ZyXEL P-660HW-T1 v2 User Guide
ZyXEL P-660HW-T1 v2 Manual
 |
View all ZyXEL P-660HW-T1 v2 manuals
Add to My Manuals
Save this manual to your list of manuals |
ZyXEL P-660HW-T1 v2 manual content summary:
- ZyXEL P-660HW-T1 v2 | User Guide - Page 1
P-660HW-T v2 802.11g Wireless ADSL 2+ 4-port Gateway User's Guide Version 3.40 Edition 1 12/2006 - ZyXEL P-660HW-T1 v2 | User Guide - Page 2
- ZyXEL P-660HW-T1 v2 | User Guide - Page 3
P-660HW-T v2 User's Guide Copyright Copyright © 2006 by ZyXEL Communications Corporation. The contents of this manual, or otherwise, without the prior written permission of ZyXEL Communications Corporation. Published by ZyXEL Communications Corporation. All rights reserved. Disclaimer ZyXEL - ZyXEL P-660HW-T1 v2 | User Guide - Page 4
P-660HW-T v2 User's Guide Certifications Federal Communications Commission (FCC) Interference Statement The device radiation exposure limits set forth for an uncontrolled environment, under 47 CFR 2.1093 paragraph (d)(2). End users must follow the specific operating instructions for satisfying RF - ZyXEL P-660HW-T1 v2 | User Guide - Page 5
660HW-T v2 User's Guide Notices Changes or modifications not expressly approved by the party responsible for compliance could void the user Canada. Viewing Certifications 1 Go to http://www.zyxel.com. 2 Select your product from the drop-down list box on the ZyXEL home page to go to that product's - ZyXEL P-660HW-T1 v2 | User Guide - Page 6
P-660HW-T v2 User's Guide Safety Warnings For your safety, be sure to read and follow all warning notices and instructions. • Do NOT use ports. • Place connecting cables carefully so that no one will step on them or stumble over them. • Always disconnect all cables from this device before servicing - ZyXEL P-660HW-T1 v2 | User Guide - Page 7
This product is recyclable. Dispose of it properly. P-660HW-T v2 User's Guide Safety Warnings 7 - ZyXEL P-660HW-T1 v2 | User Guide - Page 8
by ZyXEL to the corresponding return address, Postage Paid. This warranty gives you specific legal rights, and you may also have other rights that vary from country to country. Registration Register your product online to receive e-mail notices of firmware upgrades and information at www.zyxel.com - ZyXEL P-660HW-T1 v2 | User Guide - Page 9
P-660HW-T v2 User's Guide Customer Support Please have the following information ready when you contact customer support. • Product model and serial number. • Warranty Information. • Date that you received your device. • Brief description of the problem and the steps you took to solve it. METHOD - ZyXEL P-660HW-T1 v2 | User Guide - Page 10
P-660HW-T v2 User's Guide METHOD SUPPORT E-MAIL LOCATION NORWAY SALES E-MAIL [email protected] [email protected] TELEPHONE FAX +47-22-80-61-80 +47-22-80-61-81 WEB SITE FTP SITE www.zyxel.no POLAND [email protected] +48 (22) 333 8250 +48 (22) 333 8251 www.pl.zyxel.com RUSSIA http://zyxel.ru/ - ZyXEL P-660HW-T1 v2 | User Guide - Page 11
P-660HW-T v2 User's Guide Table of Contents Copyright ...3 Certifications ...4 Safety Warnings ...6 ZyXEL Limited Warranty 8 Customer Support...9 Table of Contents 11 List of Figures ...21 List of Tables ...27 Preface ...31 Chapter 1 Getting To Know Your ZyXEL Device 33 1.1 Introducing the ZyXEL - ZyXEL P-660HW-T1 v2 | User Guide - Page 12
P-660HW-T v2 User's Guide 2.4.6 Status: Packet Statistics 51 2.4.7 Changing Login Password 52 Chapter 3 Wizard Setup for Internet Access 55 3.1 Introduction ...55 3.2 Internet Access Wizard Setup 55 3.2.1 Automatic Detection 57 3.2.2 Manual Configuration 57 3.3 Wireless Connection Wizard Setup - ZyXEL P-660HW-T1 v2 | User Guide - Page 13
P-660HW-T v2 User's Guide 5.3.1 ATM Traffic Classes 80 5.3.1.1 Constant Bit Rate (CBR 80 5.3.1.2 Variable Bit Rate (VBR 80 5.3.1.3 Unspecified Bit Rate (UBR 80 5.4 Zero Configuration Internet Access 80 5.5 Internet Connection 81 5.5.1 Configuring Advanced Internet Connection Setup 83 5.6 - ZyXEL P-660HW-T1 v2 | User Guide - Page 14
User Account) Versus NAT 128 8.3 NAT General Setup 128 8.4 Port Forwarding 129 8.4.1 Default Server IP Address 130 8.4.2 Port Forwarding: Services and Port Numbers 130 8.4.3 Configuring Servers Behind Port Forwarding (Example 131 8.5 Configuring Port Forwarding 131 8.5.1 Port Forwarding - ZyXEL P-660HW-T1 v2 | User Guide - Page 15
P-660HW-T v2 User's Guide 9.4 Denial of Service 139 9.4.1 Basics ...139 9.4.2 Types of DoS Attacks 140 9.4.2.1 ICMP 148 9.7.2 Firewall 148 9.7.2.1 When To Use The Firewall 148 Chapter 10 Firewall Configuration 149 10.1 Access Methods 149 10.2 Firewall Policies Overview 149 10.3 Rule - ZyXEL P-660HW-T1 v2 | User Guide - Page 16
660HW-T v2 User's Guide 10.10 DoS Thresholds 166 10.10.1 Threshold Values 166 10.10.2 Half-Open Sessions 167 10.10.2.1 TCP Maximum Incomplete and Blocking Time 167 10.10.3 Configuring Firewall Thresholds 168 Chapter 11 Content Filtering 171 11.1 Content Filtering Overview 171 11.2 Configuring - ZyXEL P-660HW-T1 v2 | User Guide - Page 17
P-660HW-T v2 User's Guide Chapter 14 Dynamic DNS Setup 191 14.1 Dynamic DNS Overview 191 14.1.1 DYNDNS Wildcard 191 14.2 Configuring Dynamic DNS 191 Chapter 15 Remote Management Configuration 195 15.1 Remote Management Overview 195 15.1.1 Remote Management Limitations 195 15.1.2 Remote - ZyXEL P-660HW-T1 v2 | User Guide - Page 18
-T v2 User's Guide 17.1.2 General Setup 219 17.2 Time Setting 221 Chapter 18 Logs ...225 18.1 Logs Overview 225 18.1.1 Alerts and Logs 225 18.2 Viewing the Logs 225 18.3 Configuring Log Settings 226 18.3.1 Example E-mail Log 228 18.4 Log Descriptions 229 Chapter 19 Tools ...245 19.1 Firmware - ZyXEL P-660HW-T1 v2 | User Guide - Page 19
P-660HW-T v2 User's Guide Internal SPTGEN Overview 263 The Configuration Text File Format 263 Internal SPTGEN FTP Download Example 264 Internal SPTGEN FTP Upload Example 265 Example Internal SPTGEN Menus 266 Command Examples 278 Appendix D Wall-mounting Instructions 279 Appendix E Setting up - ZyXEL P-660HW-T1 v2 | User Guide - Page 20
660HW-T v2 User's Guide NetBIOS Filter Configuration 316 Appendix J Splitters and Microfilters 317 Connecting a POTS Splitter 317 Telephone Microfilters 317 ZyXEL Route ...343 The Ideal Setup...343 The "Triangle Route" Problem 343 The "Triangle Route" Solutions 344 IP Aliasing ...344 Index... - ZyXEL P-660HW-T1 v2 | User Guide - Page 21
P-660HW-T v2 User's Guide List of Figures Figure 1 Protected Internet Access Applications 38 Figure 2 LAN-to-LAN Application Example 38 Figure 3 Front Panel ...38 Figure 4 Password Screen 42 Figure 5 Change Password at Login 42 Figure 6 Select a Mode ...43 Figure 7 Web Configurator: Main Screen - ZyXEL P-660HW-T1 v2 | User Guide - Page 22
P-660HW-T v2 User's Guide Figure 39 Internet Connection (PPPoE 81 Figure 40 Advanced Internet Connection Setup 83 Figure 41 More Connections 85 Figure 42 More Connections Edit 86 Figure 43 More Connections Advanced Setup 88 Figure 44 Traffic Redirect Example 89 Figure 45 Traffic Redirect LAN - ZyXEL P-660HW-T1 v2 | User Guide - Page 23
P-660HW-T v2 User's Guide Figure 82 Stateful Inspection 143 Figure 83 Firewall: General 152 Figure 84 Firewall Rules ...154 Figure 85 Firewall: Edit Rule 156 Figure 86 Firewall: Customized Services 158 Figure 87 Firewall: Configure Customized Services 159 Figure 88 Firewall Example: Rules 160 - ZyXEL P-660HW-T1 v2 | User Guide - Page 24
P-660HW-T v2 User's Guide Figure 125 Internet Connection Properties: Advanced Settings: Add 214 Figure 126 System Tray Icon 214 Figure 127 Internet Connection Status 215 Figure 128 Network Connections 216 Figure 129 Network Connections: My Network - ZyXEL P-660HW-T1 v2 | User Guide - Page 25
P-660HW-T v2 User's Guide Figure 168 Red Hat 9.0: KDE: Ethernet Device: General 293 Figure 169 Red Hat 9.0: KDE: Network Configuration: DNS 294 Figure 170 Red Hat 9.0: KDE: Network Configuration: Activate 294 Figure 171 Red Hat 9.0: Dynamic IP Address Setting in ifconfig-eth0 295 Figure 172 Red - ZyXEL P-660HW-T1 v2 | User Guide - Page 26
P-660HW-T v2 User's Guide 26 List of Figures - ZyXEL P-660HW-T1 v2 | User Guide - Page 27
P-660HW-T v2 User's Guide List of Tables Table 1 ADSL Standards ...33 Table 2 Front Panel LEDs 39 Table 3 Web Configurator Screens Summary 44 Table 4 Status Screen ...47 Table 5 Status: Any IP Table 49 Table 6 Status: WLAN Status 50 Table 7 Status: Packet Statistics 51 Table 8 Internet Access - ZyXEL P-660HW-T1 v2 | User Guide - Page 28
P-660HW-T v2 User's Guide Table 39 LAN IP Alias ...122 Table 40 NAT Definitions ...125 Table 41 NAT Mapping Types 128 Table 42 NAT General ...129 Table 43 Services and Port Numbers 130 Table 44 NAT Port Forwarding 132 Table 45 Port Forwarding Rule Setup 133 Table 46 Address Mapping Rules 134 - ZyXEL P-660HW-T1 v2 | User Guide - Page 29
P-660HW-T v2 User's Guide Table 82 Remote Management: ICMP 204 Table 83 TR-069 Commands 205 Table 84 Configuring UPnP 209 Table 85 System General Setup 220 Table 86 System Time Setting 222 Table 87 View Log ...226 Table 88 Log Settings ...227 Table 89 System Maintenance Logs 229 Table 90 - ZyXEL P-660HW-T1 v2 | User Guide - Page 30
P-660HW-T v2 User's Guide Table 125 Menu 21.1 Filter Set #1 273 Table 126 Menu 21.1 Filer Set #2 275 Table 127 Menu 23 System Menus 276 Table 128 Menu 24.11 Remote Management Control 277 Table 129 Command Examples 278 Table 130 Classes of IP Addresses 297 Table 131 Allowed IP Address Range By - ZyXEL P-660HW-T1 v2 | User Guide - Page 31
to receive e-mail notices of firmware upgrades and information at www.zyxel.com for global products, or at www.us.zyxel.com for North American products. About This User's Guide This manual is designed to guide you through the configuration of your ZyXEL Device for its various applications. The - ZyXEL P-660HW-T1 v2 | User Guide - Page 32
P-660HW-T v2 User's Guide User Guide Feedback Help us help you. E-mail all User Guide-related comments, questions or suggestions for improvement to [email protected] or send regular mail to The Technical Writing Team, ZyXEL Communications Corp., 6 Innovation Road II, Science-Based Industrial - ZyXEL P-660HW-T1 v2 | User Guide - Page 33
P-660HW-T v2 User's Guide CHAPTER 1 Getting To Know Your ZyXEL Device This chapter describes the key features and applications of your ZyXEL Device. 1.1 Introducing the ZyXEL Device The ZyXEL Device is an ADSL2+ gateway that allows super-fast, secure Internet access over analog (POTS) or digital ( - ZyXEL P-660HW-T1 v2 | User Guide - Page 34
and password) is required or the ZyXEL Device cannot connect to the ISP, you will be redirected to web screen(s) for information input or troubleshooting. Any IP The Any IP feature allows a computer to access the Internet and the ZyXEL Device without changing the network settings (such as IP address - ZyXEL P-660HW-T1 v2 | User Guide - Page 35
P-660HW-T v2 User's Guide Media Bandwidth Management ZyXEL's Media Bandwidth Management allows you to specify bandwidth classes based on an application and/or subnet. You can allocate specific amounts of bandwidth capacity (bandwidth budgets) to different bandwidth classes. Universal Plug and Play ( - ZyXEL P-660HW-T1 v2 | User Guide - Page 36
P-660HW-T v2 User's Guide IP Alias IP Alias allows you to partition a physical network into logical networks over the same Ethernet interface. The ZyXEL Device supports three logical LAN interfaces via its single physical Ethernet interface with the ZyXEL Device itself as the gateway for each LAN - ZyXEL P-660HW-T1 v2 | User Guide - Page 37
P-660HW-T v2 User's Guide Both WPA and WPA2 improve data encryption by using Temporal Key Integrity Protocol (TKIP), Message Integrity Check (MIC) and IEEE 802.1x. In addition to TKIP, WPA2 also uses Advanced Encryption Standard (AES) in the Counter mode with Cipher block chaining Message - ZyXEL P-660HW-T1 v2 | User Guide - Page 38
P-660HW-T v2 User's Guide Figure 1 Protected Internet Access Applications 1.3.2 LAN to LAN Application You can use the ZyXEL Device to connect two geographically dispersed networks over the ADSL line. A typical front panel LEDs. Figure 3 Front Panel 38 Chapter 1 Getting To Know Your ZyXEL Device - ZyXEL P-660HW-T1 v2 | User Guide - Page 39
660HW-T v2 User's Guide The following table describes the LEDs. Table 2 Front Panel LEDs LED POWER COLOR Green STATUS On Red ETHERNET Green 1,2,3,4 WLAN Green Blinking On Off On Blinking Off On Blinking DSL Green INTERNET Green Off On Blinking Off On Blinking Off DESCRIPTION The ZyXEL - ZyXEL P-660HW-T1 v2 | User Guide - Page 40
P-660HW-T v2 User's Guide 40 Chapter 1 Getting To Know Your ZyXEL Device - ZyXEL P-660HW-T1 v2 | User Guide - Page 41
to connect to the ZyXEL Device (refer to the Quick Start Guide). 3 Launch your web browser. 4 Type "192.168.1.1" as the URL. 5 A window displays as shown. Enter the default admin password 1234 to configure the wizards and the advanced features or enter the default user password user to view the - ZyXEL P-660HW-T1 v2 | User Guide - Page 42
P-660HW-T v2 User's Guide status only. Click Login to proceed to a screen asking you to change your password or click Cancel to revert to the default password. Figure 4 Password Screen 6 If you entered the user password, skip the next two steps and refer to Section 2.4.2 on page 46 for more - ZyXEL P-660HW-T1 v2 | User Guide - Page 43
660HW-T v2 User's Guide Note: The management session automatically times out when the time period set in the Administrator Inactivity Timer field expires (default five minutes). Simply log back into the ZyXEL Device if this happens to you. 2.3 Resetting the ZyXEL Device If you forget your password - ZyXEL P-660HW-T1 v2 | User Guide - Page 44
, WAN IP address assignment, DNS servers and other advanced properties. More Connections Use this screen to view and configure other connections for placing calls to another remote gateway. WAN Backup Setup Use this screen to configure your traffic redirect properties and WAN backup settings. 44 - ZyXEL P-660HW-T1 v2 | User Guide - Page 45
660HW-T v2 User's Guide Table 3 Web Configurator Screens Summary (continued) LINK/ICON LAN Wireless LAN NAT Security Firewall Content Filter Advanced Static Route Bandwidth MGMT Dynamic DNS SUB-LINK FUNCTION IP Use this screen to configure LAN TCP/IP settings, enable Any IP and other advanced - ZyXEL P-660HW-T1 v2 | User Guide - Page 46
