Home » ZyXEL Manuals » Networking » ZyXEL ZYWALL USG 100 » Manual Viewer

ZyXEL ZYWALL USG 100 User Guide - Page 34

What Can Go Wrong?, 2.6 How to Set Up an IPv6 6to4 Tunnel, 2.6.1 Configuration Concept

Get ZyXEL ZYWALL USG 100 PDF manuals and user guides

View all ZyXEL ZYWALL USG 100 manuals

Add to My Manuals
Save this manual to your list of manuals

Page 34 highlights

Chapter 2 How to Set Up Your Network 2.5.7 What Can Go Wrong? 1 If you forgot to enable Auto-Configuration on the WAN1 IPv6 interface, you will not have any default route to forward the LAN's IPv6 packets. 2 To use prefix delegation, you must set the WAN interface to a DHCPv6 client, enable router advertisements on the LAN interface as well as configure the Advertised Prefix from DHCPv6 Prefix Delegation table. 3 If the Value field in the WAN1's DHCPv6 Request Options table displays n/a, contact your ISP for further support. 4 In Windows, some IPv6 related tunnels may be enabled by default such as Teredo and 6to4 tunnels. It may cause your computer to handle IPv6 packets in an unexpected way. It is recommended to disable those tunnels on your computer. 2.6 How to Set Up an IPv6 6to4 Tunnel This example shows how to use the interface configuration screens to create the following 6to4 tunnel. Figure 22 6to4 Tunnel Example LAN Z WAN IPv6 IPv4 2002:7a64:dcee:1::111/128 2002:7a64:dcee:1::/64 122.100.220.238 R 192.99.88.1 In this example, the ZyWALL (Z) acts as a 6to4 router which connects the IPv4 Internet (through WAN1 with an IP address of 122.100.220.238) and an IPv6 intranet network. In the 6to4 tunnel application, you must configure the LAN1 with an IP address starting with 2002:7a64:dcee::/48 if you decide to use the WAN1 IP address to forward 6to4 packets to the IPv4 network. The second and third sets of 16-bit IP address from the left must be converted from 122.100.220.238. It becomes 7a64:dcee in hexadecimal. You are free to use the fourth set of 16-bit IP address from the left in order to allocate different network addresses (prefixes) to IPv6 interfaces. In this example, the LAN1 network address is assigned to use 2002:7a64:dcee:1::/64 and the LAN1 IP address is set to 2002:7a64:dcee:1::111/128. A relay router R (192.99.88.1) is used in this example in order to forward 6to4 packets to any unknown IPv6 addresses. 2.6.1 Configuration Concept After the 6to4 tunnel settings are complete, IPv4 and IPv6 packets transmitted between WAN1 and LAN1 will be handled by the ZyWALL through the following flow. 34 ZyWALL USG100-PLUS User's Guide

