click Ignore, the Installation Setup Wizard opens if the ZyWALL is using its default configuration; otherwise the dashboard appears.
Security Check for Web Interface Overview
Use this screen to configure settings to secure your Zyxel Device. You can configure:
• Secure SSL access from the Internet to the Zyxel Device.
• Secure SSL access from the Internet to the network behind the Zyxel Device.
• The default port that IPSec VPN clients use to retrieve VPN rule settings from the Zyxel Device.
• The default port for two-factor authentication for VPN clients to access the network behind the Zyxel Device.
Secure SSL Access from the Internet to the Zyxel Device
You can configure up to 3 trusted computers to access the Zyxel Device using secure SSL. The default HTTPS SSL port is 443. If you change this, remote connections from the Internet must use this port. For example, if you change this to port 8800 and the Zyxel Device is using IP address 1.1.1.1, then remote users must use htttps://1.1.1.1:8800.
Configure a new port between 1024 to 65535 that is not in use by other services.
Secure SSL VPN Access from the Internet to the Network Behind the Zyxel Device
The default SSL VPN port is 443. If you change the default SSL VPN port on the Zyxel Device, make sure to make the same change to SecuExtender, the SSL VPN client software. Configure a new port between 1024 to 65535 that is not in use by other services.
You can also restrict SSL VPN access to up to 3 locations on the Internet.
Change the Default IPSec VPN Provisioning Port
Change the default port that IPSec VPN clients use to retrieve VPN rule settings from the Zyxel Device. The default is 443 which is already in use for remote management by default. If you change the default IPSec VPN port on the Zyxel Device, make sure to make the same change to the Zyxel IPSec VPN client.
Configure a new port between 1024 to 65535 that is not in use by other services.
The remote management port, the SSL VPN port and the IPSec VPN port all use 443 by default. If you do not change the default ports, then only 3 connections of the remote management and SSL VPN will be allowed at one time.Change the Default Port for Two-Factor VPN Access Authentication
Change the default port for two-factor authentication for VPN clients to access the network behind the Zyxel Device. VPN clients do not need to change the port number on their devices, because the link to access the network behind the Zyxel Devices will contain the new port number. For example, if you change this to port 8008 and the link is using a.b.c.d, then VPN clients will see this link in their email or SMS to retrieve settings: htttps://a.b.c.d:8008.
You can also change this port in Object > Auth. Method > Two-factor Authentication > VPN Access. See Two-Factor Authentication Admin Access for more information on two-factor authentication.
Configure a new port between 1024 to 65535 that is not in use by other services.
Overall Port Configuration Example
Below is an example of configuring these ports to avoid port conflict.
remote management | ssl vpn | ipsec vpn provisioning | two-factor vpn access authentication |
|---|---|---|---|
8800 | 8080 | 443 (default) | 8008 |
Other Security Measures
New firmware contains patches to enhance security. Make sure to check for new firmware regularly and update firmware in Maintenance > Firmware Management.
Change admin passwords regularly. Select Enable Password Complexity in Object > User/Group > Setting to require the user to use a password that's not easy to guess. The password must include:
• at least 8 characters
• at least one upper case alphabetic character and at least one lower case alphabetic character
• one numeric character
• one special character such as @#$%^
Security Check for Web Interface
The following screen appears when the Zyxel Device detects a rule that allows traffic such as HTTP, HTTPS, SSL and so on to access to your Zyxel Device from any IPv4 source on the WAN. This may expose your Zyxel Device to a security risk. Configure settings in this screen to allow access only from specified IP addresses, FQDNs or regions to secure your Zyxel Device.
The following table describes the labels in this screen.
