Interface

See the Interface section for related information on these screens.

Interface Overview

In general, an interface has the following characteristics.

Types of Interfaces

You can create several types of interfaces in the ZyWALL.

The other types of interfaces--Ethernet, VLAN, bridge, PPPoE/PPTP, and virtual--have a lot of similar characteristics. These characteristics are listed in the following table and discussed in more detail below.

Ethernet, VLAN, Bridge, PPPoE/PPTP, and Virtual Interfaces Characteristics 

Characteristics
Ethernet
VLAN
Bridge
PPPoE/PPTP
Virtual
Name*
gex
vlanx
brx
pppx
**
IP Address Assignment
         
static IP address
Yes
Yes
Yes
Yes
Yes
DHCP client
Yes
Yes
Yes
Yes
No
routing metric
Yes
Yes
Yes
Yes
Yes
Interface Parameters
         
bandwidth restrictions
Yes
Yes
Yes
Yes
Yes
packet size (MTU)
Yes
Yes
Yes
Yes
No
DHCP
         
DHCP server
Yes
Yes
Yes
No
No
DHCP relay
Yes
Yes
Yes
No
No
Ping Check
Yes
Yes
Yes
Yes
No

* - The format of interface names is strict. Each name consists of 2-4 letters (interface type), followed by a number (x, limited by the maximum number of each type of interface). For example, Ethernet interface names are ge1, ge2, ge3, ...; VLAN interfaces are vlan0, vlan1, vlan2, ...; and so on.
** - The names of virtual interfaces are derived from the interfaces on which they are created. For example, virtual interfaces created on Ethernet interface ge1 are called ge1:1, ge1:2, and so on. Virtual interfaces created on VLAN interface vlan2 are called vlan2:1, vlan2:2, and so on. You cannot specify the number after the colon(:) in the web configurator; it is a sequential number. You can specify the number after the colon if you use the CLI to set up a virtual interface.

IP Address Assignment

Most interfaces have an IP address and a subnet mask. This information is used to create an entry in the routing table.

In most interfaces, you can enter the IP address and subnet mask manually. In PPPoE/PPTP interfaces, however, the subnet mask is always 255.255.255.255 because it is a point-to-point interface. For these interfaces, you can only enter the IP address.

In many interfaces, you can also let the IP address and subnet mask be assigned by an external DHCP server on the network. In this case, the interface is a DHCP client. Virtual interfaces, however, cannot be DHCP clients. You have to assign the IP address and subnet mask manually.

In general, the IP address and subnet mask of each interface should not overlap, though it is possible for this to happen with DHCP clients.

The gateway is an optional setting for each interface. If there is more than one gateway, the ZyWALL uses the gateway with the lowest metric, or cost. If two or more gateways have the same metric, the ZyWALL uses the one that was set up first (the first entry in the routing table). In PPPoE/PPTP interfaces, the other computer is the gateway for the interface by default. In this case, you should specify the metric.

If the interface gets its IP address and subnet mask from a DHCP server, the DHCP server also specifies the gateway, if any.

Interface Parameters

The ZyWALL restricts the amount of traffic into and out of the ZyWALL through each interface.

If you set the bandwidth restrictions very high, you effectively remove the restrictions.

The ZyWALL also restricts the size of each data packet. The maximum number of bytes in each packet is called the maximum transmission unit (MTU). If a packet is larger than the MTU, the ZyWALL divides it into smaller fragments. Each fragment is sent separately, and the original packet is re-assembled later. The smaller the MTU, the more fragments sent, and the more work required to re-assemble packets correctly. On the other hand, some communication channels, such as Ethernet over ATM, might not be able to handle large data packets.

DHCP Settings

Dynamic Host Configuration Protocol (DHCP, RFC 2131, RFC 2132) provides a way to automatically set up and maintain IP addresses, subnet masks, gateways, and some network information (such as the IP addresses of DNS servers) on computers in the network. This reduces the amount of manual configuration you have to do and usually uses available IP addresses more efficiently.

In DHCP, every network has at least one DHCP server. When a computer (a DHCP client) joins the network, it submits a DHCP request. The DHCP servers get the request; assign an IP address; and provide the IP address, subnet mask, gateway, and available network information to the DHCP client. When the DHCP client leaves the network, the DHCP servers can assign its IP address to another DHCP client.

In the ZyWALL, some interfaces can provide DHCP services to the network. In this case, the interface can be a DHCP relay or a DHCP server.

As a DHCP relay, the interface routes DHCP requests to DHCP servers on different networks. You can specify more than one DHCP server. If you do, the interface routes DHCP requests to all of them. It is possible for an interface to be a DHCP relay and a DHCP client simultaneously.

As a DHCP server, the interface provides the following information to DHCP clients.

It is not possible for an interface to be the DHCP server and a DHCP client simultaneously.

WINS

WINS (Windows Internet Naming Service) is a Windows implementation of NetBIOS Name Server (NBNS) on Windows. It keeps track of NetBIOS computer names. It stores a mapping table of your network's computer names and IP addresses. The table is dynamically updated for IP addresses assigned by DHCP. This helps reduce broadcast traffic since computers can query the server instead of broadcasting a request for a computer name's IP address. In this way WINS is similar to DNS, although WINS does not use a hierarchy (unlike DNS). A network can have more than one WINS server. Samba can also serve as a WINS server.

Ping Check Settings

The interface can regularly ping the gateway you specified to make sure it is still available. You specify how often the interface pings the gateway, how long to wait for a response before the attempt is a failure, and how many consecutive failures are required before the ZyWALL stops routing to the gateway. The ZyWALL resumes routing to the gateway the first time the gateway acknowledges the ping.

Relationships Between Interfaces

In the ZyWALL, interfaces are usually created on top of other interfaces. Only Ethernet interfaces are created directly on top of the physical ports (or port groups). The relationships between interfaces are explained in the following table.

Relationships Between Different Types of Interfaces 

Interface
Required Port / Interface
auxiliary interface
auxiliary port
port group
physical port
Ethernet interface
physical port
port group
VLAN interface
Ethernet interface
bridge interface
Ethernet interface*
VLAN interface*
PPPoE/PPTP interface
Ethernet interface*
VLAN interface*
bridge interface
virtual interface
(virtual Ethernet interface)
(virtual VLAN interface)
(virtual bridge interface)
Ethernet interface*
VLAN interface*
bridge interface
trunk
Ethernet interface
VLAN interface
bridge interface
PPPoE/PPTP interface
auxiliary interface

Ethernet Interfaces

This section introduces Ethernet interfaces and then explains the screens for Ethernet interfaces.