P-660HW-T v2 User's Guide Table 3 Web Configurator Screens Summary (continued) LINK/ICON Remote MGMT SUB-LINK WWW Telnet FTP SNMP DNS UPnP Maintenance System Logs Tools Diagnostic ICMP General Time Setting View Log Log Settings Firmware Configuration Restart General DSL Line FUNCTION Use - ZyXEL P-660HW-T1 v2 | User Guide - Page 47
Firmware version and the date created. ZyNOS is ZyXEL's Version proprietary Network Operating System design. WAN Information DSL Mode This is the standard that your ZyXEL Device is using. IP Address This is the WAN port IP address. IP Subnet Mask This is the WAN port IP subnet mask. Default - ZyXEL P-660HW-T1 v2 | User Guide - Page 48
P-660HW-T v2 User's Guide Table 4 Status Screen LABEL DESCRIPTION IP Subnet Mask This is the LAN port IP subnet mask. DHCP This is the WAN port DHCP role - Server, Relay or None. WLAN Information (Wireless devices only) SSID This is the descriptive name used to identify the ZyXEL Device in - ZyXEL P-660HW-T1 v2 | User Guide - Page 49
P-660HW-T v2 User's Guide Table 4 Status Screen LABEL DESCRIPTION Bandwidth Status Use this screen to view the ZyXEL Device's bandwidth usage and allotments. Packet Statistics Use this screen to view port status and packet specific statistics. 2.4.3 Status: Any IP Table Click the Any IP Table - ZyXEL P-660HW-T1 v2 | User Guide - Page 50
P-660HW-T v2 User's Guide Figure 10 Status: WLAN Status The following table describes the labels in this screen. Table 6 Status: WLAN Status LABEL # MAC Address Association TIme Refresh DESCRIPTION This is the index number of an associated wireless station. This field displays the MAC (Media - ZyXEL P-660HW-T1 v2 | User Guide - Page 51
P-660HW-T v2 User's Guide 2.4.6 Status: Packet Statistics Click the Packet Statistics hyperlink in the Status screen. Read-only information here includes port status and packet specific statistics. Also provided are "system up time" and "poll interval(s)". The Poll Interval(s) field is configurable. - ZyXEL P-660HW-T1 v2 | User Guide - Page 52
poll interval you entered in the Poll Interval field above. Click this button to halt the refreshing of the system statistics. 2.4.7 Changing Login Password It is highly recommended that you periodically change the password for accessing the ZyXEL Device. If you didn't change the default one after - ZyXEL P-660HW-T1 v2 | User Guide - Page 53
Figure 13 System General P-660HW-T v2 User's Guide Chapter 2 Introducing the Web Configurator 53 - ZyXEL P-660HW-T1 v2 | User Guide - Page 54
P-660HW-T v2 User's Guide 54 Chapter 2 Introducing the Web Configurator - ZyXEL P-660HW-T1 v2 | User Guide - Page 55
to you by your ISP. Note: See the advanced menu chapters for background information on these fields. 3.2 Internet Access Wizard Setup 1 After you enter the admin password to access the web configurator, select Go to Wizard setup and click Apply. Otherwise, click the wizard icon ( ) in the top right - ZyXEL P-660HW-T1 v2 | User Guide - Page 56
P-660HW-T v2 User's Guide Figure 15 Wizard: Welcome 3 The wizard attempts to detect which screen appears (see Figure 17 on page 57), click Next and refer to Section 3.2.2 on page 57 on how to configure the ZyXEL Device for Internet access manually. 56 Chapter 3 Wizard Setup for Internet Access - ZyXEL P-660HW-T1 v2 | User Guide - Page 57
prompting you to enter your Internet account information. Enter the username, password and/or service name exactly as provided. 2 Click Next and see Section 3.3 on page 62 for wireless connection wizard setup. Figure 18 Auto-Detection: PPPoE 3.2.2 Manual Configuration 1 If the ZyXEL Device fails to - ZyXEL P-660HW-T1 v2 | User Guide - Page 58
P-660HW-T v2 User's Guide Figure 19 Internet Access Wizard Setup: ISP Parameters The following table describes the fields in this screen. Table 8 Internet Access Wizard Setup: ISP Parameters LABEL Mode Encapsulation Multiplexing Virtual Circuit ID VPI VCI Back Next Exit DESCRIPTION From the Mode - ZyXEL P-660HW-T1 v2 | User Guide - Page 59
P-660HW-T v2 User's Guide 2 The next wizard screen varies depending on what mode and encapsulation type you use. All screens shown are with routing mode. Configure the fields and click Next to continue. See Section 3.3 on page 62 for wireless connection wizard setup Figure 20 Internet Connection - ZyXEL P-660HW-T1 v2 | User Guide - Page 60
P-660HW-T v2 User's Guide The following table describes the fields in this screen. Table 10 Internet Connection with RFC 1483 LABEL IP Address Back Next Exit DESCRIPTION This field is available if you select Routing in the Mode field. Type your ISP assigned IP address in this field. Click Back - ZyXEL P-660HW-T1 v2 | User Guide - Page 61
with PPPoA LABEL User Name Password Back Apply Exit DESCRIPTION Enter the login name that your ISP gives you. Enter the password associated with the user name above. Click Back to go back to the previous wizard screen. Click Apply to save your changes to the ZyXEL Device. Click Exit to close - ZyXEL P-660HW-T1 v2 | User Guide - Page 62
P-660HW-T v2 User's Guide Figure 24 Connection Test Failed-1 • If the following screen displays, check if your account is activated or click Restart the Internet/Wireless Setup Wizard to verify your Internet access settings. Figure 25 Connection Test Failed-2. 3.3 Wireless Connection Wizard Setup - ZyXEL P-660HW-T1 v2 | User Guide - Page 63
Figure 26 Connection Test Successful P-660HW-T v2 User's Guide 2 Use this screen to activate the wireless LAN and OTIST. Click Next to continue. Figure 27 Wireless LAN Setup Wizard 1 Chapter 3 Wizard Setup for Internet Access 63 - ZyXEL P-660HW-T1 v2 | User Guide - Page 64
P-660HW-T v2 User's Guide The following table describes the labels in this screen. Table 13 Wireless LAN Setup Wizard 1 LABEL Active Enable OTIST DESCRIPTION Select the check box to turn on the wireless LAN. Select the check box to enable OTIST if you want to transfer your ZyXEL Device's SSID - ZyXEL P-660HW-T1 v2 | User Guide - Page 65
P-660HW-T v2 User's Guide The following table describes the labels in this screen. Table 14 Wireless LAN Setup Wizard 2 LABEL Network Name(SSID) Channel Selection Security DESCRIPTION Enter a descriptive name (up to 32 printable 7-bit ASCII characters) for the wireless LAN. If you change this - ZyXEL P-660HW-T1 v2 | User Guide - Page 66
P-660HW-T v2 User's Guide Figure 29 Manually assign a WPA-PSK key The following table describes the labels in this screen. Table 15 Manually assign a WPA key LABEL Pre-Shared Key Back Next Exit DESCRIPTION Type from 8 to 63 case-sensitive ASCII characters. You can set up the most secure wireless - ZyXEL P-660HW-T1 v2 | User Guide - Page 67
P-660HW-T v2 User's Guide The following table describes the labels in this screen. Table 16 Manually assign a WEP key LABEL Key Back Next Exit DESCRIPTION The WEP keys are used to encrypt data. Both the ZyXEL Device and the wireless stations must use the same WEP key for data transmission. Enter - ZyXEL P-660HW-T1 v2 | User Guide - Page 68
P-660HW-T v2 User's Guide Figure 32 Internet Access and WLAN Wizard Setup Complete 7 Launch your web browser and navigate to www.zyxel.com. Internet access is just the beginning. Refer to the rest of this guide for more detailed information on the complete range of ZyXEL Device features. If you - ZyXEL P-660HW-T1 v2 | User Guide - Page 69
P-660HW-T v2 User's Guide CHAPTER 4 Bandwidth Management Wizard This chapter shows you how to configure basic bandwidth management using the wizard screens. 4.1 Introduction Bandwidth management allows you to control the amount of bandwidth going out through the ZyXEL Device's WAN port and - ZyXEL P-660HW-T1 v2 | User Guide - Page 70
P-660HW-T v2 User's Guide Table 17 Media Bandwidth Management Setup: Services (continued) SERVICE VoIP (SIP) Telnet TFTP WWW DESCRIPTION Sending voice signals over the Internet is called Voice over IP or VoIP. Session Initiated Protocol (SIP) is an internationally recognized standard for - ZyXEL P-660HW-T1 v2 | User Guide - Page 71
apply bandwidth management to traffic going out through the ZyXEL Device's port(s). Select Services Setup to allocate bandwidth based on the service requirements. Click Back to display the previous screen. Click Next to proceed to the next screen. Click Exit to close the wizard screen without saving - ZyXEL P-660HW-T1 v2 | User Guide - Page 72
be set to User Configured. The Advanced > Bandwidth MGMT > Rule Setup screen allows you to edit these rule configurations. Auto classifier Select Auto classifier rest bandwidth to automatically allocate unbudgeted or rest bandwidth unused bandwidth to services based on the packet type. Back Click - ZyXEL P-660HW-T1 v2 | User Guide - Page 73
P-660HW-T v2 User's Guide 5 Follow the on-screen instructions and click Finish to complete the wizard setup and save your configuration. Figure 37 Bandwidth Management Wizard: Complete Chapter 4 Bandwidth Management Wizard 73 - ZyXEL P-660HW-T1 v2 | User Guide - Page 74
P-660HW-T v2 User's Guide 74 Chapter 4 Bandwidth Management Wizard - ZyXEL P-660HW-T1 v2 | User Guide - Page 75
P-660HW-T v2 User's Guide CHAPTER 5 WAN Setup This chapter describes how to configure WAN settings. 5.1 WAN Overview A WAN (Wide Area Network) is an outside connection to another network or the Internet. 5.1.1 Encapsulation Be sure to use the encapsulation method required by your ISP. The ZyXEL - ZyXEL P-660HW-T1 v2 | User Guide - Page 76
660HW-T v2 User's Guide By implementing PPPoE directly on the ZyXEL Device (rather than individual computers), the computers on the LAN do not need PPPoE software installed, since the ZyXEL Circuit) to the Internet Service Provider's (ISP) a specific virtual circuit; for example, VC1 carries IP, - ZyXEL P-660HW-T1 v2 | User Guide - Page 77
P-660HW-T v2 User's Guide IP Address field and not the ENET ENCAP Gateway field. 5.1.5.2 IP Assignment with RFC 1483 Encapsulation In this case the IP Address Assignment must be static with the same requirements for the IP Address and ENET ENCAP Gateway fields as stated above. Chapter 5 WAN Setup - ZyXEL P-660HW-T1 v2 | User Guide - Page 78
P-660HW-T v2 User's Guide 5.1.5.3 IP Assignment with ENET ENCAP Encapsulation In this case you can have either a static or dynamic IP. For a static IP you must fill in all the IP Address and ENET ENCAP Gateway fields as supplied by your ISP. However for a dynamic IP, the ZyXEL Device acts as a DHCP - ZyXEL P-660HW-T1 v2 | User Guide - Page 79
660HW-T v2 User's Guide If you want the dial-backup route to take first priority over the traffic-redirect route or even the normal route, all you need to do is set the dial-backup route's metric to "1" and the others to "2" (or greater). IP Policy Routing overrides the default is set to the default - ZyXEL P-660HW-T1 v2 | User Guide - Page 80
additional account information (such as an Internet account user name and password) is required or the ZyXEL Device cannot connect to the ISP, you will be redirected to web screen(s) for information input or troubleshooting. Zero configuration for Internet access is disable when 80 Chapter 5 WAN - ZyXEL P-660HW-T1 v2 | User Guide - Page 81
P-660HW-T v2 User's Guide • the ZyXEL Device is in bridge mode • you set the ZyXEL Device to use a static (fixed) WAN IP address. 5.5 Internet Connection To change your ZyXEL Device's WAN Internet access settings, click Network > WAN. The screen differs by the encapsulation. See Section 5.1 on page - ZyXEL P-660HW-T1 v2 | User Guide - Page 82
P-660HW-T v2 User's Guide Table 20 Internet Connection (continued) LABEL DESCRIPTION Encapsulation Select the method of encapsulation used by your ISP from the drop-down list box. Choices vary depending on the mode you select in the Mode field. If you select Bridge in the Mode field, select - ZyXEL P-660HW-T1 v2 | User Guide - Page 83
of your WAN setup. 5.5.1 Configuring Advanced Internet Connection Setup To edit your ZyXEL Device's advanced WAN settings, click the Advanced Setup button in the Internet Connection screen. The screen appears as shown. Figure 40 Advanced Internet Connection Setup The following table describes - ZyXEL P-660HW-T1 v2 | User Guide - Page 84
, which is less than 65535. Zero Configuration This feature is not applicable/available when you configure the ZyXEL Device to use a static WAN IP address or in bridge mode. Select Yes to set the ZyXEL Device to automatically detect the Internet connection settings (such as the VCI/VPI numbers and - ZyXEL P-660HW-T1 v2 | User Guide - Page 85
Figure 41 More Connections P-660HW-T v2 User's Guide The following table describes Click Apply to save the changes. Click Cancel to begin configuring this screen afresh. 5.6.1 More Connections Edit Click the edit icon in the More Connections screen to configure a connection. Chapter 5 WAN Setup - ZyXEL P-660HW-T1 v2 | User Guide - Page 86
P-660HW-T v2 User's Guide Figure 42 More Connections Edit The following table describes the labels in this screen. Table 23 More Connections Edit LABEL Active Name Mode Encapsulation DESCRIPTION Select the check box to activate or clear the check box to deactivate this connection. Enter a unique - ZyXEL P-660HW-T1 v2 | User Guide - Page 87
on Demand. The default setting is 0, which means the Internet session will not timeout. NAT SUA only is available only when you select Routing in the Mode field. Select SUA Only if you have one public IP address and want to use NAT. Click Edit to go to the Port Forwarding screen to edit a server - ZyXEL P-660HW-T1 v2 | User Guide - Page 88
P-660HW-T v2 User's Guide Table 23 More Connections Edit (continued) LABEL Cancel Advanced Setup DESCRIPTION Click Cancel to begin configuring this screen afresh. Click this button to display the More Connections Advanced screen and edit more details of your WAN setup. 5.6.2 Configuring More - ZyXEL P-660HW-T1 v2 | User Guide - Page 89
660HW-T v2 User's Guide Table 24 More Connections Advanced Setup The Sustain Cell Rate (SCR) sets the average cell rate (long-term) that than the PCR. Note that system default is 0 cells/sec. Maximum Burst IP alias to configure the LAN into two or three logical networks with the ZyXEL Device - ZyXEL P-660HW-T1 v2 | User Guide - Page 90