Label | Description |
|---|---|
Allow secure remote management from WAN | Select this to allow access to the Zyxel Device remotely only from specified IP addresses or Fully Qualified Domain Names (FQDNs), such as 1.1.1.1 or www.zyxel.com. See Secure SSL Access from the Internet to the Zyxel Device for more information. |
Port | Configure a new port between 1024 to 65535 to use it to access the web configurator. Do not use a port number that has been used. For example, use https://1.1.1.1:8800 if you changed the default HTTPS port to 8800. |
Trusted Host 1-3 | Configure the IP addresses or FQDNs that are allowed to access the Zyxel Device. |
Allow SSL VPN access from WAN | Select this to allow SSL VPN clients to access the Zyxel Device only from specified regions. See Secure SSL VPN Access from the Internet to the Network Behind the Zyxel Device for more information. |
Port | Configure a new port between 1024 to 65535 to use it to access the web configurator using SSL VPN. Do not use a port number that has been used. The port you configure here must be the same as the port you use in SecuExtender. See Secure SSL VPN Access from the Internet to the Network Behind the Zyxel Device for more information on SecuExtender. |
Trusted Geolocation 1-3 | Select the regions that are allowed to access the Zyxel Device from the drop-down list box. |
Change Two-Factor Authentication Port | Select this to change the port VPN clients use to access the Zyxel Device LAN with two-factor authentication. See Change the Default Port for Two-Factor VPN Access Authentication for more information. Configure a new port between 1024 to 65535. Do not use a port number that has been used. |
Change Zyxel IPSec VPN Client Provisioning Port | Select this to change the port IPSec VPN clients use to retrieve VPN rule settings from the Zyxel Device. See Change the Default IPSec VPN Provisioning Port for more information. Configure a new port between 1024 to 65535. Do not use a port number that has been used. The port you configure here must be the same as the port you use when logging in as a Zyxel IPSec VPN client. |
Please remind me | Select how often to display the screen from the drop-down list box. |
OK | Click OK to save your changes back to the Zyxel Device. |
Cancel | Click Cancel to exit this screen without saving your changes. |
Remote Access to the Zyxel Device Networks
Your Zyxel Device keeps your networks safe while allowing external access by applying the security measures below:
• Two-Factor Authentication: Use two-factor authentication to have double-layer security to access a secured network behind the Zyxel Device. The first layer is the VPN client/Zyxel Device’s login user name / password. The second layer is an authorized SMS (via mobile phone number) or email address. See Two-Factor Authentication for more information on two-factor authentication.
• IPSec VPN: You can create highly secure connections with IKEv2 or EAP authentication to access networks behind the Zyxel Device. For example, home workers can securely access company resources if they have proper authentication. See IPSec VPN for more information on IPSec VPN.
• Upload Bandwidth Limit: Zyxel subscription-based SecuExtender IPSec VPN clients with Windows version 5.6.80.007 or later or macOS version 1.2.0.7 or later support upload bandwidth limit. Use this to set the maximum bandwidth for uploading traffic from IPSec VPN clients over IPSec VPN tunnels. See Zyxel Device IPSec VPN Client Configuration Provisioning for more information on upload bandwidth limit.
Web Configurator Screens Overview
The Web Configurator screen is divided into these parts:
• A – title bar
• B – navigation panel
• C – main window
Title Bar
The title bar icons in the upper right corner provide the following functions.
Label | Description |
|---|---|
Web Console | Click this to open one or multiple console windows from which you can run command line interface (CLI) commands. You will be prompted to enter your user name and password. See the Command Reference Guide for information about the commands. Logging in to the Zyxel Device with HTTPS, so you can open one or multiple console windows. |
CLI | Click this to open a popup window that displays the CLI commands sent by the Web Configurator to the Zyxel Device. |
Reference | Click this to check which configuration items reference an object. |
Site Map | Click this to see an overview of links to the Web Configurator screens. |
Community | Go to https://businessforum.zyxel.com/categories/security for security product discussions. |
Help | Click this to open the help page for the current screen. |
About | Click this to display basic information about the Zyxel Device. |
Easy Mode | Click this to go to a mode that contains wizards that help you configure the Zyxel Device, and links to portals. Not all models have this mode. |
Logout | Click this to log out of the Web Configurator. |
CLI Messages
Click CLI to look at the CLI commands sent by the Web Configurator. Open the pop-up window and then click some menus in the Web Configurator to display the corresponding commands.
Reference
Select the type of object and the individual object and click Refresh to show which configuration settings reference the object.
The fields vary with the type of object. This table describes labels that can appear in this screen.
