ZyWALL

Quick Info. Guide
ZyWALL USG Series Feature Matrix

Infrastructure Security

ZyWALL USG 2000 ZyWALL USG 1000 ZyWALL USG 300 ZyWALL USG 200 ZyWALL USG 100

Graphic

System Firewall Throughput VPN Throughput (AES) UTM Throughput (AV+IDP+Firewall) Unlimited User Licenses Sessions Max. Concurrent IPSec VPN Tunnels Max. Concurrent SSL VPN Users Physical Port Customizable Zone Networking Routing/NAT/SUA Mode Bridge Mode Mix Mode (Routing+Bridge) VLAN Tagging (802.1q) Wireless Card Support 3G Support Security Firewall IPsec VPN SSL VPN Content Filtering Anti-SPAM Anti-Virus IDS/IDP IM/P2P Management Bandwidth Management User-aware Management High Availability Device HA VPN HA Multiple WANs for Load Balancing Auto Fail-over, Fail-back Dial Backup Redundant Power Module Authentication Method Local Database Radius LDAP Microsoft AD ZyWALL OTP Management WebGUI (HTTP and HTTPS) Command Line Vantage CNM Vantage Report
Note: *1: With SEM-DUAL/SEM-VPN module

*3 *3 *3

2,000 Mbps 500 Mbps*Mbps*2
350 Mbps 150 Mbps 100 Mbps
200 Mbps 100 Mbps 48 Mbps

150 Mbps 75 Mbps 24 Mbps

100 Mbps 50 Mbps 24 Mbps
1,000,000 2,(6) 10/100/1000 GbE (2) Dual-Personality GbE (SFP/RJ45)

500,000 1,(250*3)

60,10 (25*3)
40,x LAN/DMZ, 2 x WAN, 1 x OPT (All GbE)
20,x LAN/DMZ, 2 x WAN (All GbE)

(5) 10/100/1000 GbE

(7) 10/100/1000 GbE
*2: With SEM-DUAL/SEM-UTM module
*3: Available In future firmware release

ZyWALL Feature Matrix

Home Office/SOHO

ZyWALL 2 Plus ZyWALL 2WG

ZyWALL SSL 10
System Firewall Throughput VPN Throughput (AES) UTM Throughput (AV+IDP+Firewall) Unlimited User Licenses Sessions Max. Concurrent IPSec VPN tunnels Max. Concurrent SSL VPN users Wireless Physical Port Customizable Zone WAN Type Ethernet 3G (Optional) Networking Routing/NAT/SUA Mode Bridge Mode Mix Mode (Routing+Bridge) VLAN Tagging (802.1q) Security Firewall IPsec VPN SSL VPN Content Filtering Anti-SPAM Anti-Virus IDS/IDP IM/P2P Bandwidth Management User-aware Management High Availability Device HA VPN HA Multiple WANs for Load Balancing Auto Fail-over, Fail-back Dial Backup Authentication Method Local database Radius LDAP Microsoft AD ZyWALL OTP Management WebGUI (HTTP and HTTPS) Command Line Vantage CNM Vantage Report
Note: *1: Available In future firmware release

24 Mbps 24 Mbps

24 Mbps

3,000 5

4 x LAN, 1 x WAN

4 x LAN/DMZ, 1 x WAN
Maintain Control: Unified Security Gateway helps you win the battle
Challenges that may Drain Your IT Resource
1. Secure Connectivity With the nature, scale and risks associated with significant deployments of new networking technologies, organizations must evaluate solutions to build up a safer infrastructure to secure online transactions. Infrastructure should be tailored to meet operation requirements for expanding remote sites as well as mobile teleworkers.
2. Proactive Protection Malicious virus, worm, exploits could cripple corporate networks and halt business transactions. In addition to severe financial loss, you also risk leakage of confidential information. Your network is bombarded with massive amounts of junk mail (spam). Without intelligent detection and proactive blocking, users have to go through the tedious and time-consuming task of filtering through their email, reducing productivity.
3. Policy Compliance With numerous file-sharing peer-to-peer (P2P) and Instant Messaging (IM) applications, it is easy for company employees to share files and chat online during work hours. File sharing not only compromises network safety with the sharing of questionable files, but may also violate copyright laws and create legal hassles.
4. Network Resilience Broken ISP links, hardware and software failure on the gateway, dead VPN tunnels - these are severe challenges IT staff face when designing the network infrastructure. We need to take fault tolerance of the network path into consideration when designing a network infrastructure for nonstop operations.

