ZyXEL ZyWALL USG 100 Unified Security Gateway

ZyXEL ZyWALL USG 100 Overview:

Network Security for Offices of up to 25 People

• All-new platform: "3rd" generation ZyWALL
• 22x faster than previous-generation ZyWALL firewalls
• New generation UTM solution
• Robust hybrid VPN (IPSec and SSL)
• Application firewall
• Web security (Security Web access): ZyXEL safe browsing
• Non-stop Internet access with multiple WAN and 3G backups
• ICSA firewall, IPSec certification
• Comprehensive report system
• Best-of-breed security solution
• Free Anti-spam service
• ZyXEL Security Distribution Network (ZSDN)

The ZyWALL USG (Unified Security Gateway) 100 is the "third generation" ZyWALL featuring an all-new platform. It provides the performance 22 times faster than the previous-generation ZyWALL firewalls, as well as a deep packet inspection security solution for small businesses to enterprises alike. It embodies a Stateful Packet Inspection (SPI) firewall, Anti-Virus, Intrusion Detection and Prevention (IDP), Content Filtering, Anti-Spam, and VPN (IPSec/SSL/L2TP) in one box. This multilayered security safeguards your organization's customer and company records, intellectual property, and critical resources from external and internal threats.

The ZyWALL USG 100 is a Unified Security Gateway, integrated with complete, enterprise-level and advanced security solutions designed for Small/Medium Business (SMB) recommended for up to 25 PC users. Its flexible configuration helps network administrators set up the network and enforce security policies more efficiently. With certified by ICSA SPI Firewall and IPSec VPN, the ZyWALL USG 100’s security features also include IPSec VPN, SSL VPN, Firewall, Content Filter, Anti-Virus and IDP (Intrusion Detection and Prevention) for maximum network security protection. It also provides bandwidth management, for QoS of VoIP or mission critical applications, Multiple-WAN Failover and Load Balancing. Moreover, IPSec VPN and SSL VPN design for telecommuters and home workers can access data more easily and safely at home. Remote access with SSL VPN requires only a standard web browser. ZyWALL USG 100’s excellent throughput is the key to implement features of an enterprise level to provide a full-time, non-stop and secure service.

Advantages:

• The ICSA-certified, stateful inspection firewall protects the network and vital Internet services like e-mail, Web browsing, servers, and file transfers.
• For protection against viruses and spyware, choose the ICSA-certified ZyXEL Anti-Virus or one powered by Kaspersky Labs.
• The IDP engine protects your network from intrusions such as Trojans and worms.
• Use IPSec VPN to secure connections to branch offices, partners, and headquarters. Road warriors and telecommuters can use SSL or L2TP VPN to securely access the company network without having to install VPN software.
• Application Patrol controls who can use what IM and P2P applications like MSN and BitTorrent, and even who can use specific features within an application.
• The anti-spam feature can tag or discard unsolicited commercial or junk e-mail.
• User-aware configuration lets you control access to applications or resources and apply security scans by user or user group.
• Bandwidth management lets you prioritize time-sensitive applications like VoIP and video conferencing.
• Multiple WAN ports let you use multiple ISP links and load balancing to enhance traffic. Throughput, optimize bandwidth usage, and help ensure continuous uptime if a link goes down.
• Along with your regular user name and password, use the ZyWALL OTP (One Time Password). hardware token* to generate a new PIN code each time you log in.
• Use the extension card slot and USB ports for multiple 3G wireless WAN connections.

*Tokens Sold separately

Benefits:

Secure connectivity
Given the prevalence and importance of information technology (IT) systems today and the nature and scale of both the opportunities and risks associated with significant deployments of new networking technologies, organizations are forced to evaluate solutions to build up a safer infrastructure to secure online transactions, in which involve exchange of valuable information. The infrastructure should be tailored to meet operation requirements for expanding remote sites as well as mobile teleworkers.