Label | Description |
|---|---|
Type | Select the type of reference from the drop-down list box. |
Name | Select the specific reference for the type selected. The settings then display in the table below. |
# | This field is a sequential value, and it is not associated with any entry. |
Service | This is the type of setting that references the selected object. Click a service’s name to display the service’s configuration screen in the main window. |
Priority | If it is applicable, this field lists the referencing configuration item’s position in its list, otherwise N/A displays. |
Name | This field identifies the configuration item that references the object. |
Description | If the referencing configuration item has a description configured, it displays here. |
Refresh | Click this to update the information in this screen. |
Cancel | Click Cancel to close the screen. |
Web Console
Click Web Console to open console windows from which you can run CLI commands. You will be prompted to enter your user name and password. See the Command Reference Guide for information about the commands.
Site Map
Click Site MAP to see an overview of links to the Web Configurator screens.
About
Click About to display basic information about the Zyxel Device.
SecuReporter Banner
Next to the Title Bar, you may see a SecuReporter banner. Click the banner is to configure an organization in SecuReporter and set the Data Protection Policy for this Zyxel Device.
If you click x to close the banner, the banner will still display the next time you log in.
You will not see the SecuReporter banner if you:
• Have enabled SecuReporter in CloudCNM > SecuReporter and the Zyxel Device was added to an organization.
• Clicked "Don't ask me again" in the banner.
If you close the SecuReporter banner, and later decide you want to configure SecuReporter, go to CloudCNM > SecuReporter and click the 'set Org/Network site' hyperlink in the second note.
Navigation Panel
Use the navigation panel menu items to open status and configuration screens. Click the arrow in the middle of the right edge of the navigation panel to hide the panel or drag to resize it. The following sections introduce the Zyxel Device’s navigation panel menus and their screens.
Dashboard
The dashboard displays general device information, system status, system resource usage, licensed service status, and interface status in widgets that you can re-arrange to suit your needs.
Monitor Menu
The monitor menu screens display status and statistics information.
Folder or Link | Tab | Function |
|---|---|---|
System Status | ||
Port Statistics | Port Statistics | Displays packet statistics for each physical port. |
Interface Status | Interface Summary | Displays general interface information and packet statistics. |
Traffic Statistics | Traffic Statistics | Collect and display traffic statistics. |
Session Monitor | Session Monitor | Displays the status of all current sessions. |
IGMP Statistics | IGMP Statistics | Collect and display IGMP statistics. |
DDNS Status | DDNS Status | Displays the status of the Zyxel Device’s DDNS domain names. |
IP/MAC Binding | IP/MAC Binding | Lists the devices that have received an IP address from Zyxel Device interfaces using IP/MAC binding. |
Login Users | Login Users | Lists the users currently logged into the Zyxel Device. |
Dynamic Guest | Dynamic Guest | List the dynamic guest accounts in the Zyxel Device’s local database. |
Cellular Status | Cellular Status | Displays details about the Zyxel Device’s mobile broadband connection status. |
UPnP Port Status | Port Statistics | Displays details about UPnP connections going through the Zyxel Device. |
USB Storage | Storage Information | Displays details about USB device connected to the Zyxel Device. |
Ethernet Neighbor | Ethernet Neighbor | View and manage the Zyxel Device’s neighboring devices via Smart Connect (Layer Link Discovery Protocol (LLDP)). Use the Zyxel One Network (ZON) utility to view and manage the Zyxel Device’s neighboring devices via the Zyxel Discovery Protocol (ZDP). |
FQDN Object | FQDN Object | Displays FQDN (Fully Qualified Domain Name) object cache lists used in DNS queries. |
Wireless | ||
AP Information | AP List | Lists APs managed by the Zyxel Device. |
Radio List | Lists wireless details of APs managed by the Zyxel Device. | |
Top N APs | Lists managed APs with the most wireless traffic usage and most associated wireless stations. | |
Single AP | Lists APs wireless traffic usage and associated wireless stations for a managed AP. | |
ZyMesh | ZyMesh Link Info | Display statistics about ZyMesh wireless connections between managed APs. |
SSID Info | SSID Info | Display information about the SSID’s wireless clients. |
Station Info | Station List | Lists wireless clients associated with the APs managed by the Zyxel Device. |
