Vantage Report

Quick Start Guide

Version 2.2 7/2005
Vantage Report Quick Start Guide

Overview

Vantage Report is an application that collects and analyzes logs sent by ZyXEL devices to the Vantage Report syslog server. See the Users Guide for more information. The following figure shows what you can do with Vantage Report 1 The ZyXEL device sends logs to the Vantage Report server. 2 The logs are used in Vantage Report to build statistical reports. 3 Vantage Report sends reports to clients who have requested them. 3 2
This Quick Start Guide shows you: 1 Requirements 2 Vantage Report Installation Procedure 3 Starting and Stopping Vantage Report 4 Sending and Receiving Vantage Reports 5 Uninstalling Vantage Report 6 Viewing Your Products Certifications

1 Requirements

1.1 Vantage Report Administrator
CPU RAM Hard Disk Operating System Browser Pentium IV 2.6 GHz or faster recommended 1024 MB or more 80 GB or more Microsoft Windows 2000 Server/ Windows XP Professional Internet Explorer 6.0 (Service Pack 1) or above with 1024*768 resolution
1.2 ZyXEL Device Support for Vantage Report
The following devices can send logs to the Vantage Report server. Partial Support (Some Reports) ZyWALL 2 version 3.62 ZyWALL 5 version 3.62 ZyWALL 35 version 3.62 ZyWALL 70 version 3.62 ZyWALL IDP 10 version 2.0 P662HW - 61/63 version 3.40 Full Support (All Reports) ZyWALL 5 version 3.64 ZyWALL 35 version 3.63 and above ZyWALL 70 version 3.63 and above
2 Vantage Report Installation Procedure
Use the Vantage installation wizard to install Vantage Report software. In each wizard screen, click Next to proceed to the next screen in the wizard, click Back to return to the previous screen or click Cancel to abort the installation and exit the wizard. You should prepare an SMTP server IP address and login name/password. You can add this servers details during the wizard installation or after you install Vantage Report in the System > Server Config screen.
Note: This software installs a Kiwi Syslog server and a MySQL server to the computer from which you run Vantage Report server. If the computer already has a Kiwi Syslog server or MySQL server installed, backup any existing databases before the installation or install the Vantage Report software on another computer.

2.1 Installation Wizard

You should uninstall any previous versions of Vantage before beginning. 1 Insert the CD into your CDROM. Click Vantage Report to start the installation wizard. The following screen displays.
2 Read the license agreement and click Yes if you agree.
3 Enter a user name and specify the name of your company.
4 Choose where you want to install the software.
5 The next screen asks you to configure a mail server. The mail server is used to send notifications. Type the IP address or domain name of the mail server. Type the e-mail address that you want to send Vantage reports.
6 Configure the user name and password of the mail server if it requires authentication.
7 Enter the name for a new folder or choose an existing folder to use.
8 Click Next if your settings are appropriate (otherwise click Back).
9 Wait for the wizard to install Vantage Report.
10 Click Finish to complete your installation. It is recommended you restart your computer.
Vantage Report has installed successfully when you then see the next screen. It is recommended you restart your computer.
3 Starting Vantage Report
1 Stop other syslog, MySQL, and web services before starting Vantage Report. 2 Double click the desktop icon that was created when you installed Vantage Report. 3 The Kiwi Syslog Daemon and ApacheTomcat open.
4 Open a browser window and enter http://localhost: 8080/vrpt in the address bar to open the login screen. Enter root as the user name and the password and click OK to open the Vantage Report main screen.
4 Sending and Receiving Vantage Reports
This section shows you how to configure a ZyXEL device to send logs to the syslog server. The syslog server then sends the logs to Vantage Report. Use either the web configurator or command interface (see the ZyXEL device Users Guide for access information) to activate the syslog server.
Note: If both the web configurator and the command interface are configured, the latest settings configured apply.

4.1 Web Configurator

In the ZyXEL device main screen click LOGS and then select the Log Settings tab. 1 Configure the E-mail Log Settings section if you want logs and alert messages to be sent via e-mail. In Syslog Logging: 2 Select the Active checkbox. 3 Type the IP address or name of the Vantage Report server computer in the Syslog Server field. In Active Log and Alert select the logs that you want Vantage Report to receive from the ZyXEL device: In Log Consolidation: 4 Select the Active check box to merge logs with identical messages into one log. Some logs (such as the Attacks logs) may be so numerous that it becomes easy to ignore other important log messages. You can use the sys log consolidate msglist command to see what log messages will be consolidated. 5 In the Consolidation Period field specify the time interval during which the ZyXEL device merges logs with identical messages into one log.
Vantage Report Quick Start Guide In the ZyXEL device main screen click LOGS and select the Reports tab. Select the Send Raw Traffic Statistics to Syslog Server for Analysis check box and click Apply to have the ZyXEL device send unprocessed traffic statistics to the Vantage syslog server for analysis.
Note: You must have the syslog server already configured in the previous Log Settings screen.

