User manual ZYXEL USG300

[. . . ] ZyWALL USG 300 Unified Security Gateway Default Login Details LAN Port IP Address User Name Password P1 https://192. 168. 1. 1 admin 1234 Firmware Version 2. 20 Edition 2, 9/2010 www. zyxel. com www. zyxel. com Copyright © 2010 ZyXEL Communications Corporation About This User's Guide About This User's Guide Intended Audience This manual is intended for people who want to want to configure the ZyWALL using the Web Configurator. How To Use This Guide · Read Chapter 1 on page 33 chapter for an overview of features available on the ZyWALL. · Read Chapter 3 on page 47 for web browser requirements and an introduction to the main components, icons and menus in the ZyWALL Web Configurator. · Read Chapter 4 on page 65 if you're using the installation wizard for first time setup and you want more detailed information than what the real time online help provides. · Read Chapter 5 on page 75 if you're using the quick setup wizards and you want more detailed information than what the real time online help provides. [. . . ] Then, you can specify, by application, whether or not the ZyWALL continues to route the connection. Configurable Application Policies The ZyWALL has policies for individual applications. For each policy, you can specify the default action the ZyWALL takes once it identifies one of the service's connections. You can also specify custom policies that have the ZyWALL forward, drop, or reject a service's connections based on criteria that you specify (like the source zone, destination zone, original destination port of the connection, schedule, user, source, and destination information). Your custom policies take priority over the policy's default settings. Classification of Applications There are two ways the ZyWALL can identify the application. The ZyWALL looks at the IP payload (OSI level-7 inspection) and attempts to match it with known patterns for specific applications. Usually, this occurs at the beginning of a connection, when the payload is more consistent across connections, and the ZyWALL examines several packets to make sure the match is correct. Note: The ZyWALL allows the first eight packets to go through the firewall, regardless of the application patrol policy for the application. The ZyWALL examines these first eight packets to identify the application. The second approach is called service ports. The ZyWALL uses only OSI level-4 information, such as ports, to identify what application is using the connection. This approach is available in case the ZyWALL identifies a lot of "false positives" for a particular application. Custom Ports for SIP and the SIP ALG Configuring application patrol to use custom port numbers for SIP traffic also configures the SIP ALG (see Chapter 21 on page 435) to use the same port 560 ZyWALL USG 300 User's Guide Chapter 32 Application Patrol numbers for SIP traffic. Likewise, configuring the SIP ALG to use custom port numbers for SIP traffic also configures application patrol to use the same port numbers for SIP traffic. DiffServ and DSCP Marking QoS is used to prioritize source-to-destination traffic flows. CoS (class of service) is a way of managing traffic in a network by grouping similar types of traffic together and treating each type as a class. You can use CoS to give different priorities to different packet types. DiffServ (Differentiated Services) is a class of service (CoS) model that marks packets so that they receive specific per-hop treatment at DiffServ-compliant network devices along the route based on the application types and traffic flow. Packets are marked with DiffServ Code Points (DSCPs) indicating the level of service desired. This allows the intermediary DiffServ-compliant network devices to handle the packets differently depending on the code points without the need to negotiate paths or remember state information for every flow. In addition, applications do not have to request a particular service or give advanced notice of where the traffic is going. Use application patrol to set a DSCP value for an application's traffic that the ZyWALL sends out. Bandwidth Management When you allow an application, you can restrict the bandwidth it uses or even the bandwidth that particular features in the application (like voice, video, or file sharing) use. This restriction may be ineffective in certain cases, however, such as using MSN to send files via P2P. The application patrol bandwidth management is more flexible and powerful than the bandwidth management in policy routes. Use policy routes to manage other types of traffic (like ICMP). Note: Bandwidth management in policy routes has priority over application patrol bandwidth management. It is recommended to use application patrol instead of policy routes to manage the bandwidth of TCP and UDP traffic. Connection and Packet Directions Application patrol looks at the connection direction, that is from which zone the connection was initiated and to which zone the connection is going. The ZyWALL controls the bandwidth of traffic of each flow as it is going out through an interface or VPN tunnel. ZyWALL USG 300 User's Guide 561 Chapter 32 Application Patrol · The outbound traffic flows from the connection initiator to the connection responder. [. . . ] Select your product on the ZyXEL home page to go to that product's page. Select the certification you wish to view from this page. ZyXEL Limited Warranty ZyXEL warrants to the original end user (purchaser) that this product is free from any defects in material or workmanship for a specific period (the Warranty Period) from the date of purchase. Check with your vendor and/or the authorized ZyXEL local distributor for details about the Warranty Period of this product. During the warranty period, and upon proof of purchase, should the product have indications of failure due to faulty workmanship and/or materials, ZyXEL will, at its discretion, repair or replace the defective products or components without charge for either parts or labor, and to whatever extent it shall deem necessary to restore the product or components to proper operating condition. [. . . ]