Monitor

Use the Monitor screens to check status and statistics information.

Use this screen to look at packet statistics for each Gigabit Ethernet port.

Monitor > System Status > Port Statistics
Label	Description
Poll Interval	Enter how often you want this window to be updated automatically, and click Set Interval.
Set Interval	Click this to set the Poll Interval the screen uses.
Stop	Click this to stop the window from updating automatically. You can start it again by setting the Poll Interval and clicking Set Interval.
Switch to Graphic View	Click this to display the port statistics as a line graph.
#	This field displays the port’s number in the list.
Port	This field displays the physical port number.
Status	This field displays the current status of the physical port. Down - The physical port is not connected. Speed / Duplex - The physical port is connected. This field displays the port speed and duplex setting (Full or Half).
TxPkts	This field displays the number of packets transmitted from the ZyWALL on the physical port since it was last connected.
RxPkts	This field displays the number of packets received by the ZyWALL on the physical port since it was last connected.
Collisions	This field displays the number of collisions on the physical port since it was last connected.
Tx B/s	This field displays the transmission speed, in bytes per second, on the physical port in the one-second interval before the screen updated.
Rx B/s	This field displays the reception speed, in bytes per second, on the physical port in the one-second interval before the screen updated.
Up Time	This field displays how long the physical port has been connected.
System Up Time	This field displays how long the ZyWALL has been running since it last restarted or was turned on.

Port Statistics Graph

Use this screen to look at a line graph of packet statistics for each physical port.

Monitor > System Status > Port Statistics > Switch to Graphic View
Label	Description
Refresh Interval	Enter how often you want this window to be automatically updated.
Refresh Now	Click this to update the information in the window right away.
Port Selection	Select the number of the physical port for which you want to display graphics.
Switch to Grid View	Click this to display the port statistics as a table.
bps	The y-axis represents the speed of transmission or reception.
time	The x-axis shows the time period over which the transmission or reception occurred
TX	This line represents traffic transmitted from the ZyWALL on the physical port since it was last connected.
RX	This line represents the traffic received by the ZyWALL on the physical port since it was last connected.
Last Update	This field displays the date and time the information in the window was last updated.
System Up Time	This field displays how long the ZyWALL has been running since it last restarted or was turned on.

Interface Status

This screen lists all of the ZyWALL’s interfaces and gives packet statistics for them.

Monitor > System Status > Interface Status
Label	Description
Interface Status	If an Ethernet interface does not have any physical ports associated with it, its entry is displayed in light gray text.
Expand/Close	Click this button to show or hide statistics for all the virtual interfaces on top of the Ethernet interfaces.
Name	This field displays the name of each interface. If there is an Expand icon (plus-sign) next to the name, click this to look at the status of virtual interfaces on top of this interface.
Port	This field displays the physical port number.
Status	This field displays the current status of each interface. The possible values depend on what type of interface it is. For Ethernet interfaces: Inactive - The Ethernet interface is disabled. Down - The Ethernet interface is enabled but not connected. Speed / Duplex - The Ethernet interface is enabled and connected. This field displays the port speed and duplex setting (Full or Half). For cellular (3G) interfaces, see USB Storage for the status that can appear. For the auxiliary interface: Inactive - The auxiliary interface is disabled. Connected - The auxiliary interface is enabled and connected. Disconnected - The auxiliary interface is not connected. For virtual interfaces, this field always displays Up. If the virtual interface is disabled, it does not appear in the list. For VLAN and bridge interfaces, this field always displays Up. If the VLAN or bridge interface is disabled, it does not appear in the list. For PPP interfaces: Connected - The PPP interface is connected. Disconnected - The PPP interface is not connected. If the PPP interface is disabled, it does not appear in the list. For WLAN interfaces: Up - The WLAN interface is enabled. Down - The WLAN interface is disabled.
Zone	This field displays the zone to which the interface is assigned.
IP Addr/Netmask	This field displays the current IP address and subnet mask assigned to the interface. If the IP address and subnet mask are 0.0.0.0, the interface is disabled or did not receive an IP address and subnet mask via DHCP. If this interface is a member of an active virtual router, this field displays the IP address it is currently using. This is either the static IP address of the interface (if it is the master) or the management IP address (if it is a backup).
IP Assignment	This field displays how the interface gets its IP address. Static - This interface has a static IP address. DHCP Client - This interface gets its IP address from a DHCP server.
Services	This field lists which services the interface provides to the network. Examples include DHCP relay, DHCP server, DDNS, RIP, and OSPF. This field displays n/a if the interface does not provide any services to the network.
Action	Use this field to get or to update the IP address for the interface. Click Renew to send a new DHCP request to a DHCP server. Click Connect to try to connect a PPPoE/PPTP interface. If the interface cannot use one of these ways to get or to update its IP address, this field displays n/a.
Tunnel Interface Status	This displays the details of the ZyWALL’s configured tunnel interfaces.
Name	This field displays the name of the interface.
Status	The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive.
Zone	This field displays the zone to which the interface is assigned.
IP Address	This is the IP address of the interface. If the interface is active (and connected), the ZyWALL tunnels local traffic sent to this IP address to the Remote Gateway Address.
My Address	This is the interface or IP address uses to identify itself to the remote gateway. The ZyWALL uses this as the source for the packets it tunnels to the remote gateway.
Remote Gateway Address	This is the IP address or domain name of the remote gateway to which this interface tunnels traffic.
Mode	This field displays the tunnel mode that you are using.
Action	This field lists which services the interface provides to the network. This field displays n/a if the interface does not provide any services to the network.
IPv6 Interface Status	This section displays the status of the IPv6 interface. If an Ethernet interface does not have any physical ports associated with it, its entry is displayed in light gray text.
Expand/Close	Click this button to show or hide statistics for all the virtual interfaces on top of the Ethernet interfaces.
Name	This field displays the name of each interface. If there is an Expand icon (plus-sign) next to the name, click this to look at the status of virtual interfaces on top of this interface.
Port	This field displays the physical port number.
Status	This field displays the current status of each interface. The possible values depend on what type of interface it is. For Ethernet interfaces: Inactive - The Ethernet interface is disabled. Down - The Ethernet interface is enabled but not connected. Speed / Duplex - The Ethernet interface is enabled and connected. This field displays the port speed and duplex setting (Full or Half). For cellular (3G) interfaces, see Cellular Status for the status that can appear. For the auxiliary interface: Inactive - The auxiliary interface is disabled. Connected - The auxiliary interface is enabled and connected. Disconnected - The auxiliary interface is not connected. For virtual interfaces, this field always displays Up. If the virtual interface is disabled, it does not appear in the list. For VLAN and bridge interfaces, this field always displays Up. If the VLAN or bridge interface is disabled, it does not appear in the list. For PPP interfaces: Connected - The PPP interface is connected. Disconnected - The PPP interface is not connected. If the PPP interface is disabled, it does not appear in the list. For WLAN interfaces: Up - The WLAN interface is enabled. Down - The WLAN interface is disabled.
HA Status	This field displays the status of the interface in the virtual router. Active - This interface is the master interface in the virtual router. Stand-By - This interface is a backup interface in the virtual router. Fault - This VRRP group is not functioning in the virtual router right now. For example, this might happen if the interface is down. n/a - Device HA is not active on the interface.
Zone	This field displays the zone to which the interface is assigned.
IP Address	This field displays the current IPv6 address assigned to the interface. If the IPv6 address is not displayed, the interface is disabled or did not receive an IPv6 address via DHCP. If this interface is a member of an active virtual router, this field displays the IP address it is currently using. This is either the static IP address of the interface (if it is the master) or the management IP address (if it is a backup).
IP Assignment	This field displays how the interface gets its IP address. Static - This interface has a static IP address. DHCP Client - This interface gets its IP address from a DHCP server.
Services	This field lists which services the interface provides to the network. Examples include DHCP relay, DHCP server, DDNS, RIP, and OSPF. This field displays n/a if the interface does not provide any services to the network.
Action	Use this field to get or to update the IP address for the interface. Click Renew to send a new DHCP request to a DHCP server. Click Connect to try to connect a PPPoE/PPTP interface. If the interface cannot use one of these ways to get or to update its IP address, this field displays n/a.
Interface Statistics	This table provides packet statistics for each interface.
Refresh	Click this button to update the information in the screen.
Expand/Close	Click this button to show or hide statistics for all the virtual interfaces on top of the Ethernet interfaces.
Name	This field displays the name of each interface. If there is a Expand icon (plus-sign) next to the name, click this to look at the statistics for virtual interfaces on top of this interface.
Status	This field displays the current status of the interface. Down - The interface is not connected. Speed / Duplex - The interface is connected. This field displays the port speed and duplex setting (Full or Half). This field displays Connected and the accumulated connection time (hh:mm:ss) when the PPP interface is connected.
TxPkts	This field displays the number of packets transmitted from the ZyWALL on the interface since it was last connected.
RxPkts	This field displays the number of packets received by the ZyWALL on the interface since it was last connected.
Tx B/s	This field displays the transmission speed, in bytes per second, on the interface in the one-second interval before the screen updated.
Rx B/s	This field displays the reception speed, in bytes per second, on the interface in the one-second interval before the screen updated.