Ethernet Interfaces Overview

The ZyWALL has five Ethernet interfaces: ge1, ge2, ge3, ge4, and ge5. Unlike other types of interfaces, you cannot create new Ethernet interfaces nor can you delete any of these five. If you do not assign any physical ports to an Ethernet interface , the Ethernet interface is effectively removed from the ZyWALL, but you can still configure it.

Ethernet interfaces are similar to other types of interfaces in many other ways. They have an IP address, subnet mask, and gateway used to make routing decisions. They restrict the amount of bandwidth and packet size. They can provide DHCP services, and they can verify the gateway is available.

In addition, you use Ethernet interfaces to control which physical ports exchange routing information with other routers and how much information is exchanged through each one. The more routing information is exchanged, the more efficient the routers should be. However, the routers also generate more network traffic, and some routing protocols require a significant amount of configuration and management.

The ZyWALL supports two routing protocols, RIP and OSPF.With RIP, you can use Ethernet interfaces to do the following things.

With OSPF, you can use Ethernet interfaces to do the following things.

Interface Summary Screen

This screen lists all of the ZyWALL's interfaces and gives packet statistics for them.

Network > Interface > Interface Summary 

Label
Description
Interface Summary
If an Ethernet interface does not have any physical ports associated with it, its entry is displayed in light gray text.
Name
This field displays the name of each interface. If there is a Expand icon (plus-sign) next to the name, click this to look at the status of virtual interfaces on top of this interface.
Status
This field displays the current status of each interface. The possible values depend on what type of interface it is.
For port groups:
Inactive - The port group is disabled.
Port Group Down - The port group is enabled but not connected.
Port Group Up - The port group is enabled, and at least one of the physical ports associated with it is connected.
For Ethernet interfaces:
Port Group Inactive - The Ethernet interface does not have any physical ports associated with it.
Inactive - The Ethernet interface is disabled.
Down - The Ethernet interface is enabled but not connected.
Speed / Duplex - The Ethernet interface is enabled and connected. This field displays the port speed and duplex setting (Full or Half).
For the auxiliary interface:
Inactive - The auxiliary interface is disabled.
Connected - The auxiliary interface is enabled and connected.
Disconnected - The auxiliary interface is not connected.
For virtual interfaces, this field always displays Up. If the virtual interface is disabled, it does not appear in the list.
For VLAN and bridge interfaces, this field always displays Up. If the VLAN or bridge interface is disabled, it does not appear in the list.
For PPPoE/PPTP interfaces:
Connected - The PPPoE/PPTP interface is connected.
Disconnected - The PPPoE/PPTP interface is not connected.
If the PPPoE/PPTP interface is disabled, it does not appear in the list.
HA Status
This field displays the status of the interface in the virtual router.
Active - This interface is the master interface in the virtual router.
Stand-By - This interface is a backup interface in the virtual router.
Fault - This VRRP group is not functioning in the virtual router right now. For example, this might happen if the interface is down.
n/a - Device HA is not active on the interface.
Zone
This field displays the zone to which the interface is currently assigned.
IP Addr/Netmask
This field displays the current IP address and subnet mask assigned to the interface. If the IP address and subnet mask are 0.0.0.0, the interface is disabled or did not receive an IP address and subnet mask via DHCP.
If this interface is a member of an active virtual router, this field displays the IP address it is currently using. This is either the static IP address of the interface (if it is the master) or the management IP address (if it is a backup).
IP Assignment
This field displays how the interface gets its IP address.
Static - This interface has a static IP address.
DHCP Client - This interface gets its IP address from a DHCP server.
Dynamic - This is the auxiliary interface.
Services
This field lists which services the interface provides to the network. Examples include DHCP relay, DHCP server, DDNS, RIP, and OSPF. This field displays n/a if the interface does not provide any services to the network.
Renew/Dial
Use this field to get or to update the IP address for the interface. Click Renew to send a new DHCP request to a DHCP server. Click the Connect icon to try to connect the auxiliary interface or a PPPoE/PPTP interface. If the interface cannot use one of these ways to get or to update its IP address, this field displays n/a.
Interface Statistics
This table provides packet statistics for each interface.
Name
This field displays the name of each interface. If there is a Expand icon (plus-sign) next to the name, click this to look at the statistics for virtual interfaces on top of this interface.
Status
This field displays the current status of the interface.
Down - The interface is not connected.
Speed / Duplex - The interface is connected. This field displays the port speed and duplex setting (Full or Half).
TxPkts
This field displays the number of packets transmitted from the ZyWALL on the interface since it was last connected.
RxPkts
This field displays the number of packets received by the ZyWALL on the interface since it was last connected.
Collision
This field displays the number of collisions on the interface since it was last connected.
Tx B/s
This field displays the transmission speed, in bytes per second, on the interface in the one-second interval before the screen updated.
Rx B/s
This field displays the reception speed, in bytes per second, on the interface in the one-second interval before the screen updated.
Refresh
Click this button to update the information in the screen.

Ethernet Summary Screen

This screen lists every Ethernet interface and virtual interface created on top of Ethernet interfaces.

Network > Interface > Ethernet 

Label
Description
#
This field is a sequential value, and it is not associated with any interface.
Name
This field displays the name of the interface.
IP Address
This field displays the current IP address of the interface. If the IP address is 0.0.0.0, the interface does not have an IP address yet.
This screen also shows whether the IP address is a static IP address (STATIC) or dynamically assigned (DHCP). IP addresses are always static in virtual interfaces.
Mask
This field displays the interface's subnet mask in dot decimal notation.
Modify
This column lets you create, edit, remove, activate, and deactivate interfaces. You cannot add or remove Ethernet interfaces, however.
To create a virtual Ethernet interface, click the Add icon next to the corresponding Ethernet interface. The Virtual Interface Add/Edit screen appears.
To edit an interface, click the Edit icon next to it. The Ethernet Edit screen or Virtual Interface Add/Edit screen appears accordingly.
To remove a virtual interface, click the Remove icon next to it. The ZyWALL confirms you want to remove it before doing so.
To activate or deactivate an interface, click the Active icon next to it.

