ZYWALL 2WG - VPN маршрутизатор ZYXEL - Бесплатное руководство пользователя

РУКОВОДСТВО ПОЛЬЗОВАТЕЛЯ ZYWALL 2WG ZYXEL

1Поdkлючениоборуданя

Bam noTpe6yEtCJIeIyUoOee oBOpyObaHne.

ZyWALL

Komnblotep

Kabéni Ethernet

AanTep nTaHn

Длп подклюоченя оборудань вллелпследуоне дйства.

3

1Для подкноченя потOB LAN/DMZ K komьютупспьуется кабелb Ethernet.ЕсиВ Web-KOHФигуразе 3TN поънасточны Кад поъ DMZВOKHELANИП DMZ，Для подкноченяобшededoc'tynbIX cepвор (web-ceрвep，poTuTOBBI cepBep，FTP-cepBepи np.)КnapTAMLAN/DMZMOЖноТakke Испльзовытkaбелb Ethernet.
2 C nomoBIO npyrorO ka6ena Ethernet nodknouHte nopT WAN B po3eKy Ethernet, c kOtopoI mMeetcdoCTyn B INTEpHET.

EcnBbXOTIe NOKIOHTB K CBOemy KOMNbOtepy nopT CONSOLE (KOHCOJIb), To IcNoJIb3yIe CnHn Ka6eNb KOHCOJI. Ecn Bbl XOTIe NOKIOHTB nopT AUX K aHaIOrOBOMy MOdemy, To IcNoJIb3yIte YepHb 3aNaCHOH Ka6eNb.

3Для подклоченя к бспpoBOнOH сети 3GВставытбспpoBOHyКapTy 3GВ сnot HaбOKOBои paHeH. Ha MOMeHT habиcaHЯ руКOBODCTBa BmecTe c ZyWALL. можно ИспОьБаТь только бспpoBOHy cTeByIO KapTy Sierra AC850/860 3G.
4IopKJIIOHHTe pa3bem NITAHnHa 3aHHe naneHn Kpo3ETke cetn 3neKTPoNTAHnC nOMOu bO aanTepa NITAHN, BXODJUeroB KOMPJIeKT NOCTABKN.
5 NocmToPte Ha nepeHIOI paHeJIb. CBeToIOIO PWR rOpNT. CBeToIOIObl CARD, LAN/DMZ u WAN rOpT, ecJIN npaBnIbHO BbINOJIHeHbI COOTBeTCTByUOUIne CoeDInHeHnI.

EcnH ODNH I3 INDnKaTOpOB He 3aTogApaeTc, To npOBepbTe NOKIChueHne O6OpyIOBaHnry n ceNocTHoCTb Ka6eNe. Y6eNTecb, YTO Bbl NOKIChUHN K ZyWALL 6bok PntaHnra BepHO Ttna H BkIIOuHn ERO B NODXODJusm NCTOCHNK 3JeKTPoPITaHnra. Y6eNTecb, YTO CeTEBOe PNTaHne BKNIOUHeO. Ecn HNDnKaTOpBb BCE eSche He ropT, To o6paTNTecb K BaShem My MeCTHOMY NOCTABUKNK.

2 Достун Web-конфигураТopy

B 3tOM pa3dene OINcIbIaETCa HAcTPOJa INHTepFeIca WAN 1 dJa DoCTyna B INHTepHET.

1 3anycnte Web-6o3peBaTeIb. BVeIte aIpec 192.168.1.1 (IP-aIpec ZyWALL no ymoJuaHIO).

2 Μεικητe Login (Bxοι) (napοJB no ymoJIuaHnIO 1234 yxe BVeJeH).

Ecnn 3KpaH BXOa B CnCTeMy He NOBJIeTc, To nPoBepbTe HacTpoKn 6e3OnaChocTN BaWero 6pay3epa HOpMaJIbHyIO paBoTy cTeBOI Ethernet KapTbI BaWero KOMNbIoTepa. Ha BaWeM KOMNbIoTepe TAKKe DoJXHO 6bITb BKJIIOHeO ABTOMaTIueckoe NoIyEne Ip- aDpeCa c DHCP-cepbepa. Dny noLyUeHn DaONHInTeMbHO INΦopMauIN CMOTpInTe pa3dEn YctanOBka IP-aDpeca KOMNbIoTepa.

3Измehnte napoIb NO yMOJIaHnIO, BBeJa HOBbI napoIb N uIeNKHyB NO KHOJNKe Apply (ПрIMeHTb).