4.2 Command Lines

In the ZyXEL device command interface ras> sys logs category traffic you can activate the syslog server and Usage: [0:none/1:log] [0:don't show debug type/1:show debug type] set the server IP address. Type the commands as displayed in bold. ras> sys logs category traffic 1
ras> sys logs save ras> sys logs category load consolidate clear mail display save switch errlog syslog
Note: The address displayed after the sys logs syslog server command should be the IP address of the Vantage Report server.

updateSvrIP

ras> sys logs load ras> sys logs syslog active display facility server
ras> sys logs syslog server 172.23.19.242 ras> sys logs syslog facility Usage: [Local ID(1-7)] ras> sys logs syslog facility 1 ras> sys logs syslog active Usage: [0:no/1:yes] ras> sys logs syslog active 1 ras> sys logs syslog display Active: Yes Syslog IP Address: 172.23.19.242 Log Facility: Local 1 ras>

5 Uninstalling Vantage Report
You must uninstall any previous versions of Vantage Report before you install a new version of Vantage Report. Follow this procedure to uninstall Vantage Report. 1 You should first stop Vantage by clicking Logout in the main screen.
2 In Windows, click start, Control Panel, Add or Remove Programs. Select Vantage Report and click Change/Remove.
3 In the InstallShield Wizard screen, select Remove and click Next.
Vantage Report Quick Start Guide 4 Click OK to confirm that you want to remove Vantage Report.
5 This screen displays the status of the program removal.
Vantage Report Quick Start Guide 6 This screen displays when Vantage Report has been removed from your computer. Click Finish.
6 Viewing Your Products Certifications
1 Go to www.zyxel.com. 2 Select your product from the drop-down list box on the ZyXEL home page to go to that product's page. 3 Select the certification you wish to view from this page.

Note: This Users Guide discusses the features in the full version.
The following table shows differences between the basic and full versions.
Table 1 Differences Between Basic Version and Full Version

FEATURE

Number of supported devices Supported formats for scheduled reports Drill-down reports Reverse DNS lookup Reverse Hostname lookup Web usage by category AntiVirus AntiSpam Dashboard Number of scheduled reports Customizable scheduled report templates Schedule Report Format Reports for the ZyWALL 1050/ZyWALL USG series
1 PDF 1 layer no no no no no no 20 no PDF no
up to 100 PDF, HTML 2 layers yes yes yes yes yes yes 20 per device yes PDF, HTML yes
There is also a free trial of the full version. The trial version is the same as the full version except that it only supports one device. You can get the trial version by registering Vantage Report. See Section 13.5 on page 432 for more information.
1.3 Hardware Requirements
Minimum hardware requirements: Intel Pentium 4 processor 1 GHz 512 Mb RAM
Chapter 1 Introducing Vantage Report 8 GB free hard disk space The following table shows the recommended hardware specifications. The more powerful your computer, the more devices you can manage.
Table 2 Hardware Specification Recommendations

NUMBER OF DEVICES

0-- - 100
LOG HANDLING CAPABILITY (LOGS/ SEC)

0 - - - 1500

CPU SPEC (GHZ)
Intel P4 2.6 GHz Intel P4 2.6 GHz Intel P4 3.2 GHz

MEMOR Y SPEC

512 MB 1 GB 1 GB
LOG SPACE REQUIRED (GB/ DAY)

0-- - 24

Chapter 1 Introducing Vantage Report
The Vantage Report Server
This chapter explains several characteristics of the Vantage Report server.
2.1 Starting and Stopping the Vantage Report Server
Note: Make sure the port Vantage Report uses for web services is not used by other applications, especially web servers.
The Vantage Report server runs as a service on the Vantage Report server. By default, this service starts automatically when you log in to the Vantage Report server. You can use the services management screen to start, stop, or configure this service. To open this screen, 1 In Windows 2000, click Start > Settings > Control Panel > Administrative Tools > Services. The Services screen opens. In Windows XP, click Start > Control Panel > Performance and Maintenance > Administrative Tools > Services. The Services screen opens.

