ZyXEL Communications USG FLEX H Series User Manual page 182

Table 91 VPN > IPSec VPN > Remote Access VPN (continued)
LABEL DESCRIPTION
First DNS Server Specify the IP address of the DNS server whose information the Zyxel Device sends to the
remote users. This allows them to access devices on the local network using domain names
instead of IP addresses.
ZyWALL- the VPN clients use the IP address of the interface you specified in the SSL VPN rule
and the Zyxel Device works as a DNS relay.
Custom Defined- enter a static IPv4 address
Second DNS Enter a secondary DNS server IP address that is checked if the first one is unavailable.
Server
Authentication
Primary/ Select a specified RADIUS server from the drop-down list box for the Zyxel Device to use for
Secondary Server
authentication.
User Select a user or user group to associate the user or user group to this remote access IPSec
VPN policy.
Advanced Settings
SA Life Time Set how often the Zyxel Device renegotiates the IKE SA. A short SA life time increases
security, but renegotiation temporarily disconnects the VPN tunnel.
The value you set for the SA life time in Phase 2 Settings should be lesser than or equal to the
value you set for the SA life time in Phase 1 Settings.
Add Click this to add an entry.
Edit Select an entry and click this to edit the entry.
Remove Select an entry and click this to remove the entry.
Encryption Select which key size and encryption algorithm to use in the IPSec SA. Choices are:
des-cbc - a 56-bit key with the DES encryption algorithm
3des-cbc - a 168-bit key with the DES encryption algorithm
aes128-cbc - a 128-bit key with the AES encryption algorithm
aes192-cbc - a 192-bit key with the AES encryption algorithm
aes256-cbc - a 256-bit key with the AES encryption algorithm
The Zyxel Device and the remote IPSec router must both have at least one proposal that
uses use the same encryption and the same key.
Longer keys are more secure, but require more processing power, resulting in increased
latency and decreased throughput.
Authentication Select which hash algorithm to use to authenticate packet data in the IPSec SA. Choices
are hmac-md5, hmac-sha1, hmac-sha256, hmac-sha384 and hmac-sha512. SHA is
generally considered stronger than MD5, but it is also slower.
The Zyxel Device and the remote IPSec router must both have a proposal that uses the
same authentication algorithm.
Chapter 11 IPSec VPN
USG FLEX H Series User's Guide
182