P-660HW-T v2 User's Guide Figure 45 Traffic Redirect LAN Setup 5.8 Configuring WAN Backup To change your ZyXEL Device's WAN backup settings, click Network > WAN > WAN Backup Setup. The screen appears as shown. Figure 46 WAN Backup Setup 90 Chapter 5 WAN Setup - ZyXEL P-660HW-T1 v2 | User Guide - Page 91
of your backup gateway in dotted decimal notation. The ZyXEL Device automatically forwards traffic to this IP address if the ZyXEL Device's Internet connection terminates. Apply Click Apply to save the changes. Cancel Click Cancel to begin configuring this screen afresh. Chapter 5 WAN Setup 91 - ZyXEL P-660HW-T1 v2 | User Guide - Page 92
P-660HW-T v2 User's Guide 92 Chapter 5 WAN Setup - ZyXEL P-660HW-T1 v2 | User Guide - Page 93
660HW-T v2 User's Guide CHAPTER 6 Wireless LAN This chapter discusses how to configure the wireless network settings in your ZyXEL the printer) or with the Internet. Your ZyXEL Device is the AP. Every wireless network the wireless network. It stands for Service Set IDentity. • If two wireless networks - ZyXEL P-660HW-T1 v2 | User Guide - Page 94
660HW-T v2 User's Guide default User's Guide or other documentation. You can use the MAC address filter to tell the AP which wireless clients are allowed or not allowed to use the wireless network. If a wireless client is allowed to use the wireless network, it still has to have the correct settings - ZyXEL P-660HW-T1 v2 | User Guide - Page 95
P-660HW-T v2 User's Guide 6.2.3 User Authentication Authentication is the process of verifying whether a wireless device is allowed to use the wireless network. You can make every user log in to the wireless network before they can use it. This is called user authentication. However, every - ZyXEL P-660HW-T1 v2 | User Guide - Page 96
P-660HW-T v2 User's Guide Usually, you should set up the strongest encryption that every wireless client in the wireless network supports. For example, suppose the AP does not have a local user database, and you do not have a RADIUS server. Therefore, there is no user authentication. Suppose the - ZyXEL P-660HW-T1 v2 | User Guide - Page 97
Set the operating frequency/channel depending on your particular region. Select a channel from the drop-down list box. Click Apply to save your changes to the ZyXEL Device. Click Cancel to reload the previous configuration for this screen. Click Advanced Setup to display the Wireless Advanced Setup - ZyXEL P-660HW-T1 v2 | User Guide - Page 98
DESCRIPTION Security Mode Apply Cancel Advanced Setup Choose No Security from the drop-down list box. Click Apply to save your changes to the ZyXEL Device. Click Cancel to reload the previous configuration for this screen. Click Advanced Setup to display the Wireless Advanced Setup screen and - ZyXEL P-660HW-T1 v2 | User Guide - Page 99
P-660HW-T v2 User's Guide The following table describes the wireless LAN security labels in this screen. Table 29 Wireless: Static WEP Encryption LABEL DESCRIPTION Security Mode Passphrase WEP Key Apply Cancel Advanced Setup Choose Static WEP from the drop-down list box. Enter a Passphrase - ZyXEL P-660HW-T1 v2 | User Guide - Page 100
of user-specific credentials. Type a pre-shared key from 8 to 63 case-sensitive ASCII characters (including spaces and symbols). Specify how often wireless clients have to resend usernames and passwords in order to stay connected. Enter a time interval between 10 and 9999 seconds. The default time - ZyXEL P-660HW-T1 v2 | User Guide - Page 101
Setting of the Group Key Update Timer is also supported in WPA-PSK/WPA2-PSK mode. The default is 1800 seconds (30 minutes). Apply Click Apply to save your changes to the ZyXEL Device. Cancel Click Cancel to reload the previous configuration for this screen. Advanced Setup Click Advanced Setup - ZyXEL P-660HW-T1 v2 | User Guide - Page 102
P-660HW-T v2 User's Guide Figure 52 Wireless: WPA/WPA2 The following table describes the wireless LAN security labels in this screen. Table 31 Wireless: WPA/WPA2 LABEL DESCRIPTION WPA Compatible This check box is available only when you select WPA2-PSK or WPA2 in the Security Mode field. - ZyXEL P-660HW-T1 v2 | User Guide - Page 103
basis. Setting of the Group Key Update Timer is also supported in WPA-PSK/WPA2-PSK mode. The default is 1800 seconds (30 minutes). Authentication Server IP Address Enter the IP address of the external authentication server in dotted decimal notation. Port Number Enter the port number of - ZyXEL P-660HW-T1 v2 | User Guide - Page 104
P-660HW-T v2 User's Guide Figure 53 Advanced The following table describes the labels in this screen. Table 32 Wireless LAN: Advanced LABEL DESCRIPTION Wireless Advanced Setup RTS/CTS Threshold Enter a value between 0 and 2432. Fragmentation This is the maximum data fragment size that can be - ZyXEL P-660HW-T1 v2 | User Guide - Page 105
P-660HW-T v2 User's Guide Table 32 Wireless LAN: Advanced LABEL Max. Frame Burst Back Apply Cancel DESCRIPTION Enable Maximum Frame Burst to help eliminate collisions in mixed-mode networks (networks with both IEEE 802.11g and IEEE 802.11b traffic) and enhance the performance of both pure IEEE - ZyXEL P-660HW-T1 v2 | User Guide - Page 106
P-660HW-T v2 User's Guide Note: If you hold in the RESET button too long, the device will reset to the factory defaults! 6.5.1.1.2 Web Configurator Click the Network > Wireless LAN > OTIST. The following screen displays. Figure 54 OTIST The following table describes the labels in this screen. - ZyXEL P-660HW-T1 v2 | User Guide - Page 107
OTIST enabled. 1 In the AP, a web configurator screen pops up showing you the security settings to transfer. You can use the key in this screen to set up WPA-PSK encryption manually for non-OTIST devices in the wireless network. After reviewing the settings, click OK. Figure 56 Security Key 2 This - ZyXEL P-660HW-T1 v2 | User Guide - Page 108
, you must still click Start in the AP OTIST web configurator screen or hold in the RESET button (for one to five seconds) for the AP to transfer settings. 4 If you change the SSID or the keys on the AP after using OTIST, you need to run OTIST again or enter them manually in the wireless - ZyXEL P-660HW-T1 v2 | User Guide - Page 109
P-660HW-T v2 User's Guide To change your ZyXEL Device's MAC filter settings, click Network > Wireless LAN > MAC Filter. The screen appears as shown. Figure 61 MAC Address Filter The following table describes the labels in this menu. Table 34 MAC Address Filter LABEL DESCRIPTION Active MAC - ZyXEL P-660HW-T1 v2 | User Guide - Page 110
P-660HW-T v2 User's Guide Table 34 MAC Address Filter LABEL Apply Cancel DESCRIPTION Click Apply to save your changes to the ZyXEL Device. Click Cancel to reload the previous configuration for this screen. 110 Chapter 6 Wireless LAN - ZyXEL P-660HW-T1 v2 | User Guide - Page 111
P-660HW-T v2 User's Guide CHAPTER 7 LAN Setup This chapter describes how to configure LAN settings. 7.1 LAN Overview A Local Area Network (LAN) is a shared communication system to which many computers are attached. A LAN is a computer network limited to the immediate area, - ZyXEL P-660HW-T1 v2 | User Guide - Page 112
P-660HW-T v2 User's Guide 7.1.2 DHCP Setup DHCP (Dynamic Host Configuration Protocol, RFC 2131 and RFC 2132) allows individual clients to obtain TCP/IP configuration at start-up from a server. You can configure the ZyXEL Device as a DHCP server or disable it. When configured as a server, the ZyXEL - ZyXEL P-660HW-T1 v2 | User Guide - Page 113
specifies the network number portion of an IP address. Your ZyXEL Device will compute the subnet mask automatically based on the IP address that you entered. You don't need to change the subnet mask computed by the ZyXEL Device unless you are instructed to do otherwise. Chapter 7 LAN Setup 113 - ZyXEL P-660HW-T1 v2 | User Guide - Page 114
P-660HW-T v2 User's Guide 7.2.1.1 Private IP Addresses Every machine on the Internet must have a unique address. If your networks are isolated from the Internet, for example, only between your two branch offices, you can assign any IP addresses to the hosts without problems. However, the Internet - ZyXEL P-660HW-T1 v2 | User Guide - Page 115
the ZyXEL Device periodically updates this information. IP multicasting can be enabled/disabled on the ZyXEL Device LAN and/or WAN interfaces in the web configurator (LAN; WAN). Select None to disable IP multicasting on these interfaces. 7.2.4 Any IP Traditionally, you must set the IP addresses and - ZyXEL P-660HW-T1 v2 | User Guide - Page 116
P-660HW-T v2 User's Guide Figure 63 Any IP Example The Any IP feature does not apply to a computer using either a dynamic IP address or a static IP address that is in the same subnet as the ZyXEL Device's IP address. Note: You must enable NAT/SUA to use the Any IP feature on the ZyXEL Device. - ZyXEL P-660HW-T1 v2 | User Guide - Page 117
Cancel Advanced Setup DESCRIPTION Enter the IP address of your ZyXEL Device in dotted decimal notation, for example, 192.168.1.1 (factory default). Type the subnet mask assigned to you by your ISP (if given). Click Apply to save your changes to the ZyXEL Device. Click Cancel to begin configuring - ZyXEL P-660HW-T1 v2 | User Guide - Page 118
P-660HW-T v2 User's Guide Figure 65 Advanced LAN Setup The following table describes the labels in this screen. Table 36 Advanced LAN Setup LABEL RIP & Multicast Setup RIP Direction RIP Version Multicast Any IP Setup Windows Networking (NetBIOS over TCP/IP) Allow between LAN and WAN Back Apply - ZyXEL P-660HW-T1 v2 | User Guide - Page 119
P-660HW-T v2 User's Guide 7.4 DHCP Setup Use this screen to configure the DNS server information that the ZyXEL Device sends to the DHCP client devices on the LAN. Figure 66 DHCP Setup The following table describes the labels in this screen. Table 37 DHCP Setup LABEL DHCP Setup DHCP IP Pool - ZyXEL P-660HW-T1 v2 | User Guide - Page 120
P-660HW-T v2 User's Guide Table 37 DHCP Setup LABEL DESCRIPTION Primary DNS Server Secondary DNS Server This field is not available when you set DHCP to Relay. Enter the IP addresses of the DNS servers. The DNS servers are passed to the DHCP clients along with the IP address and the subnet mask - ZyXEL P-660HW-T1 v2 | User Guide - Page 121
P-660HW-T v2 User's Guide The following table describes the labels in this screen. Table 38 LAN Client List LABEL IP Address MAC Address Add # Status Host Name IP Address MAC Address Reserve Modify Apply Cancel Refresh DESCRIPTION Enter the IP address that you want to assign to the computer on - ZyXEL P-660HW-T1 v2 | User Guide - Page 122
P-660HW-T v2 User's Guide Figure 68 Physical Network & Partitioned Logical Networks To change your ZyXEL Device's IP alias settings, click Network > LAN > IP Alias. The screen appears as shown. Figure 69 LAN IP Alias The following table describes the labels in this screen. Table 39 LAN IP Alias - ZyXEL P-660HW-T1 v2 | User Guide - Page 123
P-660HW-T v2 User's Guide Table 39 LAN IP Alias LABEL RIP Direction RIP Version Apply Cancel default, RIP direction is set to Both and the Version set to RIP-1. Click Apply to save your changes to the ZyXEL Device. Click Cancel to begin configuring this screen afresh. Chapter 7 LAN Setup - ZyXEL P-660HW-T1 v2 | User Guide - Page 124
P-660HW-T v2 User's Guide 124 Chapter 7 LAN Setup - ZyXEL P-660HW-T1 v2 | User Guide - Page 125
P-660HW-T v2 User's Guide CHAPTER 8 Network Address Translation (NAT) Screens This chapter discusses how to configure NAT on the ZyXEL Device. 8.1 NAT Overview NAT (Network Address Translation - NAT, RFC 1631) is the translation of the IP address of a host in a packet, for example, the source - ZyXEL P-660HW-T1 v2 | User Guide - Page 126
P-660HW-T v2 User's Guide 8.1.2 What NAT Does In the simplest form, NAT changes the source IP address in a packet received from a subscriber (the inside local address) to another (the inside global address) before forwarding the packet to the WAN side. When the response comes back, NAT translates - ZyXEL P-660HW-T1 v2 | User Guide - Page 127
IP address to one global IP address. • Many to One: In Many-to-One mode, the ZyXEL Device maps multiple local IP addresses to one global IP address. This is equivalent to SUA (for instance, PAT, port address translation), ZyXEL's Single User Account feature that previous ZyXEL routers supported - ZyXEL P-660HW-T1 v2 | User Guide - Page 128
Full Feature if you have multiple public WAN IP addresses for your ZyXEL Device. 8.3 NAT General Setup You must create a firewall rule in addition to setting up SUA/NAT, to allow traffic from the WAN to be forwarded through the ZyXEL Device. Click Network > NAT to open the following screen. Not - ZyXEL P-660HW-T1 v2 | User Guide - Page 129
users using peer to peer applications, you can lower this number to ensure no single client is using all of the available NAT sessions. Click Apply to save your changes to the ZyXEL Device. Click Cancel to reload the previous configuration for this screen. 8.4 Port Forwarding A port forwarding set - ZyXEL P-660HW-T1 v2 | User Guide - Page 130
P-660HW-T v2 User's Guide You may enter a single port number or a range of port numbers to be forwarded, and the local IP address of the desired server. The port number identifies a service; for example, web service is on port 80 and FTP on port 21. In some cases, such as for unknown services or - ZyXEL P-660HW-T1 v2 | User Guide - Page 131
P-660HW-T v2 User's Guide 8.4.3 Configuring Servers Behind Port Forwarding (Example) Let's say you want to assign ports 21-25 to one FTP, Telnet and SMTP server (A in the example), port 80 to another (B in the example) and assign a default server IP address of 192.168.1.35 to a third (C in the - ZyXEL P-660HW-T1 v2 | User Guide - Page 132
P-660HW-T v2 User's Guide The following table describes the fields in this screen. Table 44 NAT Port Forwarding LABEL DESCRIPTION Default Server Setup Default Server In addition to the servers for specified services, NAT supports a default server. A default server receives packets from ports - ZyXEL P-660HW-T1 v2 | User Guide - Page 133
P-660HW-T v2 User's Guide The following table describes the fields in this screen. Table 45 Port Forwarding Rule Setup LABEL Active Service Name Start Port End Port Server IP Address Back Apply Cancel DESCRIPTION Click this check box to enable the rule. Enter a name to identify this port- - ZyXEL P-660HW-T1 v2 | User Guide - Page 134