ZyWALL USG Series Advantages
The ZyWALL USG series is a high performance, deep packet inspection security solution for small business to enterprise. It embodies a Stateful Packet Inspection (SPI) firewall, Anti-Virus, Intrusion Detection and Prevention (IDP), Content Filtering, Anti-Spam, and VPN (IPSec/SSL/L2TP) in one box. This multilayered security safeguards your organizations customer and company records, intellectual property, and critical resources from external and internal threats.
1. Leading, High Performance UTM Solution
ZyWALL USG series deploys hardware-acceleration technology in one box. Powered by high-performance SecuASIC technology and a hardware-based encryption accelerator, the ZyWALL USG series delivers leading high performance and multi-layer threat protection for small business to enterprises. All ZyWALL USG series support Gigabit Ethernet interfaces.
2. Robust Hybrid VPN (IPSec and SSL)
The ZyWALL USG series can provide secure access from remote locations to corporate resources through the Internet for organizations of any size. Using IPSec VPN companies can secure connections to branch offices, partners, and headquarters. Road warriors and telecommuters can use SSL or L2TP VPN to securely access the company network without having to install VPN software.

3. Managing IM/P2P Abuse

For increasing network efficiency and business productivity, the IM/P2P application needs to be well managed. The ZyWALL USG series support Application Patrol which controls who can use IM and P2P applications like MSN and BitTorrent, and even who can use specific features within an application.
4. Non-Stop Internet Access with Multiple WAN and 3G as backup
The ZyWALL USG not only supports multiple WAN ports but also supports USB 3G or PCMCIA 3G card. This enables it to provide active-active load sharing or active-passive failover configuration to deliver highly reliable network connectivity. To minimize the impact of single-point failures, the ZyWALL USG series support device HA (High Availability) to assure network availability.
5. ICSA Firewall, IPSec, Antivirus Certification
With ICSA certified SPI Firewall, Anti-Virus and IPSec VPN, the ZyWALL USG series enables organizations to take complete control of their network infrastructure and provide the most up-to-date protection against the network threats.

6. Comprehensive Report System
ZyWALL USG series build-in report system which offers a comprehensive set of real-time and historical reports, including firewall, virus and intrusion attacks, bandwidth usage, web site usage, and user activity. Furthermore, with the web-based reporting system, Vantage Report (VRPT), administrators can easily collect traffic data and analyze a distributed network, so organizations are aware of suspicious activity and to ensure increase business productivity.
ZyXEL North America Tel: 800.255.4101
For more product information, visit us on the web at www.us.ZyXEL.com

0808v100qig-Security

Copyright 2008 ZyXEL Communications Corp. All rights reserved. ZyXEL, ZyXEL logo are registered trademarks of ZyXEL Communications Corp. All other brands, product names, or trademarks mentioned are the property of their respective owners. All specifications are subject to change without notice.

ZyNEWS

Nr. 2|2008
USG next Security Generation
The next security generation is now complete. The successful launch at the end of last year of two high-end rewalls is now followed by the ZyWALL USG 100 and 200, both designed for between 5 and 50 users. A key feature of the entire USG series is the hybrid VPN with IPSec, SSL and L2TP which provides maximum remote connectivity exibility.
ZyXEL ZyWALL USG 100 / 200 Article: USG 100: 91-009-045001B USG 200: 91-009-057001B Est. street price: USG 100: 562,00 excl. VAT. USG 200: 844,00 excl. VAT.
Security is not any longer just a matter of hermetically closing your network for every type of access to be sure the no harm will be done to your valuable data or business as a whole. Today its equally important to open your network to exploit exiting new opportunities for mobile access, distance work and integration to partners network. All this is about openness and enhancing the value of existing itsystems and data. And all is about using the right security solution that will both secure the network against any type of attacks and theft, and at the same time open it for authorized users. ZyXELs expanding series of Unied Security Gateways the next generation rewall is the answer to a companys demands for full security and valuable openness. Magnus Ahlberg Nordic Business Manager, Channel
USG next security generation
ZyXEL is extending the line of Unied Security Gateway products the next generation rewall to t every size and type of company: From the small company to the largest enterprise.

Going wireless

The new generation wireless home gateways is here 802.11n Draft 2.0 delivers up to 8x the speed and 5x the range with virtually no dead spots in the radio coverage.