Traffic Statistics

This screen provides basic information about the following for example:

•

Most-visited Web sites and the number of times each one was visited. This count may not be accurate in some cases because the ZyWALL counts HTTP GET packets. Please see Monitor > System Status > Traffic Statistics for more information.

•

Most-used protocols or service ports and the amount of traffic on each one

•

LAN IP with heaviest traffic and how much traffic has been sent to and from each one

You use the Traffic Statistics screen to tell the ZyWALL when to start and when to stop collecting information for these reports. You cannot schedule data collection; you have to start and stop it manually in the Traffic Statistics screen.

Monitor > System Status > Traffic Statistics
Label	Description
Data Collection
Collect Statistics	Select this to have the ZyWALL collect data for the report. If the ZyWALL has already been collecting data, the collection period displays to the right. The progress is not tracked here real-time, but you can click the Refresh button to update it.
Apply	Click Apply to save your changes back to the ZyWALL.
Reset	Click Reset to return the screen to its last-saved settings.
Statistics
Interface	Select the interface from which to collect information. You can collect information from Ethernet, VLAN, bridge and PPPoE/PPTP interfaces.
Traffic Type	Select the type of report to display. Choices are: Host IP Address/User - displays the IP addresses or users with the most traffic and how much traffic has been sent to and from each one. Service/Port - displays the most-used protocols or service ports and the amount of traffic for each one. Web Site Hits - displays the most-visited Web sites and how many times each one has been visited. Each type of report has different information in the report (below).
Refresh	Click this button to update the report display.
Flush Data	Click this button to discard all of the screen’s statistics and update the report display.
	These fields are available when the Traffic Type is Host IP Address/User.
#	This field is the rank of each record. The IP addresses and users are sorted by the amount of traffic.
IP Address/User	This field displays the IP address or user in this record. The maximum number of IP addresses or users in this report is indicated in Maximum Values for Reports.
Direction	This field indicates whether the IP address or user is sending or receiving traffic. Ingress- traffic is coming from the IP address or user to the ZyWALL. Egress - traffic is going from the ZyWALL to the IP address or user.
Amount	This field displays how much traffic was sent or received from the indicated IP address or user. If the Direction is Ingress, a red bar is displayed; if the Direction is Egress, a blue bar is displayed. The unit of measure is bytes, Kbytes, Mbytes or Gbytes, depending on the amount of traffic for the particular IP address or user. The count starts over at zero if the number of bytes passes the byte count limit. See Maximum Values for Reports.
	These fields are available when the Traffic Type is Service/Port.
#	This field is the rank of each record. The protocols and service ports are sorted by the amount of traffic.
Service/Port	This field displays the service and port in this record. The maximum number of services and service ports in this report is indicated in Maximum Values for Reports.
Protocol	This field indicates what protocol the service was using.
Direction	This field indicates whether the indicated protocol or service port is sending or receiving traffic. Ingress - traffic is coming into the router through the interface Egress - traffic is going out from the router through the interface
Amount	This field displays how much traffic was sent or received from the indicated service / port. If the Direction is Ingress, a red bar is displayed; if the Direction is Egress, a blue bar is displayed. The unit of measure is bytes, Kbytes, Mbytes, Gbytes, or Tbytes, depending on the amount of traffic for the particular protocol or service port. The count starts over at zero if the number of bytes passes the byte count limit. See Maximum Values for Reports.
	These fields are available when the Traffic Type is Web Site Hits.
#	This field is the rank of each record. The domain names are sorted by the number of hits.
Web Site	This field displays the domain names most often visited. The ZyWALL counts each page viewed on a Web site as another hit. The maximum number of domain names in this report is indicated in Maximum Values for Reports.
Hits	This field displays how many hits the Web site received. The ZyWALL counts hits by counting HTTP GET packets. Many Web sites have HTTP GET references to other Web sites, and the ZyWALL counts these as hits too. The count starts over at zero if the number of hits passes the hit count limit. See Maximum Values for Reports.