local IP addresses to one global IP address. This is equivalent to SUA (i.e., PAT, port address translation), ZyXEL's Single User Account feature that previous ZyXEL routers supported only. M-M Ov (Overload): Many-to-Many Overload mode maps multiple local IP addresses to shared global IP addresses - ZyXEL P-660HW-T1 v2 | User Guide - Page 135
NAT mapping type. • Many-to-One: Many-to-One mode maps multiple local IP addresses to one global IP address. This is equivalent to SUA (i.e., PAT, port address translation), ZyXEL's Single User Account feature that previous ZyXEL routers supported only. • Many-to-Many Overload: Many-to-Many Overload - ZyXEL P-660HW-T1 v2 | User Guide - Page 136
P-660HW-T v2 User's Guide Table 47 Edit Address Mapping Rule (continued) LABEL Edit Details Back Apply Cancel DESCRIPTION Click this link to go to the Port Forwarding screen to edit a server mapping set that you have selected in the Server Mapping Set field. Click Back to return to the previous - ZyXEL P-660HW-T1 v2 | User Guide - Page 137
P-660HW-T v2 User's Guide CHAPTER 9 Firewalls This chapter gives some background information on firewalls and introduces the ZyXEL Device firewall. 9.1 Firewall Overview Originally, the term firewall referred to a construction technique designed to prevent the spread of fire from one room to another - ZyXEL P-660HW-T1 v2 | User Guide - Page 138
P-660HW-T v2 User's Guide 9.2.2 Application-level Firewalls Application-level firewalls restrict access by serving as proxies for external servers. Since they use programs written for specific Internet services, such as HTTP, FTP and telnet, they can evaluate network packets for valid application- - ZyXEL P-660HW-T1 v2 | User Guide - Page 139
v2 User's Guide • The LAN (Local Area Network) port attaches to a network of computers, which needs security from the outside world. These computers will have access to Internet services such as e-mail, FTP, and the World Wide Web. However, "inbound access" will not be allowed unless you configure - ZyXEL P-660HW-T1 v2 | User Guide - Page 140
P-660HW-T v2 User's Guide Some of the most common IP ports are: Table 48 Common IP Ports 21 FTP 53 23 Telnet 80 25 SMTP 110 DNS HTTP POP3 9.4.2 Types of DoS Attacks There are four types of DoS attacks: 1 Those that exploit bugs in a TCP/IP implementation. 2 Those that exploit weaknesses - ZyXEL P-660HW-T1 v2 | User Guide - Page 141
660HW-T v2 User's Guide which is set at IP specification known as directed or subnet broadcasting, to quickly flood the target network with useless data. A Smurf hacker floods a router with Internet Control Message Protocol (ICMP) echo request packets (pings). Since the destination IP address - ZyXEL P-660HW-T1 v2 | User Guide - Page 142
P-660HW-T v2 User's Guide Figure 81 Smurf Attack 9.4.2.1 ICMP Vulnerability ICMP is an error-reporting protocol that works in concert with IP. The following ICMP types trigger an alert: Table 49 ICMP Commands That Trigger Alerts 5 REDIRECT 13 TIMESTAMP_REQUEST 14 TIMESTAMP_REPLY 17 - ZyXEL P-660HW-T1 v2 | User Guide - Page 143
P-660HW-T v2 User's Guide 9.4.2.3 Traceroute Traceroute is a utility used to determine the path a packet takes between two endpoints. Sometimes when a packet filter firewall is configured incorrectly an attacker can traceroute the firewall gaining knowledge of the network topology inside the - ZyXEL P-660HW-T1 v2 | User Guide - Page 144
P-660HW-T v2 User's Guide The previous figure shows the ZyXEL Device's default firewall rules in action as well as demonstrates how stateful inspection works. User A can initiate a Telnet session from within the LAN and responses to this request are allowed. However other Telnet traffic initiated - ZyXEL P-660HW-T1 v2 | User Guide - Page 145
P-660HW-T v2 User's Guide • Allow certain types of traffic from the Internet to specific hosts on the LAN. • Allow access to a Web server to everyone but competitors. • Restrict use of certain protocols, such as Telnet, to authorized users on the LAN. These custom rules work by evaluating the - ZyXEL P-660HW-T1 v2 | User Guide - Page 146
P-660HW-T v2 User's Guide A similar situation exists for ICMP, except that the ZyXEL Device is even more restrictive. Specifically, only outgoing echoes will allow incoming echo replies, outgoing address mask requests will allow incoming address mask replies, and outgoing timestamp requests will - ZyXEL P-660HW-T1 v2 | User Guide - Page 147
P-660HW-T v2 User's Guide • Encourage your company or organization to develop a comprehensive security yet can be complex to configure and maintain, especially if you need a chain of rules to filter a service. • Packet filtering only checks the header portion of an IP packet. Chapter 9 Firewalls - ZyXEL P-660HW-T1 v2 | User Guide - Page 148
P-660HW-T v2 User's Guide 9.7.1.1 When To Use Filtering • To block/allow LAN packets by their MAC addresses. • To block/allow special IP packets which are neither TCP nor UDP, nor ICMP packets. • To block/allow both inbound (WAN to LAN) and outbound (LAN to WAN) traffic between the specific inside - ZyXEL P-660HW-T1 v2 | User Guide - Page 149
P-660HW-T v2 User's Guide CHAPTER 10 Firewall Configuration This chapter shows you how to enable and configure the ZyXEL Device firewall. 10.1 Access Methods The web configurator is, by far, the most comprehensive firewall configuration tool your ZyXEL Device has to offer. For this reason, it is - ZyXEL P-660HW-T1 v2 | User Guide - Page 150
the Source IP address, Destination IP address and IP protocol type of network traffic to rules set by the administrator. Your customized rules take precedence and override the ZyXEL Device's default rules. 10.3 Rule Logic Overview Note: Study these points carefully before configuring rules. 10 - ZyXEL P-660HW-T1 v2 | User Guide - Page 151
P-660HW-T v2 User's Guide 4 Does a rule that allows Internet users access to resources on the LAN create a security vulnerability? For example, if FTP ports (TCP 20, 21) are allowed from the Internet to the LAN, Internet users may be able to connect to computers with running FTP servers. 5 Does this - ZyXEL P-660HW-T1 v2 | User Guide - Page 152
P-660HW-T v2 User's Guide 10.4.1 LAN to WAN Rules The default rule for LAN to WAN traffic is that all users on the LAN are allowed nonrestricted access to the WAN. When you configure a LAN to WAN rule, you in essence want to limit some or all users from accessing certain services on the WAN. WAN to - ZyXEL P-660HW-T1 v2 | User Guide - Page 153
P-660HW-T v2 User's Guide The following table describes the labels in this screen. Table 52 Firewall: General LABEL Active Firewall Bypass Triangle Route DESCRIPTION Select this check box to activate the firewall. The ZyXEL Device performs access control and protects against Denial of Service ( - ZyXEL P-660HW-T1 v2 | User Guide - Page 154
660HW-T v2 User's Guide Figure 84 Firewall Rules The following table describes the labels in this screen. Table 53 Firewall Rules LABEL DESCRIPTION Firewall Rules This read-only bar shows how much of the ZyXEL configure (summarized below) take priority over the general firewall action settings - ZyXEL P-660HW-T1 v2 | User Guide - Page 155
P-660HW-T v2 User's Guide Table 53 Firewall Rules (continued) LABEL Action Schedule Log Modify Order Apply Cancel DESCRIPTION This field displays whether the firewall silently discards packets (Drop), discards packets and sends a TCP reset packet or an ICMP destination-unreachable message to the - ZyXEL P-660HW-T1 v2 | User Guide - Page 156
P-660HW-T v2 User's Guide Figure 85 Firewall: Edit Rule 156 Chapter 10 Firewall Configuration - ZyXEL P-660HW-T1 v2 | User Guide - Page 157
includes: Single Address, Range Address, Subnet Address and Any Address. Start IP Address Enter the single IP address or the starting IP address in a range here. End IP Address Enter the ending IP address in a range here. Subnet Mask Enter the subnet mask here, if applicable. Add >> Click Add - ZyXEL P-660HW-T1 v2 | User Guide - Page 158
P-660HW-T v2 User's Guide Table 54 Firewall: Edit Rule (continued) LABEL Apply Cancel DESCRIPTION Click Apply to save your customized settings and exit this screen. Click Cancel to exit this screen without saving. 10.6.2 Customized Services Configure customized services and port numbers not - ZyXEL P-660HW-T1 v2 | User Guide - Page 159
P-660HW-T v2 User's Guide 10.6.3 Configuring a Customized Service Click a rule number in the Firewall Customized Services screen to create a new custom port or edit an existing one. This action displays the following screen. Refer to Section 9.1 on page 137 for more information. Figure 87 Firewall: - ZyXEL P-660HW-T1 v2 | User Guide - Page 160
number to display the Customized Services Config screen and configure the screen as follows and click Apply. Figure 89 Edit Custom Port Example 7 Select Any in the Destination Address box and then click Delete. 8 Configure the destination address screen as follows and click Add. 160 Chapter 10 - ZyXEL P-660HW-T1 v2 | User Guide - Page 161
P-660HW-T v2 User's Guide Figure 90 Firewall Example: Edit Rule: Destination Address 9 Use the Add >> and Remove buttons between Available Services and Selected Services list boxes to configure it as follows. Click Apply when you are done. Note: Custom services show up with an "*" before their names - ZyXEL P-660HW-T1 v2 | User Guide - Page 162
P-660HW-T v2 User's Guide Figure 91 Firewall Example: Edit Rule: Select Customized Services On completing the configuration procedure for this Internet firewall rule, the Rules screen should look like the following. Rule 1 allows a "MyService" connection from the WAN to IP addresses 10.0.0.10 - ZyXEL P-660HW-T1 v2 | User Guide - Page 163
Example: Rules: MyService P-660HW-T v2 User's Guide 10.8 Predefined Services The Available Services list box in the Edit Rule screen (see Section 10.6.1 on page 155) displays all predefined services that the ZyXEL Device already supports. Next to the name of the service, two fields appear in - ZyXEL P-660HW-T1 v2 | User Guide - Page 164
660HW-T v2 User's Guide Table 57 Predefined Services (continued) SERVICE POP3 server through a temporary connection (TCP/IP or other). Point-to-Point Tunneling Protocol Service. A streaming audio service that enables real time sound over the web. Remote Execution Daemon. Remote Login. Remote Telnet - ZyXEL P-660HW-T1 v2 | User Guide - Page 165
P-660HW-T v2 User's Guide Table 57 Predefined Services (continued) SERVICE SSDP(UDP:1900) SSH(TCP/UDP:22) STRMWORKS(UDP:1558) SYSLOG(UDP:514) TACACS(UDP:49) TELNET(TCP:23) TFTP(UDP:69) VDOLIVE(TCP:7000) DESCRIPTION Simole Service Discovery Protocol (SSDP) is a discovery service searching for - ZyXEL P-660HW-T1 v2 | User Guide - Page 166
request(s) for unused ports, thus leaving the unused ports and the ZyXEL Device Services. unseen. By default this option is not selected and the ZyXEL Device will reply with an ICMP Port Unreachable packet for a port probe on its unused UDP ports, and a TCP Reset packet for a port probe on its - ZyXEL P-660HW-T1 v2 | User Guide - Page 167
-T v2 User's Guide If your network is slower than average for any of these factors (especially if you have servers that are slow or handle many tasks and are often busy), then the default values should be reduced. You should make any changes to the threshold values before you continue configuring - ZyXEL P-660HW-T1 v2 | User Guide - Page 168
P-660HW-T v2 User's Guide 10.10.3 Configuring Firewall Thresholds The ZyXEL Device also sends alerts whenever TCP Maximum Incomplete is exceeded. The global values specified for the threshold and timeout apply to all TCP connections. Click Firewall, and Threshold to bring up the next screen. Figure - ZyXEL P-660HW-T1 v2 | User Guide - Page 169
P-660HW-T v2 User's Guide Table 59 Firewall: Threshold (continued) LABEL DESCRIPTION DEFAULT VALUES Maximum Incomplete Low This is the number of existing half-open sessions that causes the firewall to stop deleting half-open sessions. The ZyXEL Device continues to delete half-open requests as - ZyXEL P-660HW-T1 v2 | User Guide - Page 170
P-660HW-T v2 User's Guide 170 Chapter 10 Firewall Configuration - ZyXEL P-660HW-T1 v2 | User Guide - Page 171
P-660HW-T v2 User's Guide CHAPTER 11 Content Filtering This chapter covers how to configure content set a schedule for when the ZyXEL Device performs content filtering. You can also specify trusted IP addresses on the LAN for which the ZyXEL Device will not perform content filtering. 11.2 Configuring - ZyXEL P-660HW-T1 v2 | User Guide - Page 172
P-660HW-T v2 User's Guide The following table describes the labels in this screen. Table to the ZyXEL Device. Cancel Click Cancel to return to the previously saved settings. 11.3 Configuring the Schedule To set the days and times for the ZyXEL Device to perform content filtering, click Security - ZyXEL P-660HW-T1 v2 | User Guide - Page 173
ending IP address of a specific range of users on your LAN that you want to exclude from content filtering. Leave this field blank if you want to exclude an individual computer. Click Apply to save your changes to the ZyXEL Device. Click Cancel to return to the previously saved settings. Chapter - ZyXEL P-660HW-T1 v2 | User Guide - Page 174
P-660HW-T v2 User's Guide 174 Chapter 11 Content Filtering - ZyXEL P-660HW-T1 v2 | User Guide - Page 175
P-660HW-T v2 User's Guide CHAPTER 12 Static Route This chapter shows you how to configure static routes for your ZyXEL Device. 12.1 Static Route Each remote node specifies only the network to which the gateway is directly connected, and the ZyXEL Device has no knowledge of the networks beyond. For - ZyXEL P-660HW-T1 v2 | User Guide - Page 176
the IP address of the gateway. The gateway is a router or switch on the same network segment as the device's LAN or WAN port. The gateway helps forward packets to their destinations. This is the IP subnet mask. Click the Edit icon to go to the screen where you can set up a static route on the ZyXEL - ZyXEL P-660HW-T1 v2 | User Guide - Page 177
here. Enter the IP address of the gateway. The gateway is a router or switch on the same network segment as the device's LAN or WAN port. The gateway helps forward packets to their destinations. Click Back to return to the previous screen without saving. Click Apply to save your changes to the ZyXEL - ZyXEL P-660HW-T1 v2 | User Guide - Page 178
