Zyxel P-2602HW-D1A Router Manual PDF (Setup & Configuration Guide)

Home

Manuals

Zyxel

P-2602HW-D1A

Page 231 / 427 Scroll up to view Page 226 - 230

P-2602H(W)(L)-DxA Series User’s Guide

Chapter 17 VPN Screens

231

NAT Traversal

This function is available if the

VPN protocol

ESP

Select this check box if you want to set up a VPN tunnel when there are NAT

routers between the ZyXEL Device and remote IPSec router. The remote IPSec

router must also enable NAT traversal, and the NAT routers have to forward UDP

port 500 packets to the remote IPSec router behind the NAT router.

Name

Type up to 32 characters to identify this VPN policy. You may use any character,

including spaces, but the ZyXEL Device drops trailing spaces.

IPSec Key Mode

Select

IKE

Manual

from the drop-down list box.

IKE

provides more protection

so it is generally recommended.

Manual

is a useful option for troubleshooting if

you have problems using

IKE

key management.

Negotiation Mode

Select

Main

Aggressive

from the drop-down list box. Multiple SAs connecting

through a secure gateway must have the same negotiation mode.

Encapsulation

Mode

Select

Tunnel

mode or

Transport

mode from the drop-down list box.

DNS Server (for

IPSec VPN)

If there is a private DNS server that services the VPN, type its IP address here.

The ZyXEL Device assigns this additional DNS server to the ZyXEL Device's

DHCP clients that have IP addresses in this IPSec rule's range of local addresses.

A DNS server allows clients on the VPN to find other computers and servers on

the VPN by their (private) domain names.

Local

Local IP addresses must be static and correspond to the remote IPSec router's

configured remote IP addresses.

Two active SAs can have the same configured local or remote IP address, but not

both. You can configure multiple SAs between the same local and remote IP

addresses, as long as only one is active at any time.

In order to have more than one active rule with the

Secure Gateway Address

field set to

0.0.0.0

, the ranges of the local IP addresses cannot overlap between

rules.

If you configure an active rule with

0.0.0.0

in the

Secure Gateway Address

field

and the LAN’s full IP address range as the local IP address, then you cannot

configure any other active rules with the

Secure Gateway Address

field set to

0.0.0.0

Local Address

Type

Use the drop-down menu to choose

Single

Range

, or

Subnet

. Select

Single

for

a single IP address. Select

Range

for a specific range of IP addresses. Select

Subnet

to specify IP addresses on a network by their subnet mask.

IP Address Start

When the

Local Address Type

field is configured to

Single

, enter a (static) IP

address on the LAN behind your ZyXEL Device. When the

Local Address Type

field is configured to

Range

, enter the beginning (static) IP address, in a range of

computers on your LAN behind your ZyXEL Device. When the

Local Address

Type

field is configured to

Subnet

, this is a (static) IP address on the LAN behind

your ZyXEL Device.

End / Subnet Mask

When the

Local Address Type

field is configured to

Single

, this field is N/A.

When the

Local Address Type

field is configured to

Range

, enter the end (static)

IP address, in a range of computers on the LAN behind your ZyXEL Device. When

the

Local Address Type

field is configured to

Subnet

, this is a subnet mask on

the LAN behind your ZyXEL Device.

Table 87

Edit VPN Policies

LABEL

DESCRIPTION

Page 232 / 427

P-2602H(W)(L)-DxA Series User’s Guide

232

Chapter 17 VPN Screens

Remote

Remote IP addresses must be static and correspond to the remote IPSec router's

configured local IP addresses. The remote fields do not apply when the

Secure

Gateway IP Address

field is configured to

0.0.0.0

. In this case only the remote

IPSec router can initiate the VPN.

Two active SAs cannot have the local and remote IP address(es) both the same.

Two active SAs can have the same local or remote IP address, but not both. You

can configure multiple SAs between the same local and remote IP addresses, as

long as only one is active at any time.

Remote Address

Type

Use the drop-down menu to choose

Single

Range

, or

Subnet

. Select

Single

with a single IP address. Select

Range

for a specific range of IP addresses.

Select

Subnet

to specify IP addresses on a network by their subnet mask.

IP Address Start

When the

Remote Address Type

field is configured to

Single

, enter a (static) IP

address on the network behind the remote IPSec router. When the

Remote

Address Type

field is configured to

Range

, enter the beginning (static) IP

address, in a range of computers on the network behind the remote IPSec router.

When the

Remote Address Type

field is configured to

Subnet

, enter a (static) IP

address on the network behind the remote IPSec router.

End / Subnet Mask

When the

Remote Address Type

field is configured to

Single

, this field is N/A.