The following table displays the maximum number of records shown in the report, the byte count limit, and the hit count limit.

Maximum Values for Reports
Label	Description
Maximum Number of Records	20
Byte Count Limit	264 bytes; this is just less than 17 million terabytes.
Hit Count Limit	264 hits; this is over 1.8 x 1019 hits.

Session Monitor

The Session Monitor screen displays information about active sessions for debugging or statistical analysis. It is not possible to manage sessions in this screen. The following information is displayed.

•

User who started the session

•

Protocol or service port used

•

Source address

•

Destination address

•

Number of bytes received (so far)

•

Number of bytes transmitted (so far)

•

Duration (so far)

You can look at all the active sessions by user, service, source IP address, or destination IP address. You can also filter the information by user, protocol / service or service group, source address, and/or destination address and view it by user.

Monitor > System Status > Session Monitor
Label	Description
View	Select how you want the information to be displayed. Choices are: sessions by users - display all active sessions grouped by user sessions by services - display all active sessions grouped by service or protocol sessions by source IP - display all active sessions grouped by source IP address sessions by destination IP - display all active sessions grouped by destination IP address all sessions - filter the active sessions by the User, Service, Source Address, and Destination Address, and display each session individually (sorted by user).
Refresh	Click this button to update the information on the screen. The screen also refreshes automatically when you open and close the screen.
	The User, Service, Source Address, and Destination Address fields display if you view all sessions. Select your desired filter criteria and click the Search button to filter the list of sessions.
User	This field displays when View is set to all sessions. Type the user whose sessions you want to view. It is not possible to type part of the user name or use wildcards in this field; you must enter the whole user name.
Service	This field displays when View is set to all sessions. Select the service or service group whose sessions you want to view. The ZyWALL identifies the service by comparing the protocol and destination port of each packet to the protocol and port of each services that is defined.
Source	This field displays when View is set to all sessions. Type the source IP address whose sessions you want to view. You cannot include the source port.
Destination	This field displays when View is set to all sessions. Type the destination IP address whose sessions you want to view. You cannot include the destination port.
Search	This button displays when View is set to all sessions. Click this button to update the information on the screen using the filter criteria in the User, Service, Source Address, and Destination Address fields.
Active Sessions	This is the total number of active sessions that matched the search criteria.
Show	Select the number of active sessions displayed on each page. You can use the arrow keys on the right to change pages.
User	This field displays the user in each active session. If you are looking at the sessions by users (or all sessions) report, click + or - to display or hide details about a user’s sessions.
Service	This field displays the protocol used in each active session. If you are looking at the sessions by services report, click + or - to display or hide details about a protocol’s sessions.
Source	This field displays the source IP address and port in each active session. If you are looking at the sessions by source IP report, click + or - to display or hide details about a source IP address’s sessions.
Destination	This field displays the destination IP address and port in each active session. If you are looking at the sessions by destination IP report, click + or - to display or hide details about a destination IP address’s sessions.
Rx	This field displays the amount of information received by the source in the active session.
Tx	This field displays the amount of information transmitted by the source in the active session.
Duration	This field displays the length of the active session in seconds.

DDNS Status

The DDNS Status screen shows the status of the ZyWALL’s DDNS domain names.

Monitor > System Status > DDNS Status
Label	Description
Update	Click this to have the ZyWALL update the profile to the DDNS server. The ZyWALL attempts to resolve the IP address for the domain name.
Profile Name	This field displays the descriptive profile name for this entry.
Domain Name	This field displays each domain name the ZyWALL can route.
Effective IP	This is the (resolved) IP address of the domain name.
Last Update Status	This shows whether the last attempt to resolve the IP address for the domain name was successful or not. Updating means the ZyWALL is currently attempting to resolve the IP address for the domain name.
Last Update Time	This shows when the last attempt to resolve the IP address for the domain name occurred (in year-month-day hour:minute:second format).

IP/MAC Binding Monitor

This screen lists the devices that have received an IP address from ZyWALL interfaces with IP/MAC binding enabled and have ever established a session with the ZyWALL. Devices that have never established a session with the ZyWALL do not display in the list.

Monitor > System Status > IP/MAC Binding
Label	Description
Interface	Select a ZyWALL interface that has IP/MAC binding enabled to show to which devices it has assigned an IP address.
#	This is the index number of an IP/MAC binding entry.
IP Address	This is the IP address that the ZyWALL assigned to a device.
Host Name	This field displays the name used to identify this device on the network (the computer name). The ZyWALL learns these from the DHCP client requests.
MAC Address	This field displays the MAC address to which the IP address is currently assigned.
Last Access	This is when the device last established a session with the ZyWALL through this interface.
Refresh	Click this button to update the information in the screen.

Use this screen to look at a list of the users currently logged into the ZyWALL.

Monitor > System Status > Login Users
Label	Description
#	This field is a sequential value and is not associated with any entry.
User ID	This field displays the user name of each user who is currently logged in to the ZyWALL.
Reauth Lease T.	This field displays the amount of reauthentication time remaining and the amount of lease time remaining for each user.
Type	This field displays the way the user logged in to the ZyWALL.
IP Address	This field displays the IP address of the computer used to log in to the ZyWALL.
User Info	This field displays the types of user accounts the ZyWALL uses. If the user type is ext-user (external user), this field will show its external-group information when you move your mouse over it. If the external user matches two external-group objects, both external-group object names will be shown.
Force Logout	Select a user ID and click this icon to end a user’s session.
Refresh	Click this button to update the information in the screen.

WLAN Status

The WLAN Status screen displays the connection status of the wireless clients connected to (or trying to connect to) a IEEE 802.11b/g card installed in the ZyWALL.

