Chapter 21 IPSec VPN
USG20(W)-VPN Series User’s Guide
361
Figure 235
IKE SA: Main Negotiation Mode, Steps 5 - 6: Authentication (continued)
You have to create (and distribute) a pre-shared key. The USG and remote IPSec router use it in
the authentication process, though it is not actually transmitted or exchanged.
Note: The USG and the remote IPSec router must use the same pre-shared key.
Router identity consists of ID type and content. The ID type can be domain name, IP address, or e-
mail address, and the content is a (properly-formatted) domain name, IP address, or e-mail
address. The content is only used for identification. Any domain name or e-mail address that you
enter does not have to actually exist. Similarly, any domain name or IP address that you enter does
not have to correspond to the USG’s or remote IPSec router’s properties.
The USG and the remote IPSec router have their own identities, so both of them must store two
sets of information, one for themselves and one for the other router. Local ID type and content
refers to the ID type and content that applies to the router itself, and peer ID type and content
refers to the ID type and content that applies to the other router.
Note: The USG’s local and peer ID type and content must match the remote IPSec
router’s peer and local ID type and content, respectively.
For example, in
, the USG and the remote IPSec router authenticate each
other successfully. In contrast, in
, the USG and the remote IPSec router
cannot authenticate each other and, therefore, cannot establish an IKE SA.
Step 5:
pre-shared key
USG identity, consisting of
- ID type
- content
Step 6:
pre-shared key
Remote IPSec router identity, consisting of
- ID type
- content
Table 141
VPN Example: Matching ID Type and Content
USG
REMOTE IPSEC ROUTER
Local ID type: E-mail
Local ID type: IP
Local ID content: tom@yourcompany.com
Local ID content: 1.1.1.2
Peer ID type: IP
Peer ID type: E-mail
Peer ID content: 1.1.1.2
Peer ID content: tom@yourcompany.com
5
6
X
Y
Summary of Contents for ZyWall USG20-VPN
Page 17: ...17 PART I User s Guide ...
Page 18: ...18 ...
Page 99: ...99 PART II Technical Reference ...
Page 100: ...100 ...