ZyXEL Communications ZYWALL USG 20 Manual page 422

Unified security gateway
Hide thumbs Also See for ZYWALL USG 20:
Table of Contents

Advertisement

Chapter 23 IPSec VPN
Encapsulation
There are two ways to encapsulate packets. Usually, you should use tunnel mode
because it is more secure. Transport mode is only used when the IPSec SA is used
for communication between the ZyWALL and remote IPSec router (for example,
for remote management), not between computers on the local and remote
networks.
Note: The ZyWALL and remote IPSec router must use the same encapsulation.
These modes are illustrated below.
Figure 249 VPN: Transport and Tunnel Mode Encapsulation
Original Packet
Transport Mode Packet
Tunnel Mode Packet
In tunnel mode, the ZyWALL uses the active protocol to encapsulate the entire IP
packet. As a result, there are two IP headers:
• Outside header: The outside IP header contains the IP address of the ZyWALL or
remote IPSec router, whichever is the destination.
• Inside header: The inside IP header contains the IP address of the computer
behind the ZyWALL or remote IPSec router. The header for the active protocol
(AH or ESP) appears between the IP headers.
In transport mode, the encapsulation depends on the active protocol. With AH, the
ZyWALL includes part of the original IP header when it encapsulates the packet.
With ESP, however, the ZyWALL does not include the IP header when it
encapsulates the packet, so it is not possible to verify the integrity of the source IP
address.
IPSec SA Proposal and Perfect Forward Secrecy
An IPSec SA proposal is similar to an IKE SA proposal (see
page
415), except that you also have the choice whether or not the ZyWALL and
remote IPSec router perform a new DH key exchange every time an IPSec SA is
established. This is called Perfect Forward Secrecy (PFS).
422
IP Header TCP
Data
Header
IP Header AH/ESP
TCP
Header
Header
IP Header AH/ESP
IP Header TCP
Header
Data
Data
Header
IKE SA Proposal on
ZyWALL USG 20/20W User's Guide

Hide quick links:

Advertisement

Table of Contents
loading

This manual is also suitable for:

Zywall usg 20wZywall usg 2000

Table of Contents