Monitor > System Status > WLAN Status
Label	Description
Station List	Select the location where the WLAN card is located.
#	This is the index number of the MAC address.
MAC Address	This displays the MAC address (in XX:XX:XX:XX:XX:XX format) of a connected wireless station.
Strength	This displays the strength of the wireless client’s radio signal. The signal strength mainly depends on the antenna output power and the wireless client’s distance from the ZyWALL.
Connect Rate	This displays what data transfer rate of the wireless client’s connection to the ZyWALL. This field displays up to the standard IEEE 802.11g connection rate of 54 Mbps. It does not display higher, even if you enable super mode. The display on your wireless clients may vary.
Interface	This is the name of the wireless LAN interface on the ZyWALL to which the wireless client is connected.
Refresh	Click this button to update the information in the screen.

Cellular Status

This screen displays your 3G connection status.

Monitor > System Status > Cellular Status
Label	Description
Refresh	Click this button to update the information in the screen.
More Information	Click this to display more information on your 3G, such as the signal strength, IMEA/ESN and IMSI. This is only available when the 3G device attached and activated on your ZyWALL.
#	This field is a sequential value, and it is not associated with any interface.
Extension Slot	This field displays where the entry’s cellular card is located.
Connected Device	This field displays the model name of the cellular card.
Status	No device - no 3G device is connected to the ZyWALL. No Service - no 3G network is available in the area; you cannot connect to the Internet. Limited Service - returned by the service provider in cases where the SIM card is expired, the user failed to pay for the service and so on; you cannot connect to the Internet. Device detected - displays when you connect a 3G device. Device error - a 3G device is connected but there is an error. Probe device fail - the ZyWALL’s test of the 3G device failed. Probe device ok - the ZyWALL’s test of the 3G device succeeded. Init device fail - the ZyWALL was not able to initialize the 3G device. Init device ok - the ZyWALL initialized the 3G card. Check lock fail - the ZyWALL’s check of whether or not the 3G device is locked failed. Device locked - the 3G device is locked. SIM error - there is a SIM card error on the 3G device. SIM locked-PUK - the PUK is locked on the 3G device’s SIM card. SIM locked-PIN - the PIN is locked on the 3G device’s SIM card. Unlock PUK fail - Your attempt to unlock a WCDMA 3G device’s PUK failed because you entered an incorrect PUK. Unlock PIN fail - Your attempt to unlock a WCDMA 3G device’s PIN failed because you entered an incorrect PIN. Unlock device fail - Your attempt to unlock a CDMA2000 3G device failed because you entered an incorrect device code. Device unlocked - You entered the correct device code and unlocked a CDMA2000 3G device. Get dev-info fail - The ZyWALL cannot get cellular device information. Get dev-info ok - The ZyWALL succeeded in retrieving 3G device information. Searching network - The 3G device is searching for a network. Get signal fail - The 3G device cannot get a signal from a network. Network found - The 3G device found a network. Apply config - The ZyWALL is applying your configuration to the 3G device. Inactive - The 3G interface is disabled. Active - The 3G interface is enabled. Incorrect device - The connected 3G device is not compatible with the ZyWALL. Correct device - The ZyWALL detected a compatible 3G device. Set band fail - Applying your band selection was not successful. Set band ok - The ZyWALL successfully applied your band selection. Set profile fail - Applying your ISP settings was not successful. Set profile ok - The ZyWALL successfully applied your ISP settings. PPP fail - The ZyWALL failed to create a PPP connection for the cellular interface. Need auth-password - You need to enter the password for the 3G card in the cellular edit screen. Device ready - The ZyWALL successfully applied all of your configuration and you can use the 3G connection.
Service Provider	This displays the name of your network service provider. This shows Limited Service if the service provider has stopped service to the 3G SIM card. For example if the bill has not been paid or the account has expired.
Cellular System	This field displays what type of cellular network the 3G connection is using. The network type varies depending on the 3G card you inserted and could be UMTS, UMTS/HSDPA, GPRS or EDGE when you insert a GSM 3G card, or 1xRTT, EVDO Rev.0 or EVDO Rev.A when you insert a CDMA 3G card.
Signal Quality	This displays the strength of the signal. The signal strength mainly depends on the antenna output power and the distance between your ZyWALL and the service provider’s base station.

More Information

This screen displays more information on your 3G, such as the signal strength, IMEA/ESN and IMSI that helps identify your 3G device and SIM card.

Note:

This screen is only available when the 3G device is attached to and activated on the ZyWALL.

Monitor > System Status > More Information
Label	Description
Extension Slot	This field displays where the entry’s cellular card is located.
Service Provider	This displays the name of your network service provider. This shows Limited Service if the service provider has stopped service to the 3G SIM card. For example if the bill has not been paid or the account has expired.
Cellular System	This field displays what type of cellular network the 3G connection is using. The network type varies depending on the 3G card you inserted and could be UMTS, UMTS/HSDPA, GPRS or EDGE when you insert a GSM 3G card, or 1xRTT, EVDO Rev.0 or EVDO Rev.A when you insert a CDMA 3G card.
Signal Strength	This is the Signal Quality measured in dBm.
Signal Quality	This displays the strength of the signal. The signal strength mainly depends on the antenna output power and the distance between your ZyWALL and the service provider’s base station.
Device Manufacturer	This shows the name of the company that produced the 3G device.
Device Model	This field displays the model name of the cellular card.
Device Firmware	This shows the software version of the 3G device.
Device IMEI/ESN	IMEI (International Mobile Equipment Identity) is a 15-digit code in decimal format that identifies the 3G device. ESN (Electronic Serial Number) is an 8-digit code in hexadecimal format that identifies the 3G device.
SIM Card IMSI	IMSI (International Mobile Subscriber Identity) is a 15-digit code that identifies the SIM card.

USB Storage

This screen displays information about a connected USB storage device.

Monitor > System Status > USB Storage
Label	Description
Device description	This is a basic description of the type of USB device.
Usage	This field displays how much of the USB storage device’s capacity is currently being used out of its total capacity and what percentage that makes.
Filesystem	This field displays what file system the USB storage device is formatted with. This field displays Unknown if the file system of the USB storage device is not supported by the ZyWALL, such as NTFS.
Speed	This field displays the connection speed the USB storage device supports.
Status	Ready - you can have the ZyWALL use the USB storage device. Click Remove Now to stop the ZyWALL from using the USB storage device so you can remove it. Unused - the connected USB storage device was manually unmounted by using the Remove Now button or for some reason the ZyWALL cannot mount it. Click Use It to have the ZyWALL mount a connected USB storage device. This button is grayed out if the file system is not supported (unknown) by the ZyWALL. none - no USB storage device is connected.
Detail	This field displays any other information the ZyWALL retrieves from the USB storage device. Deactivated - the use of a USB storage device is disabled (turned off) on the ZyWALL. OutofSpace - the available disk space is less than the disk space full threshold . Mounting - the ZyWALL is mounting the USB storage device. Removing - the ZyWALL is unmounting the USB storage device. none - the USB device is operating normally or not connected.