Content

Seamless roaming
To be really useful for voice and video applications a wireless network must have seamless roaming. ZyXEL has the solution
Copyright 2008 ZyXEL Communications Corp., Columbusvej 5, 2860 Sborg Publisher: ZyXEL Communications 2008, Editor. Carsten Hetling, Issue date: 1. August 2008

Security

New addition to the ZyWALL USG family
At the end of May, two fanless models will be added to the ZyWALL USG family: the ZyWALL USG 100 and 200, for between 5 and 50 users. The ZyWALL USG family differs from the ZyWALL ITM series in that it comes with a hybrid VPN, two WAN ports, object-oriented conguration and a number of other key features.
ZyWALL USG 100 The rewall provides comprehensive protection for small networks with up to 25 users. Of the seven gigabit Ethernet ports, two are predened as xed WAN ports. Five ports can be freely allocated to one of the LAN/DMZ/WLAN security zones. A PC card slot and two USB ports support the addition of 3G and WLAN functionality. ZyWALL USG 200 The ZyWALL USG 200 is designed for small and mid-sized businesses with up to 50 users. Two of the seven gigabit Ethernet ports are predened as xed WAN ports. Four ports can be freely allocated to one of the LAN/DMZ/WLAN security zones. One port can be assigned either as a third WAN or LAN/DMZ/WLAN port. This model also offers 3G and WLAN support. Firewall with hybrid VPN Until now, IPSec-based VPN connections have been generally considered to offer the best solution for secure remote access. Today hybrid VPN with IPSec, L2TP and SSL is the ideal tool for meeting the requirements of different business models. IPSec-VPN is primarily used for connecting entire networks. The L2TP included in the operating system is a good solution for remote access by a large number of Windows PCs without the need to install software. SSL-VPN has recently also become established as an access technology in the SME sector. With the new ZyWALL USG solutions, these three VPN types can be used simultaneously.

HSDPA UMTS GPRS EDGE

WAN 1 WAN 2

USB-Modem fr 3G

Front side ZyWALL USG 200

optional WAN or LAN/DMZ

Example of application with backup via 3G
Productivity and security The Application Patrol allows variable access policies to be implemented for specic users or groups. Access to selected instant messaging or peer-to-peer applications can be blocked completely or restricted to certain times or certain bandwidths. Gateway antivirus The administrator can choose between ICSA-certied ZyXEL AV or Kaspersky AV to protect the network from viruses, trojans and spyware. The ZyXEL antivirus solution features around ve times more signatures than the 3,000 or so provided by Kaspersky. The service at the gateway (network) level is an ideal complement to local antivirus protection and inspect the protocols FTP, HTTP, SMTP, POP3 and IMAP4. Intrusion detection & prevention More than 2,000 signatures protect systems from attacks by worms, trojans, backdoors, etc., and recognise the most frequently used instant messaging and peer-to-peer applications that are usually not permitted in a business network. While antivirus functions seek to prevent infection, IDP blocks active intruders or attacks which are already active. Gateway anti-spam ZyWALL USG 100/200 supports free-of-charge protection against spam mail via DNSBL (DNS Block List), also known as the Realtime Blackhole List (RBL). These lists contain the senders of mass mails. The rewall can now be congured to deal with mail from such senders. For exam-
ple, by setting up a rst spam lter at the gateway. Anti-spam will be supported on ZyWALL USG 300/1000 and ZyWALL 1050 by a rmware upgrade as from the third quarter of 2008. High availability At the WAN end, multiple ISP links can be set up so as to ensure redundant Internet access in the event that one ISP fails. A connection via HSDPA/UMTS provides additional backup. A second, identical ZyWALL USG allows high hardware availability in active/passive mode. The conguration is synchronised at regular intervals. If the active rewall fails, the backup takes over the gateway function. Two-fold access security SSL and IPSec-VPN links can be additionally protected by requesting a PIN code which generates a one-time token password (ZyWALL OTP). There is an ever-increasing demand when setting up partner or customer access to a VPN for two-factor authentication. Similar to e-banking systems with scratch lists, two factors are needed for identication. First the password is entered, then the newly generated token number. Status and reporting For a better overview, the current status can be displayed graphically on the status page of the ZyWALL USG 100/200. Detailed reports can be drawn up using the optional VRPT software. Future ZyWALL 5 ZyWALL 5 (without UTM) will remain in the ZyXEL portfolio as a exible stateful packet inspection