Chapter 2 The Vantage Report Server In Windows Vista or Windows 7, click Start > Control Panel > Administrative Tools > Services. The Services screen opens.
Right-click on Vantage Report. A menu appears. Select Start or Stop to start or stop the Vantage Report service. Select Properties to configure the service.
2.2 E-Mail in the Vantage Report Server
Note: Before the Vantage Report server can send e-mail to anyone, you have to configure the SMTP mail server. See Section 13.2 on page 428 for more information.
The Vantage Report server can use e-mail to send information in several situations. In some situations, it sends e-mail to the e-mail address that is associated with a specific user (see Section 13.3 on page 429). In other situations, it sends e-mail to any valid e-mail address. scheduled report - The Vantage Report server can send one or more statistical reports regularly or one-time to any valid e-mail address. See Chapter 11 on page 383 for more information. system notifications - When certain system parameters cross a threshold (minimum or maximum) value, the Vantage Report server sends e-mail to the Vantage Report administrator (the e-mail address associated with the root account). Some of these messages are warnings; in some situations, however, the Vantage Report server starts or stops receive logs. See Appendix A on page 465 for a list of parameters and threshold values. One of the threshold values can be configured. See Section 13.1 on page 423.
Chapter 2 The Vantage Report Server forgotten password - A user clicks Forget Password? in the Login screen. In this case, the Vantage Report server sends the account information to the email address associated with the specified user name. See Section 3.2 on page 31 for an example of the Login screen. test message - The Vantage Report administrator tests the SMTP mail server settings. The Vantage Report server sends an e-mail message to the e-mail address associated with the root account. See Section 13.2 on page 428 for more information.
2.3 Time in the Vantage Report Server
In Vantage Report, clock time is the time the Vantage Report server receives information (log entries or traffic statistics) from the ZyXEL devices, not the time the device puts in the entry. As soon as the Vantage Report server receives information, it replaces device times with the current time in the Vantage Report server. The Vantage Report server processes log entries and traffic statistics before the information is available in any screen (including log viewers). For performance reasons, the Vantage Report server does not process this information right away. Instead, the processing time depends on the way the information is used in Vantage Report. See the following table for processing times for each menu item.

See Section 2.4 on page 25 for more information about the source data used by the statistical report.
Chapter 3 The Web Configurator You can also right-click on statistical reports. In some places, you see the standard browser menu. In other places (especially on graphs), the following menu appears.
Figure 20 Report and Setting Window Right-Click Menu

3.6.3 View Logs

The Logs > Log Viewer screen displays the logs related to an individual record in a statistical report. See Appendix C on page 481 and Appendix D on page 507 for information on the logs.

Figure 21 View Logs

See Table 169 on page 402 for the description of each field in this screen.

3.7 System Dashboard

When you log into the Vantage Report, the System Dashboard is the first screen displayed. The screen summarizes the Vantage Report system, license, log received and system settings information. You can also click the Dashboard button at the right top corner to open this screen when you are in another screen.
Figure 22 System Dashboard
Each field is described in the following table.
Table 16 System Dashboard
Refresh Now Server Information Software Version Release Date Free Disk Space Max JVM Memory Size This field displays the Vantage Report version. This field displays the date the Vantage Report software version is released. This field displays the available disk space in the computer your Vantage Report is installed. This field displays the maximum memory size the Vantage Reports Java Virtual Machine (JVM) can allocate on the computer where the Vantage Report is installed. You can configure the memory size according to the computers RAM (Random Access Memory) size. Java applications request memory to the computer through the JVM. This field displays the total amount of memory the computer has allocated for the Vantage Reports JVM. This field displays the amount of memory size the Java applications are using.
Click this to get this screen updated immediately.
Total JVM Memory Size Used JVM Memory Size
Free JVM Memory Size Total Log Number Total Number of Today Max Log Number of Single Device Average Speed of Receiver License Information Status This field displays the status or the version type (Full Version or Basic Version) of the Vantage Report license. Click the hyperlink to view more information about the license status in the System Setting > Registration screen. This field displays the user account you used to register your Vantage Report to the www.zyxel.com website. Click the myzyxel.com hyperlink to take you to the website. www.myzyxel.com is a central product registration website owned by ZyXEL. This field displays the string generated during the registration of your Vantage Report to www.zyxel.com. This field displays the maximum number of ZyXEL devices your Vantage Report version supports. This field displays the maximum ZyXEL devices you are allowed to manage in the Vantage Report. The number depends on the license you have entered in the System Setting > Registration. See Section 13.5.1 on page 433. This field displays the number of ZyXEL devices you can manage in the Vantage Report. Click the Add Device icon to add more devices in the Vantage Report. This field displays the copyright of the Vantage Report. This field displays the number of days the Vantage Report stores logs. The Vantage Report automatically deletes logs over this configured days. This field displays the mail server you configured for the Vantage Report to send reports through emails. Click the edit icon to take you to the System Setting > Server Configuration screen where you can configure the related settings.