Для настори пота WAN 2 IncnojbyOTc OKha WAN в pa3dene NETWORK (CETb).Вы тохе можete устовпь пашиpeдение pa3rpy3kn Мжdy pa3beMamn ГВС.

3 Pekim MekceTeBOrO MoCTa

EcnB ZyWALL yctaHOBnEH pexKIM MEXCeTeBOr MOCTa, ycTpoNcTBo FyHKUOHNpye T KAK npO3paHbI MEXCeTeBO 3kpaH. JIy YCTaHOBKn peKIMa MEXCeTeBOr MOCTa ZyWALL BblONHnTE CneDyUOuNe DeiCTBna.

1ВПанели habигагши щeлкни TE MAINTENANCE（OBSCЛУЖИBAHIE）и 3aTeM Device Mode（Pexim yctpoiCTBa).
2 Bыберпerte Bridge (MocT) u yctaHOBnTe CTatnueckm IP-aDpec, Macky nOdcetu IP-aDpec shIIO3a dIpy nHTeppeucoB LAN, WAN, DMZ u WLAN.
3 ÜeßKNHTe Apply (Пурмени). ZyWALL nepe3arpy3ntc.

Ecnn nmeoTc cepBepb, KOToPbIe DOJIxHbI 6bIb DoCTyHbI I3 IIO6aJIbHOJ CETN, CM. Pa3dEn 5.

4 Hac troponka doctyna B INHTepHET n pernctpauny n3denn

1 Μεικηνιte Ha 3haúke Wizard (MacTep) (BOKHe HOME (ΩOMAUHЯ), a 3aTeM Ha CcbIke Internet Access Setup (HactpoiKa DoCTyNa K INHTepHET), yTo6bI OTKpbITb MaCTep HactpoiKN.

BBeIte yueTHbIe daHbIe IJn oNkInOeHnK INHTepHeTy.

EcnBam Ha3nueHcTaNueckn IP-aDpeC, BbIbepnTe Static (CtAnueckn) B paackpbBaHOeMcra CnncKe IP Address Assignment (Ha3nueHne IP-aDpeca) n BBeDiTE npedocTabJeHHbe Bam npapaMeTpbl.

3aONHЯEMbIe NOJIa MOrYt pa3NIuAcbcB 3aBnCmOCTn 3NaYeHn, yCTaHOBLeHHOro B nOJe Encapsulation (INKancyIaIz). BBeIte npaMeTpbl, ppeOCTabIeHNbIe INTepHeTnpOBaIdepOM IIN CTeBBIM aDMNHICTpaTOPOM.

ПО OKOHани РжКНTe Apply (Примeнтб).

- INkancylaць Ethernet

HacpoTe cnyk6y Roadrunner c nomoizbu OKOH WAN B pa3dene NETWORK (CETb) (3aknaika WAN).

WIZARD - Internet Access

ISP Parameters for Internet Access

DMZ (DeMilitarized Zone - Демплтариьаня зона) поваяг Всшим польбовелям образацьк obseoctуньсервepam (web-ceвep, потоьий срвep, FTP-сервep и др.) и обесnéчвает зашиту срвевор посядстом мжсебoreо Зкрана от Всшнихатak DoS (Denial of Service - otka3 ot obслуживаши).

Bb mojte Ha3nauHb KOHfnguraHIO TCP/IP Quepe3 DHCP JJI KOMNbIOTepo, NOKJIuOeHHbIX K nopTaDMZ. IIN, no dpyromy, Bb mojte Ha3nauHb KOMNbIOTepam cTatnueckne IP-aIpeca (B ToJ Ke NpOcTe, UTOIP-aIpec npota DMZ) u aIpeca cepBepo DNS. IP-aIpec npota DMZ B ZyWALL nCnoNb3yeTcB KaueCTBeUJIO3a no yMOJuaHIO.

Дянастоюк DMZ, ecn ZyWALL haxoindcB peximMe mapspTyu3aun, BblonHnte cIeDyuOuee.

Hactpoika DMZ B pexime mekceTeBOrO MOCTa He Tpe6yeTcA, cM. daJee Pa3dien 7.

1 B PanaHn HauBaIuIu IeJKNHTe NETWORK (CETb) > 3aTeM DMZ.
2 BBeIte IP-aIpec macky noIcTe nIra nHTeppeica DMZ.

Ecnn nCnojIb3yETc yacthbl IP-aDpec dIy DMZ, To YTObIcJeIaTb CepBepbl DocTyHbIMN dIy BCex IOnlb3ObaTeIeN, Heo6xOIMO nCnoJIb3ObaTb NAT (cm. Pa3den 6).

