Zyxel ZyWALL-USG50 Router Manual PDF (Setup & Configuration Guide)

Page 381 / 944 Scroll up to view Page 376 - 380

Chapter 23 IPSec VPN

ZyWALL USG 50 User’s Guide

381

Figure 230

Configuration > VPN > IPSec VPN > VPN Connection > Edit (IKE)

Page 382 / 944

Chapter 23 IPSec VPN

ZyWALL USG 50 User’s Guide

382

Each field is described in the following table.

Table 113

Configuration > VPN > IPSec VPN > VPN Connection > Edit

LABEL

DESCRIPTION

Show Advance

Settings / Hide

Advance Settings

Click this button to display a greater or lesser number of

configuration fields.

Create new

Object

Use to configure any new settings objects that you need to use in this

screen.

General Settings

Enable

Select this check box to activate this VPN connection.

Connection

Name

Type the name used to identify this IPSec SA. You may use 1-31

alphanumeric characters, underscores(

_

), or dashes (-), but the first

character cannot be a number. This value is case-sensitive.

Nailed-Up

Select this if you want the ZyWALL to automatically renegotiate the

IPSec SA when the SA life time expires.

Enable Replay

Detection

Select this check box to detect and reject old or duplicate packets to

protect against Denial-of-Service attacks.

Enable

NetBIOS

Broadcast over

IPSec

Select this check box if you the ZyWALL to send NetBIOS (Network

Basic Input/Output System) packets through the IPSec SA.

NetBIOS packets are TCP or UDP packets that enable a computer to

connect to and communicate with a LAN. It may sometimes be

necessary to allow NetBIOS packets to pass through IPSec SAs in

order to allow local computers to find computers on the remote

network and vice versa.

VPN Gateway

Application

Scenario

Select the scenario that best describes your intended VPN connection.

Site-to-site

- Choose this if the remote IPSec router has a static IP

address or a domain name. This ZyWALL can initiate the VPN tunnel.

Site-to-site with Dynamic Peer

- Choose this if the remote IPSec

router has a dynamic IP address. Only the remote IPSec router can

initiate the VPN tunnel.

Remote Access (Server Role)

- Choose this to allow incoming

connections from IPSec VPN clients. The clients have dynamic IP

addresses and are also known as dial-in users. Only the clients can

initiate the VPN tunnel.

Remote Access (Client Role)

- Choose this to connect to an IPSec

server. This ZyWALL is the client (dial-in user) and can initiate the

VPN tunnel.

VPN Gateway

Select the VPN gateway this VPN connection is to use or select

Create Object

to add another VPN gateway for this VPN connection

to use.

Page 383 / 944

Chapter 23 IPSec VPN

ZyWALL USG 50 User’s Guide

383

Manual Key

Select this option to configure a VPN connection policy that uses a

manual key instead of IKE key management. This may be useful if

you have problems with IKE key management. See

Section 23.2.2 on

page 387

for how to configure the manual key fields.

Note: Only use manual key as a temporary solution, because it is

not as secure as a regular IPSec SA.

Policy

Local Policy

Select the address corresponding to the local network. Use

Create

new Object

if you need to configure a new one.

Remote Policy

Select the address corresponding to the remote network. Use

Create

new Object

if you need to configure a new one.

Policy

Enforcement

Clear this to allow traffic with source and destination IP addresses

that do not match the local and remote policy to use the VPN tunnel.

Leave this cleared for free access between the local and remote

networks.

Selecting this restricts who can use the VPN tunnel. The ZyWALL

drops traffic with source and destination IP addresses that do not

match the local and remote policy.

Phase 2 Settings

SA Life Time

Type the maximum number of seconds the IPSec SA can last. Shorter

life times provide better security. The ZyWALL automatically

negotiates a new IPSec SA before the current one expires, if there are

users who are accessing remote resources.

Active Protocol

Select which protocol you want to use in the IPSec SA. Choices are:

AH

(RFC 2402) - provides integrity, authentication, sequence

integrity (replay resistance), and non-repudiation but not encryption.

If you select

AH

, you must select an

Authentication

algorithm.

ESP

(RFC 2406) - provides encryption and the same services offered

by

AH

, but its authentication is weaker. If you select

ESP

, you must

select an

Encryption

algorithm and

Authentication

algorithm.

Both

AH

and

ESP

increase processing requirements and latency

(delay).

The ZyWALL and remote IPSec router must use the same active

protocol.

Encapsulation

Select which type of encapsulation the IPSec SA uses. Choices are

Tunnel

- this mode encrypts the IP header information and the data.

Transport

- this mode only encrypts the data.

The ZyWALL and remote IPSec router must use the same

encapsulation.

Proposal

Add

Click this to create a new entry.

Edit

Select an entry and click this to be able to modify it.