This field displays the top intrusion signatures in the selected device, sorted by the number of intrusions by each one. Click on an intrusion signature to look at the top sources for the selected signature.
This field displays what color represents each intrusion signature in the graph.

Severity Type

This field displays the severity of each intrusion signature. This field displays what kind of intrusion each intrusion signature is. This corresponds to IDP > Signature > Attack Type in most ZyXEL devices. This field displays the number of intrusions by each intrusion signature. This field displays what percentage of all intrusions was made by each intrusion signature. This is the security issue identification number. Clicking on the entries in this column will open a new window with a decription of this security issue (see Figure 122 on page 270). Click this icon to see the logs that go with the record. This entry displays the totals for the intrusion signatures above.
Intrusions % of Intrusions signature id

View Logs Total

7.2.4 Top Intrusion Signatures Drill-Down
Use this report to look at the top sources of intrusions for any top signature.
Chapter 7 Network Attack Click on a specific intrusion signature in Report > Network Attack > Intrusion > Top Intrusions to open this screen.
Figure 124 Report > Network Attack > Intrusion > Top Intrusions > Drill-Down
Table 112 Report > Network Attack > Intrusion > Top Intrusions > Drill-Down
This field displays the top sources of the selected intrusion signature, sorted by the number of intrusions by each one. If the number of sources is less than the maximum number of records displayed in this table, every source is displayed. Each source is identified by its IP address. If DNS Reverse is enabled in System > General Configuration, the table displays the domain name, if identifiable, with the IP address (for example, www.yahoo.com/200.100.20.10).
This field displays what color represents each source in the graph. This field displays the number of intrusions by each source. This field displays what percentage of all intrusions using the selected intrusion signature was made by each source. Click this icon to see the logs that go with the record. This entry displays the totals for the sources above. If the number of sources of the selected intrusion signature is greater than the maximum number of records displayed in this table, this total might be a little lower than the total in the main report. Click this to return to the main report.

This field displays the top destinations of viruses blocked in the selected device, sorted by the number of occurrences at each one. If the number of destinations is less than the maximum number of records displayed in this table, every destination is displayed. Each destination is identified by its IP address.
This field displays what color represents each destination in the graph.
Occurrences % of Occurrences View Logs Total
This field displays the number of occurrences at each destination if the selected device had not blocked the virus. This field displays what percentage of all occurrences were going to each destination. Click this icon to see the logs that go with the record. This entry displays the totals for the destinations above.
7.3.8 Top Virus Destinations Drill-Down
Use this report to look at the top viruses for any top destination. Click on a specific destination in Report > Network Attack > AntiVirus > Top Destinations to open this screen.
Figure 138 Report > Network Attack > AntiVirus > Top Destinations > Drill-Down
Table 126 Report > Network Attack > AntiVirus > Top Destinations > Drill-Down
This field displays the top viruses stopped from going to the selected destination, sorted by the number of occurrences by each one. This field displays what color represents each virus in the graph. This field displays the number of times each virus was sent to the selected destination. This field displays what percentage each virus made of the viruses sent to the selected destination. Click this icon to see the logs that go with the record. This entry displays the totals for the viruses above. If the number of viruses sent to the selected destination is greater than the maximum number of records displayed in this table, this total might be a little lower than the total in the main report. Click this to return to the main report.

7.4 AntiSpam

These reports look at spam messages that were detected by the ZyXEL devices anti-spam feature. You can also look at the top senders and sources of spam messages.
Note: To look at anti-spam reports, each ZyXEL device must record anti-spam messages in its log. See the Users Guide for each ZyXEL device for more information. In most devices, go to Logs > Log Settings, and make sure AntiSpam is enabled.

7.4.1 Spam Summary

Use this report to look at the number of spam messages by time interval.
Chapter 7 Network Attack Click Report > Network Attack > AntiSpam > Summary to open this screen.
Figure 139 Report > Network Attack > AntiSpam > Summary
Table 127 Report > Network Attack > AntiSpam > Summary

Select a specific Start Date and End Date. The date range can be up to 30 days long, but you cannot include days that are older than Store Log Days in System > General Configuration. Click Apply to update the report immediately, or click Cancel to close this screen without any changes. The Login Type field is the same as in the main screen. These fields reset to the default values when you click a menu item in the menu panel (including the menu item for the same report). It does not reset when you open or close drill-down reports. Time This field displays the time the Vantage Report server received the log entry from the ZyXEL device, not the time the user logged into the device. This field displays who logged into the selected device. This field displays what type of connection the user used to log into the device. This field displays the IP address of the computer the user used to log into the selected device. This field displays how many records there are for the specified search criteria. This field displays how many screens it takes to display all the records. Click First, Last, or a specific page number to look at the records on that page. Some choices are not available, depending on the number of pages.s Enter the page number you want to see, and click Go.
Login User Login Type Source IP Total Count Total Page First. Last

