User manual ZYXEL ZYWALL 1050

[. . . ] ZyWALL 1050 Support Notes ZyWALL 1050 Internet Security Appliance Support Notes Revision 2. 01 August. 2006 1 All contents copyright (c) 2006 ZyXEL Communications Corporation. ZyWALL 1050 Support Notes INDEX 1. Deploying VPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 1. 1 Extended Intranets. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] Connect the PC to Backup ZyWALL 1050 ge1 and the PC should be dispatched an IP address from the device. User can login to the Backup ZyWALL 1050 and configure the Backup Device HA setting. We have to set the ge1 interface IP setting as Master ZyWALL 1050 ge1. Then we can setup the Backup ZyWALL 1050 management IP address in the same LAN subnet. 145 All contents copyright (c) 2006 ZyXEL Communications Corporation. ZyWALL 1050 Support Notes Step3. PC will get a new IP address after updating the ge1 interface setting. Login to the Backup ZyWALL 1050 and switch to ZyWALL 1050 > Configuration > Network > Device HA > VRRP GROUP. Between Master and Backup Role, the difference in settings is the Management IP configuration. The Backup ZyWALL 1050 will copy all settings from the Master one so we need a management IP to access and configure the Backup ZyWALL 1050. 146 All contents copyright (c) 2006 ZyXEL Communications Corporation. ZyWALL 1050 Support Notes Step4. Unplug the PC cable from Backup ZyWALL 1050 ge1 and plug it back to L2 switch LAN segment. Connect all the cables from L2 and L3 switches to the Backup ZyWALL 1050 as on the network topology diagram shown on the index page. Now we can synchronize the configuration from the Master to the Backup. Switch to ZyWALL 1050 > Configuration > Network > Device HA > Synchronize and enter the Master ZyWALL 1050 admin account password. . Input the LAN IP address of the Master ZyWALL 1050 in the "Synchronize from" option and set the auto synchronize interval. Then click the "Apply" button to save the configuration. Step5. Switch to "Synchronize" page again and click the "Sync. NOW" button to 147 All contents copyright (c) 2006 ZyXEL Communications Corporation. ZyWALL 1050 Support Notes synchronize the configuration from the Master to the Backup. Note: Don't check the "Auto Synchronize" since there is a bug related. Sync process in action Sync successful notification window 148 All contents copyright (c) 2006 ZyXEL Communications Corporation. ZyWALL 1050 Support Notes Switch to ZyWALL 1050 > Maintenance > Logs > View Log to check the log record. Step6. You will see that the Master ZyWALL 1050's configuration has been synchronized to Backup ZyWALL 1050 and we can continue to setup the rest three VRRP group. Setup the ge2 (WAN1) VRRP group 149 All contents copyright (c) 2006 ZyXEL Communications Corporation. ZyWALL 1050 Support Notes Setup the ge3 (WAN2) VRRP group Setup the ge4 (DMZ) VRRP group 150 All contents copyright (c) 2006 ZyXEL Communications Corporation. ZyWALL 1050 Support Notes After these steps, the Device HA configuration is done. 1. 7. 2 VPN HA The VPN HA can ensure the availability of VPN demanded. A redundant remote gateway option is added to achieve the goal of availability. It means the device will try connecting to the redundant gateway if the connection to the primary remote gateway is unreachable. Setup the VPN at Master ZyWALL 1050 Switch to ZyWALL 1050 > Configuration > Network > IPSec VPN > VPN Gateway and click the "Add" icon to add a VPN gateway. 151 All contents copyright (c) 2006 ZyXEL Communications Corporation. ZyWALL 1050 Support Notes Step2. The ZyWALL 2 VPN parameter configuration has to match the setting shown here. [. . . ] AAA is a model for access control and also a basis for user-aware device. A user-aware device like ZyWALL 1050 could use authentication method to authenticate a user (to prove who the user is) and give the user proper authority (defining what the user is allowed and not allowed to do) by authorization method. Accounting measures the resources a user consume during access which is used for authorization control, resources utilization and capacity planning activities. AAA services are often provided by a dedicated AAA server or a local database in a user-aware device. [. . . ]