Ethernet Edit

The Ethernet Edit screen lets you configure IP address assignment, interface parameters, RIP settings, OSPF settings, DHCP settings, and ping check settings.

Network > Interface > Ethernet > Edit 

Label
Description
Ethernet Interface Properties
 
Enable
Select this to enable this interface. Clear this to disable this interface.
Interface Name
This field is read-only. This is the name of the Ethernet interface.
Description
Enter a description of this interface. It is not used elsewhere. You can use alphanumeric and ()+/:=?!*#@$_%- characters, and it can be up to 60 characters long.
IP Address Assignment
 
Get Automatically
Select this if this interface is a DHCP client. In this case, the DHCP server configures the IP address, subnet mask, and gateway automatically.
You should not select this if the interface is assigned to a VRRP group.
Use Fixed IP Address
Select this if you want to specify the IP address, subnet mask, and gateway manually.
IP Address
This field is enabled if you select Use Fixed IP Address.
Enter the IP address for this interface.
Subnet Mask
This field is enabled if you select Use Fixed IP Address.
Enter the subnet mask of this interface in dot decimal notation. The subnet mask indicates what part of the IP address is the same for all computers in the network.
Gateway
This field is enabled if you select Use Fixed IP Address.
Enter the IP address of the gateway. The ZyWALL sends packets to the gateway when it does not know how to route the packet to its destination. The gateway should be on the same network as the interface.
Metric
Enter the priority of the gateway (if any) on this interface. The ZyWALL decides which gateway to use based on this priority. The lower the number, the higher the priority. If two or more gateways have the same priority, the ZyWALL uses the one that was configured first.
Interface Parameters
 
Upstream Bandwidth
Enter the maximum amount of traffic, in kilobits per second, the ZyWALL can send through the interface to the network. Allowed values are 0 - 1048576.
Downstream Bandwidth
This is reserved for future use.
Enter the maximum amount of traffic, in kilobits per second, the ZyWALL can receive from the network through the interface. Allowed values are 0 - 1048576.
MTU
Maximum Transmission Unit. Type the maximum size of each data packet, in bytes, that can move through this interface. If a larger packet arrives, the ZyWALL divides it into smaller fragments. Allowed values are 576 - 1500. Usually, this value is 1500.
RIP Settings
See RIP Overview for more information about RIP.
Enable RIP
Select this to enable RIP in this interface.
Direction
This field is effective when RIP is enabled. Select the RIP direction from the drop-down list box.
BiDir - This interface sends and receives routing information.
In-Only - This interface receives routing information.
Out-Only - This interface sends routing information.
Send Version
This field is effective when RIP is enabled. Select the RIP version(s) used for sending RIP packets. Choices are 1, 2, and 1 and 2.
Receive Version
This field is effective when RIP is enabled. Select the RIP version(s) used for receiving RIP packets. Choices are 1, 2, and 1 and 2.
V2-Broadcast
This field is effective when RIP is enabled. Select this to send RIP-2 packets using subnet broadcasting; otherwise, the ZyWALL uses multicasting.
OSPF Setting
See OSPF Overview for more information about OSPF.
Area
Select the area in which this interface belongs. Select None to disable OSPF in this interface.
Priority
Enter the priority (between 0 and 255) of this interface when the area is looking for a Designated Router (DR) or Backup Designated Router (BDR). The highest-priority interface identifies the DR, and the second-highest-priority interface identifies the BDR. Set the priority to zero if the interface can not be the DR or BDR.
Link Cost
Enter the cost (between 1 and 65,535) to route packets through this interface.
Passive Interface
Select this to stop forwarding OSPF routing information from the selected interface. As a result, this interface only receives routing information.
Authentication
Select an authentication method, or disable authentication. To exchange OSPF routing information with peer border routers, you must use the same authentication method that they use. Choices are:
Same-as-Area - use the default authentication method in the area
None - disable authentication
Text - authenticate OSPF routing information using a plain-text password
MD5 - authenticate OSPF routing information using MD5 encryption
Text Authentication Key
This field is available if the Authentication is Text. Type the password for text authentication. The key can consist of alphanumeric characters and the underscore, and it can be up to eight characters long.
MD5 Authentication ID
This field is available if the Authentication is MD5. Type the ID for MD5 authentication. The ID can be between 1 and 255.
MD5 Authentication Key
This field is available if the Authentication is MD5. Type the password for MD5 authentication. The password can consist of alphanumeric characters and the underscore, and it can be up to 16 characters long.
DHCP Settings
 
DHCP
Select what type of DHCP service the ZyWALL provides to the network. Choices are:
None - the ZyWALL does not provide any DHCP services. There is already a DHCP server on the network.
DHCP Relay - the ZyWALL routes DHCP requests to one or more DHCP servers you specify. The DHCP server(s) may be on another network.
DHCP Server - the ZyWALL assigns IP addresses and provides subnet mask, gateway, and DNS server information to the network. The ZyWALL is the DHCP server for the network.
 
These fields appear if the ZyWALL is a DHCP Relay.
Relay Server 1
Enter the IP address of a DHCP server for the network.
Relay Server 2
This field is optional. Enter the IP address of another DHCP server for the network.
 
These fields appear if the ZyWALL is a DHCP Server.
IP Pool Start Address
Enter the IP address from which the ZyWALL begins allocating IP addresses. If you want to assign a static IP address to a specific computer, click Add Static DHCP.
If this field is blank, the Pool Size must also be blank. In this case, the ZyWALL can assign every IP address allowed by the interface's IP address and subnet mask, except for the first address (network address), last address (broadcast address) and the interface's IP address.
Pool Size
Enter the number of IP addresses to allocate. This number must be at least one and is limited by the interface's Subnet Mask. For example, if the Subnet Mask is 255.255.255.0 and IP Pool Start Address is 10.10.10.10, the ZyWALL can allocate 10.10.10.10 to 10.10.10.254, or 245 IP addresses.
If this field is blank, the IP Pool Start Address must also be blank. In this case, the ZyWALL can assign every IP address allowed by the interface's IP address and subnet mask, except for the first address (network address), last address (broadcast address) and the interface's IP address.
First DNS Server
Second DNS Server
Third DNS Server
Specify the IP addresses of a maximum of three DNS servers that the network can use. The ZyWALL provides these IP addresses to DHCP clients. You can specify these IP addresses two ways.
Custom Defined - enter a static IP address.
From ISP - use the IP address of a DNS server that another interface received from its DHCP server.
First WINS Server, Second WINS Server
Type the IP address of the WINS (Windows Internet Naming Service) server that you want to send to the DHCP clients. The WINS server keeps a mapping table of the computer names on your network and the IP addresses that they are currently using.
Lease time
Specify how long each computer can use the information (especially the IP address) before it has to request the information again. Choices are:
infinite - select this if IP addresses never expire.
days, hours, and minutes - select this to enter how long IP addresses are valid.
Edit static DHCP table
Click this if you want the ZyWALL to assign static IP addresses to computers. The Static DHCP screen appears.
The ZyWALL checks this table when it assigns IP addresses. If the computer's MAC address is in the table, the ZyWALL assigns the corresponding IP address. Otherwise, the ZyWALL assigns the IP address dynamically using the IP Pool Start Address and Pool Size.