Chapter 9 Event

9.2 Failed Logins
Use this screen to look at who tried to log in into the ZyXEL device (for management or monitoring purposes) but failed. See Section 2.4 on page 25 for more information about the source data used by the report.
Click Report > Event > Login > Failed Login to open the Failed Login screen.
Figure 168 Report > Event > Login > Failed Login
Table 156 Report > Event > Device Login > Failed Login
Select how many more days of information, ending with current information today, you want to look at. Select 1 if you only want to look at todays information. Click this if you want to specify the select any Start Date and End Date. The Report Display Settings screen appears. This field displays the time the Vantage Report server received the log entry from the ZyXEL device, not the time the user tried unsuccessfully to log into the device. This field displays who tried unsuccessfully to log into the selected device. This field displays what type of connection the user unsuccessfully tried to use to log into the device.

Settings Time

Login User Login Type
Source IP Total Count Total Page First. Last

10.1.1 What Endpoint Security Can Check
The settings endpoint security can check vary depending on the OS of the users computer. Depending on the OS, EPS can check user computers for the following: Operating System (Windows, Linux, Mac OSX, or others) Windows version and service pack version Windows Auto Update setting and installed security patches Personal firewall installation and activation Anti-virus installation and activation Windows registry settings Processes that the endpoint must execute Processes that the endpoint cannot execute The size and version of specific files

Chapter 10 EPS

10.2 EPS Summary
Use this screen to view statistics about the number of users computers that passed or failed EPS checking with the reasons for failure displayed in a bar or pie graph. Select a device in the device window on the left of the main screen and then click Report > EPS to open the EPS Summary screen.
Figure 171 Report > EPS
Table 159 Report > EPS
The graph displays the information in the table visually. Click the Pie View or the Bar View icon. You can specify the Default Chart Type in System > General Configuration. Move your mouse over a slice in the pie chart or a bar in the bar chart to identify it. Click on a slice in the pie chart to move it away from the pie chart a little.

Checking Item

This field displays the description about whether users computers passed all the EPS checking items or failed a specific checking item on the selected device. This field displays what color represents each EPS checking result in the graph.

Records % of Records

This field displays the number of users computers that passed all the EPS checking items or failed a specific checking item. This field displays what percentage each EPS checking results number of users computers makes out of the total number of users computers that attempted to access the corporates network. Click this icon to see the logs that go with the record. This entry displays the totals for the EPS rules above.

10.3 View Logs

Use this screen to view detailed information about users who passed or failed the EPS checking items defined on the selected ZyWALL device. Click View Logs next to an entry in the Report > EPS screen to open the screen.
Figure 172 Report > EPS > View Logs
Table 160 Report > EPS > View Logs

User IP Message Time

This field displays who tried successfully or unsuccessfully to access the protected network. This field displays the IP address of the users computer the user used to try to access the protected network. This field shows whether the users session passed EPS checking or the reason it failed. This field displays the time the Vantage Report server received the log entry from the ZyXEL device, not the time the user tried to access the protected network. This field displays how many records there are for the specified search criteria.

Hash Option

Local Host

FTP Site

Storage Server
Select this to store the archive to a storage server. Additional fields appear when you choose this option. See Section 12.5.1.2 on page 415 for more details.

Archive Location

Specify where you want Vantage Report to store log archives. The fields vary according to your preferred storage location. Select Local Host to store archives in the local directory of the Vantage Report. Select FTP Site to store the archives in an FTP server. Make sure you know the FTP Host/IP address, User Name and Password. Select Storage Server to store the archives on a storage server, such as a Network Attached Storage (NAS) server. Make sure you know the Network Folder server location, User Name and Password.

Save Reset

Click this to save your settings. Click this to change the settings in this screen to the last-saved values.
12.5.1.1 File Transfer Protocol
Use this screen to store archive files on a File Transfer Protocol (FTP) server.
Chapter 12 Logs Click Logs > Log Viewer > File Archiving Settings. Choose Ftp Site to display the following fields.
Figure 190 Logs > Log Archiving > File Archiving Settings > Ftp Site
Table 177 Logs > Log Archiving > File Archiving Settings > FTP Site
Ftp Host/IP Ftp Port User Name Password File path
Enter the location of the File Transfer Protocol (FTP) server you want to use in the Ftp Host/IP field. Enter the port number the FTP server uses for the service. Enter the User Name for your FTP account. Enter the Password for your FTP account. You can specify in which FTP folder you want to store the archive in the File Path field (optional).
See Figure 191 on page 416 for descriptions of other table fields found in this screen.