Section	Page
ZyWALL USG100-PLUS	1
Videos	2
Contents	3
Introduction	5
1.1 Overview	5
1.2 Default Zones, Interfaces, and Ports	7
1.3 Management Overview	7
1.4 Web Configurator	8
1.4.1 Web Configurator Access	9
1.4.2 Web Configurator Introduction Video	10
1.4.3 Web Configurator Screens Overview	11
1.4.4 Navigation Panel	11
1.4.5 Tables and Lists	16
1.5 Stopping the ZyWALL	19
1.6 Rack-mounting	19
1.7 Front Panel	20
1.7.1 Front Panel LEDs	20
How to Set Up Your Network	21
2.1 Wizard Overview	21
2.2 How to Configure Interfaces, Port Roles, and Zones	21
2.2.1 Configure a WAN Ethernet Interface	22
2.2.2 Configure Port Roles	23
2.2.3 Configure Zones	23
2.3 How to Configure a Cellular Interface	24
2.4 How to Configure Ethernet, PPP, VLAN, Bridge and Policy Routing	26
2.5 How to Set Up IPv6 Interfaces For Pure IPv6 Routing	27
2.5.1 Setting Up the WAN IPv6 Interface	27
2.5.2 Setting Up the LAN Interface	28
2.5.3 Pure IPv6 Routing Video Example	29
2.5.4 Prefix Delegation and Router Advertisement Settings	29
2.5.5 Test	32
2.5.6 Prefix Delegation and Router Advertisement Settings Video Example	33
2.5.7 What Can Go Wrong?	34
2.6 How to Set Up an IPv6 6to4 Tunnel	34
2.6.1 Configuration Concept	34
2.6.2 Setting Up the LAN IPv6 Interface	35
2.6.3 Setting Up the 6to4 Tunnel	36
2.6.4 Testing the 6to4 Tunnel	36
2.6.5 Set Up an IPv6 6to4 Tunnel Video Example	37
2.6.6 What Can Go Wrong?	37
2.7 How to Set Up an IPv6-in-IPv4 Tunnel	38
2.7.1 Configuration Concept	38
2.7.2 Setting Up the IPv6-in-IPv4 Tunnel	38
2.7.3 Setting Up the LAN IPv6 Interface	39
2.7.4 Setting Up the Policy Route	40
2.7.5 Testing the IPv6-in-IPv4 Tunnel	41
2.7.6 Set Up an IPv6-in-IPv4 Tunnel Video Example	42
2.7.7 What Can Go Wrong?	42
Protecting Your Network	45
3.1 Firewall	45
3.1.1 What Can Go Wrong	46
3.2 User-aware Access Control	46
3.2.1 What Can Go Wrong	46
3.3 Endpoint Security (EPS)	47
3.3.1 What Can Go Wrong	47
3.4 Device and Service Registration	47
3.5 Anti-Virus Policy Configuration	48
3.5.1 What Can Go Wrong	49
3.6 IDP Profile Configuration	50
3.6.1 Procedure To Create a New Profile	50
3.7 ADP Profile Configuration	51
3.7.1 Procedure To Create a New ADP Profile	51
3.8 Content Filter Profile Configuration	54
3.8.1 Content Filtering Video Example	56
3.9 Viewing Content Filter Reports	56
3.10 Anti-Spam Policy Configuration	60
Create Secure Connections Across the Internet	63
4.1 IPSec VPN	63
4.1.1 Test the VPN Connection	63
4.1.2 Configure Security Policies for the VPN Tunnel	63
4.1.3 What Can Go Wrong	64
4.2 VPN Concentrator Example	65
4.2.1 What Can Go Wrong	67
4.3 Hub-and-spoke IPSec VPN Without VPN Concentrator	67
4.3.1 What Can Go Wrong	68
4.4 ZyWALL IPSec VPN Client Configuration Provisioning	69
4.4.1 Overview of What to Do	69
4.4.2 Configuration Steps	70
4.4.3 ZyWALL IPSec VPN Client Configuration Provisioning Video Example	72
4.4.4 What Can Go Wrong	72
4.5 SSL VPN	73
4.5.1 SSL VPN Video Example	74
4.5.2 What Can Go Wrong	74
4.6 L2TP VPN with Android, iOS, and Windows	75
4.6.1 L2TP VPN Example	75
4.6.2 Configuring Policy Routing	77
4.6.3 Configuring L2TP VPN on the ZyWALL Video Example	80
4.6.4 Configuring L2TP VPN in Android	80
4.6.5 Configuring L2TP VPN in iOS	81
4.6.6 Configuring L2TP VPN in Windows	81
4.6.7 What Can Go Wrong	90
4.7 One-Time Password Version 2 (OTPv2)	90
4.7.1 What Can Go Wrong	91
Managing Traffic	93
5.1 How to Configure Bandwidth Management	93
5.1.1 Bandwidth Allocation Example	94
5.1.2 Setting the Interface’s Bandwidth	94
5.1.3 SIP Bandwidth Management	94
5.1.4 SIP Any-to-WAN and WAN-to-Any Bandwidth Management Example	94
5.1.5 HTTP Any-to-WAN Bandwidth Management Example	95
5.1.6 FTP WAN-to-DMZ Bandwidth Management Example	97
5.1.7 FTP LAN-to-DMZ Bandwidth Management Example	98
5.1.8 Bandwidth Management Video Example	100
5.1.9 What Can Go Wrong?	100
5.2 How to Configure a Trunk for WAN Load Balancing	100
5.2.1 Set Up Available Bandwidth on Ethernet Interfaces	101
5.2.2 Configure the WAN Trunk	102
5.3 How to Use Multiple Static Public WAN IP Addresses for LAN-to-WAN Traffic	103
5.3.1 Create the Public IP Address Range Object	103
5.3.2 Configure the Policy Route	104
5.4 How to Configure DNS Inbound Load Balancing	104
5.4.1 What Can Go Wrong?	105
5.5 How to Allow Public Access to a Web Server	106
5.5.1 Configure NAT	106
5.5.2 Set Up a Firewall Rule	107
5.5.3 What Can Go Wrong	108
5.6 How to Manage Voice Traffic	108
5.6.1 How to Allow Incoming H.323 Peer-to-peer Calls	108
5.6.2 How to Use an IPPBX on the DMZ	110
5.6.3 What Can Go Wrong	112
5.7 How to Limit Web Surfing and MSN to Specific People	113
5.7.1 Set Up Web Surfing Policies	113
5.7.2 Set Up MSN Policies	114
5.7.3 AppPatrol Video Example	117
5.7.4 What Can Go Wrong	117
Maintenance	119
6.1 How to Allow Management Service from WAN	119
6.1.1 Check Service Control	119
6.1.2 Check Firewall Settings	120
6.2 How to Use a RADIUS Server to Authenticate User Accounts based on Groups	122
6.3 How to Use SSH for Secure Telnet Access	123
6.3.1 Example 1: Microsoft Windows	123
6.3.2 Example 2: Linux	124
6.4 How to Manage ZyWALL Configuration Files	124
6.4.1 What Can Go Wrong	125
6.5 How to Manage ZyWALL Firmware	125
6.5.1 What Can Go Wrong	126
6.6 How to Download and Upload a Shell Script	126
6.6.1 What Can Go Wrong	127
6.7 How to Save System Logs to a USB Storage Device	127
6.7.1 What Can Go Wrong?	130
6.8 How to Get the ZyWALL’s Diagnostic File	130
6.9 How to Capture Packets on the ZyWALL	131
6.9.1 Example of Viewing a Packet Capture (CAP) File	133
6.10 How to Get the ZyWALL’s Core Dump File	134
6.11 How to Use Packet Flow Explore for Troubleshooting	135

