Chapter 30 IPSec VPN
ZyWALL USG Series User’s Guide
625
Edit
Select an entry and click this to be able to modify it.
Remove
Select an entry and click this to delete it.
#
This field is a sequential value, and it is not associated with a specific proposal. The
sequence of proposals should not affect performance significantly.
Encryption
Select which key size and encryption algorithm to use in the IKE SA. Choices are:
DES
- a 56-bit key with the DES encryption algorithm
3DES
- a 168-bit key with the DES encryption algorithm
AES128
- a 128-bit key with the AES encryption algorithm
AES192
- a 192-bit key with the AES encryption algorithm
AES256
- a 256-bit key with the AES encryption algorithm
The Zyxel Device and the remote IPSec router must use the same key size and encryption
algorithm. Longer keys require more processing power, resulting in increased latency and
decreased throughput.
Authentication
Select which hash algorithm to use to authenticate packet data in the IPSec SA. Choices
are
SHA1
,
SHA256
,
SHA512
and
MD5
. SHA is generally considered stronger than
MD5
, but it is
also slower.
The remote IPSec router must use the same authentication algorithm.
Key Group
Select which Diffie-Hellman key group (DH
x
) you want to use for encryption keys. Choices
are:
DH1
- use a 768-bit random number
DH2
- use a 1024-bit random number
DH5
- use a 1536-bit random number
DH14
- use a 2048 bit random number
The longer the key, the more secure the encryption, but also the longer it takes to encrypt
and decrypt information. Both routers must use the same DH key group.
NAT Traversal
Select this if any of these conditions are satisfied.
• This IKE SA might be used to negotiate IPSec SAs that use ESP as the active protocol.
• There are one or more NAT routers between the Zyxel Device and remote IPSec router,
and these routers do not support IPSec pass-thru or a similar feature.
The remote IPSec router must also enable NAT traversal, and the NAT routers have to
forward packets with UDP port 500 and UDP 4500 headers unchanged.
This field applies for IKEv1 only. NAT Traversal is always performed when you use IKEv2.
Dead Peer
Detection (DPD)
Select this check box if you want the Zyxel Device to make sure the remote IPSec router is
there before it transmits data through the IKE SA. The remote IPSec router must support DPD.
If there has been no traffic for at least 15 seconds, the Zyxel Device sends a message to the
remote IPSec router. If the remote IPSec router responds, the Zyxel Device transmits the
data. If the remote IPSec router does not respond, the Zyxel Device shuts down the IKE SA.
If the remote IPSec router does not support DPD, see if you can use the VPN connection
connectivity check (see
This field applies for IKEv1 only. Dead Peer Detection (DPD) is always performed when you
use IKEv2.
X Auth / Extended
Authentication
Protocol
This part of the screen displays
X-Auth
when using
IKEv1
and
Extended Authentication
Protocol
when using
IKEv2
.
Table 223 Configuration > VPN > IPSec VPN > VPN Gateway > Add/Edit (continued)
LABEL
DESCRIPTION
Summary of Contents for USG110
Page 27: ...27 PART I User s Guide ...
Page 195: ...195 PART II Technical Reference ...
Page 309: ...Chapter 10 Interfaces ZyWALL USG Series User s Guide 309 ...
Page 313: ...Chapter 10 Interfaces ZyWALL USG Series User s Guide 313 ...
Page 358: ...Chapter 10 Interfaces ZyWALL USG Series User s Guide 358 ...
Page 373: ...Chapter 10 Interfaces ZyWALL USG Series User s Guide 373 ...