Note: You must click OK in the Static DHCP screen and then click OK in this screen to save your changes.

Ping Check
The interface can regularly ping the gateway you specified to make sure it is still available. You specify how often the interface pings the gateway, how long to wait for a response before the attempt is a failure, and how many consecutive failures are required before the ZyWALL stops routing to the gateway. The ZyWALL resumes routing to the gateway the first time the gateway acknowledges the ping.
Enable
Select this to enable the ping check.
Check Period
Enter the number of seconds between ping attempts.
Check Timeout
Enter the number of seconds to wait for a response before the attempt is a failure.
Check Fail Tolerance
Enter the number of consecutive failures before the ZyWALL stops routing through the gateway.
Ping Default Gateway
Select this to ping the default gateway.
Ping this address
Select this to ping a specified domain name or IP address. Enter that domain name or IP address in the field next to it.

Port Grouping

Use port grouping to create port groups and to assign physical ports and port groups to Ethernet interfaces.

Each physical port is assigned to one Ethernet interface. In port grouping, the Ethernet interfaces are called representative interfaces. If you assign more than one physical port to a representative interface, you create a port group. Port groups have the following characteristics:

Network > Interface > Port Grouping 

Label
Description
Representative Interface (ge1, ge2, ge3, ge4, ge5)
These are Ethernet interfaces. To add a physical port to a representative interface, drag the physical port onto the corresponding representative interface.
Physical Port (1, 2, 3, 4, 5)
These are the physical ports as they appear on the front panel of the ZyWALL. To add a physical port to a representative interface, drag the physical port onto the corresponding representative interface.
Apply
Click this button to save your changes and apply them to the ZyWALL.
Reset
Click this button to change the port groups to their current configuration (last-saved values).

VLAN Interfaces

A Virtual Local Area Network (VLAN) divides a physical network into multiple logical networks. The standard is defined in IEEE 802.1q.

Each VLAN is a separate network with separate IP addresses, subnet masks, and gateways. Each VLAN also has a unique identification number (ID). The ID is a 12-bit value that is stored in the MAC header. The VLANs are connected to switches, and the switches are connected to the router. (If one switch has enough connections for the entire network, the network does not need switches A and B.)

This approach provides a few advantages.

In the ZyWALL, each VLAN is called a VLAN interface. As a router, the ZyWALL routes traffic between VLAN interfaces, but it does not route traffic within a VLAN interface. All traffic for each VLAN interface can go through only one Ethernet interface, though each Ethernet interface can have one or more VLAN interfaces.

Note: Each VLAN interface is created on top of only one Ethernet interface.

Otherwise, VLAN interfaces are similar to other interfaces in many ways. They have an IP address, subnet mask, and gateway used to make routing decisions. They restrict bandwidth and packet size. They can provide DHCP services, and they can verify the gateway is available.

Network > Interface > VLAN 

Label
Description
#
This field is a sequential value, and it is not associated with any interface.
Name
This field displays the name of the interface.
Port/VID
For VLAN interfaces, this field displays
  • the Ethernet interface on which the VLAN interface is created
  • the VLAN ID
For virtual interfaces, this field is blank.
IP Address
This field displays the current IP address of the interface. If the IP address is 0.0.0.0, the interface does not have an IP address yet.
This screen also shows whether the IP address is a static IP address (STATIC) or dynamically assigned (DHCP). IP addresses are always static in virtual interfaces.
Mask
This field displays the interface's subnet mask in dot decimal notation.
Add icon
This column lets you create, edit, remove, activate, and deactivate interfaces.
To create a VLAN interface, click the Add icon at the top of the column. The VLAN Add/Edit screen appears.
To create a virtual VLAN interface, click the Add icon next to the corresponding VLAN interface. The Virtual Interface Add/Edit screen appears
To edit an interface, click the Edit icon next to it. The VLAN Add/Edit screen or Virtual Interface Add/Edit screen appears accordingly.
To remove an interface, click the Remove icon next to it. The ZyWALL confirms you want to remove it before doing so.
To activate or deactivate an interface, click the Active icon next to it.

VLAN Add/Edit

This screen lets you configure IP address assignment, interface bandwidth parameters, DHCP settings, and ping check for each VLAN interface.

Network > Interface > VLAN > Edit 

Label
Description
VLAN Interface Properties
 
Enable
Select this to enable this interface. Clear this to disable this interface.
Interface Name
This field is read-only if you are editing the interface. Enter the name of the VLAN interface. The format is vlanx, where x is 0 - 31. For example, vlan0, vlan8, and so on.
Port
Select the Ethernet interface on which the VLAN interface runs.
Virtual LAN Tag
Enter the VLAN ID. This 12-bit number uniquely identifies each VLAN. Allowed values are 1 - 4094. (0 and 4095 are reserved.)
Description
Enter a description of this interface. It is not used elsewhere. You can use alphanumeric and ()+/:=?!*#@$_%- characters, and it can be up to 60 characters long.
IP Address Assignment
 