Match case Limit results 1 per page

Chapter 2 How to Set Up Your Network

ZyWALL USG100-PLUS User’s Guide

2.5.7

What Can Go Wrong?

If you forgot to enable

Auto-Configuration

on the WAN1 IPv6 interface, you will not have any

default route to forward the LAN’s IPv6 packets.

To use prefix delegation, you must set the WAN interface to a DHCPv6 client, enable router

advertisements on the LAN interface as well as configure the

Advertised Prefix from DHCPv6

Prefix Delegation

table.

If the

Value

field in the WAN1’s

DHCPv6 Request Options

table displays

n/a

, contact your ISP

for further support.

In Windows, some IPv6 related tunnels may be enabled by default such as Teredo and 6to4

tunnels. It may cause your computer to handle IPv6 packets in an unexpected way. It is

recommended to disable those tunnels on your computer.

2.6

How to Set Up an IPv6 6to4 Tunnel

This example shows how to use the interface configuration screens to create the following 6to4

tunnel.

Figure 22

6to4 Tunnel Example

In this example, the ZyWALL (

) acts as a 6to4 router which connects the IPv4 Internet (through

WAN1 with an IP address of 122.100.220.238) and an IPv6 intranet network. In the 6to4 tunnel

application, you must configure the LAN1 with an IP address starting with 2002:7a64:dcee::/48 if

you decide to use the WAN1 IP address to forward 6to4 packets to the IPv4 network. The second

and third sets of 16-bit IP address from the left must be converted from 122.100.220.238. It

becomes 7a64:dcee in hexadecimal. You are free to use the fourth set of 16-bit IP address from the

left in order to allocate different network addresses (prefixes) to IPv6 interfaces. In this example,

the LAN1 network address is assigned to use 2002:7a64:dcee:1::/64 and the LAN1 IP address is

set to 2002:7a64:dcee:1::111/128.

A relay router

(192.99.88.1) is used in this example in order to forward 6to4 packets to any

unknown IPv6 addresses.

2.6.1

Configuration Concept

After the 6to4 tunnel settings are complete, IPv4 and IPv6 packets transmitted between WAN1 and

LAN1 will be handled by the ZyWALL through the following flow.

2002:7a64:dcee:1::111/128

122.100.220.238

192.99.88.1

2002:7a64:dcee:1::/64

IPv6

IPv4

WAN

LAN