Proactive protection
As mass-mailing software companies mushroom on the Internet, your network is bombarded with massive amounts of junk mails (spam). Without intelligent detection and proactive blocking, users have to go through the tedious and time-consuming task of sieving through the overflowing mailbox, and such scenario leads to serious productivity loss.

Policy compliance
With numerous file-sharing (P2P) and Instant Messaging (IM) applications, it is easier for company employees to share files and chat online during work hours. Rapid file sharing not only compromises network safety with the sharing of questionable files containing malicious viruses, but may also violate copyright issues and create legal hassles.

Network resilience
ISP links broken, hardware and software failure on the gateway, dead VPN tunnels—these are severe challenges IT staff face when designing the network infrastructure. In short, we need to take fault tolerance on the network path into consideration when build up a highly available network infrastructure for non-stop operations.

Manageability
With Vantage CNM (Centralized Network Management), users can achieve the follow objects:

• Easy VPN management and diagnostic capability
• Complete security policies management
• Low TCO of massive deployment and device maintenance
• Active monitoring, alerting and comprehensive graphic reports

The solution provides an efficient centralized management system for enterprises of any size to reduce operational costs regardless of the number of branch offices or remote locations.

Cost-effectiveness
With the adoption of ZyXEL's USG 20, the follow costs can be saved:

• Device hardware maintenance fee: ZyXEL provides a one more year hardware warranty out of factory.
• Free Software upgrade: now ZyXEL provides free software upgrade for you to enjoy complete protection without additional expanse.

Application Diagram:

ZyWALL USG clean-traffic architecture
The ZyWALL USG’s clean-traffic architectureprotects against network risks such as viruses,worms, Trojan Horses, spyware, phishing attacksand other emerging Internet threats. With theclean-traffic architecture, enterprises users areassured to have clean and secure networkenvironments.

Endpoint security
With the new Endpoint Security feature (EPS),administrators can easily identify “bad” users, i.e.where no AV software has been installed. Byenforcing installation of the Anti-Virus software,the ZyWALL mitigates the threat of virusoutbreaks and thus the loss of money andemployee productivity. The EPS supportsNortonTM KasperskyTM and TrendMicroTM AV clientsoftware, among others. Additionally, personalfirewall software such as Kaspersky InternetSecurity 2009/2010, Windows Firewall andTrendMicro PC-Cillin/Internet Security 2010 arealso supported with the new EPS feature.

New generation UTM solution
The ZyWALL USG Series deploys hardwareaccelerationtechnology in one box. Poweredby high-performance SecuASIC technologyand a hardware-based encryptionaccelerator, the ZyWALL USG Series deliversindustry-leading performance and multilayerthreat protection for small businessesand enterprises. The ZyWALL USG Seriesprovides integrated Unified ThreatManagement security features such as Anti-Virus (include Kaspersky Anti-Virus & ZyXELAnti-Virus), IDP, Anti-Spam, Content Filteringand Firewall, VPN. All ZyWALL USG Seriesproducts support the Gigabit Ethernet.

High performance
ZyXEL USG Series is built with a powerfulIntegrated High Performance Securityarchitecture, a performance provenarchitecture for gigabit fiber. It providesreal-time inspection to prevent networkfrom threats without sacrificingperformance. Company network is notonly flawlessly secured but also greatlyenhanced on performance to improveoperational productivity and efficiencywhen applications such as file-loading,emailing, and information searches areprocessed at higher speed. Take USG 50 asan example, USG 50 delivers excellentperformance to meet small business.

Robust hybrid VPN (IPSec and SSL)
The ZyWALL USG Series can provide secureaccess between remote locations andcorporate resources through the Internet fororganizations of any size. Using IPSec VPN,companies can secure connections to branchoffices, partners and headquarters. Roadwarriors and telecommuters can use SSL orL2TP VPN to safely access the companynetwork without having to install VPNsoftware. The Series provides a flexible andeasy way to enable mobile employees,vendors and partners to confidently accessyour network resource for better efficiency.

