ZyXEL Communications ZyWall ATP series User Manual page 408

Figure 280 IKE SA: Main Negotiation Mode, Steps 5 - 6: Authentication (continued)
X
You have to create (and distribute) a pre-shared key. The Zyxel Device and remote IPSec router use it in
the authentication process, though it is not actually transmitted or exchanged.
Note: The Zyxel Device and the remote IPSec router must use the same pre-shared key.
Router identity consists of ID type and content. The ID type can be domain name, IP address, or email
address, and the content is a (properly-formatted) domain name, IP address, or email address. The
content is only used for identification. Any domain name or email address that you enter does not have
to actually exist. Similarly, any domain name or IP address that you enter does not have to correspond
to the Zyxel Device's or remote IPSec router's properties.
The Zyxel Device and the remote IPSec router have their own identities, so both of them must store two
sets of information, one for themselves and one for the other router. Local ID type and content refers to
the ID type and content that applies to the router itself, and peer ID type and content refers to the ID
type and content that applies to the other router.
Note: The Zyxel Device's local and peer ID type and content must match the remote IPSec
router's peer and local ID type and content, respectively.
For example, in the next table, the Zyxel Device and the remote IPSec router authenticate each other
successfully. In contrast, in the following table, the Zyxel Device and the remote IPSec router cannot
authenticate each other and, therefore, cannot establish an IKE SA.
Table 162 VPN Example: Matching ID Type and Content
ZYXEL DEVICE
Local ID type: E-mail
Local ID content: tom@yourcompany.com
Peer ID type: IP
Peer ID content: 1.1.1.2
Chapter 20 IPSec VPN
Step 5:
pre-shared key
Zyxel Device identity, consisting of
- ID type
- content
Step 6:
pre-shared key
Remote IPSec router identity, consisting of
- ID type
- content
5
6
REMOTE IPSEC ROUTER
Local ID type: IP
Local ID content: 1.1.1.2
Peer ID type: E-mail
Peer ID content: tom@yourcompany.com
ZyWALL ATP Series User's Guide
408
Y