ObseOocTyHbI IP-aDpec DoJxHnHex HaxoHtbcra B noDCeTn, OTInuHno ot obSeOocTyHoro IP- aDpeca nopTa WAN. Ecnn FyHKuNAT dJa obSeOocTyHbIX IP-aDpecoB dJa DMZ He hAcTpoHa, ZyWALL HanpaBJIeT TpaFuk Ha obSeOocTyHbIe IP-aDpeca B DMZ 6e3 npImeHEnna NAT. 3TO nCnONb3yeTcra dJa XocTcePBePOB C pnpIoXeHnYIMn, HecOBMeCTmMbIMn C NAT.

3 ΜεικηνιTe Apply (Πριμενηῦ).
4 По умочаню посы LAN/DMZ c 1-ю no 4-bi Яьлготся потуми пokально сети.Чтосы насст点点头 пот кад DMZ, щенин te залдку Port Roles (Роевbie Имера поров), установite пегк nullасть рядом с DMZ и щенинte Apply (Примен综合体).

6 NAT

NAT (Network Address Translation - trpaHcIaIcIaIcIaIcIaIcIaIcIaIcIaIcIaIcIaIcIaIcIaIcIaIcIaIcIaIcIaIcIaIcIaIcIaIcIaIcIaIcIaIcIaIcIaIcIaIcIaIcIaIIbIX aJpecoB NAT, RFC 1631) bblnoJIHReT ppeo6pa3OBAHnE IP-aJpeca oJHO cETn B O'TnHbI IP-aJpeC dpyroJ cETn. OkHa NAT Address Mapping (Ppeo6pa3OBAHnE aJpecoB NAT) nCNoJIb3yUToTc IJn HAcTpoRKn ZyWALL Ha ppeo6pa3OBAHnE HeckOnbKnx 06eIoCTynbIX IP-aJpecoB B uacThbIE IP-aJpeca BaWeJ loKaJIbHO cETn (nIn DMZ).

B cIeJyUoIeM npImepe pa3pe7aETcA DocTyn n3 rIo6aJIbHOI CETn K cepBepy HTTP (web-cepBep) B DMZ. 3TOT cepBep Imeet YacTHbI IP-aDpec 10.0.0.20.

1ВПанели habигачи ёелкнITE ADVANCED（ДОПОЛНITEЛьHO）> 3aTeM NATи 3aTeM Port Forwarding (IpeeaDpecaua npToB).
2 Bыберпе соедиени ГВС (WAN1) (ГВС1) Дя КOTOPО Вь XOTITE国有资产抵押прази перадразсuin пота.
3 YctaHOBnTe Флжok Active (BknHouNTb).
4 BVeIte nMa npaBnla.
5 BBeIe HOMep npOpTa, KOtOpbI nCnoJIb3yeTc sJyK6oI.
6 BBeIte IP-aIpec HTTP-cepBepa.
7 LJIKNHTe Apply (PpIMeHnTB).

7 MexceTeBOJ 3KpaH

Name (Имя): В蜱и Te IMя Дя Иденти Каси CTpaTeRIM IJIIO3a.

Remote Gateway Address (Адпес удаленихушюз): В蜱ипеша IP-aадпес идоменhoe Имя удаленихо маршутузатopa IPSec.

3 3TO OKHO INCNOJIb3yeTcRДЯ HAcTPOIKN IIOINTIKN CETN.

Флжok Active (Вкночь) Должен биты установп.

Name (IVM): BBeInte IIMy IINIy IeHTnKauN INOJIITUNC CETN.

Authentication Algorithm (Алгоргия математICALS): Быбэрпеш MD5 дд МИнимально уровая бezорасости URL SHA-1 дд мakсимально.

Key Group (KloueBa rpynna): Bb6epnte DH2 dIra MNHmAbNo yObo 6e3oNachoctn.

SA Life Time (BpemcuyceCTBOBaHn3aunuHHOcoeHNHeH):YctaHOte,kaq cacto ZyWALL BbIOnnHaTcORJIACOBaHne 3auuHHeHOrO CoeHNHeHNo npOTOKny IKE (MmHmym 180 ceKynd).MaOoe BpemcoeHNHeHn yBeNnBaet ypoBeHb 6e3OpacHOCTn, Ho npn pnoeDype corlaocBaHn TynHeNb VPN BpemehHo He DoCTyneH.