12.5.1.2 Storage Server

Use this screen to store archive files on a storage server, such as a Network Attached Storage (NAS) server.
Chapter 12 Logs Click Logs > Log Viewer > File Archiving Settings. Choose Storage Server to display the following fields.
Figure 191 Logs > Log Archiving > File Archiving Settings > Storage Server
Table 178 Logs > Log Archiving > File Archiving Settings > Storage
Network Folder Authentication User Name Password
Enter the server location where you want to store the archive in the Network Folder field. Click Authentication if your server prompts for identification before allowing access. Enter the User Name for server login if authentication is required. Enter the corresponding Password for server login if authentication is required.
See Figure 192 on page 417 for descriptions of other table fields found in this screen.

This message is sent by the device ("RAS" displays as the system name if you havent configured one) at the time when this syslog is generated. The facility is defined in the web MAIN MENU, LOGS, Log Settings page. The severity is the logs syslog class. 1stReIP is the IP address of the first mail relay server. The definition of messages and notes are defined in the Anti-Spam log descriptions. This message is sent by the "RAS" at the time when this syslog is generated. The facility is defined in the web MAIN MENU, LOGS, Log Settings page. The severity is the centralized log type. The definition of messages and notes are defined in the IDP categories.
Appendix C ZyNOS Log Descriptions The following table shows RFC-2408 ISAKMP payload types that the log displays. Please refer to the RFC for detailed information on each type.
Table 236 RFC-2408 ISAKMP Payload Types

LOG DISPLAY

SA PROP TRANS KE ID CER CER_REQ HASH SIG NONCE NOTFY DEL VID

PAYLOAD TYPE

Security Association Proposal Transform Key Exchange Identification Certificate Certificate Request Hash Signature Nonce Notification Delete Vendor ID
ZyWALL 1050 and ZyWALL USG Series Log Descriptions
This appendix provides descriptions of example log messages for the ZyWALL 1050 and ZyWALL USG Series.
Table 237 Content Filter Logs
Content filter has been enabled Content filter has been disabled
An administrator turned the content filter on. An administrator turned the content filter off.
Table 238 Forward Web Site Logs

%s: Trusted Web site

The device allowed access to a web site in a trusted domain. %s: website host
The device allowed access to a web site. The content filtering service is registered and activated or the service is not activated in a profile, this is a web site that is not blocked according to a profile and the default policy is not set to block. %s: website host
%s: Service is not registered
The device allowed access to a web site. The content filtering service is unregistered and the default policy is not set to block. %s: website host
Appendix D ZyWALL 1050 and ZyWALL USG Series Log Descriptions
Table 239 Blocked Web Site Logs

%s :%s

The rating server responded that the web site is in a specified category and access was blocked according to a content filter profile. 1st %s: website host 2nd %s: website category

%s: Unrated

The rating server responded that the web site cannot be categorized and access was blocked according to a content filter profile. %s: website host

%s: Service is unavailable
Content filter rating service is temporarily unavailable and access to the web site was blocked due to: 1. Can't resolve rating server IP (No DNS) 2. Invalid service license 4. Rating service is restarting 5. Cant connect to rating server 6. Query failed 7. Query timeout 8. Too many queries 9. Unknown reason %s: website host

%s: %s(cache hit)

The web site's category exists in the devices local cache and access was blocked according to a content filter profile. 1st %s: website host 2nd %s: website category
%s: Not in trusted web list
The web site is not a trusted host/domain, and the device blocks all traffic except for trusted web sites. %s: website host

%s: Contains ActiveX

The web site contains ActiveX and access was blocked according to a profile. %s: website host

%s: Contains Java applet

The web site contains Java applet and access was blocked according to a profile. %s: website host

%s: Contains cookie

The web site contains a cookie and access was blocked according to a profile. %s: website host
Table 239 Blocked Web Site Logs (continued)
%s: Proxy mode is detected
The system detected a proxy connection and blocked access according to a profile. %s: website host
%s: Forbidden Web site The web site is in forbidden web site list. %s: website host %s: Keyword blocking The web content matched a user defined keyword. %s: website host %s: Blocking by default policy No content filter policy is applied and access was blocked since the default action is block. %s: website host