Application Patrol Statistics

This screen displays statistics for selected protocols.

Protocol Statistics

Monitor > AppPatrol Statistics > Protocol Statistics
Label	Description
Service	This is the protocol. Click the service’s name to display a screen with statistics for each of the service’s application patrol rules.
Forwarded Data (KB)	This is how much of the application’s traffic the ZyWALL has sent (in kilobytes).
Dropped Data (KB)	This is how much of the application’s traffic the ZyWALL has discarded without notifying the client (in kilobytes). This traffic was dropped because it matched an application policy set to “drop”.
Rejected Data (KB)	This is how much of the application’s traffic the ZyWALL has discarded and notified the client that the traffic was rejected (in kilobytes). This traffic was rejected because it matched an application policy set to “reject”.
Matched Auto Connection	This is how much of the application’s traffic the ZyWALL identified by examining the IP payload.
Matched Service Ports Connection	This is how much of the application’s traffic the ZyWALL identified by examining OSI level-3 information such as IP addresses and port numbers.

Application Patrol Statistics: Individual Protocol Statistics by Rule

Click a service’s name to display this screen with statistics for each of the service’s application patrol rules.

Monitor > AppPatrol Statistics > Protocol Statistics: Service rule
Label	Description
Service Name	This is the application.
Rule Statistics	This table displays the statistics for each of the service’s application patrol rules.
#	This field is a sequential value, and it is not associated with a specific rule.
Rule	This is the name of the protocol’s rule.
Forwarded Data (KB)	This is how much of the application’s traffic the ZyWALL has sent (in kilobytes).
Dropped Data (KB)	This is how much of the application’s traffic the ZyWALL has discarded without notifying the client (in kilobytes). This traffic was dropped because it matched a policy set to “drop”.
Rejected Data (KB)	This is how much of the application’s traffic the ZyWALL has discarded and notified the client that the traffic was rejected (in kilobytes). This traffic was rejected because it matched a policy set to “reject”.
Cancel	Click Cancel to close this screen.

Bandwidth Statistics: General Setup

Monitor > AppPatrol Statistics > Bandwidth Statistics: General Setup
Label	Description
Refresh Interval	Select how often you want the statistics display to update.
Display Protocols	Select the protocols for which to display statistics. Select All selects all of the protocols. Clear All clears all of the protocols. Click Expand to display individual protocols. Collapse hides them. Statistics for the selected protocols display after you click Apply.

Bandwidth Statistics: Bandwidth Statistics

•

The y-axis represents the amount of bandwidth used.

•

The x-axis shows the time period over which the bandwidth usage occurred.

•

A solid line represents a protocol’s incoming bandwidth usage. This is the protocol’s traffic that the ZyWALL sends to the initiator of the connection.

•

A dotted line represents a protocol’s outgoing bandwidth usage. This is the protocol’s traffic that the ZyWALL sends out from the initiator of the connection.

•

Different colors represent different protocols.

IPSec Monitor

You can use the IPSec Monitor screen to display and to manage active IPSec SAs. Click a column’s heading cell to sort the table entries by that column’s criteria. Click the heading cell again to reverse the sort order.

Monitor > VPN Monitor > IPSec
Label	Description
Name	Enter the name of a IPSec SA here and click Search to find it (if it is associated). You can use a keyword or regular expression. Use up to 30 alphanumeric and _+-.()!$*^:?\|{}[]<>/ characters. See Regular Expressions in Searching IPSec SAs for more details.
Policy	Enter the IP address(es) or names of the local and remote policies for an IPSec SA and click Search to find it. You can use a keyword or regular expression. Use up to 30 alphanumeric and _+-.()!$*^:?\|{}[]<>/ characters. See Regular Expressions in Searching IPSec SAs for more details.
Search	Click this button to search for an IPSec SA that matches the information you specified above.
Disconnect	Select an IPSec SA and click this button to disconnect it.
Total Connection	This field displays the total number of associated IPSec SAs.
connection per page	Select how many entries you want to display on each page.
Page x of x	This is the number of the page of entries currently displayed and the total number of pages of entries. Type a page number to go to or use the arrows to navigate the pages of entries.
#	This field is a sequential value, and it is not associated with a specific SA.
Name	This field displays the name of the IPSec SA.
Encapsulation	This field displays how the IPSec SA is encapsulated.
Policy	This field displays the content of the local and remote policies for this IPSec SA. The IP addresses, not the address objects, are displayed.
Algorithm	This field displays the encryption and authentication algorithms used in the SA.
Up Time	This field displays how many seconds the IPSec SA has been active. This field displays N/A if the IPSec SA uses manual keys.
Timeout	This field displays how many seconds remain in the SA life time, before the ZyWALL automatically disconnects the IPSec SA. This field displays N/A if the IPSec SA uses manual keys.
Inbound (Bytes)	This field displays the amount of traffic that has gone through the IPSec SA from the remote IPSec router to the ZyWALL since the IPSec SA was established.
Outbound (Bytes)	This field displays the amount of traffic that has gone through the IPSec SA from the ZyWALL to the remote IPSec router since the IPSec SA was established.
Refresh	Click Refresh to update the information in the display.

Regular Expressions in Searching IPSec SAs

A question mark (?) lets a single character in the VPN connection or policy name vary. For example, use “a?c” (without the quotation marks) to specify abc, acc and so on.

Wildcards (*) let multiple VPN connection or policy names match the pattern. For example, use “*abc” (without the quotation marks) to specify any VPN connection or policy name that ends with “abc”. A VPN connection named “testabc” would match. There could be any number (of any type) of characters in front of the “abc” at the end and the VPN connection or policy name would still match. A VPN connection or policy name named “testacc” for example would not match.

A * in the middle of a VPN connection or policy name has the ZyWALL check the beginning and end and ignore the middle. For example, with “abc*123”, any VPN connection or policy name starting with “abc” and ending in “123” matches, no matter how many characters are in between.