Pre-Shared Key (Празьарпелбно соглacobаньй клю): Исnotьуется от 8 до 31 сивona ASCII c четом Perictra и поот 16 до 62 чеснадцатеруньх сивовор ("0-9", "A-F"). Пера чеснадцатеруньм Ключим В蜱игпг "0x" (нόль x), оно сивовны He сочаючаську Ключа и 16 - 62 сивовор.

Encapsulation Mode (PexkIM INKancyIaIIN): PexkIM Tunnel (TyHHeIb) COBmecTUM c NAT, peXkIM Transport (Tpahcnpot) He coBmecTUM.

IPSec Protocol (ПрOTOKОЛ IPSec): ESP COBmecTUM c NAT, AH He COBmecTUM.

Perfect Forward Secrecy (PFS) (Дeальная пreamаь бezonaachoctb): None (Het) nO3BOJЯET bIcTpyo hactpoKy IPSec, ho DH1иDH2 noBbIaIoT ypoBeHbбezonaCHocTn.

4 3To OKHIO nCNoB3yeTc8 dIa NaCTpoiKn napametpoB tyHHeJIe IKE (Internet Key Exchange - npOTOKoJ O6MeHa KlnOuAmN).

5 3To OKHO nCnOJIb3yeTcIЯ NaCTpoKINapametpoB IPSec.

6 Поберъп Насторку VPN. Лжнite Finish (ГотоBO) Деля COхраень Насторк.

7 B nocJIeHem OKHe ueKNHTe Close (3aKpbITb) IJra 3aBepWeHn pa6oTbI MaCTepa HacTPOwnVPN. JIra BKJIouHEny npabuJa VPN uYcTaHOBNeHn coeHNHeHn VPN nepeXoOnTe K cIeDyUOSeMy pa3Deny.

8.1 Исторынecоеденя VPN

TynheNnVPN nCnoIb3yIOTcI Ia 3aunueHHo OTnpabKn n noncka paJNoB, a TaKKe pa3peWeHn ydaJIeHHoro DoCTyna K KopnpaTINBbIM CeTAM, Web-cepBepam n NoOTOBbIM cepBepam. 3TN cnyk6bl 6dyT pa60TaTB TAK, KaK ecNn 6bl Bbl HaxOdnncB OΦnce, a He NODKNUoyanncb Upe3 INHTepHET.

Hanpimep, npabuhoVPN "test" pa3pe7aet 3aunueHHbI DocTyn K webcepBepy B ydaJIeHHoK KopnpaTubHOJ IokaIbHOcTe. BVeDInTe IP-aIpec cepBepa (10.0.0.23 B daHHom npimepe) BVnoIe URL BaWero 6pay3epa.ZyWALL abTomatUweckn co3dact TynHeNb VPN, KOrDa Bbl nonbTaTeCb erO nCNoIb3OBaTb.

BПанели habiraци щeлкни TE SECURITY (БE3ОПАСHОCTь) > 3aTeM

VPN n 3aTeM 3aKJaDky SA Monitor (MoHITop 3aUuIeHHOro CoeINHeHn) IJIr OTo6paJKeHn cInsKa pOdkJIoUeHHbIX TynHeJeV VPN (3deCb yCTaHOBJIe TynHeJIb VPN c ImeHem "test").

EcnBbHe MoKeTe yCTaHOBtB coeHHeHne VPN,To y6eHITcB, YTO ZyWALL n
ydaJIeHHbI MapuTy3aTOp IPSec nCNoJIb3yIOT oINHaKOBbIe HAcTpoJIKN VPN. IeJIKNHTe Ha
KhONKe VPN (ΓBC) Ha naHEni HABnIaUN, YTO6bl YCTaHOBtB paCSIIpeHNbIe HAcTPOJKN.
PocETnTe KaKoJ-Ni6o Be6-caIIT, YTO6bl pnoBepNTb ycNeIshOe NODKnIOUeHne K INTEpHET

YctaHOBka IP-aDpeca KOMNbIOTepa

B 3tOM pa3dene OINcIbIaETCa, KaH NaCTpOnTb KOMNbIOpTe Ha noJIyUeHne IP-aIpeCa B onepaunHOHcncTeMe Windows 2000, Windows NT u Windows XP. BbIOnHeHne 3ToJ onepaunn rapaHTnpyeT, YTO KOMNbIOpTe CMOKeT B3aIMoDeIcTBoBaTa b c ZyWALL.