Granular control over socialnetworking applications
Social networking applications such asFacebook, Twitter, and Youtube have become anInternet phenomenon to connect peoplequickly and to share information. Withoutflexible management, social networkingapplications will eat up business productivity.ZyWALL USG ensures that the Internet is notabused to prevent bandwidth to be wasted orhuman resource policy violations.ZyWALL USG provides granular control oversocial networking applications.

Application firewall
More and more network applications bringmalicious software into your office. This kindof unwanted software, especially IM/P2Papplications, may cause bandwidth waste oreven system damage. Using the applicationpatrol and bandwidth management features,you can have full control over traffic blockingor rate limit settings.

Non-stop Internet access withmultiple WAN and 3G backups
The ZyWALL USG not only supportsmultiple WAN ports but also 3G throughUSB or PCMCIA cards. This feature enables“active-active” load sharing or “activepassive”failover configuration to deliverhighly reliable network connectivity.

High availability
High availability is essential in enterprisenetworks. It ensures a system or componentcan be continuously operational for a desirablylong length of time.The ZyWALL USG Series provide highavailability feature as:

• Multiple WAN ports and configure load balancing between these ports.
• An auxiliary (backup) Internet connection as known as out of band Management.
• A backup ZyWALL in the event the master ZyWALL fails (device HA).

To minimize the impact of single-point failures,the ZyWALL USG Series supports device HA(High Availability) to assure network availability.

Anti-Spam service
ZyXEL’s Anti-Spam service eliminates spam,phishing, virus and malware threats through aunified security architecture without droppinglegitimate messages. With ZyXEL’s Anti-Spamservice, enterprises can save time and resourcesdealing with unwanted email to reduceoperational costs.

Comprehensive reporting system
The ZyWALL USG Series has a built-in reportingsystem that offers a comprehensive set of realtimeand historical reports including firewall, virusand intrusion attacks, bandwidth usage, Web siteusage and user activities. Furthermore, withVantage Report (VRPT), a Web-based reportingsystem, administrators can easily collect trafficdata and analyze a distributed network for theirorganizations to become more aware ofsuspicious activities and to ensure betterbusiness productivity.

ZyXEL Security Distribution Network(ZSDN) ensures rapid response tonew threats
ZSDN Provides Up-to-Date Protection

• The myZyXEL.com Web site delivers a convenient, centralized way to register all ZyWALL units and Security Services.
• The ZyXEL Security Update Servers operates 24x7 to automatically deliver updated signature databases to ZyWALL units around the world.
• The mySecurityZone portal provides comprehensive, searchable information regarding viruses and system vulnerabilities, and it provides a wealth of information resources that keep customers up-to-date on the latest vulnerabilities and countermeasures.

Specifications:

Note:
*1: Testing Methodologies: Maximum performance based on RFC 2544 (UDP packets, 1,518 bytes). Actual performance may vary depending on network conditions and activated services.
*2: VPN (AES) throughput measured using UDP traffic with 1,424 bytes packet size, based on RFC 2544.
*3: UTM (AV+IDP) throughput measured using industry standard Ixia IxLoad test tool against HTTP protocol with 1,460 bytes packet size. Testing done with multiple flows.
*4: Max sessions measured using industry standard Ixia IxLoad test tool.

Model Comparison:

Model Name	ZyWALL USG 100	ZyWALL USG 200	ZyWALL USG 300	ZyWALL USG 1000	ZyWALL USG 2000
Features	• Unified Security Gateway for SMB (10~25 PC Users) • High-performance multilayer threat protection • Hybrid VPN (IPSec, SSL and L2TP) secures connection to headquarters • Support Kaspersky and ZyXEL anti-virus	• Unified Security Gateway for SMB (25~50 PC Users) • High-performance multilayer threat protection • Hybrid VPN (IPSec, SSL and L2TP) secures connection to headquarters • Support Kaspersky and ZyXEL anti-virus • Flexible OPT (option) port	• Unified Security Gateway for SMB (50~75 PC Users) • Providing Hybrid VPN (IPSec/SSL VPN) and robust UTM security services • High-performance multi-layer threat protection • User-aware policy engine enables access granularity • Excellent manageability with object, text-based and centralized	• Unified Security Gateway for SMB (75~200 PC Users) • Providing Hybrid VPN (IPSec/SSL VPN) and robust UTM security services • High-performance multilayer threat protection • Non-stop operations of mission-critical applications • Excellent manageability with object, text-based and centralized	• Unified Security Gateway for SMB (200~500 PC Users) • Gigabit Firewall with Fiber interface (SFP) • Scalable VPN/UTM performance • Support Kaspersky and ZyXEL anti-virus • Redundant power module
Hardware Specifications
10/100/1000 Interfaces (Copper)	5 x LAN/DMZ, 2 x WAN	5 x LAN/DMZ, 2 x WAN	7	5	6
Dual Personality GbE (SFP/RJ45)	-	-	-	-	2
USB Ports	2	2	2	2	2
SEM Slot (Security Extension Module)	-	-	-	-	1
Card Slot	1	1	2	1	1
802.11b/g/n	-	-	-	-	-
2x2 Antenna	-	-	-	-	-
System Capacity & Performance
SPI Firewall Throughput*1, Mbps	150	200	300	400	2,000
VPN Throughput (3DES)*2, Mbps	60	75	100	150	400*4
UTM Throughput (AV+IDP)*3, Mbps	30	40	60	80	400*5
WiFi Throughput, Mbps	-	-	-	-	-
Unlimited User Licenses	Yes	Yes	Yes	Yes	Yes
Max. Sessions*6	20,000	40,000	60,000	500,000	1,000,000
New Session Rate	1,000	1,000	1,500	12,000	20,000
Max. Concurrent IPSec VPN Tunnels	50	100	200	1,000	2,000
Max. Concurrent SSL VPN Users	5	10	25	250	750*1*2
Included SSL VPN Users	2	2	2	5	5
Customizable Zone	Yes	Yes	Yes	Yes	Yes
Power Requirement
Input Voltage	100 - 240 V AC, 50 - 60 Hz, 1.2 A	100 - 240 V AC, 50 - 60 Hz, 1.2 A	100 - 240 V AC, 50/60 Hz, 0.55 - 0.3 A	100 - 240 V AC, 50/60 Hz, 1 A Max	100 - 240 V AC, 50 - 60 Hz, 3 - 6 A
Power Rating	20 W Max	20 W Max	35 W Max	80 W Max	200 W Max
Environmental Specifications
Operating Temperature	0°C to 40°C
Storage Temperature	-30°C to 60°C
Operating Humidity	5% to 95% (non-condensing)		20% to 95% (non-condensing)	5% to 95% (non-condensing)
Physical Specifications
Dimensions, (W) x (D) x (H) mm	242 x 175 x 35.5	242 x 175 x 35.5	430 x 201 x 42	431 x 292 x 43.5	430 x 487 x 89
Weight, kg	1.2	1.2	2.8	4.7	10.5

Note:
*1: Testing Methodologies: Maximum performance based on RFC 2544 (UDP packets, 1,518 bytes). Actual performance may vary depending on network conditions and activated services.
*2: VPN (AES) throughput measured using UDP traffic with 1,424 bytes packet size, based on RFC 2544.
*3: UTM (AV+IDP) throughput measured using industry standard Ixia IxLoad test tool against HTTP protocol with 1,460 bytes packet size. Testing done with multiple flows.
*4: With SEM-DUAL/SEM-VPN module
*5: With SEM-DUAL module
*6: Max sessions measured using industry standard Ixia IxLoad test tool.

Documentation:

Download the ZyXEL ZyWALL USG 100 Datasheet (PDF).