The whole VPN connection or policy name has to match if you do not use a question mark or asterisk.

SSL Connection Monitor

The ZyWALL keeps track of the users who are currently logged into the VPN SSL client portal. Use this screen to do the following:

•

View a list of active SSL VPN connections.

•

Log out individual users and delete related session information.

Once a user logs out, the corresponding entry is removed from the Connection Monitor screen.

Monitor > VPN Monitor > SSL
label	description
Disconnect	Select a connection and click this button to terminate the user’s connection and delete corresponding session information from the ZyWALL.
#	This field displays the index number.
User	This field displays the account user name used to establish this SSL VPN connection.
Access	This field displays the name of the SSL VPN application the user is accessing.
Login Address	This field displays the IP address the user used to establish this SSL VPN connection.
Connected Time	This field displays the time this connection was established.
Inbound (Bytes)	This field displays the number of bytes received by the ZyWALL on this connection.
Outbound (Bytes)	This field displays the number of bytes transmitted by the ZyWALL on this connection.
Refresh	Click Refresh to update this screen.

L2TP over IPSec Session Monitor

Use this screen to display and manage the ZyWALL’s connected L2TP VPN sessions.

Monitor > VPN Monitor > L2TP over IPSec
Label	Description
Disconnect	Select a connection and click this button to disconnect it.
#	This is the index number of a current L2TP VPN session.
User Name	This field displays the remote user’s user name.
Hostname	This field displays the name of the computer that has this L2TP VPN connection with the ZyWALL.
Assigned IP	This field displays the IP address that the ZyWALL assigned for the remote user’s computer to use within the L2TP VPN tunnel.
Public IP	This field displays the public IP address that the remote user is using to connect to the Internet.
Refresh	Click Refresh to update this screen.

Anti-Virus Statistics

This screen displays anti-virus statistics.

Monitor > Anti-X Statistics > Anti-Virus
Label	Description
Collect Statistics	Select this check box to have the ZyWALL collect anti-virus statistics. The collection starting time displays after you click Apply. All of the statistics in this screen are for the time period starting at the time displayed here. The format is year, month, day and hour, minute, second. All of the statistics are erased if you restart the ZyWALL or click Flush Data. Collecting starts over and a new collection start time displays.
Apply	Click Apply to save your changes back to the ZyWALL.
Reset	Click Reset to return the screen to its last-saved settings.
Refresh	Click this button to update the report display.
Flush Data	Click this button to discard all of the screen’s statistics and update the report display.
Total Viruses Detected	This field displays the number of different viruses that the ZyWALL has detected.
Infected Files Detected	This field displays the number of files in which the ZyWALL has detected a virus.
Top 100 Entries By	Use this field to have the following (read-only) table display the top anti-virus log entries by Virus Name, Source IP or Destination IP. This table displays the most common, recent virus logs. See the log screen for less common virus logs or use a syslog server to record all virus logs. Select Virus Name to list the most common viruses that the ZyWALL has detected. Select Source IP to list the source IP addresses from which the ZyWALL has detected the most virus-infected files. Select Destination IP to list the most common destination IP addresses for virus-infected files that ZyWALL has detected.
#	This field displays the entry’s rank in the list of the top entries.
Virus name	This column displays when you display the entries by Virus Name. This displays the name of a detected virus.
Source IP	This column displays when you display the entries by Source. It shows the source IP address of virus-infected files that the ZyWALL has detected.
Destination IP	This column displays when you display the entries by Destination. It shows the destination IP address of virus-infected files that the ZyWALL has detected.
Occurrences	This field displays how many times the ZyWALL has detected the event described in the entry.

IDP Statistics

This screen displays IDP (Intrusion Detection and Prevention) statistics.

Monitor > Anti-X Statistics > IDP
Label	Description
Collect Statistics	Select this check box to have the ZyWALL collect IDP statistics. The collection starting time displays after you click Apply. All of the statistics in this screen are for the time period starting at the time displayed here. The format is year, month, day and hour, minute, second. All of the statistics are erased if you restart the ZyWALL or click Flush Data. Collecting starts over and a new collection start time displays.
Apply	Click Apply to save your changes back to the ZyWALL.
Reset	Click Reset to return the screen to its last-saved settings.
Refresh	Click this button to update the report display.
Flush Data	Click this button to discard all of the screen’s statistics and update the report display.
Total Session Scanned	This field displays the number of sessions that the ZyWALL has checked for intrusion characteristics.
Total Packet Dropped	The ZyWALL can detect and drop malicious packets from network traffic. This field displays the number of packets that the ZyWALL has dropped.
Total Packet Reset	The ZyWALL can detect and drop malicious packets from network traffic. This field displays the number of packets that the ZyWALL has reset.
Top 100 Entries By	Use this field to have the following (read-only) table display the top IDP log entries by Signature Name, Source or Destination. This table displays the most common, recent IDP logs. See the log screen for less common IDP logs or use a syslog server to record all IDP logs. Select Signature Name to list the most common signatures that the ZyWALL has detected. Select Source to list the source IP addresses from which the ZyWALL has detected the most intrusion attempts. Select Destination to list the most common destination IP addresses for intrusion attempts that the ZyWALL has detected.
#	This field displays the entry’s rank in the list of the top entries.
Signature Name	This column displays when you display the entries by Signature Name. The signature name identifies the type of intrusion pattern. Click the hyperlink for more detailed information on the intrusion.
Signature ID	This column displays when you display the entries by Signature Name. The signature ID is a unique value given to each intrusion detected.
Type	This column displays when you display the entries by Signature Name. It shows the categories of intrusions.
Severity	This column displays when you display the entries by Signature Name. It shows the level of threat that the intrusions may pose.
Source IP	This column displays when you display the entries by Source. It shows the source IP address of the intrusion attempts.
Destination IP	This column displays when you display the entries by Destination. It shows the destination IP address at which intrusion attempts were targeted.
Occurrences	This field displays how many times the ZyWALL has detected the event described in the entry.

Content Filter Statistics

This screen displays content filter statistics.