Table 240 User Logs

%s %s has logged in from %s
The specified user signed in. 1st %s: Administrator|Limited-Admin|User|Ext-User|Guest 2nd %s: username 3rd %s: service name (HTTP/HTTPS, FTP, telnet, SSH, console) NOTE field: %s means username.
%s %s has logged out from %s
The specified user signed out. 1st %s: Administrator|Limited-Admin|User|Ext-User|Guest 2nd %s: username 3rd %s: service name (HTTP/HTTPS, FTP, telnet, SSH, console) NOTE field: %s means username.
%s %s from %s has been logged out (re-auth timeout)
The specified user was signed out by the device due to a reauthentication timeout. 1st %s: Administrator|Limited-Admin|User|Ext-User|Guest 2nd %s: username 3rd %s: service name (HTTP/HTTPS, FTP, telnet, SSH, console) NOTE field: %s means username.
Table 240 User Logs (continued)
%s %s from %s has been logged out (lease timeout)
The specified user was signed out by the device due to a lease timeout. 1st %s: Administrator|Limited-Admin|User|Ext-User|Guest 2nd %s: username 3rd %s: service name (HTTP/HTTPS, FTP, telnet, SSH, console) NOTE field: %s means username.
%s %s from %s has been logged out (idle timeout)
The specified user was signed out by the device due to an idle timeout. 1st %s: Administrator|Limited-Admin|User|Ext-User|Guest 2nd %s: username 3rd %s: service name (HTTP/HTTPS, FTP, telnet, SSH, console) NOTE field: %s means username.

10. U.S. GOVERNMENT RESTRICTED RIGHTS. If Software is being acquired by or on behalf of the U.S. Government or by a U.S. Government prime contractor or subcontractor (at any tier), then the Government's rights in Software and accompanying documentation will be only as set forth in this Agreement; this is in accordance with 48 CFR 227.7201 through 227.7202-4 (for Department of Defense (DOD) acquisitions) and with 48 CFR 2.101 and 12.212 (for non-DOD acquisitions).
11. GOVERNING LAW. Any action related to this Agreement will be governed by California law and controlling U.S. federal law. No choice of law rules of any jurisdiction will apply.
12. SEVERABILITY. If any provision of this Agreement is held to be unenforceable, this Agreement will remain in effect with the provision omitted, unless omission would frustrate the intent of the parties, in which case this Agreement will immediately terminate.
13. INTEGRATION. This Agreement is the entire agreement between you and Sun relating to its subject matter. It supersedes all prior or contemporaneous oral or written communications, proposals, representations and warranties and prevails over any conflicting or additional terms of any quote, order, acknowledgment, or other communication between the parties relating to its subject matter during the term of this Agreement. No modification of this Agreement will be binding, unless in writing and signed by an authorized representative of each party.
SUPPLEMENTAL LICENSE TERMS
These Supplemental License Terms add to or modify the terms of the Binary Code License Agreement. Capitalized terms not defined in these Supplemental Terms shall have the same meanings ascribed to them in the Binary Code License Agreement. These Supplemental Terms shall supersede any inconsistent or conflicting terms in the Binary Code License Agreement, or in any license contained within the Software.
Appendix E Open Software Announcements A. Software Internal Use and Development License Grant. Subject to the terms and conditions of this Agreement and restrictions and exceptions set forth in the Software "README" file, including, but not limited to the Java Technology Restrictions of these Supplemental Terms, Sun grants you a non-exclusive, nontransferable, limited license without fees to reproduce internally and use internally the Software complete and unmodified for the purpose of designing, developing, and testing your Programs.
B. License to Distribute Software. Subject to the terms and conditions of this Agreement and restrictions and exceptions set forth in the Software README file, including, but not limited to the Java Technology Restrictions of these Supplemental Terms, Sun grants you a non-exclusive, non-transferable, limited license without fees to reproduce and distribute the Software, provided that (i) you distribute the Software complete and unmodified and only bundled as part of, and for the sole purpose of running, your Programs, (ii) the Programs add significant and primary functionality to the Software, (iii) you do not distribute additional software intended to replace any component(s) of the Software, (iv) you do not remove or alter any proprietary legends or notices contained in the Software, (v) you only distribute the Software subject to a license agreement that protects Sun's interests consistent with the terms contained in this Agreement, and (vi) you agree to defend and indemnify Sun and its licensors from and against any damages, costs, liabilities, settlement amounts and/or expenses (including attorneys' fees) incurred in connection with any claim, lawsuit or action by any third party that arises or results from the use or distribution of any and all Programs and/or Software.