rewall. It is envisaged that the established VPN rewall for small networks not requiring UTM services will be replaced in the second quarter of 2009. ZyWALL 5 UTM / 35 / 35 UTM After a brief transition period these models will be replaced by ZyWALL USG 100 and 200. Bundles with services Both new models are also available as attractive bundles with one year AV/IDP/CF. All products in the new ZyWALL USG series have a ve-year warranty. ZyXEL provides regular rmware updates at no extra charge.
Overview of ZyXEL ZyWALL Functions
ZyXEL ZyWALL 5 Firewall ZyXEL ZyWALL USG 1000 USG-Firewall ZyXEL ZyWALL USG 300 USG-Firewall ZyXEL ZyWALL USG 200 USG-Firewall ZyXEL ZyWALL USG 100 USG-Firewall
Data transfer rate: Firewall (Mbps) Data transfer rate: IPSec-VPN (Mbps) Data transfer rate: UTM (Mbps) Max. NAT sessions Max. IPSec tunnels SSL tunnels IDP-/AV-/ CF-/AS service option* Interface/throughput Zone-specic rule Object-oriented conguration High hardware availability Guarantee (in years) Article Sale Price * Anti-spam free of charge 24 Mbps 2 / max. 5

24 Mbps 2 / max. 10

48 Mbps 2 / max. 10

/ / /Q3/08

100 Mbps 5 / max. 50

/ / /Q3/08

-/-/ /4 x LAN/DMZ, 1 x WAN 2 91-009-014001B 434,00 excl. VAT
5 x LAN/DMZ; 2 x WAN Predened only
4 x LAN/DMZ; 2 x WAN, 1 x OPT 7 x 10/100/1000 Predened only

5 x 10/100/1000

Active/passive 5 91-009-045001B 562,00 excl. VAT
Active/passive 5 91-009-057001B 844,00 excl. VAT
Active/passive 5 91-009-034001B 1518,00 excl. VAT
Active/passive 5 91-009-052001B 3350,00 excl. VAT

Wireless LAN

Gigabit WLAN Router 802.11n
The NBG-460N is equipped with state-of-the-art 300 Mbps wireless LAN technology in accordance with IEEE802.11n V2.0. With its 4-port gigabit switch, this router offers a quick platform for communication with PCs, game consoles and storage devices. It also offers a special time switch function which allows the WLAN transmitter to be turned off whenever it is not required.
Gigabit speed The NBG-460N offers full gigabit speed via the integrated 4-port switch which allows it to accommodate high WLAN data throughput rates. This device also includes an integrated NAT router with rewall functions and supports four dynamic DNS services to enable remote access. An all-rounder which is a class above the rest. NEW: WLAN time switch A special function makes it possible to turn the wireless LAN transmitter off during predened periods of time. These periods of time can be dened in 30-minute increments via an online GUI. This feature offers the advantages of increased security and reduced radiation whenever WLAN is not needed. External antennas Should additional wireless coverage ever be needed, three more external antennas can be connected to the NBG-460N. However only suitable antennas, such as the ANT-1106 (Art. 2499), should be used. Both the type of antenna and the distance between the antennas is perfectly adjusted for use with 802.11n.

ZyXEL NBG-460N Article: 91-003-208001B Est. street price: 83,00 excl. VAT.

FEATURES

Gigabit WLAN Firewall Router 802.11n Wireless LAN time switch (online GUI) Virtual DMZ zone 4 dynamic DNS services 2 IPSec VPN tunnels WPA/WPA2 security Wi-Fi Protected Setup (WPS) Vista certified
Dene on/off time segments
300 Mbps via WLAN MIMO technology makes it possible to achieve data rates this high. Under ideal conditions, the net data throughput rate can reach up to 150 Mbps! The 802.11n uses signals which are bounced off walls, ceilings, windows, etc. to increase the data rate and improve transmission reliability. The different wireless streams are received via multiple antennas and, thanks to complex chipsets, ensure the highest-performance connection possible. This technique is the secret behind the excellent results achieved inside buildings with many different obstacles.
Encryption WAN 10 / 100 / 1000 Mbps
Back of the ZyXEL NBG-460N