When the

Remote Address Type

field is configured to

Range

, enter the end

(static) IP address, in a range of computers on the network behind the remote

IPSec router. When the

Remote Address Type

field is configured to

Subnet

enter a subnet mask on the network behind the remote IPSec router.

Address

Information

Local ID Type

Select

to identify this ZyXEL Device by its IP address.

Select

DNS

to identify this ZyXEL Device by a domain name.

Select

E-mail

to identify this ZyXEL Device by an e-mail address.

Content

When you select

in the

Local ID Type

field, type the IP address of your

computer in the local

Content

field. The ZyXEL Device automatically uses the IP

address in the

My IP Address

field (refer to the

My IP Address

field description)

if you configure the local

Content

field to

0.0.0.0

or leave it blank.

It is recommended that you type an IP address other than

0.0.0.0

in the local

Content

field or use the

DNS

E-mail

ID type in the following situations.

When there is a NAT router between the two IPSec routers.

When you want the remote IPSec router to be able to distinguish between VPN

connection requests that come in from IPSec routers with dynamic WAN IP

addresses.

When you select

DNS

E-mail

in the

Local ID Type

field, type a domain name

or e-mail address by which to identify this ZyXEL Device in the local

Content

field.

Use up to 31 ASCII characters including spaces, although trailing spaces are

truncated. The domain name or e-mail address is for identification purposes only

and can be any string.

My IP Address

Enter the WAN IP address of your ZyXEL Device. The VPN tunnel has to be

rebuilt if this IP address changes.

The following applies if this field is configured as

0.0.0.0

The ZyXEL Device uses the current ZyXEL Device WAN IP address (static or

dynamic) to set up the VPN tunnel.

If the WAN connection goes down, the ZyXEL Device uses the dial backup IP

address for the VPN tunnel when using dial backup or the LAN IP address when

using traffic redirect. See

Chapter 7 on page 93

for details on dial backup and

traffic redirect.

Table 87

Edit VPN Policies

LABEL

DESCRIPTION

Page 233 / 427

P-2602H(W)(L)-DxA Series User’s Guide

Chapter 17 VPN Screens

233

Peer ID Type

Select

to identify the remote IPSec router by its IP address.

Select

DNS

to identify the remote IPSec router by a domain name.

Select

E-mail

to identify the remote IPSec router by an e-mail address.

Content

The configuration of the peer content depends on the peer ID type.

For

, type the IP address of the computer with which you will make the VPN

connection. If you configure this field to

0.0.0.0

or leave it blank, the ZyXEL

Device will use the address in the

Secure Gateway Address

field (refer to the

Secure Gateway Address

field description).

For

DNS

E-mail

, type a domain name or e-mail address by which to identify the

remote IPSec router. Use up to 31 ASCII characters including spaces, although

trailing spaces are truncated. The domain name or e-mail address is for

identification purposes only and can be any string.

It is recommended that you type an IP address other than

0.0.0.0

or use the

DNS

E-mail

ID type in the following situations:

When there is a NAT router between the two IPSec routers.

When you want the ZyXEL Device to distinguish between VPN connection

requests that come in from remote IPSec routers with dynamic WAN IP

addresses.

Secure Gateway

Address

Type the WAN IP address or the URL (up to 31 characters) of the IPSec router

with which you're making the VPN connection. Set this field to

0.0.0.0

if the

remote IPSec router has a dynamic WAN IP address (the

Key Management

field

must be set to

IKE

In order to have more than one active rule with the

Secure Gateway Address

field set to

0.0.0.0

, the ranges of the local IP addresses cannot overlap between

rules.

If you configure an active rule with

0.0.0.0

in the

Secure Gateway Address

field

and the LAN’s full IP address range as the local IP address, then you cannot

configure any other active rules with the

Secure Gateway Address

field set to

0.0.0.0

Security Protocol

VPN Protocol

Select

ESP

if you want to use ESP (Encapsulation Security Payload). The ESP

protocol (RFC 2406) provides encryption as well as some of the services offered

. If you select

ESP

here, you must select options from the

Encryption

Algorithm

and

Authentication Algorithm

fields (described below).

Pre-Shared Key

Type your pre-shared key in this field. A pre-shared key identifies a

communicating party during a phase 1 IKE negotiation. It is called "pre-shared"

because you have to share it with another party before you can communicate with

them over a secure connection.

Type from 8 to 31 case-sensitive ASCII characters or from 16 to 62 hexadecimal

("0-9", "A-F") characters. You must precede a hexadecimal key with a "0x” (zero

x), which is not counted as part of the 16 to 62 character range for the key. For

example, in "0x0123456789ABCDEF", “0x” denotes that the key is hexadecimal

and “0123456789ABCDEF” is the key itself.