6.No Warranty THE SOFTWARE IS PROVIDED "AS IS." TO THE MAXIMUM EXTENT PERMITTED BY LAW, ZyXEL DISCLAIMS ALL WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. ZyXEL DOES NOT WARRANT THAT THE FUNCTIONS CONTAINED IN THE SOFTWARE WILL MEET ANY REQUIREMENTS OR NEEDS YOU MAY HAVE, OR THAT THE SOFTWARE WILL OPERATE ERROR FREE, OR IN AN UNINTERUPTED FASHION, OR THAT ANY DEFECTS OR ERRORS IN THE SOFTWARE WILL BE CORRECTED, OR THAT THE SOFTWARE IS COMPATIBLE WITH ANY PARTICULAR PLATFORM. SOME JURISDICTIONS DO NOT ALLOW THE WAIVER OR EXCLUSION OF IMPLIED WARRANTIES SO THEY MAY NOT APPLY TO YOU. IF THIS EXCLUSION IS HELD TO BE UNENFORCEABLE BY A COURT OF COMPETENT JURISDICTION, THEN ALL EXPRESS AND IMPLIED WARRANTIES SHALL BE LIMITED IN DURATION TO A PERIOD OF THIRTY (30) DAYS FROM THE DATE OF PURCHASE OF THE SOFTWARE, AND NO WARRANTIES SHALL APPLY AFTER THAT PERIOD.
7.Limitation of Liability IN NO EVENT WILL ZyXEL BE LIABLE TO YOU OR ANY THIRD PARTY FOR ANY INCIDENTAL OR CONSEQUENTIAL DAMAGES (INCLUDING, WITHOUT LIMITATION, INDIRECT, SPECIAL, PUNITIVE, OR EXEMPLARY DAMAGES FOR LOSS OF BUSINESS, LOSS OF PROFITS, BUSINESS INTERRUPTION, OR LOSS OF BUSINESS INFORMATION) ARISING OUT OF THE USE OF OR INABILITY TO USE THE PROGRAM, OR FOR ANY CLAIM BY ANY OTHER PARTY, EVEN IF ZyXEL HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. ZyXEL'S AGGREGATE LIABILITY WITH RESPECT TO ITS OBLIGATIONS UNDER THIS AGREEMENT OR OTHERWISE WITH RESPECT TO THE SOFTWARE AND DOCUMENTATION OR OTHERWISE SHALL BE EQUAL TO THE PURCHASE PRICE, BUT SHALL IN NO EVENT EXCEED $1,000. BECAUSE SOME STATES/COUNTRIES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES, THE ABOVE LIMITATION MAY NOT APPLY TO YOU.
8.Export Restrictions THIS LICENSE AGREEMENT IS EXPRESSLY MADE SUBJECT TO ANY APPLICABLE LAWS, REGULATIONS, ORDERS, OR OTHER RESTRICTIONS ON THE EXPORT OF THE SOFTWARE OR INFORMATION ABOUT SUCH SOFTWARE WHICH MAY BE IMPOSED FROM TIME TO TIME. YOU SHALL NOT EXPORT THE SOFTWARE, DOCUMENTATION OR INFORMATION ABOUT THE SOFTWARE AND

Copyright

Copyright 2010 by ZyXEL Communications Corporation.

Legal Information

The contents of this publication may not be reproduced in any part or as a whole, transcribed, stored in a retrieval system, translated into any language, or transmitted in any form or by any means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the prior written permission of ZyXEL Communications Corporation. Published by ZyXEL Communications Corporation. All rights reserved.
Note: Refer also to the Open Software Announcements on page 553.

Disclaimer

ZyXEL does not assume any liability arising out of the application or use of any products, or software described herein. Neither does it convey any license under its patent rights nor the patent rights of others. ZyXEL further reserves the right to make changes in any products described herein without notice. This publication is subject to change without notice.

Trademarks

ZyNOS (ZyXEL Network Operating System) is a registered trademark of ZyXEL Communications, Inc. Other trademarks mentioned in this publication are used for identification purposes only and may be properties of their respective owners.

ZyXEL Limited Warranty

ZyXEL warrants that (a) the Vantage software (henceforth called the SOFTWARE) will perform substantially in accordance with the accompanying written materials for a period of ninety (90) days from the date of receipt, and (b) any Support Services provided by ZyXEL shall be substantially as described in applicable written materials provided to you by ZyXEL, and ZyXEL support engineers will make commercially reasonable efforts to solve any problem issues. To the extent
Appendix F Legal Information allowed by applicable law, implied warranties on the SOFTWARE, if any, are limited to ninety (90) days.

CUSTOMER REMEDIES.

ZyXEL's and its suppliers' entire liability and your exclusive remedy shall be, at ZyXEL's option, either (a) return of the price paid, if any, or (b) repair or replacement of the SOFTWARE that does not meet ZyXEL's Limited Warranty and which is returned to ZyXEL with a copy of your receipt. This Limited Warranty is void if failure of the SOFTWARE has resulted from accident, abuse, or misapplication. Any replacement SOFTWARE will be warranted for the remainder of the original warranty period or thirty (30) days, whichever is longer. Outside Taiwan, neither these remedies nor any product support services offered by ZyXEL are available without proof of purchase from an authorized international source.