Darstellung Unterschied ZyNOS Firmware Version 4.02 => 4.03

Transcription

1 Darstellung Unterschied ZyNOS Firmware Version 4.02 => ZyWALL Firmware v4.03 Enhancement (1) - Content Filter Support for Multiple Policies : : November 14, ZyWALL Firmware v4.03 Enhancement (2) - Auto Diagnostics : : November 14, ZyWALL Firmware v4.03 Enhancement (3) - Anti-Spam Wizard : : November 14, ZyWALL Firmware v4.03 Enhancement (4) - Firewall GUI Enhancement : : November 14, ZyWALL Firmware v4.03 Enhancement (5) - NAT over IPSec : : November 14, ZyWALL Firmware v4.03 Enhancement (6) - Host-based Load Balancing : : November 14, ZyWALL Firmware v4.03 Enhancement (7) - Custom Applications : : November 14, 2007

2 ZyWALL Firmware v4.03 Enhancement (1) - Content Filter Support for Multiple Policies : : November 14, 2007 QUESTION ZyWALL Firmware v4.03 Enhancement (1) - Content Filter Support for Multiple Policies ANSWER Previously, ZyWALL could only create one single Content Filter policy for all the categories. Although we can create schedule and exclude some IP addresses from the policy, it is quite inconvenient for administrators to configure, especially in scenarios similar to the ones below. Network administrator wants to block Adult/Gambling websites at all times for everyone. And block computer game websites from 8:00 to 18:00 on working days. Financial websites, should only be available to selected users, without time restrictions.

3 News and Computer related websites, should be available to anyone without restriction. ZyWALL with firmware 4.03 enhanced the Content Filter feature with Multiple Policy support, allowing the administrator to block selected web features, and specific web site access by configuring multiple policies, satisfying the above scenarios. Below is an example step-by-step Content Filter configuration guide for firmware v Enable the Content Filter and External Database.

4 2. Go to Policy setup, and click Insert to add a new policy rule. 3. After applying, click the corresponding icons to edit the external database or schedule. 4. Configure the External Database.

5 5. Edit the Schedule. 6. After configuration is finished, ZyWALL Content Filter will work according to the scenario. Customization allows the administrator to specify additional Trusted or Forbidden websites. Keep in mind that an object must be configured first.

6

7 ZyWALL Firmware v4.03 Enhancement (2) - Auto Diagnostics : : November 14, 2007 QUESTION ZyWALL Firmware v4.03 Enhancement (2) - Auto Diagnostics ANSWER Previously, it was very difficult for engineers to get complete debug information from ZyNOS ZyWALL. When problems occurred, we needed the customer to perform CLI commands to obtain necessary diagnostic information. In ZyWALL firmware 4.03, the new "Diagnostics" feature provides a much easier way to get debug information. This new feature supports the following options: 1. Automatically perform diagnosis based on CPU utilization threshold and schedule 2. Perform diagnostic immediately 3. Send diagnostic information by 4. Dump diagnostic information on the console at the same time (remember to change the baud rate to ) 5. Avoid diagnostic mail flooding, at least 5 minutes interval between two sending mails Diagnostic information includes CPU load, Routing Table, VPN info, AS info, HTTP Client state, Session info, TOS Table, etc. Configuration is available in "Maintenance - Diagnostics" menu.

8 ZyWALL Firmware v4.03 Enhancement (3) - Anti-Spam Wizard : : November 14, 2007 QUESTION ZyWALL Firmware v4.03 Enhancement (3) - Anti-Spam Wizard ANSWER Previously, redundant checking on ZyWALL Anti-Spam was quite common because network administrators selected Anti-Spam check for all direction. Performing pointless checks presents significant CPU load, and ZyWALL can become very busy easily. In firmware 4.03, Anti-Spam Wizard is introduced, enabling administrators to configure AS easily and efficiently. Please follow the steps below to configure it. 1. Click the magic wand symbol to start AS Wizard 2. Click on the interface button to tell ZyWALL where your mail server located.

9 3. ZyWALL will give a recommendation 4. Unselect WAN2 is your WAN2 is not active.

10 5. Click Apply to finish the Anti-Spam setting via wizard. 6. Return to GUI to configure other settings such as "Action for Spam Mails", threshold for External Database or blacklist/whitelist.

11 ZyWALL Firmware v4.03 Enhancement (4) - Firewall GUI Enhancement : : November 14, 2007 QUESTION ZyWALL Firmware v4.03 Enhancement (4) - Firewall GUI Enhancement ANSWER In order to enable administrators configure our ZyWALL more conveniently, we made an enhancement to the firewal GUI. In the menu "Default Rule", we can directly add firewall rules for each direction. In menu "Rule Summary", a ZLD-like configuration page is provided for easier firewall direction selection.

12 ZyWALL Firmware v4.03 Enhancement (5) - NAT over IPSec : : November 14, 2007 QUESTION ZyWALL Firmware v4.03 Enhancement (5) - NAT over IPSec ANSWER Previously, the only way to resolve and avoid IP address conflicts was to change the remote subnet IP range. Take following scenario for example. Scenario 1: Scenario 2: Scenario 3: With ZyWALL firmware 4.03, a new feature "NAT over IPSec" provides an easy solution to the problem. NAT over IPSec Solution to Scenario 1:

13 NAT over IPSec Solution to Scenario 2: NAT over IPSec Solution to Scenario 3:

14 Configuring NAT over IPSec You can also choose One-to-One mapping or Many-to-One mapping. If Many-to-One is selected, Port Forwarding will be available for configuration.

15 ZyWALL Firmware v4.03 Enhancement (6) - Host-based Load Balancing : : November 14, 2007 QUESTION ZyWALL Firmware v4.03 Enhancement (6) - Host-based Load Balancing ANSWER In the original design, when ZyWALL WAN port works in load balancing mode, ZyWALL determines which WAN interface should be used to transmit outbound traffic based on sessions. However, in reality, one transaction is often accomplished by multiple sessions. For example, accessing one web page may be accomplished by many TCP sessions, each session accessing different parts on different locations. This might cause errors on some secured websites, which do not allow any users to log in from multiple IPs. In firmware 4.03, ZyWALL load balancing is host-based. Host-based Load Balancing makes outbound traffic from one host pass through the same WAN interface within a specific time period. This approach solved the problem mentioned above.

16 ZyWALL Firmware v4.03 Enhancement (7) - Custom Applications : : November 14, 2007 QUESTION ZyWALL Firmware v4.03 Enhancement (7) - Custom Applications ANSWER The ZyWALL series can monitor some well known network protocols, for example, ZyWALL ALG can detect FTP, SIP and H.323 protocol, ZyWALL Anti-virus and Anti-SPAM can detect HTTP/FTP or SMTP/POP3 traffic. However, since each protocol is identified by a TCP/UDP port, in the past, ZyWALL only support the well know ports for those protocols. FTP: 21 SIP: 5060 H.323: 1720 SMTP: 25 POP3: 110 HTTP: 80 If the port is changed, ZyWALL would not be able to detect the protocol, for example, if the port for FTP server is changed to 2021, ZyWALL FTP ALG will not work. Thus, we addressed this issue by adding Custom Applications which enable ZyWALL to monitor traffic using non-standard port numbers. For example, if we want ZyWALL to detect FTP traffic on port 2021, we should add a custom application rule. The default port of a well known service still work when a custom port is configured, which means ZyWALL will support both port 21 and port 2021 if we configure this rule.