Get Automatically
Select this if this interface is a DHCP client. In this case, the DHCP server configures the IP address, subnet mask, and gateway automatically.
You should not select this if the interface is assigned to a VRRP group..
Use Fixed IP Address
Select this if you want to specify the IP address, subnet mask, and gateway manually.
IP Address
This field is enabled if you select Use Fixed IP Address.
Enter the IP address for this interface.
Subnet Mask
This field is enabled if you select Use Fixed IP Address.
Enter the subnet mask of this interface in dot decimal notation. The subnet mask indicates what part of the IP address is the same for all computers in the network.
Gateway
This field is enabled if you select Use Fixed IP Address.
Enter the IP address of the gateway. The ZyWALL sends packets to the gateway when it does not know how to route the packet to its destination. The gateway should be on the same network as the interface.
Metric
Enter the priority of the gateway (if any) on this interface. The ZyWALL decides which gateway to use based on this priority. The lower the number, the higher the priority. If two or more gateways have the same priority, the ZyWALL uses the one that was configured first.
Interface Parameters
 
Upstream Bandwidth
Enter the maximum amount of traffic, in kilobits per second, the ZyWALL can send through the interface to the network. Allowed values are 0 - 1048576.
Downstream Bandwidth
This is reserved for future use.
Enter the maximum amount of traffic, in kilobits per second, the ZyWALL can receive from the network through the interface. Allowed values are 0 - 1048576.
MTU
Maximum Transmission Unit. Type the maximum size of each data packet, in bytes, that can move through this interface. If a larger packet arrives, the ZyWALL divides it into smaller fragments. Allowed values are 576 - 1500. Usually, this value is 1500.
DHCP Setting
 
DHCP
Select what type of DHCP service the ZyWALL provides to the network. Choices are:
None - the ZyWALL does not provide any DHCP services. There is already a DHCP server on the network.
DHCP Relay - the ZyWALL routes DHCP requests to one or more DHCP servers you specify. The DHCP server(s) may be on another network.
DHCP Server - the ZyWALL assigns IP addresses and provides subnet mask, gateway, and DNS server information to the network. The ZyWALL is the DHCP server for the network.
 
These fields appear if the ZyWALL is a DHCP Relay.
Relay Server 1
Enter the IP address of a DHCP server for the network.
Relay Server 2
This field is optional. Enter the IP address of another DHCP server for the network.
 
These fields appear if the ZyWALL is a DHCP Server.
IP Pool Start Address
Enter the IP address from which the ZyWALL begins allocating IP addresses. If you want to assign a static IP address to a specific computer, click Add Static DHCP.
If this field is blank, the Pool Size must also be blank. In this case, the ZyWALL can assign every IP address allowed by the interface's IP address and subnet mask, except for the first address (network address), last address (broadcast address) and the interface's IP address.
Pool Size
Enter the number of IP addresses to allocate. This number must be at least one and is limited by the interface's Subnet Mask. For example, if the Subnet Mask is 255.255.255.0 and IP Pool Start Address is 10.10.10.10, the ZyWALL can allocate 10.10.10.10 to 10.10.10.254, or 245 IP addresses.
If this field is blank, the IP Pool Start Address must also be blank. In this case, the ZyWALL can assign every IP address allowed by the interface's IP address and subnet mask, except for the first address (network address), last address (broadcast address) and the interface's IP address.
First DNS Server
Second DNS Server
Third DNS Server
Specify the IP addresses of a maximum of three DNS servers that the network can use. You can specify these IP addresses two ways.
Custom Defined - enter a static IP address
From ISP - use the IP address of a DNS server that another interface received from its DHCP server.
First WINS Server, Second WINS Server
Type the IP address of the WINS (Windows Internet Naming Service) server that you want to send to the DHCP clients. The WINS server keeps a mapping table of the computer names on your network and the IP addresses that they are currently using.
Lease time
Specify how long each computer can use the information (especially the IP address) before it has to request the information again. Choices are:
infinite - select this if IP addresses never expire
days, hours, and minutes - select this to enter how long IP addresses are valid.
Edit static DHCP table
Click this if you want the ZyWALL to assign static IP addresses to computers. The Static DHCP screen appears.
The ZyWALL checks this table when it assigns IP addresses. If the computer's MAC address is in the table, the ZyWALL assigns the corresponding IP address. Otherwise, the ZyWALL assigns the IP address dynamically using the IP Pool Start Address and Pool Size.

Note: You must click OK in the Static DHCP screen and then click OK in this screen to save your changes.

Ping Check
The interface can regularly ping the gateway you specified to make sure it is still available. You specify how often the interface pings the gateway, how long to wait for a response before the attempt is a failure, and how many consecutive failures are required before the ZyWALL stops routing to the gateway. The ZyWALL resumes routing to the gateway the first time the gateway acknowledges the ping.
Enable
Select this to enable the ping check.
Check Period
Enter the number of seconds between ping attempts.
Check Timeout
Enter the number of seconds to wait for a response before the attempt is a failure.
Check Fail Tolerance
Enter the number of consecutive failures before the ZyWALL stops routing through the gateway.
Ping Default Gateway
Select this to ping the default gateway.
Ping this address
Select this to ping a specified domain name or IP address. Enter that domain name or IP address in the field next to it.

Bridge Interfaces

A bridge creates a connection between two or more network segments at the layer-2 (MAC address) level.

When the bridge receives a packet, the bridge records the source MAC address and the port on which it was received in a table. It also looks up the destination MAC address in the table. If the bridge knows on which port the destination MAC address is located, it sends the packet to that port. If the destination MAC address is not in the table, the bridge broadcasts the packet on every port (except the one on which it was received).

A bridge interface creates a software bridge between the members of the bridge interface. It also becomes the ZyWALL's interface for the resulting network.

A bridge interface may consist of the following members:

When you create a bridge interface, the ZyWALL removes the members' entries from the routing table and adds the bridge interface's entries to the routing table.For example, this table shows the routing table before and after you create bridge interface br0 (250.250.250.0/23) between ge1 and vlan1.

Example: Routing Table Before and After Bridge Interface br0 Is Created 

IP Address(es)
Destination
 
IP Address(es)
Destination
210.210.210.0/24
ge1
 
221.221.221.0/24
vlan0
210.211.1.0/24
ge1:1
 
230.230.230.192/26
ge3
221.221.221.0/24
vlan0
 
241.241.241.241/32
ge4
222.222.222.0/24
vlan1
 
242.242.242.242/32
ge5
230.230.230.192/26
ge3
 
250.250.250.0/23
br0
241.241.241.241/32
ge4
     
242.242.242.242/32
ge5
     

Bridge Summary

This screen lists every bridge interface and virtual interface created on top of bridge interfaces.