Monitor > Anti-X Statistics > Content Filter
Label	Description
General Settings
Collect Statistics	Select this check box to have the ZyWALL collect content filtering statistics. The collection starting time displays after you click Apply. All of the statistics in this screen are for the time period starting at the time displayed here. The format is year, month, day and hour, minute, second. All of the statistics are erased if you restart the ZyWALL or click Flush Data. Collecting starts over and a new collection start time displays.
Apply	Click Apply to save your changes back to the ZyWALL.
Reset	Click Reset to return the screen to its last-saved settings.
Refresh	Click this button to update the report display.
Flush Data	Click this button to discard all of the screen’s statistics and update the report display.
Web Request Statistics
Total Web Pages Inspected	This field displays the number of web pages that the ZyWALL’s content filter feature has checked.
Blocked	This is the number of web pages that the ZyWALL blocked access.
Warned	This is the number of web pages for which the ZyWALL displayed a warning message to the access requesters.
Passed	This is the number of web pages to which the ZyWALL allowed access.
Category Hit Summary
Security Threat (unsafe)	This is the number of requested web pages that the ZyWALL’s content filtering service identified as posing a threat to users.
Managed Web Pages	This is the number of requested web pages that the ZyWALL’s content filtering service identified as belonging to a category that was selected to be managed.
Block Hit Summary
Web Pages Warned by Category Service	This is the number of web pages that matched an external database content filtering category selected in the ZyWALL and for which the ZyWALL displayed a warning before allowing users access.
Web Pages Blocked by Custom Service	This is the number of web pages to which the ZyWALL did not allow access due to the content filtering custom service configuration.
Restricted Web Features	This is the number of web pages to which the ZyWALL did not allow access due to the content filtering custom service’s restricted web features configuration.
Forbidden Web Sites	This is the number of web pages to which the ZyWALL did not allow access because they matched the content filtering custom service’s forbidden web sites list.
URL Keywords	This is the number of web pages to which the ZyWALL did not allow access because they contained one of the content filtering custom service’s list of forbidden keywords.
Web Pages Blocked Without Policy	This is the number of web pages to which the ZyWALL did not allow access because they were not rated by the external database content filtering service.
Report Server	Click this link to go to http://www.myZyXEL.com where you can view content filtering reports after you have activated the category-based content filtering subscription service.

Content Filter Cache

Use this screen to view and configure your ZyWALL’s URL caching. You can also configure how long a categorized web site address remains in the cache as well as view those web site addresses to which access has been allowed or blocked based on the responses from the external content filtering server. The ZyWALL only queries the external content filtering database for sites not found in the cache.

You can remove individual entries from the cache. When you do this, the ZyWALL queries the external content filtering database the next time someone tries to access that web site. This allows you to check whether a web site’s category has been changed.

Click a column’s heading cell to sort the table entries by that column’s criteria. Click the heading cell again to reverse the sort order.

Monitor > Anti-X > Content Filter > Cache
Label	Description
URL Cache Entry
Refresh	Click this button to reload the list of content filter cache entries.
Flush	Click this button to clear all web site addresses from the cache manually.
Remove	Select one or more URL entries and click Delete to remove them from the cache.
#	This is the index number of a categorized web site address record.
Category	This field shows whether access to the web site’s URL was blocked or allowed. Click the column heading to sort the entries. Point the triangle up to display the blocked URLs before the URLs to which access was allowed. Point the triangle down to display the URLs to which access was allowed before the blocked URLs.
URL	This is a web site’s address that the ZyWALL previously checked with the external content filtering database.
Remaining Time (minutes)	This is the number of minutes left before the URL entry is discarded from the cache.
URL Cache Setup
Maximum TTL	Type the maximum time to live (TTL) (1 to 720 hours). This sets how long the ZyWALL is to keep an entry in the URL cache before discarding it. The external content filtering database frequently adds previously un-categorized web sites and sometimes changes a web site’s category. Setting this limit higher will speed up the processing of web access requests but will also make it take longer for the ZyWALL to reflect changes in the external content filtering database.
Apply	Click Apply to save your changes back to the ZyWALL.
Reset	Click Reset to return the screen to its last-saved settings.

Anti-Spam Statistics

This screen displays spam statistics.

Monitor > Anti-X Statistics > Anti-Spam
Label	Description
Collect Statistics	Select this check box to have the ZyWALL collect anti-spam statistics. The collection starting time displays after you click Apply. All of the statistics in this screen are for the time period starting at the time displayed here. The format is year, month, day and hour, minute, second. All of the statistics are erased if you restart the ZyWALL or click Flush Data. Collecting starts over and a new collection start time displays.
Apply	Click Apply to save your changes back to the ZyWALL.
Reset	Click Reset to return the screen to its last-saved settings.
Refresh	Click this button to update the report display.
Flush Data	Click this button to discard all of the screen’s statistics and update the report display.
Total Mails Scanned	This field displays the number of e-mails that the ZyWALL’s anti-spam feature has checked.
Clear Mails	This is the number of e-mails that the ZyWALL has determined to not be spam.
Clear Mails Detected by Whitelist	This is the number of e-mails that matched an entry in the ZyWALL’s anti-spam white list.
Spam Mails	This is the number of e-mails that the ZyWALL has determined to be spam.
Spam Mails Detected by Black List	This is the number of e-mails that matched an entry in the ZyWALL’s anti-spam black list.
Spam Mails Detected by IP Reputation	This is the number of e-mails that the ZyWALL has determined to be spam by IP Reputation. Spam or Unwanted Bulk Email is determined by the sender’s IP address.
Spam Mails Detected by Mail Content	This is the number of e-mails that the ZyWALL has determined to have malicious contents.
Spam Mails Detected by DNSBL	The ZyWALL can check the sender and relay IP addresses in an e-mail’s header against DNS (Domain Name Service)-based spam Black Lists (DNSBLs). This is the number of e-mails that had a sender or relay IP address in the header which matched one of the DNSBLs that the ZyWALL uses.
Spam Mails with Virus Detected by Mail Content	This is the number of e-mails that the ZyWALL has determined to have malicious contents and attached with virus.
Virus Mails	This is the number of e-mails that the ZyWALL has determined to be attached with virus.
Query Timeout	This is how many queries that were sent to the ZyWALL’s configured list of DNSBL domains or Mail Scan services and did not receive a response in time.
Mail Sessions Forwarded	This is how many e-mail sessions the ZyWALL allowed because they exceeded the maximum number of e-mail sessions that the anti-spam feature can check at a time. You can see the ZyWALL’s threshold of concurrent e-mail sessions in the Anti-Spam > Status screen. Use the Anti-Spam > General screen to set whether the ZyWALL forwards or drops sessions that exceed this threshold.
Mail Sessions Dropped	This is how many e-mail sessions the ZyWALL dropped because they exceeded the maximum number of e-mail sessions that the anti-spam feature can check at a time. You can see the ZyWALL’s threshold of concurrent e-mail sessions in the Anti-Spam > Status screen. Use the Anti-Spam > General screen to set whether the ZyWALL forwards or drops sessions that exceed this threshold.
Top Sender By	Use this field to list the top e-mail or IP addresses from which the ZyWALL has detected the most spam. Select Sender IP to list the source IP addresses from which the ZyWALL has detected the most spam. Select Sender Email Address to list the top e-mail addresses from which the ZyWALL has detected the most spam.
#	This field displays the entry’s rank in the list of the top entries.
Sender IP	This column displays when you display the entries by Sender IP. It shows the source IP address of spam e-mails that the ZyWALL has detected.
Sender Email Address	This column displays when you display the entries by Sender Email Address. This column displays the e-mail addresses from which the ZyWALL has detected the most spam.
Occurrence	This field displays how many spam e-mails the ZyWALL detected from the sender.

