Summary of the content on the page No. 1
ZyWALL IDP 10
Intrusion Detection and Prevention Appliance
Quick Start Guide
Version 1.00
July 2004
Summary of the content on the page No. 2
ZyWALL IDP 10 Quick Start Guide Table of Contents 1 Introduction to Intrusions .....................................................................................................4 2 Introducing the ZyWALL IDP 10 ...........................................................................................5 3 Application Examples............................................................................................................5 4 Hardware Connections..................................
Summary of the content on the page No. 3
ZyWALL IDP 10 Quick Start Guide Figure 13 Wizard–Time Setting .............................................................................................................. 16 Figure 14 Wizard– Stealth Setting........................................................................................................... 17 Figure 15 Wizard– State Setting.............................................................................................................. 18 Figure 16 Wizard - Summary ....
Summary of the content on the page No. 4
ZyWALL IDP 10 Quick Start Guide 1 Introduction to Intrusions Refer to the following figure for the introduction. Figure 1 Intrusions Figure 1 represents a typical business network consisting of an employee LAN, a DMZ (DeMilitarized Zone) containing the company web, FTP, mail etc. servers, a firewall and/or NAT router connected to a broadband modem for Internet access. Host-based intrusions are what most people call “virus attacks”. The goal of host-based intrusions is to infiltrate fil
Summary of the content on the page No. 5
ZyWALL IDP 10 Quick Start Guide Network-based intrusions have the goal of bringing down a network or networks by attacking computer(s), switch(es), router(s) or modem(s) (see 1, 2, 3 and 4 in Figure 1). If the LAN and/or DMZ switch is compromised (see 2 in Figure 1), then those networks are compromised. If the firewall/router is attacked (see 3 in Figure 1) and/or the Internet access broadband modem (see 4 in Figure 1), then this is the equivalent of a Denial of Service (DoS) attack on your
Summary of the content on the page No. 6
ZyWALL IDP 10 Quick Start Guide Figure 2 Installation Example 4 Hardware Connections This section describes the front and rear panels of the ZyWALL IDP. 4.1 Front Panel The front panel contains ports and LEDs. 6
Summary of the content on the page No. 7
ZyWALL IDP 10 Quick Start Guide WAN Port LAN Port MGMT Port Figure 3 Front Panel Connections Table 1 Front Panel Ports LABEL DESCRIPTION WAN 10/100 Connect a firewall, switch or cable/DSL modem to this port depending on where you deploy the ZyWALL IDP (see Figure 2). LAN 10/100 Use a crossover Ethernet cable to connect a computer to this port or use a straight- through Ethernet cable to connect a hub. This port is auto-negotiating (can connect at 10 or 100Mbps). MGMT Use a crossov
Summary of the content on the page No. 8
ZyWALL IDP 10 Quick Start Guide Table 1 Front Panel Ports LABEL DESCRIPTION CONSOLE Use this port if you want to configure the ZyWALL IDP using the command-line interface. See your User’s Guide for details on commands. Connect the 9-pin male end of the console cable to the console port of the ZyWALL IDP and the other end to a serial port (COM1, COM2 or other COM port) on your computer. Your computer should have a terminal emulation communications program (such as HyperTerminal) set to VT
Summary of the content on the page No. 9
ZyWALL IDP 10 Quick Start Guide Table 2 Rear Panel Power Connection LABEL DESCRIPTION WARNING: Using an incorrect power adapter will damage your device! After you’ve made the connections, use the power cord to connect the power adaptor to a power source and look at the front panel LEDs. 4.3 The Front Panel LEDs Figure 5 Front Panel LEDs The PWR LED turns on when you first connect the power. The SYS LED blinks while performing system testing and then stays on if the testing is succes
Summary of the content on the page No. 10
ZyWALL IDP 10 Quick Start Guide Table 3 Front Panel LEDs LED COLOR STATUS DESCRIPTION Blinking The ZyWALL IDP is sending or receiving packets on the 10Mbps WAN connection. Amber On The ZyWALL IDP has a successful 100Mbps WAN connection. Blinking The ZyWALL IDP is sending or receiving packets on the 100Mbps WAN connection. LAN Off The LAN port is not connected. 10/100 Green On The ZyWALL IDP has a successful 10Mbps LAN Ethernet connection. Blinking The ZyWALL IDP is sending or r
Summary of the content on the page No. 11
