Ike Sa Setup; Ike Sa Proposal; Figure 159 Ike Sa: Main Negotiation Mode, Steps 1 - 2: Ike Sa Proposal - ZyXEL Communications ZYWALL 2 PLUS User Manual

Table 62 SECURITY > VPN > VPN Rules (IKE) (continued)
LABEL
Recycle Bin

14.3 IKE SA Setup

This section provides more details about IKE SAs.

14.3.1 IKE SA Proposal

The IKE SA proposal is used to identify the encryption algorithm, authentication algorithm,
and Diffie-Hellman (DH) key group that the ZyWALL and remote IPSec router use in the IKE
SA. In main mode, this is done in steps 1 and 2, as illustrated below.

Figure 159 IKE SA: Main Negotiation Mode, Steps 1 - 2: IKE SA Proposal

The ZyWALL sends one or more proposals to the remote IPSec router. (In some devices, you
can set up only one proposal.) Each proposal consists of an encryption algorithm,
authentication algorithm, and DH key group that the ZyWALL wants to use in the IKE SA.
The remote IPSec router selects an acceptable proposal and sends the accepted proposal back
to the ZyWALL. If the remote IPSec router rejects all of the proposals (for example, if the
VPN tunnel is not configured correctly), the ZyWALL and remote IPSec router cannot
establish an IKE SA.
Both routers must use the same encryption algorithm, authentication
algorithm, and DH key group.
See the field descriptions for information about specific encryption algorithms, authentication
algorithms, and DH key groups. See
DH key groups.
ZyWALL 2 Plus User's Guide
DESCRIPTION
Click this icon to display a screen in which you can change the settings of a
gateway or network policy.
Click this icon to delete a gateway or network policy.
Click this icon to establish a VPN connection to a remote network.
This indicates that a network policy is not active.
The recycle bin holds any network policies without an associated gateway
policy.
Section 14.3.1.1 on page 240
Chapter 14 IPSec VPN
for more information about
239