P-660HW-T v2 User's Guide 178 Chapter 12 Static Route - ZyXEL P-660HW-T1 v2 | User Guide - Page 179
P-660HW-T v2 User's Guide CHAPTER 13 Bandwidth Management This chapter contains information about configuring bandwidth management, editing rules and viewing the ZyXEL Device's bandwidth management logs. 13.1 Bandwidth Management Overview ZyXEL's Bandwidth Management allows you to specify bandwidth - ZyXEL P-660HW-T1 v2 | User Guide - Page 180
P-660HW-T v2 User's Guide Figure 101 Subnet-based Bandwidth Management Example 13.4 Application and priority-based. 13.5.1 Priority-based Scheduler With the priority-based scheduler, the ZyXEL Device forwards traffic from bandwidth classes according to the priorities that you assign to the - ZyXEL P-660HW-T1 v2 | User Guide - Page 181
P-660HW-T v2 User's Guide 13.5.2 Fairness-based Scheduler The ZyXEL Device divides bandwidth equally among bandwidth Reserving Bandwidth for Non-Bandwidth Class Traffic Do the following three steps to configure the ZyXEL Device to allow bandwidth for traffic that is not defined in a bandwidth - ZyXEL P-660HW-T1 v2 | User Guide - Page 182
P-660HW-T v2 User's Guide 13.6.2 Maximize Bandwidth Usage Example Here is an example of a ZyXEL Device that has maximize bandwidth usage enabled on an interface. The following table shows each bandwidth class's bandwidth budget. The classes are set up based on subnets. The interface is set to - ZyXEL P-660HW-T1 v2 | User Guide - Page 183
P-660HW-T v2 User's Guide • Research requires more bandwidth but only gets its budgeted 2048 kbps following table describes the priorities that you can apply to traffic that the ZyXEL Device forwards out through an interface. Table 69 Bandwidth Management Priorities PRIORITY LEVELS: TRAFFIC WITH - ZyXEL P-660HW-T1 v2 | User Guide - Page 184
P-660HW-T v2 User's Guide 13.7 Over Allotment of Bandwidth You can set the bandwidth management speed for an bandwidth. 13.8 Configuring Summary Click Advanced > Bandwidth MGMT to open the screen as shown next. Enable bandwidth management on an interface and set the maximum allowed bandwidth - ZyXEL P-660HW-T1 v2 | User Guide - Page 185
settings to the ZyXEL Device. Cancel Click Cancel to begin configuring this screen afresh. 13.9 Bandwidth Management Rule Setup You must use the Bandwidth Management Summary screen to enable bandwidth management on an interface before you can configure rules for that interface. Click Advanced - ZyXEL P-660HW-T1 v2 | User Guide - Page 186
P-660HW-T v2 User's Guide Figure 103 Bandwidth Management: Rule Setup The following table describes the labels in this screen. Table 72 Bandwidth Management: Rule Setup LABEL Direction Service Priority Bandwidth (kbps) Add # Active Rule Name Destination Port Priority Bandwidth (kbps) Modify Apply - ZyXEL P-660HW-T1 v2 | User Guide - Page 187
P-660HW-T v2 User's Guide 13.9.1 Rule Configuration Click the Edit icon or select User Defined from the Service drop-down list in the Rule Setup screen to configure a bandwidth management rule. Use bandwidth rules to allocate specific amounts of bandwidth capacity (bandwidth budgets) to specific - ZyXEL P-660HW-T1 v2 | User Guide - Page 188
(TCP or UDP) or select User defined and enter the protocol (service type) number. 0 means any protocol number. Back Click Back to go to the previous screen. Apply Click Apply to save your changes to the ZyXEL Device. Cancel Click Cancel to begin configuring this screen afresh. 188 Chapter - ZyXEL P-660HW-T1 v2 | User Guide - Page 189
P-660HW-T v2 User's Guide Table 74 Services and Port Numbers SERVICES ECHO FTP (File Transfer Protocol) SMTP (Simple Tunneling Protocol) PORT NUMBER 7 21 25 53 79 80 110 119 161 162 1723 13.10 Bandwidth Monitor To view the ZyXEL Device's bandwidth usage and allotments, click Advanced > Bandwidth - ZyXEL P-660HW-T1 v2 | User Guide - Page 190
P-660HW-T v2 User's Guide 190 Chapter 13 Bandwidth Management - ZyXEL P-660HW-T1 v2 | User Guide - Page 191
P-660HW-T v2 User's Guide CHAPTER 14 Dynamic DNS Setup This chapter discusses how to configure your ZyXEL Device to use Dynamic DNS. 14.1 Dynamic DNS Overview Dynamic DNS allows you to update your current dynamic IP address with one or many dynamic DNS services so that anyone can contact you (in - ZyXEL P-660HW-T1 v2 | User Guide - Page 192
P-660HW-T v2 User's Guide Figure 106 Dynamic DNS The following table describes the fields in this screen. Table 75 Dynamic DNS LABEL DESCRIPTION Dynamic DNS Setup Active Dynamic Select this check box to use dynamic DNS. DNS Service Provider This is the name of your Dynamic DNS service - ZyXEL P-660HW-T1 v2 | User Guide - Page 193
660HW-T v2 User's Guide Table 75 Dynamic DNS (continued) LABEL DESCRIPTION Dynamic DNS server auto detect IP Address Select this option only when there are one or more NAT routers between the ZyXEL Device and the DDNS server. This feature has the DDNS server automatically detect and use the IP - ZyXEL P-660HW-T1 v2 | User Guide - Page 194
P-660HW-T v2 User's Guide 194 Chapter 14 Dynamic DNS Setup - ZyXEL P-660HW-T1 v2 | User Guide - Page 195
P-660HW-T v2 User's Guide CHAPTER 15 Remote Management Configuration This chapter provides information on configuring remote management. 15.1 Remote Management Overview Remote management allows you to determine which services/protocols can access which ZyXEL Device interface (if any) from which - ZyXEL P-660HW-T1 v2 | User Guide - Page 196
P-660HW-T v2 User's Guide • The IP address in the Secured Client IP field does not match the client IP address. If it does not match, the ZyXEL Device will disconnect the session immediately. • There is already another remote management session with an equal or higher priority running. You may only - ZyXEL P-660HW-T1 v2 | User Guide - Page 197
with the IP address that you specify to access the ZyXEL Device using this service. Apply Click Apply to save your settings to the ZyXEL Device. Cancel Click Cancel to begin configuring this screen afresh. 15.3 Telnet You can configure your ZyXEL Device for remote Telnet access as shown - ZyXEL P-660HW-T1 v2 | User Guide - Page 198
the IP address that you specify to access the ZyXEL Device using this service. Apply Click Apply to save your customized settings and exit this screen. Cancel Click Cancel to begin configuring this screen afresh. 15.5 Configuring FTP You can upload and download the ZyXEL Device's firmware and - ZyXEL P-660HW-T1 v2 | User Guide - Page 199
Selected to just allow the computer with the IP address that you specify to access the ZyXEL Device using this service. Apply Click Apply to save your customized settings and exit this screen. Cancel Click Cancel to begin configuring this screen afresh. 15.6 SNMP Simple Network Management - ZyXEL P-660HW-T1 v2 | User Guide - Page 200
P-660HW-T v2 User's Guide Figure 111 SNMP Management Model An SNMP managed network consists of two main types of component: agents and a manager. An agent is a management software module that resides in a managed device (the ZyXEL Device). An agent translates the local management information from - ZyXEL P-660HW-T1 v2 | User Guide - Page 201
, (for example, download new files, CI command "sys reboot", etc.). 6b For fatal error: A trap is sent with the message of the fatal code if the system reboots because of fatal errors. 15.6.3 Configuring SNMP To change your ZyXEL Device's SNMP settings, click Advanced > Remote MGMT > SNMP - ZyXEL P-660HW-T1 v2 | User Guide - Page 202
IP address that you specify to access the ZyXEL Device using this service. SNMP Configuration Get Community Enter the Get Community, which is the password for the incoming Get and GetNext requests from the management station. The default is public and allows all requests. Set Community Enter - ZyXEL P-660HW-T1 v2 | User Guide - Page 203
660HW-T v2 User's Guide The following table describes the labels in this screen. Table 81 Remote Management: DNS LABEL DESCRIPTION Port Access Status The DNS service port number is 53. Select the interface(s) through which a computer may send DNS queries to the ZyXEL Device. Secured Client IP - ZyXEL P-660HW-T1 v2 | User Guide - Page 204
device, modify settings, perform firmware upgrades as well as monitor and diagnose the ZyXEL device. All you have to do is enable the device to be managed by CNM Access and specify the CNM Access IP address or domain name and username and password. 204 Chapter 15 Remote Management Configuration - ZyXEL P-660HW-T1 v2 | User Guide - Page 205
v2 User's Guide Follow the procedure below to configure your ZyXEL Device to be managed by CNM Access. See the Command Interpreter appendix for information on the command structure and how to access the CLI (Command Line Interface) on the ZyXEL Device. Note: In this example a.b.c.d is the IP address - ZyXEL P-660HW-T1 v2 | User Guide - Page 206
P-660HW-T v2 User's Guide 206 Chapter 15 Remote Management Configuration - ZyXEL P-660HW-T1 v2 | User Guide - Page 207
P-660HW-T v2 User's Guide CHAPTER 16 Universal Plug-and-Play (UPnP) This chapter introduces the UPnP feature in the web configurator. 16.1 Introducing Universal Plug and Play Universal Plug and Play (UPnP) is a distributed, open networking standard that uses TCP/IP for simple peer-to-peer network - ZyXEL P-660HW-T1 v2 | User Guide - Page 208
P-660HW-T v2 User's Guide 16.1.3 Cautions with UPnP The automated nature of NAT traversal applications in establishing their own services and opening firewall ports may present network security issues. Network information and configuration may also be obtained and modified by users in some network - ZyXEL P-660HW-T1 v2 | User Guide - Page 209
Play (UPnP) Feature a UPnP application to open the web configurator's login screen without entering the ZyXEL Device's IP address (although you must still enter the password to access the web configurator). Allow users to make configuration changes through UPnP Select this check box to allow - ZyXEL P-660HW-T1 v2 | User Guide - Page 210
P-660HW-T v2 User's Guide Figure 117 Add/Remove Programs: Windows Setup: Communication 3 In the Communications window, select the Universal Plug and Play check box in the Components selection box. Figure 118 Add/Remove Programs: Windows Setup: Communication: Components 4 Click OK to go back to the - ZyXEL P-660HW-T1 v2 | User Guide - Page 211
P-660HW-T v2 User's Guide 16.3.2 Installing UPnP in Windows XP Follow the steps below to install the UPnP in Windows XP. 1 Click start and Control Panel. 2 Double-click Network Connections. 3 In the Network Connections window, click Advanced in the main menu and select Optional Networking Components - ZyXEL P-660HW-T1 v2 | User Guide - Page 212
P-660HW-T v2 User's Guide Figure 121 Networking Services 6 Click OK to go back to the Windows Optional Networking Component Wizard window and click Next. 16.4 Using UPnP in Windows XP Example This section shows you how to use the UPnP feature in Windows XP. You must already have - ZyXEL P-660HW-T1 v2 | User Guide - Page 213
Network Connections P-660HW-T v2 User's Guide 3 In the Internet Connection Properties window, click Settings to see the port mappings there were automatically created. Figure 123 Internet Connection Properties 4 You may edit or delete the port mappings or click Add to manually add port mappings - ZyXEL P-660HW-T1 v2 | User Guide - Page 214
P-660HW-T v2 User's Guide Figure 124 Internet Connection Properties: Advanced Settings Figure 125 Internet Connection Properties: Advanced Settings: Add Note: When the UPnP-enabled device is disconnected from your computer, all port mappings will be deleted automatically. 5 Select Show icon in - ZyXEL P-660HW-T1 v2 | User Guide - Page 215
Connection Status P-660HW-T v2 User's Guide 16.4.2 Web Configurator Easy Access With UPnP, you can access the web-based configurator on the ZyXEL Device without finding out the IP address of the ZyXEL Device first. This comes helpful if you do not know the IP address of the ZyXEL Device. Follow - ZyXEL P-660HW-T1 v2 | User Guide - Page 216
P-660HW-T v2 User's Guide Figure 128 Network Connections 4 An icon with the description for each UPnP-enabled device displays under Local Network. 5 Right-click on the icon for your ZyXEL Device and select Invoke. The web configurator login screen displays. 216 Chapter 16 Universal Plug-and-Play - ZyXEL P-660HW-T1 v2 | User Guide - Page 217
Figure 129 Network Connections: My Network Places P-660HW-T v2 User's Guide 6 Right-click on the icon for your ZyXEL Device and select Properties. A properties window displays with basic information about the ZyXEL Device. Figure 130 Network Connections: My Network Places: Properties: Example - ZyXEL P-660HW-T1 v2 | User Guide - Page 218
P-660HW-T v2 User's Guide 218 Chapter 16 Universal Plug-and-Play (UPnP) - ZyXEL P-660HW-T1 v2 | User Guide - Page 219
P-660HW-T v2 User's Guide CHAPTER 17 System Use this screen to configure the ZyXEL Device's time and date settings. 17.1 General Setup 17.1.1 General Setup and System Name General Setup contains administrative and system-related information. System Name is for identification purposes. However, - ZyXEL P-660HW-T1 v2 | User Guide - Page 220
P-660HW-T v2 User's Guide Figure 131 System General Setup The following table describes the labels in this screen. Table 85 System General Setup LABEL General Setup System Name Domain Name Administrator Inactivity Timer Password User Password New Password Retype to Confirm DESCRIPTION Choose a - ZyXEL P-660HW-T1 v2 | User Guide - Page 221
P-660HW-T v2 User's Guide Table 85 System General Setup LABEL DESCRIPTION Admin Password If you log in with the admin password, you can configure the advanced features as well as the wizard setup on the ZyXEL Device. Old Password Type the default admin password (1234) or the existing password - ZyXEL P-660HW-T1 v2 | User Guide - Page 222
in this field and then click Apply. This field displays the last updated date from the time server or the last date configured manually. When you set Time and Date Setup to Manual, enter the new date in this field and then click Apply. Select this radio button to have the ZyXEL Device get the time - ZyXEL P-660HW-T1 v2 | User Guide - Page 223
