ZyXEL Communications ZyWall 10W User Manual page 224

ZyWALL Series Internet Security Gateway
LABEL
Remote
Address Type
Starting IP
Address
Ending IP
Address / Subnet
Mask
DNS Server (for
IPSec VPN)
Authentication
Method
15-14
Table 15-7 VPN IKE
Remote IP addresses must be static and correspond to the remote IPSec router's
configured local IP addresses. The remote fields do not apply when the Secure
Gateway Address field is configured to 0.0.0.0. In this case only the remote IPSec
router can initiate the VPN.
Two active SAs can have the same configured local or remote IP address, but not
both. You can configure multiple SAs between the same local and remote IP
addresses, as long as only one is active at any time.
Use the drop-down menu to choose Single Address, Range Address, or Subnet
Address. Select Single Address with a single IP address. Select Range Address
for a specific range of IP addresses. Select Subnet Address to specify IP addresses
on a network by their subnet mask.
When the Address Type field is configured to Single Address, enter a (static) IP
address on the network behind the remote IPSec router. When the Address Type
field is configured to Range Address, enter the beginning (static) IP address, in a
range of computers on the network behind the remote IPSec router. When the
Address Type field is configured to Subnet Address, enter a (static) IP address on
the network behind the remote IPSec router.
When the Address Type field is configured to Single Address, this field is N/A.
When the Address Type field is configured to Range Address, enter the end (static)
IP address, in a range of computers on the network behind the remote IPSec router.
When the Address Type field is configured to Subnet Address, enter a subnet
mask on the network behind the remote IPSec router.
If there is a private DNS server that services the VPN, type its IP address here. The
ZyWALL assigns this additional DNS server to the ZyWALL's DHCP clients that have
IP addresses in this IPSec rule's range of local addresses.
A DNS server allows clients on the VPN to find other computers and servers on the
VPN by their (private) domain names.
Select Pre-Shared Key to use a pre-shared key to identify the ZyWALL and the
remote IPSec router. A pre-shared key identifies a communicating party during a
phase 1 IKE negotiation. It is called "pre-shared" because you have to share it with
another party before you can communicate with them over a secure connection.
Select Certificate to identify the ZyWALL and the remote IPSec router by
certificates.
DESCRIPTION
VPN Screens