Anti-Spam Status

Use the Anti-Spam Status screen to see how many e-mail sessions the anti-spam feature is scanning and statistics for the DNSBLs.

Monitor > Anti-X Statistics > Anti-Spam > Status
Label	Description
Refresh	Click this button to update the information displayed on this screen.
Flush	Click this button to clear the DNSBL statistics. This also clears the concurrent mail session scanning bar’s historical high.
Concurrent Mail Session Scanning	The darker shaded part of the bar shows how much of the ZyWALL’s total spam checking capability is currently being used. The lighter shaded part of the bar and the pop-up show the historical high. The first number to the right of the bar is how many e-mail sessions the ZyWALL is presently checking for spam. The second number is the maximum number of e-mail sessions that the ZyWALL can check at once. An e-mail session is when an e-mail client and e-mail server (or two e-mail servers) connect through the ZyWALL.
Mail Scan Statistics	These are the statistics for the service the ZyWALL uses. These statistics are for when the ZyWALL actually queries the service servers.
#	This is the entry’s index number in the list.
Service	This displays the name of the service.
Total Queries	This is the total number of queries the ZyWALL has sent to this service.
Avg. Response Time (sec)	This is the average for how long it takes to receive a reply from this service.
No Response	This is how many queries the ZyWALL sent to this service without receiving a reply.
DNSBL Statistics	These are the statistics for the DNSBL the ZyWALL uses. These statistics are for when the ZyWALL actually queries the DNSBL servers. Matches for DNSBL responses stored in the cache do not affect these statistics.
#	This is the entry’s index number in the list.
DNSBL Domain	These are the DNSBLs the ZyWALL uses to check sender and relay IP addresses in e-mails.
Total Queries	This is the total number of DNS queries the ZyWALL has sent to this DNSBL.
Avg. Response Time (sec)	This is the average for how long it takes to receive a reply from this DNSBL.
No Response	This is how many DNS queries the ZyWALL sent to this DNSBL without receiving a reply.

Log

Log messages are stored in two separate logs, one for regular log messages and one for debugging messages. In the regular log, you can look at all the log messages by selecting All Logs, or you can select a specific category of log messages (for example, firewall or user). You can also look at the debugging log by selecting Debug Log. All debugging messages have the same priority.

Note:

When a log reaches the maximum number of log messages, new log messages automatically overwrite existing log messages, starting with the oldest existing log message first.

Events that generate an alert (as well as a log message) display in red. Regular logs display in black. Click a column’s heading cell to sort the table entries by that column’s criteria. Click the heading cell again to reverse the sort order.

Monitor > Log
Label	Description
Show Filter / Hide Filter	Click this button to show or hide the filter settings. If the filter settings are hidden, the Display, Email Log Now, Refresh, and Clear Log fields are available. If the filter settings are shown, the Display, Priority, Source Address, Destination Address, Service, Keyword, and Search fields are available.
Display	Select the category of log message(s) you want to view. You can also view All Logs at one time, or you can view the Debug Log.
Priority	This displays when you show the filter. Select the priority of log messages to display. The log displays the log messages with this priority or higher. Choices are: any, emerg, alert, crit, error, warn, notice, and info, from highest priority to lowest priority. This field is read-only if the Category is Debug Log.
Source Address	This displays when you show the filter. Type the source IP address of the incoming packet that generated the log message. Do not include the port in this filter.
Destination Address	This displays when you show the filter. Type the IP address of the destination of the incoming packet when the log message was generated. Do not include the port in this filter.
Source Interface	This displays when you show the filter. Select the source interface of the packet that generated the log message.
Destination Interface	This displays when you show the filter. Select the destination interface of the packet that generated the log message.
Service	This displays when you show the filter. Select the service whose log messages you would like to see. The Web Configurator uses the protocol and destination port number(s) of the service to select which log messages you see.
Keyword	This displays when you show the filter. Type a keyword to look for in the Message, Source, Destination and Note fields. If a match is found in any field, the log message is displayed. You can use up to 63 alphanumeric characters and the underscore, as well as punctuation marks ()’ ,:;?! +-*/= #$% @ ; the period, double quotes, and brackets are not allowed.
Protocol	This displays when you show the filter. Select a service protocol whose log messages you would like to see.
Search	This displays when you show the filter. Click this button to update the log using the current filter settings.
Email Log Now	Click this button to send log message(s) to the Active e-mail address(es) specified in the Send Log To field on the Log Settings page.
Clear Log	Click this button to clear the whole log, regardless of what is currently displayed on the screen.
#	This field is a sequential value, and it is not associated with a specific log message.
Time	This field displays the time the log message was recorded.
Priority	This field displays the priority of the log message. It has the same range of values as the Priority field above.
Category	This field displays the log that generated the log message. It is the same value used in the Display and (other) Category fields.
Message	This field displays the reason the log message was generated. The text “[count=x]”, where x is a number, appears at the end of the Message field if log consolidation is turned on . and multiple entries were aggregated to generate into this one.
Source	This field displays the source IP address and the port number in the event that generated the log message.
Destination	This field displays the destination IP address and the port number of the event that generated the log message.
Note	This field displays any additional information about the log message.