Top N Stations | Lists wireless stations with the most wireless traffic usage. | |
Single Station | Lists wireless traffic usage for an associated wireless station. | |
Detected Device | Detected Device | Display information about suspected rogue APs. |
Printer Status | Printer Status | Display information about the connected statement printers. |
VPN Monitor | ||
IPSec | IPSec | Displays and manages the active IPSec SAs. |
SSL | SSL | Lists users currently logged into the VPN SSL client portal. You can also log out individual users and delete related session information. |
L2TP over IPSec | L2TP over IPSec | Displays details about current L2TP sessions. |
UTM Statistics | ||
App Patrol | Summary | Displays application patrol statistics. |
Content Filter | Summary | Collect and display content filter statistics |
IDP | Summary | Collect and display statistics on the intrusions that the Zyxel Device has detected. |
Anti-Virus | Summary | Collect and display statistics on the viruses that the Zyxel Device has detected. |
Anti-Spam | Summary | Collect and display spam statistics. |
Status | Displays how many mail sessions the ZyWALL is currently checking and DNSBL (Domain Name Service-based spam Black List) statistics. | |
SSL Inspection | Summary | Collect and display SSL Inspection statistics. |
Certificate Cache List | Displays traffic to destination servers using certificates. | |
Log | View Log | Lists log entries. |
View AP Log | Lists AP log entries. | |
Dynamic Users Log | Display the Zyxel Device’s dynamic guest account log messages. | |
Configuration Menu
Use the configuration menu screens to configure the Zyxel Device’s features.
Folder or Link | Tab | Function |
|---|---|---|
Quick Setup | Quickly configure WAN interfaces or VPN connections. | |
Licensing | ||
Registration | Registration | Register the device and activate trial services. |
Service | View the licensed service status and upgrade licensed services. | |
Signature Update | Anti-Virus | Update anti-virus signatures immediately or by a schedule. |
IDP/AppPatrol | Update IDP signatures immediately or by a schedule. | |
Wireless | ||
Controller | Configuration | Configure manual or automatic controller registration. |
AP Management | Mgnt AP List | Edit or remove entries in the lists of APs managed by the Zyxel Device. |
AP Policy | Configure the AP controller’s IP address on the managed APs and determine the action the managed APs take if the current AP controller fails. | |
AP Group | Create groups of APs, define their radio, VLAN, port and load balancing settings. | |
Firmware | Update the firmware on APs connected to your Zyxel Device. | |
Rogue AP | Rogue/Friendly AP List | Configure how the Zyxel Device monitors rogue APs. |
Load Balancing | Load Balancing | Configure load balancing for traffic moving to and from wireless clients. |
DCS | DCS | Configure dynamic wireless channel selection. |
Auto Healing | Auto Healing | Enable auto healing to extend the wireless service coverage area of the managed APs when one of the APs fails. |
RTLS | Real Time Location System | Use the managed APs as part of an Ekahau RTLS to track the location of Ekahau WiFi tags. |
Network | ||
Interface | Port Port Role/Port Configuration | Use the Port Role screen to set the Zyxel Device’s flexible ports such as LAN, OPT, WLAN, or DMZ. Use the Port Configuration screen to configure settings for individual Zyxel Device ports. |
Ethernet | Manage Ethernet interfaces and virtual Ethernet interfaces. | |
PPP | Create and manage PPPoE and PPTP interfaces. | |
Cellular | Configure a cellular Internet connection for an installed mobile broadband card. | |
Tunnel | Configure tunneling between IPv4 and IPv6 networks. | |
VLAN | Create and manage VLAN interfaces and virtual VLAN interfaces. | |
Bridge | Create and manage bridges and virtual bridge interfaces. | |
VTI | Configure IP address assignment and interface parameters for VTI (Virtual Tunnel Interface). | |
Trunk | Create and manage trunks (groups of interfaces) for load balancing. | |
Routing | Policy Route | Create and manage routing policies. |
Static Route | Create and manage IP static routing information. | |
RIP | Configure device-level RIP settings. | |
OSPF | Configure device-level OSPF settings, including areas and virtual links. | |
BGP | Configure exchange of Border Gateway Protocol (BGP) information over an IPSec tunnel. | |
DDNS | DDNS | Define and manage the Zyxel Device’s DDNS domain names. |
NAT | NAT | Set up and manage port forwarding rules. |
Redirect Service | Redirect Service | Set up and manage HTTP and SMTP redirection rules. |
ALG | ALG | Configure SIP, H.323, and FTP pass-through settings. |
UPnP | UPnP | Configure interfaces that allow UPnP and NAT-PMP connections. |
IP/MAC Binding | Summary | Configure IP to MAC address bindings for devices connected to each supported interface. |
