Figure 231 Vpn Example: Nat For Inbound And Outbound Traffic - ZyXEL Communications ZyWALL 1050 User Manual

The ZyWALL and remote IPSec router must use the same encryption key and
authentication key.
Authentication and the Security Parameter Index (SPI)
For authentication, the ZyWALL and remote IPSec router use the SPI, instead of pre-shared
keys, ID type and content. The SPI is an identification number.
The ZyWALL and remote IPSec router must use the same SPI.
NAT for Inbound and Outbound Traffic
The ZyWALL can translate the following types of network addresses in IPSec SA.
• Source address in outbound packets - this translation is necessary if you want the
ZyWALL to route packets from computers outside the local network through the IPSec
SA.
• Source address in inbound packets - this translation hides the source address of computers
in the remote network.
• Destination address in inbound packets - this translation is used if you want to forward
packets (for example, mail) from the remote network to a specific computer (like the mail
server) in the local network.
Each kind of translation is explained below. The following example is used to help explain
each one.

Figure 231 VPN Example: NAT for Inbound and Outbound Traffic

ZyWALL 1050 User's Guide
Chapter 21 IPSec VPN
353