ZyWALL IDP 10 Quick Start Guide By default remote management is disabled on both the LAN and WAN ports. You must first enable remote management on these ports via the console port or the MGMT port if you want to configure the ZyWALL IDP using these ports. 6 Setting Up Your Computer’s IP Address Use this section to set up your computer to use a static IP address of 192.168.1.1, 192.168.1.2 or from 192.168.1.4 to 192.168.1.254 with a subnet mask of 255.255.255.0. This is necessary to ensure
Summary of the content on the page No. 12
ZyWALL IDP 10 Quick Start Guide 5. The Internet Protocol TCP/IP Properties screen opens (the General tab in Windows XP). -Click Use the following IP Address and fill in the IP address (choose an used one from 192.168.1.1, 192.168.1.2 or from 192.168.1.4 to 192.168.1.254), Subnet mask (255.255.255.0), and Default gateway (192.168.1.3) fields (if your computer is connected directly to the ZyWALL IDP. Figure 6 Set IP Address 6. Click OK to close the Internet Protocol (TCP/
Summary of the content on the page No. 13
ZyWALL IDP 10 Quick Start Guide Default IP address. Figure 7 Web Site Address 2. The default password (“1234”) is already in the password field (in non-readable format). Click Login to proceed to a screen asking you to change your password. Click Reset to revert to the default password in the password field. Default password = 1234 Figure 8 Login 3. It is highly recommended you change the default password. Enter a new password, retype it to confirm and click Apply; alternatively click
Summary of the content on the page No. 14
ZyWALL IDP 10 Quick Start Guide 4. You should now see the web configurator HOME screen. Navigation panel Setup Wizard LOGOUT Figure 10 Home Screen Click Quick Setup to begin a wizard to help you configure your ZyWALL IDP for the first time. Click a link under SYSTEM in the navigation panel to configure general ZyWALL IDP features. Click IDP in the navigation panel to configure IDP-related ZyWALL IDP features. Click a link under LOG & REPORT in the navigation panel to view ZyWALL
Summary of the content on the page No. 15
ZyWALL IDP 10 Quick Start Guide Click LOGOUT when you have finished a ZyWALL IDP management session. The ZyWALL IDP automatically logs you out if a management session (web or console) is left idle for five minutes. If this happens, you will have to log back in. 7 ZyWALL IDP Quick Setup Wizard 1. Click Quick Setup in the HOME screen of the web configurator. The first wizard screen allows you to change the access password. It is highly recommended you change the default password. Ent
Summary of the content on the page No. 16
ZyWALL IDP 10 Quick Start Guide Enter the ZyWALL IDP IP address, subnet mask, gateway IP address and DNS server IP address in these fields. The gateway and DNS entries relate to the e-mail, syslog and SNMP functions of the ZyWALL IDP. The DNS server maps a domain name to its corresponding IP address and vice versa. If you configure a DNS server, you can enter an IP address or domain name for e-mail, syslog, etc. servers. If you change the ZyWALL IDP IP address, you will need to
Summary of the content on the page No. 17
ZyWALL IDP 10 Quick Start Guide 4. Enable/disable the stealth function on either or both the LAN and WAN ports. The MGMT port has no stealth function. Stealth enabled on a port means that the ZyWALL IDP drops all incoming packets destined for the ZyWALL IDP received on that port with no response to the sender. When you enable Stealth on a port, you cannot perform management via that port. When Stealth is enabled on a port, the ZyWALL IDP doesn’t respond to ICMP requests such as Ping (
Summary of the content on the page No. 18
ZyWALL IDP 10 Quick Start Guide Inline means the ZyWALL IDP will both identify suspicious or malicious packets and perform the action dictated by the rule for that type of intrusion (block, log, drop, send an alarm). Monitor means the ZyWALL IDP will function as a traditional IDS (Intrusion Detection System) by identifying suspicious or malicious packets and then sending alerts (only). Bypass means the ZyWALL IDP allows all LAN and WAN traffic to pass through it without inspe
Summary of the content on the page No. 19
ZyWALL IDP 10 Quick Start Guide 7. The final wizard screen shows which settings have been saved successfully to the ZyWALL IDP. Check the Result screen and click Close to return to the Home screen. Fields incorrectly configured display “Error”. You need to reconfigure those fields before deploying the ZyWALL IDP. Figure 17 Wizard Result 19
Summary of the content on the page No. 20
ZyWALL IDP 10 Quick Start Guide 8 Troubleshooting Table 4 Troubleshooting PROBLEM CORRECTIVE ACTION None of the LEDs turn Make sure that you have the included power adaptor connected to the ZyWALL on when you turn on IDP and connected to an appropriate power source. Using an incorrect power the ZyWALL IDP. adaptor will damage your device! Check all cable connections. If the LEDs still do not turn on, you may have a hardware problem. In this case, you should contact your local vendor. Ca