Wireless-LAN

Hybrid Access Point in practice
ZyXELs Hybrid AP concept makes it possible to combine up to eight access points into one group and congure these via one single online GUI. Networks with multiple access points will benet from a conguration process which has been standardised, simplied and well structured.
Simple conguration and control Conguration is childs play: Via the online GUI, at least one of the APs is assigned the role of controller. As soon as other APs within the same network are assigned the function of Managed AP, these restart, obtain an IP address via DHCP and report to the Controller. The Controller then lists all available access points in Managed AP mode. Communication via exchange Access to the Managed APs now takes place exclusively via the Controller. The network of individual components hybrid APs manifests itself to the administrator as a single, independent system. Communication is directed through encrypted tunnels based on a protocol specially created for this application CAPWAP. Cell and channel planning Proles are created for both band and channel division as well as for the ESSID and security settings in line with cell planning. Multiple prole levels make it possible to organise wireless cells in a structured way. All prole conguration changes are automatically transferred to the assigned access points. An automatic channel assignment function is available within the Hybrid AP which serves the purpose of isolating the cells with the least interference possible. The NWA-3160 is the rst device to support the Hybrid AP concept; other models, including an outdoor version, will follow in the months to come.
Every Hybrid AP-compatible access point can be used either as a normal access point, as an access point in a controller capacity or as a managed access point, as desired.

Tips for seamless roaming
The term roaming refers to the automatic handover of WLAN sessions between various access points. This function is a prerequisite, particularly for VoIP telephony via WLAN. If a VoIP call is being made, roaming sees to it that the call is not interrupted when moving from one cell to another.
ZyXEL NWA-3xxx access points are suitable for demanding WLAN networks for VoIP applications such as those used for business infrastructures, for example. Seamless handover of a session to a neighboring access point is the most challenging requirement. Extremely precise cell planning is essential and the wireless coverage of individual APs must overlap somewhat on the edges. The VoIP WLAN client then makes a decision during operation whether the strength of the approaching AP signal is strong enough to trigger roaming. Here it must be kept in mind that the client has a signicant impact on roaming quality. Updating the client driver or, even better, adjusting the conguration might be sufcient in some cases. The latter option is generally only offered for high-quality products. NWA-3xxx APs from ZyXEL also offer a PMK cache function which speeds up authentication during a cell change and enables nearly seamless roaming.

Area 1 Area 2

ROAMING

PMK-CACHE LAN

PMK cache function enables seamless roaming
ZyXEL business access point with 802.11n
ZyXEL is one of the rst manufacturers to launch a business access point in accordance with 802.11n, the NWA-3165. It uses MIMO technology (multiple in, multiple out) which ensures high reliability and high performance when operating wireless LANs. The NWA-3165 is exible and ideally suited to applications in the healthcare sector or for production and logistics services.
Net throughput of up to 100 Mbps! Until now, rates this fast were only possible via Ethernet connections. MIMO technology uses multiple antennas for transmission and can even increase throughput rates by making use of otherwise undesired reections. This improves WLAN coverage and eliminates so-called dead spots. Wi-Fi n/b/g certied The ZyXEL NWA-3165 is certied in accordance with the most recent draft of the standard, IEEE 802.11n Draft 2.0. This guarantees maximum compatibility for professional WLANs. Since 802.11n is backward compatible to 802.11b/g, NWA-3165 offers a high degree of investment protection. 802.11a, g or n? Of course the question arises of which technology is best and when. In addition to 802.11n, ZyXEL also offers 11a and g products. Finding the right one depends on its intended use. If the installation of a dense network of access points makes cell planning more complex, 11a or g is recommended. 802.11n makes cell planning more difcult since two channels are bundled. 802.11n, on the other hand, is ideal for high transmission rates. While the NWA-3165 is equipped with built-in omnidirectional antennas, external antennas can be used for the NWA-3100, 3160 and 3500 models.

ZyXEL NWA-3165 Article: 91-005-214001B Est. street price: 212,00 excl. VAT.
Overview of ZyXEL Business Access Points
ZyXEL NWA-3165 WLAN-Access-Point ZyXEL NWA-3500 WLAN-Access-Point ZyXEL NWA-3160 WLAN-Access-Point ZyXEL NWA-3100 WLAN-Access-Point
Technology Radio module Max. throughput MultiSSID 802.1Q VLAN tag Ext. antenna connection QoS Article Est. street price 802.11a/b/g single 54 Mbps 8
802.11a/b/g single 54 Mbps 8
802.11a/b/g dual 54 Mbps 2x8
802.11n/b/g single 300 Mbps 8
91-005-161001B 147,00 excl. VAT
91-005-197001B 164,00 excl. VAT
91-005-154001B 240,00 excl. VAT
91-005-214001B 212,00 excl. VAT