Table 113

Configuration > VPN > IPSec VPN > VPN Connection > Edit (continued)

LABEL

DESCRIPTION

Page 384 / 944

Chapter 23 IPSec VPN

ZyWALL USG 50 User’s Guide

384

Remove

Select an entry and click this to delete it.

#

This field is a sequential value, and it is not associated with a specific

proposal. The sequence of proposals should not affect performance

significantly.

Encryption

This field is applicable when the

Active Protocol

is

ESP

. Select which

key size and encryption algorithm to use in the IPSec SA. Choices

are:

NULL

- no encryption key or algorithm

DES

- a 56-bit key with the DES encryption algorithm

3DES

- a 168-bit key with the DES encryption algorithm

AES128

- a 128-bit key with the AES encryption algorithm

AES192

- a 192-bit key with the AES encryption algorithm

AES256

- a 256-bit key with the AES encryption algorithm

The ZyWALL and the remote IPSec router must both have at least one

proposal that uses use the same encryption and the same key.

Longer keys are more secure, but require more processing power,

resulting in increased latency and decreased throughput.

Authentication

Select which hash algorithm to use to authenticate packet data in the

IPSec SA. Choices are

SHA1

and

MD5

.

SHA1

is generally considered

stronger than

MD5

, but it is also slower.

The ZyWALL and the remote IPSec router must both have a proposal

that uses the same authentication algorithm.

Perfect

Forward

Secrecy (PFS)

Select whether or not you want to enable Perfect Forward Secrecy

(PFS) and, if you do, which Diffie-Hellman key group to use for

encryption. Choices are:

none

- disable PFS

DH1

- enable PFS and use a 768-bit random number

DH2

- enable PFS and use a 1024-bit random number

DH5

- enable PFS and use a 1536-bit random number

PFS changes the root key that is used to generate encryption keys for

each IPSec SA. The longer the key, the more secure the encryption,

but also the longer it takes to encrypt and decrypt information. Both

routers must use the same DH key group.

Related Settings

Add this VPN

connection to

IPSec_VPN zone.

Select this check box to add the VPN connection policy to the IPSec_VPN

security zone. Any security rules or settings configured for the IPSec_VPN

security zone will also apply to this VPN connection policy.

Connectivity

Check

The ZyWALL can regularly check the VPN connection to the gateway

you specified to make sure it is still available.

Enable

Connectivity

Check

Select this to turn on the VPN connection check.

Table 113

Configuration > VPN > IPSec VPN > VPN Connection > Edit (continued)

LABEL

DESCRIPTION

Page 385 / 944

Chapter 23 IPSec VPN

ZyWALL USG 50 User’s Guide

385

Check Method

Select how the ZyWALL checks the connection. The peer must be

configured to respond to the method you select.

Select

icmp

to have the ZyWALL regularly ping the address you

specify to make sure traffic can still go through the connection. You

may need to configure the peer to respond to pings.

Select

tcp

to have the ZyWALL regularly perform a TCP handshake

with the address you specify to make sure traffic can still go through

the connection. You may need to configure the peer to accept the TCP

connection.

Check Port

This field displays when you set the

Check Method

to

tcp

. Specify

the port number to use for a TCP connectivity check.

Check Period

Enter the number of seconds between connection check attempts.

Check Timeout

Enter the number of seconds to wait for a response before the

attempt is a failure.

Check Fail

Tolerance

Enter the number of consecutive failures allowed before the ZyWALL

disconnects the VPN tunnel. The ZyWALL resumes using the first peer

gateway address when the VPN connection passes the connectivity

check.

Check this

Address

Select this to specify a domain name or IP address for the

connectivity check. Enter that domain name or IP address in the field

next to it.

Check the First

and Last IP

Address in the

Remote Policy

Select this to have the ZyWALL check the connection to the first and

last IP addresses in the connection’s remote policy. Make sure one of

these is the peer gateway’s LAN IP address.

Log

Select this to have the ZyWALL generate a log every time it checks

this VPN connection.

Inbound/

Outbound traffic

NAT

Outbound Traffic

Source NAT

This translation hides the source address of computers in the local

network. It may also be necessary if you want the ZyWALL to route

packets from computers outside the local network through the IPSec

SA.

Source

Select the address object that represents the original source address

(or select

Create Object

to configure a new one). This is the address

object for the computer or network outside the local network. The

size of the original source address range (

Source

) must be equal to

the size of the translated source address range (

SNAT

).

Destination

Select the address object that represents the original destination

address (or select

Create Object

to configure a new one). This is the

address object for the remote network.

SNAT

Select the address object that represents the translated source

address (or select

Create Object

to configure a new one). This is the

address object for the local network. The size of the original source

address range (

Source

) must be equal to the size of the translated

source address range (

SNAT

).

Table 113

Configuration > VPN > IPSec VPN > VPN Connection > Edit (continued)

LABEL

DESCRIPTION

Rate

Popular Zyxel Models

Famous Router IPs

Famous Router Companies

Bookmark Our Site

Share