User manual ZYXEL ZYWALL USG 2000

[. . . ] ZyWALL USG 2000 Unified Security Gateway Default Login Details LAN Port IP Address User Name Password P1 http://192. 168. 1. 1 admin 1234 Firmware Version 2. 11 Edition 1, 2/2009 www. zyxel. com www. zyxel. com Copyright © 2009 ZyXEL Communications Corporation About This User's Guide About This User's Guide Intended Audience This manual is intended for people who want to want to configure the ZyWALL using the web configurator. How To Use This Guide · Read Chapter 1 on page 31 chapter for an overview of features available on the ZyWALL. · Read Chapter 3 on page 47 for web browser requirements and an introduction to the main components, icons and menus in the ZyWALL web configurator. · Read Chapter 4 on page 59 if you're using the wizards for first time setup and you want more detailed information than what the real time online help provides. · It is highly recommended you read Chapter 5 on page 101 for detailed information on essential terms used in the ZyWALL, what prerequisites are needed to configure a feature and how to use that feature. [. . . ] This is the protocol's traffic that the ZyWALL sends out from the initiator of the connection. So for a connection initiated from the LAN to the WAN, the traffic sent from the LAN to the WAN is the outbound traffic. This is how much of the application's traffic the ZyWALL has sent (in kilobytes). This is how much of the application's traffic the ZyWALL has discarded without notifying the client (in kilobytes). This traffic was dropped because it matched a policy set to "drop". This is how much of the application's traffic the ZyWALL has discarded and notified the client that the traffic was rejected (in kilobytes). This traffic was rejected because it matched a policy set to "reject". Outbound Kbps Forwarded Data (KB) Dropped Data (KB) Rejected Data (KB) 470 ZyWALL USG 2000 User's Guide PART VI Anti-X Anti-Virus (473) IDP (489) ADP (523) Content Filtering (543) Content Filter Reports (567) Anti-Spam (575) 471 472 CHAPTER 29. 1 Overview 29 Anti-Virus Use the ZyWALL's anti-virus feature to protect your connected network from virus/ spyware infection. The ZyWALL checks traffic going in the direction(s) you specify for signature matches. In the following figure the ZyWALL is set to check traffic coming from the WAN zone (which includes two interfaces) to the LAN zone. Figure 337 ZyWALL Anti-Virus Example 29. 1. 1 What You Can Do in the Anti-Virus Screens · Use the General screens (Section 29. 2 on page 476) to turn anti-virus on or off, set up anti-virus policies and check the anti-virus engine type and the anti-virus license and signature status. · Use the Black/White List screen (Section 29. 3 on page 481) to set up antivirus black (blocked) and white (allowed) lists of virus file patterns. · Use the Signature screen (Section 29. 6 on page 485) to search signatures to get more information about signatures. ZyWALL USG 2000 User's Guide 473 Chapter 29 Anti-Virus 29. 1. 2 What You Need to Know About Anti-Virus Anti-Virus Engines Subscribe to signature files for ZyXEL's anti-virus engine or one powered by Kaspersky. When using the trial, you can switch from one engine to the other in the Registration screen. After the trial expires, you need to purchase an iCard for the anti-virus engine you want to use and register it in the Registration > Service screen. You must use the ZyXEL anti-virus iCard for the ZyXEL anti-virus engine and the Kaspersky anti-virus iCard for the Kaspersky anti-virus engine. See Chapter 8 on page 165 for details. Virus and Worm A computer virus is a small program designed to corrupt and/or alter the operation of other legitimate programs. A worm is a self-replicating virus that resides in active memory and duplicates itself. The effect of a virus attack varies from doing so little damage that you are unaware your computer is infected to wiping out the entire contents of a hard drive to rendering your computer inoperable. ZyWALL Anti-Virus Scanner The ZyWALL has a built-in signature database. Setting up the ZyWALL between your local network and the Internet allows the ZyWALL to scan files transmitting through the enabled interfaces into your network. As a network-based anti-virus scanner, the ZyWALL helps stop threats at the network edge before they reach the local host computers. You can set the ZyWALL to examine files received through the following protocols: · FTP (File Transfer Protocol) · HTTP (Hyper Text Transfer Protocol) · SMTP (Simple Mail Transfer Protocol) · POP3 (Post Office Protocol version 3) · IMAP4 (Internet Message Access Protocol version 4) How the ZyWALL Anti-Virus Scanner Works The following describes the virus scanning process on the ZyWALL. 1 The ZyWALL first identifies SMTP, POP3, IMAP4, HTTP and FTP packets through standard ports. 474 ZyWALL USG 2000 User's Guide Chapter 29 Anti-Virus If the packets are not session connection setup packets (such as SYN, ACK and FIN), the ZyWALL records the sequence of the packets. If a virus pattern is matched, the ZyWALL removes the infected portion of the file along with the rest of the file. [. . . ] spam 501, 575 specifications 803 device 803 feature 804 hardware 803 spillover (for load balancing) 242 spyware 555 SQL slammer 520 SSH 728 and address groups 731 and address objects 731 and certificates 731 and zones 731 client requirements 730 encryption methods 730 for secure Telnet 732 how connection is established 729 versions 730 ZyWALL USG 2000 User's Guide 955 Index with Linux 733 with Microsoft Windows 732 SSL 379, 384, 711 access policy 380 and AAA 652, 654 and AD 652, 654 and LDAP 652, 654 certificates 392 client virtual desktop logo 387 computer names 384 connection monitor 385 full tunnel mode 384 global setting 386 IP pool 384 network list 384 remote user login 392 remote user logout 396 See also SSL VPN 379 user screen bookmarks 396 user screens 391, 395 user screens access methods 391 user screens certificates 392 user screens login 392 user screens logout 396 user screens required information 392 user screens system requirements 392 WINS 384 SSL application object 689 file sharing 689 file sharing application 693 remote user screen links 690 summary 691 types 689 web-based 689, 691 web-based example 690 where used 115 SSL policy add 383 edit 383 objects used 380 SSL VPN 379 access policy 380 configuration overview 107 full tunnel mode 44, 380 network access mode 43 prerequisites 107 reverse proxy mode 43, 379 See also SSL 379 where used 107 stac compression 688 starting the ZyWALL 37 startup-config. conf 754 and synchronization (device HA) 609 if errors 752 missing at restart 752 present at restart 752 startup-config-bad. conf 752 static DHCP 198, 316 static routes 251 and interfaces 259 and OSPF 268 and RIP 264 configuration overview 110 metric 259 prerequisites 110 statistics anti-spam 787 anti-virus 781 application patrol 467 bandwidth 468 content filtering 785 daily e-mail report 790 IDP 783 protocol 469 traffic 775 status 150 status bar 56 also called message bar 55 warning message popup 56 stopping an SSL user session 386 stopping the ZyWALL 37 streaming protocols management 445 strict source routing 508 stub area 266 STUN 307 and ALG 307 subscription services 166 and synchronization (device HA) 594 AppPatrol 168 content filtering 168 IDP 168 IDP, see also IDP. new IDP/AppPatrol signatures 168 SSL VPN 166 SSL VPN, see also SSL VPN. status 170, 455, 478 956 ZyWALL USG 2000 User's Guide Index trial service activation 168 upgrading 170 supported browsers 47 supporting disc 4 SYN flood 538 synchronization 594 and subscription services 594 information synchronized 609 password 601, 605 port number 600, 604 restrictions 609 syntax conventions 5 SYS LED 35 syslog 765, 771 syslog servers, see also logs. system name 150, 698 system protect updating signatures 175 system reports, see reports. [. . . ]