Exempt List | Configure ranges of IP addresses to which the Zyxel Device does not apply IP/MAC binding. | |
Layer 2 Isolation | General | Enable layer-2 isolation on the Zyxel Device and the internal interface(s). |
White List | Enable and configure the white list. | |
DNS Inbound LB | DNS Load Balancing | Configure DNS Load Balancing. |
Web Authentication | Web Authentication General/Authentication Type/Custom Web Portal File/Custom User Agreement File/Facebook Wi-Fi | Define a web portal and exempt services from authentication. |
SSO | Configure the Zyxel Device to work with a Single Sign On agent. | |
Hotspot | ||
Billing | General | Configure the general billing settings, such as the accounting method. |
Billing Profile | Configure the billing profiles for the web-based account generator and each button on the connected statement printer. | |
Discount | Configure discount price plans. | |
Payment Service | Enable online payment service and configure the service pages. | |
Printer Manager | General | Configure the printer list, enable printer management and customize the account printout. |
Printout Configuration | Detect the connected statement printers, change their IP addresses and/or add them to the managed printer list. | |
Free Time | Free Time | Allow users to get a free account for Internet surfing during the specified time period. |
IPnP | IPnP | Enable IPnP on the Zyxel Device and the internal interface(s). |
Walled Garden | Walled Garden General/URL Base/Domain/IP Base | Create walled garden links that display in the login screen. |
Advertisement | Advertisement | Enable and set advertisement links. |
Security Policy | ||
Policy Control | Policy | Create and manage level-3 traffic rules and apply UTM profiles. |
ADP | General | Display and manage ADP bindings. |
Profile | Create and manage ADP profiles. | |
Session Control | Session Control | Limit the number of concurrent client NAT/security policy sessions. |
Cloud CNM | SecuManager | Enable and configure management of the Zyxel Device by a Central Network Management system. |
SecuReporter | Enable SecuReporter logging and access the SecuReporter security analytics portal that collects and analyzes logs from your Zyxel Device in order to identify anomalies, alert on potential internal / external threats, and report on network usage. | |
VPN | ||
IPSec VPN | VPN Connection | Configure IPSec tunnels. |
VPN Gateway | Configure IKE tunnels. | |
Concentrator | Combine IPSec VPN connections into a single secure network | |
Configuration Provisioning | Set who can retrieve VPN rule settings from the Zyxel Device using the Zyxel Device IPSec VPN Client. | |
SSL VPN | Access Privilege | Configure SSL VPN access rights for users and groups. |
Global Setting | Configure the Zyxel Device’s SSL VPN settings that apply to all connections. | |
L2TP VPN | L2TP VPN | Configure L2TP over IPSec tunnels. |
BWM | BWM | Enable and configure bandwidth management rules. |
UTM Profile | ||
AppPatrol | Profile | Manage different types of traffic in this screen. Create App Patrol template(s) of settings to apply to a traffic flow using a security policy. |
Content Filter | Profile | Create and manage the detailed filtering rules for content filtering profiles and then apply to a traffic flow using a security policy. |
Trusted Web Sites | Create a list of allowed web sites that bypass content filtering policies. | |
Forbidden Web Sites | Create a list of web sites to block regardless of content filtering policies. | |
IDP | Profile | Create IDP template(s) of settings to apply to a traffic flow using a security policy. |
Custom Signatures | Create, import, or export custom signatures. | |
Anti-Virus | Profile | Create anti-virus template(s) of settings to apply to a traffic flow using a security policy. |
Black/White List | Set up a black list to identify files with virus file patterns and a white list to identify files that should not be checked for AV. | |
Signature | Search for signatures by signature name or attributes and configure how the Zyxel Device uses them. | |
Anti-Spam | Profile | Turn anti-spam on or off and manage anti-spam policies. Create anti-spam template(s) of settings to apply to a traffic flow using a security policy. |
Mail Scan | Configure e-mail scanning details. | |
Black/White List | Set up a black list to identify spam and a white list to identify legitimate e-mail. | |
DNSBL | Have the ZyWALL check e-mail against DNS Black Lists. | |
SSL Inspection | Profile | Decrypt HTTPS traffic for UTM inspection. Create SSL Inspection template(s) of settings to apply to a traffic flow using a security policy. |
Exclude List | Configure services to be excluded from SSL Inspection. | |