Network > Interface > Bridge 

Label
Description
#
This field is a sequential value, and it is not associated with any interface.
Name
This field displays the name of the interface.
IP Address
This field displays the current IP address of the interface. If the IP address is 0.0.0.0, the interface does not have an IP address yet.
This screen also shows whether the IP address is a static IP address (STATIC) or dynamically assigned (DHCP). IP addresses are always static in virtual interfaces.
Member
This field displays the Ethernet interfaces and VLAN interfaces in the bridge interface. It is blank for virtual interfaces.
Add icon
This column lets you create, edit, remove, activate, and deactivate interfaces.
To create a bridge interface, click the Add icon at the top of the column. The Bridge Add/Edit screen appears.
To create a virtual interface, click the Add icon next to the corresponding bridge interface. The Virtual Interface Add/Edit screen appears. See Virtual Interfaces.
To edit an interface, click the Edit icon next to it. The Bridge Add/Edit screen or Virtual Interface Add/Edit screen appears accordingly.
To remove an interface, click the Remove icon next to it. The ZyWALL confirms you want to remove it before doing so.
To activate or deactivate an interface, click the Active icon next to it.

Bridge Add/Edit

This screen lets you configure IP address assignment, interface bandwidth parameters, DHCP settings, and ping check for each bridge interface.

Network > Interface > Bridge > Edit 

Label
Description
Bridge Interface Properties
 
Enable
Select this to enable this interface. Clear this to disable this interface.
Interface Name
This field is read-only if you are editing the interface. Enter the name of the bridge interface. The format is brx, where x is 0 - 11. For example, br0, br3, and so on.
Description
Enter a description of this interface. It is not used elsewhere. You can use alphanumeric and ()+/:=?!*#@$_%- characters, and it can be up to 60 characters long.
Member Configuration
 
Available
This field displays Ethernet interfaces and VLAN interfaces that can become part of the bridge interface. An interface is not available in the following situations:
  • There is a virtual interface on top of it
  • It is already used in a different bridge interface
Select one, and click the >> arrow to add it to the bridge interface. Each bridge interface can only have one VLAN interface.
Member
This field displays the interfaces that are part of the bridge interface. Select one, and click the << arrow to remove it from the bridge interface.
IP Address Assignment
 
Get Automatically
Select this if this interface is a DHCP client. In this case, the DHCP server configures the IP address, subnet mask, and gateway automatically.
Use Fixed IP Address
Select this if you want to specify the IP address, subnet mask, and gateway manually.
IP Address
This field is enabled if you select Use Fixed IP Address.
Enter the IP address for this interface.
Subnet Mask
This field is enabled if you select Use Fixed IP Address.
Enter the subnet mask of this interface in dot decimal notation. The subnet mask indicates what part of the IP address is the same for all computers in the network.
Gateway
This field is enabled if you select Use Fixed IP Address.
Enter the IP address of the gateway. The ZyWALL sends packets to the gateway when it does not know how to route the packet to its destination. The gateway should be on the same network as the interface.
Metric
Enter the priority of the gateway (if any) on this interface. The ZyWALL decides which gateway to use based on this priority. The lower the number, the higher the priority. If two or more gateways have the same priority, the ZyWALL uses the one that was configured first.
Interface Parameters
 
Upstream Bandwidth
Enter the maximum amount of traffic, in kilobits per second, the ZyWALL can send through the interface to the network. Allowed values are 0 - 1048576.
Downstream Bandwidth
This is reserved for future use.
Enter the maximum amount of traffic, in kilobits per second, the ZyWALL can receive from the network through the interface. Allowed values are 0 - 1048576.
MTU
Maximum Transmission Unit. Type the maximum size of each data packet, in bytes, that can move through this interface. If a larger packet arrives, the ZyWALL divides it into smaller fragments. Allowed values are 576 - 1500. Usually, this value is 1500.
DHCP Settings
 
DHCP
Select what type of DHCP service the ZyWALL provides to the network. Choices are:
None - the ZyWALL does not provide any DHCP services. There is already a DHCP server on the network.
DHCP Relay - the ZyWALL routes DHCP requests to one or more DHCP servers you specify. The DHCP server(s) may be on another network.
DHCP Server - the ZyWALL assigns IP addresses and provides subnet mask, gateway, and DNS server information to the network. The ZyWALL is the DHCP server for the network.
 
These fields appear if the ZyWALL is a DHCP Relay.
Relay Server 1
Enter the IP address of a DHCP server for the network.
Relay Server 2
This field is optional. Enter the IP address of another DHCP server for the network.
 
These fields appear if the ZyWALL is a DHCP Server.
IP Pool Start Address
Enter the IP address from which the ZyWALL begins allocating IP addresses. If you want to assign a static IP address to a specific computer, click Add Static DHCP.
If this field is blank, the Pool Size must also be blank. In this case, the ZyWALL can assign every IP address allowed by the interface's IP address and subnet mask, except for the first address (network address), last address (broadcast address) and the interface's IP address.
Pool Size
Enter the number of IP addresses to allocate. This number must be at least one and is limited by the interface's Subnet Mask. For example, if the Subnet Mask is 255.255.255.0 and IP Pool Start Address is 10.10.10.10, the ZyWALL can allocate 10.10.10.10 to 10.10.10.254, or 245 IP addresses.
If this field is blank, the IP Pool Start Address must also be blank. In this case, the ZyWALL can assign every IP address allowed by the interface's IP address and subnet mask, except for the first address (network address), last address (broadcast address) and the interface's IP address.
First DNS Server
Second DNS Server
Third DNS Server
Specify the IP addresses of a maximum of three DNS servers that the network can use. You can specify these IP addresses two ways.
Custom Defined - enter a static IP address
From ISP - use the IP address of a DNS server that another interface received from its DHCP server.
First WINS Server, Second WINS Server
Type the IP address of the WINS (Windows Internet Naming Service) server that you want to send to the DHCP clients. The WINS server keeps a mapping table of the computer names on your network and the IP addresses that they are currently using.
Lease time
Specify how long each computer can use the information (especially the IP address) before it has to request the information again. Choices are:
infinite - select this if IP addresses never expire
days, hours, and minutes - select this to enter how long IP addresses are valid.
Edit static DHCP table
Click this if you want the ZyWALL to assign static IP addresses to computers. The Static DHCP screen appears.
The ZyWALL checks this table when it assigns IP addresses. If the computer's MAC address is in the table, the ZyWALL assigns the corresponding IP address. Otherwise, the ZyWALL assigns the IP address dynamically using the IP Pool Start Address and Pool Size.