P-660HW-T v2 User's Guide Table 86 System Time Setting (continued) LABEL Start Date End Date Apply Cancel DESCRIPTION Configure the day and time GMT or UTC (GMT+1). Click Apply to save your changes to the ZyXEL Device. Click Cancel to begin configuring this screen afresh. Chapter 17 System 223 - ZyXEL P-660HW-T1 v2 | User Guide - Page 224
P-660HW-T v2 User's Guide 224 Chapter 17 System - ZyXEL P-660HW-T1 v2 | User Guide - Page 225
P-660HW-T v2 User's Guide CHAPTER 18 Logs This chapter contains information about configuring general log settings and viewing the ZyXEL Device's logs. Refer to the appendix for example log message explanations. 18.1 Logs Overview The web configurator allows you to choose which categories of events - ZyXEL P-660HW-T1 v2 | User Guide - Page 226
incoming packet. This field lists the destination IP address and the port number of the incoming packet. This field displays additional information about the log entry. Click Email Log Now to send the log screen to the e-mail address specified in the Log Settings page (make sure that you have first - ZyXEL P-660HW-T1 v2 | User Guide - Page 227
P-660HW-T v2 User's Guide Alerts are e-mailed as soon as they happen. Logs may be e-mailed as soon as the log is full. Selecting many alert and/or log categories (especially Access Control) may result in many emails being sent. Figure 134 Log Settings The following table describes the fields in - ZyXEL P-660HW-T1 v2 | User Guide - Page 228
P-660HW-T v2 User's Guide Table 88 Log Settings LABEL DESCRIPTION Send Log To The ZyXEL Device sends logs to the e-mail address specified in this field. If this field is left blank, the ZyXEL Device does not send logs via e-mail. Send Alerts To Alerts are real-time notifications that are sent - ZyXEL P-660HW-T1 v2 | User Guide - Page 229
Subject: Firewall Alert From xxxxx Date: Fri, 07 Apr 2000 10:05:42 From: [email protected] To: [email protected] 1|Apr 7 00 |From:192.168.1.1 To:192.168.1.255 |default policy |forward | 09:54:03 |UDP src port:00520 dest port:00520 | | 2|Apr 7 00 |From:192.168.1.131 To:192.168.1.255 - ZyXEL P-660HW-T1 v2 | User Guide - Page 230
P-660HW-T v2 User's Guide Table 89 System Maintenance Logs (continued) LOG MESSAGE DESCRIPTION FTP login failed Someone Configuration Change: PC = 0x%x, Task ID = 0x%x The router is saving configuration changes. Successful SSH login Someone has logged on to the router's SSH server. SSH login - ZyXEL P-660HW-T1 v2 | User Guide - Page 231
-T v2 User's Guide Table 91 Access Control Logs LOG MESSAGE DESCRIPTION Firewall default policy: [TCP | UDP | IGMP | ESP | GRE | OSPF] Attempted TCP/UDP/IGMP/ESP/GRE/OSPF access matched the default policy and was blocked or forwarded according to the default policy's setting - ZyXEL P-660HW-T1 v2 | User Guide - Page 232
P-660HW-T v2 User's Guide Table 92 TCP Reset Logs (continued) LOG MESSAGE Exceed MAX incomplete, sent TCP RST Access block, sent TCP RST DESCRIPTION The router sent a TCP reset packet when the number of incomplete connections (TCP and UDP) exceeded the userconfigured threshold. (Incomplete count - ZyXEL P-660HW-T1 v2 | User Guide - Page 233
P-660HW-T v2 User's Guide Table 95 CDR Logs LOG MESSAGE DESCRIPTION board%d line%d channel%d, call%d,%s C01 Outgoing Call dev=%x ch=%x%s The router received the setup requirements for a call. "call" is the reference (count) number of the call. "dev" is the device type (3 is for dial-up, 6 is - ZyXEL P-660HW-T1 v2 | User Guide - Page 234
P-660HW-T v2 User's Guide Table 98 Content Filtering Logs (continued) LOG MESSAGE DESCRIPTION %s: Contains ActiveX The web site contains ActiveX. %s: Contains Java applet The web site contains a Java applet. %s: Contains cookie The web site contains a cookie. %s: Proxy mode detected The - ZyXEL P-660HW-T1 v2 | User Guide - Page 235
P-660HW-T v2 User's Guide Table 99 Attack Logs (continued) LOG MESSAGE DESCRIPTION ip spoofing - WAN ICMP (type:%d, code:%d) icmp echo: ICMP (type:%d, code:%d) syn flood TCP ports scan TCP teardrop TCP teardrop UDP teardrop ICMP (type:%d, code:%d) illegal command TCP NetBIOS TCP ip spoofing - no - ZyXEL P-660HW-T1 v2 | User Guide - Page 236
P-660HW-T v2 User's Guide Table 101 IKE Logs LOG MESSAGE DESCRIPTION Active connection allowed exceeded The IKE process for a new connection failed because the limit of simultaneous phase 2 SAs has been reached. Start Phase 2: Quick Mode Phase 2 Quick Mode has started. Verifying Remote ID - ZyXEL P-660HW-T1 v2 | User Guide - Page 237
P-660HW-T v2 User's Guide Table 101 IKE Logs (continued) LOG MESSAGE DESCRIPTION Remote IP / conflicts The security gateway is set to "0.0.0.0" and the router used the peer's "Local Address" as the router's "Remote Address". This information conflicted with static rule - ZyXEL P-660HW-T1 v2 | User Guide - Page 238
660HW-T v2 User's Guide mismatch The listed rule's IKE phase 2 perfect forward secret (pfs) setting did not match between the router and the peer IP address and port. The SCEP online certificate enrollment failed. The Destination field records the certification authority server's IP address and port - ZyXEL P-660HW-T1 v2 | User Guide - Page 239
P-660HW-T v2 User's Guide Table 102 PKI Logs (continued) LOG MESSAGE DESCRIPTION Enrollment successful The CMP online certificate enrollment was successful. The Destination field records the certification authority server's IP address and port. Enrollment failed The CMP online certificate - ZyXEL P-660HW-T1 v2 | User Guide - Page 240
660HW-T v2 User's Guide was not valid (CA specific information missing). (Not user database because of an incorrect user password. A user was not authenticated by the local user database because the user is not listed in the local user database. A user was authenticated by the RADIUS Server. A user - ZyXEL P-660HW-T1 v2 | User Guide - Page 241
P-660HW-T v2 User's Guide Table 104 802.1X Logs (continued) LOG MESSAGE DESCRIPTION Local User Database does not support authentication method. The local user database only supports the EAP-MD5 method. A user tried to use another authentication method and was not authenticated. User logout - ZyXEL P-660HW-T1 v2 | User Guide - Page 242
P-660HW-T v2 User's Guide Table 106 ICMP Notes TYPE 0 3 4 5 8 11 12 13 14 15 16 CODE 0 0 1 2 3 4 5 0 0 1 2 3 0 0 1 0 0 0 0 0 DESCRIPTION Echo Reply Echo reply message Destination Unreachable Net unreachable Host unreachable Protocol unreachable Port unreachable A packet that needed fragmentation - ZyXEL P-660HW-T1 v2 | User Guide - Page 243
P-660HW-T v2 User's Guide Table 107 Syslog Logs LOG MESSAGE DESCRIPTION Mon dd hr:mm:ss hostname src="" dst="" msg="" note="" devID="" cat=" "This message is sent by the system ("RAS" - ZyXEL P-660HW-T1 v2 | User Guide - Page 244
P-660HW-T v2 User's Guide 244 Chapter 18 Logs - ZyXEL P-660HW-T1 v2 | User Guide - Page 245
P-660HW-T v2 User's Guide CHAPTER 19 Tools This chapter describes how to upload new firmware, manage configuration and restart your ZyXEL Device. 19.1 Firmware Upgrade Find firmware at www.zyxel.com in a file that (usually) uses the system model name with a .bin extension, for example, "ZyXEL Device - ZyXEL P-660HW-T1 v2 | User Guide - Page 246
P-660HW-T v2 User's Guide Table 109 Firmware Upgrade (continued) LABEL Browse... Upload DESCRIPTION Click Browse... to find the .bin file you want to upload. Remember that you must decompress compressed (.zip) files before you can upload them. Click Upload to begin the upload process. This - ZyXEL P-660HW-T1 v2 | User Guide - Page 247
Message P-660HW-T v2 User's Guide 19.2 Configuration Screen Click Maintenance > Tools > Configuration. Information related to factory defaults, backup configuration, and restoring configuration appears as shown next. Figure 140 Configuration 19.2.1 Backup Configuration Backup configuration allows - ZyXEL P-660HW-T1 v2 | User Guide - Page 248
in the same subnet as that of the default ZyXEL Device IP address (192.168.1.1). See the appendix for details on how to set up your computer's IP address. If the upload was not successful, the following screen will appear. Click Return to go back to the Configuration screen. 248 Chapter 19 Tools - ZyXEL P-660HW-T1 v2 | User Guide - Page 249
660HW-T v2 User's Guide 19.2.3 Back to Factory Defaults Pressing the RESET button in this section clears all user-entered configuration information and returns the ZyXEL Device to its factory defaults. You can also press the RESET button on the rear panel to reset the factory defaults of your ZyXEL - ZyXEL P-660HW-T1 v2 | User Guide - Page 250
P-660HW-T v2 User's Guide 250 Chapter 19 Tools - ZyXEL P-660HW-T1 v2 | User Guide - Page 251
P-660HW-T v2 User's Guide CHAPTER 20 Diagnostic These read-only screens display information to help you identify problems with the ZyXEL Device. 20.1 General Diagnostic Click Maintenance > Diagnostic to open the screen shown next. Figure 145 Diagnostic: General The following table describes the - ZyXEL P-660HW-T1 v2 | User Guide - Page 252
it (loops it back) to the ZyXEL Device. The ATM loopback test is useful for troubleshooting problems with the DSLAM and ATM network. DSL Line Status Click this button to view the DSL port's line operating values and line bit allocation. Reset ADSL Line Click this button to reinitialize the ADSL - ZyXEL P-660HW-T1 v2 | User Guide - Page 253
660HW-T v2 User's Guide CHAPTER 21 Troubleshooting This chapter covers potential problems and the corresponding remedies. 21.1 Problems Starting Up the ZyXEL Device Table 113 Troubleshooting Starting Up Your ZyXEL Device PROBLEM CORRECTIVE ACTION None of the LEDs turn on when I turn on the ZyXEL - ZyXEL P-660HW-T1 v2 | User Guide - Page 254
P-660HW-T v2 User's Guide 21.3 Problems with the WAN Table 115 Troubleshooting the WAN PROBLEM The DSL LED is off. I cannot get a WAN IP address from the ISP. I cannot access the Internet. The Internet connection disconnects. CORRECTIVE ACTION Check the telephone wire and connections between the - ZyXEL P-660HW-T1 v2 | User Guide - Page 255
P-660HW-T v2 User's Guide 21.4 Problems Accessing the ZyXEL Device Table 116 Troubleshooting Accessing the ZyXEL Device PROBLEM CORRECTIVE ACTION I cannot The default user password is "user" and admin password is "1234". The Password access the field is case-sensitive. Make sure that you enter - ZyXEL P-660HW-T1 v2 | User Guide - Page 256
P-660HW-T v2 User's Guide 256 Chapter 21 Troubleshooting - ZyXEL P-660HW-T1 v2 | User Guide - Page 257
P-660HW-T v2 User's Guide APPENDIX A Product Specifications See also the Introduction chapter for a general overview of the key features. Specification Tables Table 117 Device Specifications Default IP Address 192.168.1.1 Default Subnet Mask 255.255.255.0 (24 bits) Default Password 1234 - ZyXEL P-660HW-T1 v2 | User Guide - Page 258
P-660HW-T v2 User's Guide Table 118 Firmware ADSL Standards Other Protocol Support Management Wireless Multi-Mode standard (ANSI T1.413,Issue 2; G.dmt(G.992.1); G.lite(G992.2)). ADSL2 G.dmt.bis (G.992.3) ADSL2 G.lite.bis (G.992.4) ADSL2+ (G.992.5) Reach-Extended ADSL (RE ADSL) SRA (Seamless Rate - ZyXEL P-660HW-T1 v2 | User Guide - Page 259
P-660HW-T v2 User's Guide Table 118 Firmware (continued) Firewall NAT/SUA Content Filtering Static Routes Other Features Stateful Packet Inspection. Prevents Denial of Service attacks such as Ping of Death, SYN Flood, LAND, Smurf etc. Real-time E-mail alerts. Reports and logs. Port Forwarding - ZyXEL P-660HW-T1 v2 | User Guide - Page 260
P-660HW-T v2 User's Guide 260 Appendix A Product Specifications - ZyXEL P-660HW-T1 v2 | User Guide - Page 261
P-660HW-T v2 User's Guide APPENDIX B About ADSL Introduction to DSL DSL (Digital Subscriber Line) services (ADSL) are suitable for Internet users because more information is usually downloaded than uploaded. For example, a simple button click in a web browser can start an extended download that - ZyXEL P-660HW-T1 v2 | User Guide - Page 262
P-660HW-T v2 User's Guide 2 Because your line is dedicated (not shared), transmission speeds between you and the device to which you connect at your service provider are not affected by other users. With cable modems, transmission speeds drop significantly as more users go on-line because the line - ZyXEL P-660HW-T1 v2 | User Guide - Page 263
P-660HW-T v2 User's Guide APPENDIX C Internal SPTGEN This appendix Configuration Text File Format: Column Descriptions / Menu 1 General Setup 10000000 = Configured 10000001 = System Name 10000002 = Location 10000003 = Contact Person's Name 10000004 = Route IP 10000005 = Route IPX 10000006 = Bridge - ZyXEL P-660HW-T1 v2 | User Guide - Page 264
SPTGEN FTP Download Example 1 Launch your FTP application. 2 Enter "bin". The command "bin" sets the transfer mode to binary. 3 Get "rom-t" file. The command "get" transfers files from the ZyXEL Device to your computer. The name "rom-t" is the configuration filename on the ZyXEL Device. 4 Edit - ZyXEL P-660HW-T1 v2 | User Guide - Page 265
P-660HW-T v2 User's Guide Figure 150 Internal SPTGEN FTP Download Example c:\ftp 192.168.1.1 220 PPP FTP version 1.0 ready at Sat Jan 1 03:22:12 2000 User (192.168.1.1:(none)): 331 Enter PASS command Password: 230 Logged in ftp>bin 200 Type I OK ftp> get rom-t ftp>bye c:\edit rom-t (edit the rom-t - ZyXEL P-660HW-T1 v2 | User Guide - Page 266
P-660HW-T v2 User's Guide Example Internal enter * Applies to the ZyXEL Device. Table 120 Menu 1 General Setup / Menu 1 General Setup FIN FN 10000000 = Configured 10000001 = System Name 10000002 = Location 10000003 = Contact Person's Name 10000004 = Route IP 10000006 = Bridge - ZyXEL P-660HW-T1 v2 | User Guide - Page 267
1 (1~12) 30200014 = IP Policies Set 2 (1~12) 30200015 = IP Policies Set 3 (1~12) 30200016 = IP Policies Set 4 (1~12) / Menu 3.2.1 IP Alias Setup FIN FN 30201001 = IP Alias 1 30201002 = 30201003 = 30201004 = IP Address IP Subnet Mask RIP Direction P-660HW-T v2 User's Guide = 256 = 256 - ZyXEL P-660HW-T1 v2 | User Guide - Page 268
P-660HW-T v2 User's Guide Table 121 Menu 3 30201005 = Version 30201006 = 30201007 = 30201008 = 30201009 = 30201010 = 30201011 = 30201012 = 30201013 = 30201014 = 30201015 = 30201016 = 30201017 = IP Alias #1 Incoming protocol filters Set 1 IP Alias #1 Incoming protocol filters Set 2 IP Alias #1 - ZyXEL P-660HW-T1 v2 | User Guide - Page 269