Certificate Update | Use this screen to update the latest certificates of servers using SSL connections to the Zyxel Device network. | |
Device HA | General | Configure Device HA global settings, and see the status of each interface monitored by Device HA. View Device HA Pro license information. |
Device HA Pro | Configure Device HA Pro global, monitored interfaces and synchronization settings. | |
Device HA | Configure active-passive mode Device HA. See Device HA Pro logs. | |
Object | ||
Zone | Zone | Configure zone template(s) used to define various policies. |
User/Group | User | Create and manage users. |
Group | Create and manage groups of users. | |
Setting | Manage default settings for all users, general settings for user sessions, and rules to force user authentication. | |
MAC Address | Configure the MAC addresses of wireless clients for MAC authentication using the local user database. | |
AP Profile | Radio | Create template(s) of radio settings to apply to policies as an object. |
SSID SSID List/Security List/MAC Filter List | Create template(s) of wireless settings to apply to radio profiles or policies as an object. | |
MON Profile | MON Profile | Create and manage rogue AP monitoring files that can be associated with different APs. |
ZyMesh Profile | ZyMesh Profile | Create and manage ZyMesh files that can be associated with different APs. |
Application | Application | Create template(s) of services to apply to policies as an object. |
Application Group | Create and manage groups of applications to apply to policies as a single object. | |
Address/Geo IP | Address | Create and manage host, range, and network (subnet) addresses. |
Address Group | Create and manage groups of addresses to apply to policies as a single objects. | |
Geo IP | Update the database of country-to-IP address mappings and manually configure country-to-IP address mappings for geographic address objects that can be used in security policies. | |
Service | Service | Create and manage TCP and UDP services. |
Service Group | Create and manage groups of services to apply to policies as a single object. | |
Schedule | Schedule | Create one-time and recurring schedules. |
Schedule Group | Create and manage groups of schedules to apply to policies as a single object. | |
AAA Server | Active Directory | Configure the Active Directory settings. |
LDAP | Configure the LDAP settings. | |
RADIUS | Configure the RADIUS settings. | |
Auth. Method | Authentication Method | Create and manage ways of authenticating users. |
Two-factor Authentication | Configure SMS/email authentication to access a secured network behind the Zyxel Device via a VPN tunnel. | |
Certificate | My Certificates | Create and manage the Zyxel Device’s certificates. |
Trusted Certificates | Import and manage certificates from trusted sources. | |
ISP Account | ISP Account | Create and manage ISP account information for PPPoE/PPTP interfaces. |
SSL Application | SSL Application | Create SSL web application or file sharing objects to apply to policies. |
System | ||
Host Name | Host Name | Configure the system and domain name for the Zyxel Device. |
USB Storage | Settings | Configure the settings for the connected USB devices. |
Date/Time | Date/Time | Configure the current date, time, and time zone in the Zyxel Device. |
Console Speed | Console Speed | Set the console speed. |
DNS | DNS | Configure the DNS server and address records for the Zyxel Device. |
WWW | Service Control | Configure HTTP, HTTPS, and general authentication. |
Login Page Desktop View/Mobile View | Configure how the login and access user screens look. | |
SSH | SSH | Configure SSH server and SSH service settings. |
TELNET | TELNET | Configure telnet server settings for the Zyxel Device. |
FTP | FTP | Configure FTP server settings. |
SNMP | SNMP | Configure SNMP communities and services. |
Auth. Server | Auth. Server | Configure the Zyxel Device to act as a RADIUS server. |
Notification | Mail Server | Configure a mail server with authentication to send reports and password expiration notification emails. |
SMS | Enable the SMS service to send dynamic guest account information in text messages and authorization for VPN tunnel access to a secured network. | |
Language | Language | Select the Web Configurator language. |
IPv6 | IPv6 | Enable IPv6 globally on the Zyxel Device here. |
ZON | ZON | Use the Zyxel One Network (ZON) utility to view and manage the Zyxel Device’s neighboring devices via the Zyxel Discovery Protocol (ZDP). |
Log & Report | ||
Email Daily Report | Email Daily Report | Configure where and how to send daily reports and what reports to send. |
Log Settings | Log Settings | Configure the system log, e-mail logs, and remote syslog servers. |
Maintenance Menu
Use the maintenance menu screens to manage configuration and firmware files, run diagnostics, and reboot or shut down the Zyxel Device.
