ZyXEL Communications Vantage CNM 2.3 User Manual page 329

Table 130 Device Operation > Device Configuration > VPN > IPSec VPN > VPN
Connection > Add/Edit (IKE) (continued)
LABEL
Policy
Local Policy
Remote Policy
Policy
Enforcement
Property
Nailed-Up
Enable Replay
Detection
Enable
NetBIOS
broadcast over
IPSec
Connectivity
Check
Enable
Connectivity
Check
Check Method
Check Port
Check Period
Vantage CNM User's Guide
DESCRIPTION
Click Advanced to display more settings. Click Basic to display fewer
settings.
Select the address or address group corresponding to the local
network. Select Create Object to configure a new one.
Select the address or address group corresponding to the remote
network. Select Create Object to configure a new one.
Clear this to allow traffic with source and destination IP addresses
that do not match the local and remote policy to use the VPN tunnel.
Leave this cleared for free access between the local and remote
networks.
Note: Clear this to use the IPSec SA in a VPN concentrator.
Selecting this restricts who can use the VPN tunnel. The ZyWALL
drops traffic with source and destination IP addresses that do not
match the local and remote policy.
Select this if you want the ZyWALL to automatically renegotiate the
IPSec SA when the SA life time expires.
Select this check box to detect and reject old or duplicate packets to
protect against Denial-of-Service attacks.
Select this check box if you the ZyWALL to send NetBIOS (Network
Basic Input/Output System) packets through the IPSec SA.
NetBIOS packets are TCP or UDP packets that enable a computer to
connect to and communicate with a LAN. It may sometimes be
necessary to allow NetBIOS packets to pass through IPSec SAs in
order to allow local computers to find computers on the remote
network and vice versa.
The ZyWALL can regularly check the VPN connection to the gateway
you specified to make sure it is still available.
Select this to turn on the VPN connection check.
Select how the ZyWALL checks the connection. The peer must be
configured to respond to the method you select.
Select icmp to have the ZyWALL regularly ping the address you
specify to make sure traffic can still go through the connection. You
may need to configure the peer to respond to pings.
Select tcp to have the ZyWALL regularly perform a TCP handshake
with the address you specify to make sure traffic can still go through
the connection. You may need to configure the peer to accept the TCP
connection.
This field only displays when you select tcp in the Check Method
field. Specify the port number to use for a TCP connectivity check.
Enter the number of seconds between connection check attempts.
Chapter 11 IPSec VPN
329