Manual Setup; Table 29-10 Active Protocol: Encapsulation And Security Protocol - ZyXEL Communications 10 User Manual

FIELD
Perfect Perfect Forward Secrecy (PFS) is disabled (None) by default in phase 2
Forward IPSec SA setup. This allows faster IPSec setup, but is not so secure. Press
Secrecy (PFS) [SPACE BAR] and choose from DH1 or DH2 to enable PFS. DH1 refers to
Diffie-Hellman Group 1 a 768 bit random number. DH2 refers to Diffie-Hellman
Group 2 a 1024 bit (1Kb) random number (more secure, yet slower).
When you have completed this menu, press [ENTER] at the prompt "Press ENTER to Confirm..." to save
your configuration, or press [ESC] at any time to cancel.

29.6 Manual Setup

You only configure Menu 27.1.1.2 – Manual Setup when you select Manual in the Key Management field
in Menu 27.1.1 – IPSec Setup. Manual key management is useful if you have problems with IKE key
management.
29.6.1 Active Protocol
This field is a combination of mode and security protocols used for the VPN. These parameters have been
discussed earlier.

Table 29-10 Active Protocol: Encapsulation and Security Protocol

Tunnel
Transport
29.6.2 Security Parameter Index (SPI)
An SPI is used to distinguish different SAs terminating at the same destination and using the same IPSec
protocol. This data allows for the multiplexing of SAs to a single gateway. The SPI (Security Parameter
Index) along with a destination IP address uniquely identify a particular Security Association (SA). The SPI
is transmitted from the remote VPN gateway to the local VPN gateway. The local VPN gateway then uses
the network, encryption and key values that the administrator associated with the SPI to establish the tunnel.
Current ZyXEL implementation assumes identical outgoing and incoming SPIs.
To edit this menu, move the cursor to the Edit Manual Setup field in Menu 27.1.1 – IPSec Setup press
[SPACE BAR] to select Yes and then press [ENTER] to go to Menu 27.1.1.2 – Manual Setup.
VPN/IPSec Setup
Table 29-9
Menu 27.1.1.1: IKE Setup
DESCRIPTION
MODE
ZyWALL 10~100 Series Internet Security Gateway
SECURITY PROTOCOL
ESP
AH
EXAMPLE
None
29-21