Folder or Link | Tab | Function |
|---|---|---|
File Manager | Configuration File | Manage and upload configuration files for the Zyxel Device. |
Firmware Management | View the current firmware version and upload firmware. Reboot with your choice of firmware. | |
Shell Script | Manage and run shell script files for the Zyxel Device. | |
Diagnostics | Diagnostics Collect Collect on AP Files | Collect diagnostic information. |
Packet Capture Capture/Capture on AP/Files | Capture packets for analysis. | |
CPU/Memory Status | View CPU and memory usage statistics. | |
System Log | Connect a USB device to the Zyxel Device and archive the Zyxel Device system logs to it here. | |
Network Tool | Identify problems with the connections. You can use Ping or Traceroute to help you identify problems. | |
Routing Traces | Configure traceroute to identify where packets are dropped for troubleshooting. | |
Packet Flow Explore | Routing Status | Check how the Zyxel Device determines where to route a packet. |
SNAT Status | View a clear picture on how the Zyxel Device converts a packet’s source IP address and check the related settings. | |
Shutdown | Shutdown | Turn off the Zyxel Device. |
Tables and Lists
Web Configurator tables and lists are flexible with several options for how to display their entries.
Click a column heading to sort the table’s entries according to that column’s criteria.
Click the down arrow next to a column heading for more options about how to display the entries. The options available vary depending on the type of fields in the column. Here are some examples of what you can do:
• Sort in ascending or descending (reverse) alphabetical order
• Select which columns to display
• Group entries by field
• Show entries in groups
• Filter by mathematical operators (<, >, or =) or searching for text
Select a column heading cell’s right border and drag to re-size the column.
Select a column heading and drag and drop it to change the column order. A green check mark displays next to the column’s title when you drag the column to a valid new location.
Use the icons and fields at the bottom of the table to navigate to different pages of entries and control how many entries display at a time.
The tables have icons for working with table entries. You can often use the [Shift] or [Ctrl] key to select multiple entries to remove, activate, or deactivate.
Here are descriptions for the most common table icons.
Label | Description |
|---|---|
Add | Click this to create a new entry. For features where the entry’s position in the numbered list is important (features where the Zyxel Device applies the table’s entries in order like the security policy for example), you can select an entry and click Add to create a new entry after the selected entry. |
Edit | Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings. In some tables you can just click a table entry and edit it directly in the table. For those types of tables small red triangles display for table entries with changes that you have not yet applied. |
Remove | To remove an entry, select it and click Remove. The Zyxel Device confirms you want to remove it before doing so. |
Activate | To turn on an entry, select it and click Activate. |
Inactivate | To turn off an entry, select it and click Inactivate. |
Connect | To connect an entry, select it and click Connect. |
Disconnect | To disconnect an entry, select it and click Disconnect. |
References | Select an entry and click References to check which settings use the entry. |
Move | To change an entry’s position in a numbered list, select it and click Move to display a field to type a number for where you want to put that entry and press [ENTER] to move the entry to the number that you typed. For example, if you type 6, the entry you are moving becomes number 6 and the previous entry 6 (if there is one) gets pushed up (or down) one. |
Working with Lists
When a list of available entries displays next to a list of selected entries, you can often just double-click an entry to move it from one list to the other. In some lists you can also use the [Shift] or [Ctrl] key to select multiple entries, and then use the arrow button to move them to the other list.