ZyXEL Communications Vantage CNM 2.3 User Manual page 340

Chapter 11 IPSec VPN
Table 133 Device Operation > Device Configuration > VPN > IPSec VPN > VPN
Gateway > Edit (continued)
LABEL
Secure
Gateway
Address
Authentication
Method
Pre-Shared
Key
Certificate
340
DESCRIPTION
Select how the IP address of the remote IPSec router in the IKE SA is
defined.
Select Static Address to enter the domain name or the IP address
of the remote IPSec router. You can provide a second IP address or
domain name for the ZyWALL to try if it cannot establish an IKE SA
with the first one.
Select Dynamic Address if the remote IPSec router has a dynamic
IP address (and does not use DDNS).
Note: The ZyWALL and remote IPSec router must use the
same authentication method to establish the IKE SA.
Select this to have the ZyWALL and remote IPSec router use a pre-
shared key (password) to identify each other when they negotiate
the IKE SA. Type the pre-shared key in the field to the right. The pre-
shared key can be
• 8 - 32 alphanumeric characters or ,;|`~!@#$%^&*()_+\{}':./
<>=-".
• 8 - 32 pairs of hexadecimal (0-9, A-F) characters, preceded by
"0x".
If you want to enter the key in hexadecimal, type "0x" at the
beginning of the key. For example, "0x0123456789ABCDEF" is in
hexadecimal format; in "0123456789ABCDEF" is in ASCII format. If
you use hexadecimal, you must enter twice as many characters since
you need to enter pairs.
The ZyWALL and remote IPSec router must use the same pre-shared
key.
Select this to have the ZyWALL and remote IPSec router use
certificates to authenticate each other when they negotiate the IKE
SA. Then select the certificate the ZyWALL uses to identify itself to
the remote IPsec router.
This certificate is one of the certificates in My Certificates. If this
certificate is self-signed, import it into the remote IPsec router. If
this certificate is signed by a CA, the remote IPsec router must trust
that CA.
Note: The IPSec routers must trust each other's certificates.
The ZyWALL uses one of its Trusted Certificates to authenticate
the remote IPSec router's certificate. The trusted certificate can be a
self-signed certificate or that of a trusted CA that signed the remote
IPSec router's certificate.
Vantage CNM User's Guide