Note: You must click OK in the Static DHCP screen and then click OK in this screen to save your changes.

Ping Check
The interface can regularly ping the gateway you specified to make sure it is still available. You specify how often the interface pings the gateway, how long to wait for a response before the attempt is a failure, and how many consecutive failures are required before the ZyWALL stops routing to the gateway. The ZyWALL resumes routing to the gateway the first time the gateway acknowledges the ping.
Enable
Select this to enable the ping check.
Check Period
Enter the number of seconds between ping attempts.
Check Timeout
Enter the number of seconds to wait for a response before the attempt is a failure.
Check Fail Tolerance
Enter the number of consecutive failures before the ZyWALL stops routing through the gateway.
Ping Default Gateway
Select this to ping the default gateway.
Ping this address
Select this to ping a specified domain name or IP address. Enter that domain name or IP address in the field next to it.

PPPoE/PPTP Interfaces

This section introduces PPPoE, PPTP, and PPPoE/PPTP interfaces and then explains the screens for PPPoE/PPTP interfaces.

PPPoE/PPTP Overview

Point-to-Point Protocol over Ethernet (PPPoE, RFC 2516) and Point-to-Point Tunneling Protocol (PPTP, RFC 2637) are usually used to connect two computers over phone lines or broadband connections.

PPPoE is often used with cable modems and DSL connections. It provides the following advantages:

PPTP is used to set up virtual private networks (VPN) in unsecure TCP/IP environments. It sets up two sessions.

PPTP is convenient and easy-to-use, but you have to make sure that firewalls support both PPTP sessions.

PPPoE/PPTP Interfaces Overview

In the ZyWALL, you may use PPPoE/PPTP interfaces to connect to your ISP. This way, you do not have to install or manage PPPoE/PPTP software on each computer in the network.

PPPoE/PPTP interfaces are similar to other interfaces in some ways. They have an IP address, subnet mask, and gateway used to make routing decisions; they restrict bandwidth and packet size; and they can verify the gateway is available. There are two main differences between PPPoE/PPTP interfaces and other interfaces.

Each ISP account specifies the protocol (PPPoE or PPTP), as well as your ISP account information. If you change ISPs later, you only have to create a new ISP account, not a new PPPoE/PPTP interface. You should not have to change any network policies.

PPPoE/PPTP interfaces are interfaces between the ZyWALL and only one computer. Therefore, the subnet mask is always 255.255.255.255. In addition, the ZyWALL always treats the ISP as a gateway.

At the time of writing, it is possible to set up the IP address of the gateway (ISP) using CLI commands but not in the web configurator.

PPPoE/PPTP Interface Summary

Note: You have to set up an ISP account before you create a PPPoE/PPTP interface.

Network > Interface > PPPoE/PPTP 

Label
Description
#
This field is a sequential value, and it is not associated with any interface.
Name
This field displays the name of the interface.
Base Interface
This field displays the interface on the top of which the PPPoE/PPTP interface is.
Account Profile
This field displays the ISP account used by this PPPoE/PPTP interface.
Add icon
This column lets you create, edit, remove, activate, deactivate, connect and disconnect interfaces.
To create an interface, click the Add icon at the top of the column. The PPPoE/PPTP Interface Add/Edit screen appears.
To edit an interface, click the Edit icon next to it. The PPPoE/PPTP Interface Add/Edit screen appears.
To remove an interface, click the Remove icon next to it. The ZyWALL confirms you want to remove it before doing so.
To activate or deactivate an interface, click the Active icon next to it.
To connect or disconnect an interface, click the Connect icon next to it. You might use this icon to test the interface or to manually establish the connection for a Dial-on-Demand PPPoE/PPTP interface.

PPPoE/PPTP Interface Add/Edit

Note: You have to set up an ISP account before you create a PPPoE/PPTP interface.

This screen lets you configure new or existing PPPoE/PPTP interfaces.

Network > Interface > PPPoE/PPTP > Edit 

Label
Description
PPP Interface Properties
 
Enable
Select this to enable this interface. Clear this to disable this interface.
Interface Name
This field is read-only if you are editing the interface. Enter the name of the bridge interface. The format is pppx, where x is 0 - 11. For example, ppp0, ppp7, and so on.
Nail_Up
Select this if the PPPoE/PPTP connection should always be up.
Dial-on-Demand
Select this if you want the ZyWALL to establish the PPPoE/PPTP connection only when there is traffic. You might select this if there is little traffic through the interface or if it costs money to keep the connection available.
Description
Enter a description of this interface. It is not used elsewhere. You can use alphanumeric and ()+/:=?!*#@$_%- characters, and it can be up to 60 characters long.
Base Interface
Select the interface on which the PPPoE/PPTP interface runs. This interface can be an Ethernet interface, VLAN interface, or bridge interface. PPPoE/PPTP interfaces cannot run on Ethernet interfaces or VLAN interfaces that are used in bridge interfaces, however.
Account Profile
Select the ISP account that this PPPoE/PPTP interface uses. The drop-down box lists ISP accounts by name. Select Create Object to create a new ISP account (see ISP Account Edit for details).
Protocol
This field is read-only. It displays the protocol specified in the ISP account.
User Name
This field is read-only. It displays the user name for the ISP account.
Service Name
This field is read-only. It displays the PPPoE service name specified in the ISP account. This field is blank if the ISP account uses PPTP.
IP Address Assignment
 
Get Automatically
Select this if this interface is a DHCP client. In this case, the DHCP server configures the IP address automatically. The subnet mask and gateway are always defined automatically in PPPoE/PPTP interfaces.
Use Fixed IP Address
Select this if you want to specify the IP address manually.
IP Address
This field is enabled if you select Use Fixed IP Address.
Enter the IP address for this interface.
Metric
Enter the priority of the gateway (the ISP) on this interface. The ZyWALL decides which gateway to use based on this priority. The lower the number, the higher the priority. If two or more gateways have the same priority, the ZyWALL uses the one that was configured first.
Interface Parameters
 
