ZyXEL Communications USG FLEX H Series User Manual page 160

your Zyxel Device might offer another alternative, such as using the IP address of a port or interface, as
well.
You can also specify the IP address of the remote IPSec router as 0.0.0.0. This means that the remote
IPSec router can have any IP address. In this case, only the remote IPSec router can initiate an IKE SA
because the Zyxel Device does not know the IP address of the remote IPSec router. This is often used for
telecommuters.
IKE SA Proposal
The IKE SA proposal is used to identify the encryption algorithm, authentication algorithm, and Diffie-
Hellman (DH) key group that the Zyxel Device and remote IPSec router use in the IKE SA. In main mode,
this is done in steps 1 and 2, as illustrated next.
Figure 113 IKE SA: Main Negotiation Mode, Steps 1 - 2: IKE SA Proposal
The Zyxel Device sends one or more proposals to the remote IPSec router. (In some devices, you can
only set up one proposal.) Each proposal consists of an encryption algorithm, authentication algorithm,
and DH key group that the Zyxel Device wants to use in the IKE SA. The remote IPSec router selects an
acceptable proposal and sends the accepted proposal back to the Zyxel Device. If the remote IPSec
router rejects all of the proposals, the Zyxel Device and remote IPSec router cannot establish an IKE SA.
Note: Both routers must use the same encryption algorithm, authentication algorithm, and DH
key group.
In most Zyxel Devices, you can select one of the following encryption algorithms for each proposal. The
algorithms are listed in order from weakest to strongest.
• Data Encryption Standard (DES) is a widely used method of data encryption. It applies a 56-bit key to
each 64-bit block of data.
• Triple DES (3DES) is a variant of DES. It iterates three times with three separate keys, effectively tripling
the strength of DES.
• Advanced Encryption Standard (AES) is a newer method of data encryption that also uses a secret
key. AES applies a 128-bit key to 128-bit blocks of data. It is faster than 3DES.
Some Zyxel Devices also offer stronger forms of AES that apply 192-bit or 256-bit keys to 128-bit blocks of
data.
In most Zyxel Devices, you can select one of the following authentication algorithms for each proposal.
The algorithms are listed in order from weakest to strongest.
Chapter 11 IPSec VPN
One or more proposals, each one consisting of:
- authentication algorithm
- Diffie-Hellman key group
X
USG FLEX H Series User's Guide
- encryption algorithm
1
2
160
Y