Both ends of the VPN tunnel must use the same pre-shared key. You will receive

a “PYLD_MALFORMED” (payload malformed) packet if the same pre-shared key

is not used on both ends.

Table 87

Edit VPN Policies

LABEL

DESCRIPTION

Page 234 / 427

P-2602H(W)(L)-DxA Series User’s Guide

234

Chapter 17 VPN Screens

17.12

IKE Phases

There are two phases to every IKE (Internet Key Exchange) negotiation – phase 1

(Authentication) and phase 2 (Key Exchange). A phase 1 exchange establishes an IKE SA and

the second one uses that SA to negotiate SAs for IPSec.

Figure 125

Two Phases to Set Up the IPSec SA

In phase 1 you must:

•

Choose a negotiation mode.

•

Authenticate the connection by entering a pre-shared key.

Encryption

Algorithm

Select

DES

3DES

AES

NULL

from the drop-down list box.

When you use one of these encryption algorithms for data communications, both

the sending device and the receiving device must use the same secret key, which

can be used to encrypt and decrypt the message or to generate and verify a

message authentication code. The DES encryption algorithm uses a 56-bit key.

Triple DES (

3DES

) is a variation on

DES

that uses a 168-bit key. As a result,

3DES

is more secure than

DES

. It also requires more processing power, resulting

in increased latency and decreased throughput. This implementation of

AES

uses

a 128-bit key.

AES

is faster than

3DES

Select

NULL

to set up a tunnel without encryption. When you select

NULL

, you

do not enter an encryption key.

Authentication

Algorithm

Select

SHA1

MD5

from the drop-down list box.

MD5

(Message Digest 5) and

SHA1

(Secure Hash Algorithm) are hash algorithms used to authenticate packet

data. The

SHA1

algorithm is generally considered stronger than

MD5

, but is

slower. Select

MD5

for minimal security and

SHA-1

for maximum security.

Advanced

Click

Advanced

to configure more detailed settings of your IKE key management.

Back

Click

Back

to return to the previous screen.

Apply

Click

Apply

to save your changes back to the ZyXEL Device.

Cancel

Click

Cancel

to begin configuring this screen afresh.

Table 87

Edit VPN Policies

LABEL

DESCRIPTION

Page 235 / 427

P-2602H(W)(L)-DxA Series User’s Guide

Chapter 17 VPN Screens

235

•

Choose an encryption algorithm.

•

Choose an authentication algorithm.

•

Choose a Diffie-Hellman public-key cryptography key group (

DH1

DH2

)

•

Set the IKE SA lifetime. This field allows you to determine how long an IKE SA should

stay up before it times out. An IKE SA times out when the IKE SA lifetime period

expires. If an IKE SA times out when an IPSec SA is already established, the IPSec SA

stays connected.

In phase 2 you must:

•

Choose which protocol to use (

ESP

) for the IKE key exchange.

•

Choose an encryption algorithm.

•

Choose an authentication algorithm

•

Choose whether to enable Perfect Forward Secrecy (PFS) using Diffie-Hellman public-

key cryptography – see

Section 17.12.3 on page 236

. Select

None

(the default) to disable

PFS.

• Choose

Tunnel

mode or

Transport

mode.

•

Set the IPSec SA lifetime. This field allows you to determine how long the IPSec SA

should stay up before it times out. The ZyXEL Device automatically renegotiates the

IPSec SA if there is traffic when the IPSec SA lifetime period expires. The ZyXEL

Device also automatically renegotiates the IPSec SA if both IPSec routers have keep alive

enabled, even if there is no traffic. If an IPSec SA times out, then the IPSec router must

renegotiate the SA the next time someone attempts to send traffic.

17.12.1

Negotiation Mode

The phase 1

Negotiation Mode

you select determines how the Security Association (SA) will

be established for each connection through IKE negotiations.

•

Main Mode

ensures the highest level of security when the communicating parties are

negotiating authentication (phase 1). It uses 6 messages in three round trips: SA

negotiation, Diffie-Hellman exchange and an exchange of nonces (a nonce is a random

number). This mode features identity protection (your identity is not revealed in the

negotiation).

•

Aggressive Mode

is quicker than

Main Mode

because it eliminates several steps when

the communicating parties are negotiating authentication (phase 1). However the trade-

off is that faster speed limits its negotiating power and it also does not provide identity

protection. It is useful in remote access situations where the address of the initiator is not

know by the responder and both parties want to use pre-shared key authentication.

Rate

Popular Zyxel Models

Famous Router IPs

Famous Router Companies

Bookmark Our Site

Share