Upstream Bandwidth
Enter the maximum amount of traffic, in kilobits per second, the ZyWALL can send through the interface to the network. Allowed values are 0 - 1048576.
Downstream Bandwidth
This is reserved for future use.
Enter the maximum amount of traffic, in kilobits per second, the ZyWALL can receive from the network through the interface. Allowed values are 0 - 1048576.
MTU
Maximum Transmission Unit. Type the maximum size of each data packet, in bytes, that can move through this interface. If a larger packet arrives, the ZyWALL divides it into smaller fragments. Allowed values are 576 - 1492. Usually, this value is 1492.
Ping Check
The interface can regularly ping the gateway you specified to make sure it is still available. You specify how often the interface pings the gateway, how long to wait for a response before the attempt is a failure, and how many consecutive failures are required before the ZyWALL stops routing to the gateway. The ZyWALL resumes routing to the gateway the first time the gateway acknowledges the ping.
Enable
Select this to enable the ping check.
Check Period
Enter the number of seconds between ping attempts.
Check Timeout
Enter the number of seconds to wait for a response before the attempt is a failure.
Check Fail Tolerance
Enter the number of consecutive failures before the ZyWALL stops routing through the gateway.
Ping Default Gateway
Select this to ping the default gateway.
Ping this address
Select this to ping a specified domain name or IP address. Enter that domain name or IP address in the field next to it.

Auxiliary Interface

This section introduces the auxiliary interface and then explains the screen for it.

Auxiliary Interface Overview

Use the auxiliary interface to dial out from the auxiliary port (labeled DIAL BACKUP or AUX depending on your model) in the ZyWALL. For example, you might use this interface as a backup WAN interface.

You have to connect an external modem to the ZyWALL's auxiliary port to use the auxiliary interface.

Note: You have to connect an external modem to the auxiliary port.

The ZyWALL uses the auxiliary interface to dial out in two situations.

When the ZyWALL hangs up the call, it drops the Data Terminal Ready (DTR) signal and issues the command ATH.

Auxiliary

Use the Auxiliary screen to configure the ZyWALL's auxiliary interface.

Network > Interface > Auxiliary 

label
description
Auxiliary Interface Properties
 
Enable
Select this to turn on the auxiliary dial up interface. The interface does not dial out, however, unless it is part of a trunk and load-balancing conditions are satisfied.
Description
Enter a description of this interface. It is not used elsewhere. You can use alphanumeric and ()+/:=?!*#@$_%- characters, and it can be up to 60 characters long.
Port Speed
Select the speed of the connection between the ZyWALL and external computer.
Dialing Type
Tone - select this if the telephone uses tone-based dialing.
Pulse - select this if the telephone uses pulse-based dialing.
Initial String
Enter the AT command string to initialize the external modem. ATZ is the most common string, but you should check the manual for the external modem for additional commands.
Auxiliary Configuration
 
Phone Number
Enter the phone number to dial here. You can use 1-20 numbers, commas (,), or plus signs (+). Use a comma to pause during dialing. Use a plus sign to tell the external modem to make an international call.
User Name
Enter the user name required for authentication.
Password
Enter the password required for authentication.
Retype to confirm
Enter the password again to make sure you have not typed it incorrectly.
Authentication Type
Select the authentication protocol to use for outgoing calls. Choices are:
CHAP/PAP - Your ZyWALL accepts either CHAP or PAP, as requested by the computer you are dialing.
CHAP - Your ZyWALL accepts CHAP only.
PAP - Your ZyWALL accepts PAP only.
MSCHAP - Your ZyWALL accepts MSCHAP only.
MSCHAP-V2 - Your ZyWALL accepts MSCHAP-V2 only.
Timeout
Type the number of seconds the ZyWALL tries to set up a connection before it stops. Allowed values are 30 - 120.
Idle timeout
Type the number of seconds the ZyWALL should wait for traffic before it automatically disconnects the connection. Set this field to zero to disable the idle timeout. Allowed values are 0 - 360.

Virtual Interfaces

Virtual interfaces can be created on top of Ethernet interfaces, VLAN interfaces, or bridge interfaces. Virtual VLAN interfaces recognize and use the same VLAN ID. Otherwise, there is no difference between each type of virtual interface. Network policies (for example, firewall rules) that apply to the underlying interface automatically apply to the virtual interface as well.

Like other interfaces, virtual interfaces have an IP address, subnet mask, and gateway used to make routing decisions. However, you have to manually specify the IP address and subnet mask; virtual interfaces cannot be DHCP clients. Like other interfaces, you can restrict bandwidth through virtual interfaces, but you cannot change the MTU. The virtual interface uses the same MTU that the underlying interface uses. Unlike other interfaces, virtual interfaces do not provide DHCP services, and they do not verify that the gateway is available.

Virtual Interfaces Add/Edit

This screen lets you configure IP address assignment and interface parameters for virtual interfaces. To access this screen, click an Add icon next to an Ethernet interface, VLAN interface, or bridge interface in the respective interface summary screen.

Network > Interface > Add 

Label
Description
Virtual Interface Properties
Interface Name
This field is read-only. It displays the name of the virtual interface, which is automatically derived from the underlying Ethernet interface, VLAN interface, or bridge interface.
Description
Enter a description of this interface. It is not used elsewhere. You can use alphanumeric and ()+/:=?!*#@$_%- characters, and it can be up to 60 characters long.
IP Address Assignment
IP Address
Enter the IP address for this interface.
Subnet Mask
Enter the subnet mask of this interface in dot decimal notation. The subnet mask indicates what part of the IP address is the same for all computers in the network.
Gateway
Enter the IP address of the gateway. The ZyWALL sends packets to the gateway when it does not know how to route the packet to its destination. The gateway should be on the same network as the interface.
Metric
Enter the priority of the gateway (if any) on this interface. The ZyWALL decides which gateway to use based on this priority. The lower the number, the higher the priority. If two or more gateways have the same priority, the ZyWALL uses the one that was configured first.
Interface Properties
 
Upstream Bandwidth
Enter the maximum amount of traffic, in kilobits per second, the ZyWALL can send through the interface to the network. Allowed values are 0 - 1048576.
Downstream Bandwidth
This is reserved for future use.
Enter the maximum amount of traffic, in kilobits per second, the ZyWALL can receive from the network through the interface. Allowed values are 0 - 1048576.

1At the time of writing, the ZyWALL does not support downstream bandwidth management.