= Wlan 4X Mode */ MENU 3.5.1 WLAN MAC ADDRESS FILTER FIN FN 30501001 = Mac Filter Active 30501002 = Filter Action 30501003 = Address 1 30501004 = Address 2 30501005 = Address 3 Continued 30501034 = ... Address 32 Appendix C Internal SPTGEN P-660HW-T v2 User's Guide PVA INPUT - ZyXEL P-660HW-T1 v2 | User Guide - Page 270
Service Name My Login My Password Single User Account IP Address Assignment IP Address Remote IP address Remote IP subnet mask ISP incoming protocol filter set 1 ISP incoming protocol filter set 2 ISP incoming protocol filter set 3 ISP incoming protocol filter set 4 ISP outgoing protocol filter set - ZyXEL P-660HW-T1 v2 | User Guide - Page 271
P-660HW-T v2 User's Guide = 0 = 0 = 0 Table 123 Menu 12 / Menu 12.1.1 IP Static Route Setup FIN FN 120101001 = IP Static Route set #1, Name - ZyXEL P-660HW-T1 v2 | User Guide - Page 272
660HW-T v2 User's Guide Table 124 Menu 15 SUA Server Setup / Menu 15 SUA Server Setup FIN FN 150000001 = SUA Server IP address for default port 150000002 = SUA Server #2 Active 150000003 = SUA Server #2 Protocol 150000004 = 150000005 = 150000006 = 150000007 = 150000008 = SUA Server #2 Port - ZyXEL P-660HW-T1 v2 | User Guide - Page 273
P-660HW-T v2 User's Guide Table 124 Menu 15 SUA Server Setup (continued) 150000031 = 150000032 = 150000033 = SUA Server #7 Local IP address SUA Server #8 Active SUA Server #8 Protocol 150000034 = 150000035 = 150000036 = 150000037 = 150000038 = SUA Server #8 Port Start SUA Server #8 Port End SUA - ZyXEL P-660HW-T1 v2 | User Guide - Page 274
P-660HW-T v2 User's Guide Table 125 Menu 21.1 Filter Set #1 (continued) 210101002 = IP Filter Set 1,Rule 1 Active = 1 210101003 = IP Filter Set 1,Rule 1 Protocol = 6 210101004 = IP Filter Set 1,Rule 1 Dest IP address = 0.0.0.0 210101005 = IP Filter Set 1,Rule 1 Dest Subnet - ZyXEL P-660HW-T1 v2 | User Guide - Page 275
P-660HW-T v2 User's Guide Table 125 Menu 21.1 Filter Set #1 (continued) 210102013 = IP Filter Set 1,Rule 2 Act Match 210102014 = IP Filter Set 1,Rule 2 Act Not Match Table 126 Menu 21.1 Filer Set #2, / Menu 21 - ZyXEL P-660HW-T1 v2 | User Guide - Page 276
IP Filter Set 2, Rule 2 Act Not Match Table 127 Menu 23 System Menus */ Menu 23.1 System Password Setup FIN FN 230000000 = System Password */ Menu 23.2 System security: radius server FIN FN 230200001 = Authentication Server Configured 230200002 - ZyXEL P-660HW-T1 v2 | User Guide - Page 277
P-660HW-T v2 User's Guide Table 127 Menu 23 System Menus (continued) 230200005 = Authentication Server Shared Secret = 111111111111 111 111111111111 1111 230200006 = Accounting Server Configured = 1 230200007 = Accounting Server Active = 1 230200008 = - ZyXEL P-660HW-T1 v2 | User Guide - Page 278
660HW-T v2 User's Guide Table 128 Menu 24.11 Remote Management Control (continued) 241100002 = 241100003 = 241100004 = 241100005 = 241100006 = 241100007 = 241100008 = 241100009 = TELNET Server Access TELNET Server Secured IP address FTP Server Port FTP Server Access FTP Server Secured IP address - ZyXEL P-660HW-T1 v2 | User Guide - Page 279
P-660HW-T v2 User's Guide APPENDIX D Wall-mounting Instructions Do the following to hang your ZyXEL Device on a wall. Note: See the product specifications appendix for the size of screws to use and how far apart to place them. 1 Locate a high position on wall that is free of obstructions. - ZyXEL P-660HW-T1 v2 | User Guide - Page 280
P-660HW-T v2 User's Guide 280 Appendix D Wall-mounting Instructions - ZyXEL P-660HW-T1 v2 | User Guide - Page 281
, configure the TCP/IP settings in order to "communicate" with your network. If you manually assign IP information instead of using dynamic assignment, make sure that your computers have IP addresses that place them in the same subnet as the ZyXEL Device's LAN port. Windows 95/98/Me Click Start - ZyXEL P-660HW-T1 v2 | User Guide - Page 282
P-660HW-T v2 User's Guide Figure 153 WIndows 95/98/Me: Network: Configuration Installing Components The Network window Configuration tab displays a list of installed components. You need a network adapter, the TCP/IP protocol and Client for Microsoft Networks. If you need the adapter: 1 In the - ZyXEL P-660HW-T1 v2 | User Guide - Page 283
/Me: TCP/IP Properties: IP Address 3 Click the DNS Configuration tab. • If you do not know your DNS information, select Disable DNS. • If you know your DNS information, select Enable DNS and type the information in the fields below (you may not need to fill them all in). Appendix E Setting up Your - ZyXEL P-660HW-T1 v2 | User Guide - Page 284
ZyXEL Device and restart your computer when prompted. Verifying Settings 1 Click Start and then Run. 2 In the Run window, type "winipcfg" and then click OK to open the IP Configuration window. 3 Select your network adapter. You should see your computer's IP address, subnet mask and default gateway - ZyXEL P-660HW-T1 v2 | User Guide - Page 285
Menu P-660HW-T v2 User's Guide 2 In the Control Panel, double-click Network Connections (Network and Dial-up Connections in Windows 2000/NT). Figure 157 Windows XP: Control Panel 3 Right-click Local Area Connection and then click Properties. Appendix E Setting up Your Computer's IP Address 285 - ZyXEL P-660HW-T1 v2 | User Guide - Page 286
P-660HW-T v2 User's Guide Figure 158 Windows XP: Control Panel: Network Connections: Properties 4 Select Internet Protocol (TCP/IP) (under the General tab in Win XP) and then click Properties. Figure 159 Windows XP: Local Area Connection Properties 5 The Internet Protocol TCP/IP Properties window - ZyXEL P-660HW-T1 v2 | User Guide - Page 287
P-660HW-T v2 User's Guide • If you have a static IP address click Use the following IP Address and fill in the IP address, Subnet mask, and Default gateway fields. • Click Advanced. Figure 160 Windows XP: Internet Protocol (TCP/IP) Properties 6 If you do not know your gateway's IP address, remove - ZyXEL P-660HW-T1 v2 | User Guide - Page 288
660HW-T v2 User's Guide Figure 161 Windows XP: Advanced TCP/IP Properties 7 In the Internet Protocol TCP/IP Properties window (the General tab in Windows XP): • Click Obtain DNS server address automatically if you do not know your DNS server IP address(es). • If you know your DNS server IP address - ZyXEL P-660HW-T1 v2 | User Guide - Page 289
press [ENTER]. You can also open Network Connections, right-click a network connection, click Status and then click the Support tab. Macintosh OS 8/9 1 Click the Apple menu, Control Panel and double-click TCP/IP to open the TCP/IP Control Panel. Appendix E Setting up Your Computer's IP Address 289 - ZyXEL P-660HW-T1 v2 | User Guide - Page 290
P-660HW-T v2 User's Guide Figure 163 Macintosh OS 8/9: Apple Menu 2 Select Ethernet built-in from the Connect via list. Figure 164 Macintosh OS 8/9: TCP/IP 3 For dynamically assigned settings, select Using DHCP Server from the Configure: list. 4 For statically assigned settings, do the following: - ZyXEL P-660HW-T1 v2 | User Guide - Page 291
P-660HW-T v2 User's Guide • From the Configure box, select Manually. • Type your IP address in the IP Address box. • Type your subnet mask in the Subnet mask box. • Type the IP address of your ZyXEL Device in the Router address box. 5 Close the TCP/IP Control Panel. 6 Click Save if prompted, to save - ZyXEL P-660HW-T1 v2 | User Guide - Page 292
P-660HW-T v2 User's Guide Figure 166 Macintosh OS X: Network 4 For statically assigned settings, do the following: • From the Configure box, select Manually. • Type your IP address in the IP Address box. • Type your subnet mask in the Subnet mask box. • Type the IP address of your ZyXEL Device in - ZyXEL P-660HW-T1 v2 | User Guide - Page 293
P-660HW-T v2 User's Guide Note: Make sure you are logged in as the root administrator. Using the K Desktop Environment (KDE) Follow the steps below to configure your computer IP address using the KDE. 1 Click the Red Hat button (located on the bottom left corner), select System Setting and click - ZyXEL P-660HW-T1 v2 | User Guide - Page 294
P-660HW-T v2 User's Guide • If you have a static IP address click Statically set IP Addresses and fill in the Address, Subnet mask, and Default Gateway Address fields. 3 Click OK to save the changes and close the Ethernet Device General screen. 4 If you know your DNS server IP address(es), click the - ZyXEL P-660HW-T1 v2 | User Guide - Page 295
P-660HW-T v2 User's Guide • If you have a dynamic IP address, enter dhcp in the BOOTPROTO= field. The following figure shows an example. Figure 171 Red Hat 9.0: Dynamic IP Address Setting in ifconfig-eth0 DEVICE=eth0 ONBOOT=yes BOOTPROTO=dhcp USERCTL=no PEERDNS=yes TYPE=Ethernet • If you have a - ZyXEL P-660HW-T1 v2 | User Guide - Page 296
P-660HW-T v2 User's Guide Figure 174 Red Hat 9.0: Restart Ethernet Card [root@localhost init.d]# network restart Shutting down interface eth0: Shutting down loopback interface: Setting network parameters: Bringing up loopback interface: Bringing up interface eth0: [OK] [OK] [OK] [OK] [OK] - ZyXEL P-660HW-T1 v2 | User Guide - Page 297
P-660HW-T v2 User's Guide APPENDIX F IP Subnetting This appendix introduces addresses, IP address classes and subnet masks. Introduction to IP Addresses An IP address is made up of four octets, written in dotted decimal notation (for example, 192.168.1.1). An octet is an 8-digit binary number. - ZyXEL P-660HW-T1 v2 | User Guide - Page 298
P-660HW-T v2 User's Guide A class A address (3 host octets: 24 host bits) can have 224 - 2 hosts, or approximately 16 million hosts. IP Address Classes and Network ID The value of the first octet of an IP address determines the class of an address. • Class A addresses have a 0 in the leftmost bit - ZyXEL P-660HW-T1 v2 | User Guide - Page 299
Table 132 "Natural" Masks (continued) CLASS B C NATURAL MASK 255.255.0.0 255.255.255.0 P-660HW-T v2 User's Guide Subnetting With subnetting, the class arrangement of an IP address is ignored. For example, a class C address no longer has to have 24 bits of network number and 8 bits of host ID. - ZyXEL P-660HW-T1 v2 | User Guide - Page 300
P-660HW-T v2 User's Guide Example: Two Subnets As an example, you have a class "C" address 192.168.1.0 with subnet mask of 255.255.255.0. Table 134 Two Subnets Example IP/SUBNET MASK IP Address IP Address (Binary) Subnet Mask Subnet Mask (Binary) NETWORK NUMBER 192.168.1. 11000000.10101000. - ZyXEL P-660HW-T1 v2 | User Guide - Page 301
P-660HW-T v2 User's Guide Table 136 Subnet 2 (continued) IP/SUBNET MASK Subnet Address: 192.168.1.128 Broadcast Address: 192.168.1.255 LAST OCTET BIT VALUE 0 00000000 11000000 Table 138 Subnet 2 IP/SUBNET MASK IP Address IP Address (Binary) Subnet Mask (Binary) NETWORK NUMBER 192.168.1. 11000000 - ZyXEL P-660HW-T1 v2 | User Guide - Page 302
P-660HW-T v2 User's Guide Table 138 Subnet 2 (continued) IP/SUBNET MASK NETWORK NUMBER Subnet Address: 192.168.1.64 Lowest Host ID: 192.168.1.65 Broadcast Address: 192.168.1.127 Highest Host ID: 192.168.1.126 LAST OCTET BIT VALUE Table 139 Subnet 3 IP/SUBNET MASK IP Address IP Address ( - ZyXEL P-660HW-T1 v2 | User Guide - Page 303
P-660HW-T v2 User's Guide Table 141 Eight Subnets (continued) SUBNET 5 6 7 8 SUBNET ADDRESS FIRST ADDRESS 128 129 160 161 192 193 224 225 LAST ADDRESS BROADCAST ADDRESS 158 159 190 191 32 64 128 NO. HOSTS PER SUBNET 32766 16382 8190 4094 2046 1022 510 Appendix F IP Subnetting 303 - ZyXEL P-660HW-T1 v2 | User Guide - Page 304
P-660HW-T v2 User's Guide Table 143 Class B Subnet Planning (continued) NO. "BORROWED" HOST BITS SUBNET MASK 8 255.255.255.0 (/24) 9 255.255.255.128 (/25) 10 (/31) NO. SUBNETS 256 512 1024 2048 4096 8192 16384 32768 NO. HOSTS PER SUBNET 254 126 62 30 14 6 2 1 304 Appendix F IP Subnetting - ZyXEL P-660HW-T1 v2 | User Guide - Page 305
your computer IP address and the ZyXEL Device IP address are on the same subnet. In Windows, click Start (usually in the bottom left corner), Run and then type telnet 192.168.1.1 (the default ZyXEL Device IP address) and click OK. 3 A login screen displays. Enter the default admin password "1234 - ZyXEL P-660HW-T1 v2 | User Guide - Page 306
P-660HW-T v2 User's Guide Log Commands This section provides some general examples of how to use the log commands. The items that display with your device may vary but the basic function should be the same. Go to the command interpreter interface. Configuring What You Want the ZyXEL Device to Log 1 - ZyXEL P-660HW-T1 v2 | User Guide - Page 307
P-660HW-T v2 User's Guide • Use the sys logs category display command to show the log settings for all of the log categories. • Use the sys logs display [log category] command to show the logs in an individual ZyXEL Device log category. • Use the sys logs clear command to erase all of the ZyXEL - ZyXEL P-660HW-T1 v2 | User Guide - Page 308
P-660HW-T v2 User's Guide 308 Appendix G Command Interpreter - ZyXEL P-660HW-T1 v2 | User Guide - Page 309
P-660HW-T v2 User's Guide APPENDIX H Firewall Commands The following describes the firewall commands. Table 144 Firewall Commands FUNCTION Firewall SetUp COMMAND DESCRIPTION config edit firewall active This command turns the firewall on or off. config retrieve firewall This - ZyXEL P-660HW-T1 v2 | User Guide - Page 310
660HW-T v2 User's Guide Table 144 Firewall Commands (continued) FUNCTION E-mail COMMAND config edit firewall e-mail mail-server DESCRIPTION This command sets the IP address to which the e-mail messages are sent. config edit firewall e-mail return-addr - ZyXEL P-660HW-T1 v2 | User Guide - Page 311
P-660HW-T v2 User's Guide Table 144 Firewall Commands (continued) FUNCTION COMMAND config edit firewall attack minute-high DESCRIPTION This command sets the threshold rate of new half-open sessions per minute where the ZyXEL Device starts deleting old half-opened sessions until it gets - ZyXEL P-660HW-T1 v2 | User Guide - Page 312
P-660HW-T v2 User's Guide Table 144 Firewall Commands (continued) FUNCTION COMMAND DESCRIPTION Config edit firewall set tcp-idle-timeout This command sets how long ZyXEL Device lets an inactive TCP connection remain open before considering it closed. Rules Config edit - ZyXEL P-660HW-T1 v2 | User Guide - Page 313
P-660HW-T v2 User's Guide Table 144 Firewall Commands (continued) FUNCTION COMMAND config edit firewall set rule destaddrsingle DESCRIPTION This command sets the rule to have the ZyXEL Device check for traffic with this individual destination address. config edit - ZyXEL P-660HW-T1 v2 | User Guide - Page 314
P-660HW-T v2 User's Guide Table 144 Firewall Commands (continued) FUNCTION COMMAND config delete firewall set rule DESCRIPTION This command removes the specified rule in a firewall configuration set. 314 Appendix H Firewall Commands - ZyXEL P-660HW-T1 v2 | User Guide - Page 315
660HW-T v2 User's Guide APPENDIX I NetBIOS Filter Commands The following describes the NetBIOS packet filter commands. Introduction NetBIOS (Network Basic Input/Output System) are TCP or UDP broadcast packets that enable a computer to connect to and communicate with a LAN. For some dial-up services - ZyXEL P-660HW-T1 v2 | User Guide - Page 316
P-660HW-T v2 User's Guide The filter types and their default settings are as follows. Table 145 NetBIOS Filter Default Settings NAME DESCRIPTION EXAMPLE Between LAN This field displays whether NetBIOS packets are blocked or forwarded Block and WAN between the LAN and the WAN. IPSec Packets - ZyXEL P-660HW-T1 v2 | User Guide - Page 317
P-660HW-T v2 User's Guide APPENDIX J Splitters and Microfilters This appendix tells you how to install a POTS splitter or a telephone microfilter. Connecting a POTS Splitter When you use the Full Rate (G.dmt) ADSL standard, you can use a POTS (Plain Old Telephone Service) splitter to separate the - ZyXEL P-660HW-T1 v2 | User Guide - Page 318
P-660HW-T v2 User's Guide 2 Connect a cable from the wall jack to the "wall side" of the side" of the microfilter. 3 Connect another cable from the double jack end of the Y-Connector to the ZyXEL Device. 4 Connect the "phone side" of the microfilter to your telephone as shown in the following figure - ZyXEL P-660HW-T1 v2 | User Guide - Page 319
P-660HW-T v2 User's Guide ZyXEL Device With ISDN This section relates to people who use their ZyXEL Device with ADSL over ISDN (digital telephone service) only. The following is an example installation for the ZyXEL Device with ISDN. Figure 181 ZyXEL Device with ISDN Appendix J Splitters and - ZyXEL P-660HW-T1 v2 | User Guide - Page 320
P-660HW-T v2 User's Guide 320 Appendix J Splitters and Microfilters - ZyXEL P-660HW-T1 v2 | User Guide - Page 321
660HW-T v2 User's Guide APPENDIX K Wireless LANs Wireless LAN Topologies This section discusses ad-hoc and infrastructure wireless LAN topologies. Ad-hoc Wireless LAN Configuration The simplest WLAN configuration is an independent (Ad-hoc) WLAN that connects a set A Basic Service Set (BSS) exists - ZyXEL P-660HW-T1 v2 | User Guide - Page 322
P-660HW-T v2 User's Guide Figure 183 Basic Service Set ESS An Extended Service Set (ESS) consists of a series of overlapping BSSs, each containing an access point, with each access point connected together by a wired network. This wired connection between - ZyXEL P-660HW-T1 v2 | User Guide - Page 323
Figure 184 Infrastructure WLAN P-660HW-T v2 User's Guide Channel IEEE802.11a/b/g wireless devices operate in the 2.4GHz radio band. This range of frequencies is divided up into channels.The channels available depend on - ZyXEL P-660HW-T1 v2 | User Guide - Page 324
660HW-T v2 User's Guide Figure 185 RTS/CTS When station A sends data to the AP, it might not know that the station B is already using the channel. If these two stations send data at the same time, collisions may occur when both sets ) handshake. You should only configure RTS/CTS if the possibility - ZyXEL P-660HW-T1 v2 | User Guide - Page 325
P-660HW-T v2 User's Guide A large Fragmentation Threshold is recommended for networks not prone to interference while you should set a smaller threshold support long preamble, but not all support short preamble. Select Long preamble if you are unsure what preamble mode the wireless adapters support, - ZyXEL P-660HW-T1 v2 | User Guide - Page 326
P-660HW-T v2 User's Guide Wireless Security Overview Wireless security is vital to your network to protect wireless communication between wireless clients, access points and the wired network. Wireless security methods available on the ZyXEL Device are data encryption, wireless client - ZyXEL P-660HW-T1 v2 | User Guide - Page 327
660HW-T v2 User's Guide Types of RADIUS Messages The following types of RADIUS messages are exchanged between the access point and the RADIUS server for user sent over the network. In addition to the shared key, password information exchanged is also encrypted to protect the network from unauthorized - ZyXEL P-660HW-T1 v2 | User Guide - Page 328
P-660HW-T v2 User's Guide EAP-MD5 (Message-Digest Algorithm 5) MD5 authentication is the simplest one-way authentication method. The authentication server sends a challenge to the wireless client. The wireless client 'proves' that it knows the password by encrypting the password with the challenge - ZyXEL P-660HW-T1 v2 | User Guide - Page 329
660HW-T v2 User's Guide it is not necessary to configure a default encryption key in the Wireless screen. You may still configure and store keys here, but a single (identical) password entered into each access point, wireless gateway and wireless client. As long as the passwords match, a wireless - ZyXEL P-660HW-T1 v2 | User Guide - Page 330
P-660HW-T v2 User's Guide Select WEP only when the AP and/or wireless clients do not support WPA or WPA2. WEP is less PSK uses a simple common password, instead of user-specific credentials. The common-password approach makes WPA(2)-PSK susceptible to brute-force password-guessing attacks but it's - ZyXEL P-660HW-T1 v2 | User Guide - Page 331
660HW-T v2 User's Guide User supported download that adds WPA capability to Windows XP's builtin "Zero Configuration" wireless client. However, you must run Windows XP to use it. WPA(2) with RADIUS Application Example You need the IP address of the RADIUS server, its port number (default then sets up - ZyXEL P-660HW-T1 v2 | User Guide - Page 332
P-660HW-T v2 User's Guide Figure 186 WPA(2) with RADIUS Application Example WPA(2)-PSK Application Example A WPA(2)-PSK application looks as follows. 1 First enter identical passwords into the AP and all wireless clients. The Pre-Shared Key (PSK) must consist of between 8 and 63 ASCII characters or - ZyXEL P-660HW-T1 v2 | User Guide - Page 333
P-660HW-T v2 User's Guide Security Parameters Summary Refer to this table to see what other security parameters you should configure for each Authentication Method/ key management protocol type. MAC address filters are not dependent on how you configure these security features. Table 149 Wireless - ZyXEL P-660HW-T1 v2 | User Guide - Page 334
P-660HW-T v2 User's Guide 334 Appendix K Wireless LANs - ZyXEL P-660HW-T1 v2 | User Guide - Page 335
P-660HW-T v2 User's Guide APPENDIX L Pop-up Windows, JavaScripts and Java Permissions In order to use the web configurator you need to allow: • Web browser pop-up windows from your device. • JavaScripts (enabled by default). • Java permissions (enabled by default). Note: Internet Explorer 6 screens - ZyXEL P-660HW-T1 v2 | User Guide - Page 336
P-660HW-T v2 User's Guide Figure 189 Internet Options 3 Click Apply to save this setting. Enable pop-up Blockers with Exceptions Alternatively, if you only want to allow pop-up windows from your device, see the following steps. 1 In Internet - ZyXEL P-660HW-T1 v2 | User Guide - Page 337
Figure 190 Internet Options (2) P-660HW-T v2 User's Guide 3 Type the IP address of your device (the web page that you do not want to have blocked) with the prefix "http://". For example, http://192.168.1.1. 4 Click Add to move the IP address to the list of Allowed sites. Appendix L Pop-up Windows - ZyXEL P-660HW-T1 v2 | User Guide - Page 338
660HW-T v2 User's Guide Figure 191 Pop-up Blocker Settings 5 Click Close to return to the Privacy screen. 6 Click Apply to save this setting. JavaScripts If pages of the web configurator do not display properly in Internet Explorer, check that JavaScripts are allowed. 1 In Internet Explorer, click - ZyXEL P-660HW-T1 v2 | User Guide - Page 339
192 Internet Options (3) P-660HW-T v2 User's Guide 2 Click the Custom Level... button. 3 Scroll down to Scripting. 4 Under Active scripting make sure that Enable is selected (the default). 5 Under Scripting of Java applets make sure that Enable is selected (the default). 6 Click OK to close the - ZyXEL P-660HW-T1 v2 | User Guide - Page 340
P-660HW-T v2 User's Guide Figure 193 Security Settings - Java Scripting Java Permissions 1 From Internet Explorer, click Tools, Internet Options and then the Security tab. 2 Click the Custom Level... button. 3 Scroll down to Microsoft VM. 4 Under Java permissions make sure that a safety level is - ZyXEL P-660HW-T1 v2 | User Guide - Page 341
Figure 194 Security Settings - Java P-660HW-T v2 User's Guide JAVA (Sun) 1 From Internet Explorer, click Tools, Internet Options and then the Advanced tab. 2 make sure that Use Java 2 for under Java (Sun) is selected. 3 Click OK to close the window. Appendix L Pop-up Windows, JavaScripts - ZyXEL P-660HW-T1 v2 | User Guide - Page 342
P-660HW-T v2 User's Guide Figure 195 Java (Sun) 342 Appendix L Pop-up Windows, JavaScripts and Java Permissions - ZyXEL P-660HW-T1 v2 | User Guide - Page 343
P-660HW-T v2 User's Guide APPENDIX M Triangle Route The Ideal Setup When the firewall is on, your ZyXEL Device acts as a secure gateway between your LAN and the Internet. In an ideal network topology, all incoming and outgoing network traffic passes through the ZyXEL Device to protect your LAN - ZyXEL P-660HW-T1 v2 | User Guide - Page 344
-T v2 User's Guide Figure 197 "Triangle Route" Problem The "Triangle Route" Solutions This section presents you two solutions to the "triangle route" problem. IP Aliasing IP alias allows you to partition your network into logical sections over the same Ethernet interface. Your ZyXEL Device supports - ZyXEL P-660HW-T1 v2 | User Guide - Page 345
225 Index P-660HW-T v2 User's Guide Index auto-negotiating 258 auxiliary gateway 34 B backup 247 backup gateway 34 backup settings 247 backup type 91 bandwidth 35, 69, 259 budget 186 bandwidth management 69, 179 bandwidth manager class configuration 185 monitor 189 summary 184 basic service set see - ZyXEL P-660HW-T1 v2 | User Guide - Page 346
custom ports creating / editing 159 customer support 9 customized services 158 D data rate 33 date and time settings 221 dedicated circuit 261 default 249 default gateway 35 default LAN IP address 41 default settings 247, 248 defaults 257 Denial of Service see DoS destination address 151 detection - ZyXEL P-660HW-T1 v2 | User Guide - Page 347
ramifications 150 services 163 types 137 when to use 148 firmware 33, 245 upgrade 31, 245 upload 245 upload error 246 four-port switch 36 fragmentation threshold 324 FTP 69, 130, 195, 198 restrictions 195 full rate 317 G global products 31 graphics key 32 Index P-660HW-T v2 User's Guide H half-open - ZyXEL P-660HW-T1 v2 | User Guide - Page 348
v2 User's Guide IP alias 36 IP pool 119 setup 112 IP protocol type 163 IP spoofing 140, 143 ISDN 33 IV 330 L LAN 36 LAN setup 111 LAN TCP/IP 113 LAN to WAN rules 152 LAND 140, 141 local (user) database 95 and encryption 96 Local Area Network see LAN logical network 36 logs 225 alerts 225 configuring - ZyXEL P-660HW-T1 v2 | User Guide - Page 349
P-660HW-T v2 User's Guide RADIUS messages 327 RADIUS server 95 reboot 249 registration 31 product 8 related documentation 31 relay 35 remote management 258 remote management and NAT 196 remote management limitations 195 Request To Send see RTS reset 249 reset button 43 resetting the ZyXEL device - ZyXEL P-660HW-T1 v2 | User Guide - Page 350
P-660HW-T v2 User's Guide security general 146 parameters 333 ramifications 150 Server 128 server 35, 127, 128, 222 service 151 service set 97 Service Set IDentity See SSID service type 159, 254 services 130 settings backup 247 defaults 247 restore 248 setup, general 219 Single User Account see SUA - ZyXEL P-660HW-T1 v2 | User Guide - Page 351
Virtual Path Identifier see VPI Voice over IP see VoIP VoIP 69, 70 VPI 34, 77 W wall-mounting 257, 279 WAN 75 backup 90 WAN setup 75 WAN to LAN rules 152 warranty 8 note 8 web configurator 31, 41, 43, 44, 146, 151 screen summary 44 Index P-660HW-T v2 User's Guide WEP 37, 98 encryption 100 Wide Area
-
1 -
2 -
3 -
4 -
5 -
6 -
7 -
8
-
9
-
10
-
11
-
12
-
13
-
14
-
15
-
16
-
17
-
18
-
19
-
20
-
21
-
22
-
23
-
24
-
25
-
26
-
27
-
28
-
29
-
30
-
31
-
32
-
33
-
34
-
35
-
36
-
37
-
38
-
39
-
40
-
41
-
42
-
43
-
44
-
45
-
46
-
47
-
48
-
49
-
50
-
51
-
52
-
53
-
54
-
55
-
56
-
57
-
58
-
59
-
60
-
61
-
62
-
63
-
64
-
65
-
66
-
67
-
68
-
69
-
70
-
71
-
72
-
73
-
74
-
75
-
76
-
77
-
78
-
79
-
80
-
81
-
82
-
83
-
84
-
85
-
86
-
87
-
88
-
89
-
90
-
91
-
92
-
93
-
94
-
95
-
96
-
97
-
98
-
99
-
100
-
101
-
102
-
103
-
104
-
105
-
106
-
107
-
108
-
109
-
110
-
111
-
112
-
113
-
114
-
115
-
116
-
117
-
118
-
119
-
120
-
121
-
122
-
123
-
124
-
125
-
126
-
127
-
128
-
129
-
130
-
131
-
132
-
133
-
134
-
135
-
136
-
137
-
138
-
139
-
140
-
141
-
142
-
143
-
144
-
145
-
146
-
147
-
148
-
149
-
150
-
151
-
152
-
153
-
154
-
155
-
156
-
157
-
158
-
159
-
160
-
161
-
162
-
163
-
164
-
165
-
166
-
167
-
168
-
169
-
170
-
171
-
172
-
173
-
174
-
175
-
176
-
177
-
178
-
179
-
180
-
181
-
182
-
183
-
184
-
185
-
186
-
187
-
188
-
189
-
190
-
191
-
192
-
193
-
194
-
195
-
196
-
197
-
198
-
199
-
200
-
201
-
202
-
203
-
204
-
205
-
206
-
207
-
208
-
209
-
210
-
211
-
212
-
213
-
214
-
215
-
216
-
217
-
218
-
219
-
220
-
221
-
222
-
223
-
224
-
225
-
226
-
227
-
228
-
229
-
230
-
231
-
232
-
233
-
234
-
235
-
236
-
237
-
238
-
239
-
240
-
241
-
242
-
243
-
244
-
245
-
246
-
247
-
248
-
249
-
250
-
251
-
252
-
253
-
254
-
255
-
256
-
257
-
258
-
259
-
260
-
261
-
262
-
263
-
264
-
265
-
266
-
267
-
268
-
269
-
270
-
271
-
272
-
273
-
274
-
275
-
276
-
277
-
278
-
279
-
280
-
281
-
282
-
283
-
284
-
285
-
286
-
287
-
288
-
289
-
290
-
291
-
292
-
293
-
294
-
295
-
296
-
297
-
298
-
299
-
300
-
301
-
302
-
303
-
304
-
305
-
306
-
307
-
308
-
309
-
310
-
311
-
312
-
313
-
314
-
315
-
316
-
317
-
318
-
319
-
320
-
321
-
322
-
323
-
324
-
325
-
326
-
327
-
328
-
329
-
330
-
331
-
332
-
333
-
334
-
335
-
336
-
337
-
338
-
339
-
340
-
341
-
342
-
343
-
344
-
345
-
346
-
347
-
348
-
349
-
350
-
351
 |
 |
P-660HW-T v2
802.11g Wireless ADSL 2+ 4-port Gateway
User’s Guide
Version 3.40
Edition 1
12
/2006