ZyXEL Communications Vantage CNM 2.3 User Manual page 342

Chapter 11 IPSec VPN
Table 133 Device Operation > Device Configuration > VPN > IPSec VPN > VPN
Gateway > Edit (continued)
LABEL
Peer ID
Content
Extended
Authentication
Enable Extended
Authentication
Server Mode
342
DESCRIPTION
This field is disabled if the Peer ID Type is Any. Type the identity of
the remote IPSec router during authentication. The identity depends
on the Peer ID Type.
If the ZyWALL and remote IPSec router do not use certificates,
IP - type an IP address; see the note at the end of this description.
DNS - type the domain name; you can use up to 31 ASCII
characters including spaces, although trailing spaces are truncated.
This value is only used for identification and can be any string.
E-mail - the ZyWALL is identified by an e-mail address; you can use
up to 31 ASCII characters including spaces, although trailing spaces
are truncated. This value is only used for identification and can be
any string.
If the ZyWALL and remote IPSec router use certificates, type the
following fields from the certificate used by the remote IPSec router.
IP - subject alternative name field; see the note at the end of this
description.
DNS - subject alternative name field
E-mail - subject alternative name field
Subject Name - subject name (maximum 255 ASCII characters,
including spaces)
Note: If Peer ID Type is IP, please read the rest of this section.
If you type 0.0.0.0, the ZyWALL uses the IP address specified in the
Secure Gateway Address field. This is not recommended in the
following situations:
• There is a NAT router between the ZyWALL and remote IPSec
router.
• You want the remote IPSec router to be able to distinguish
between IPSec SA requests that come from IPSec routers with
dynamic WAN IP addresses.
In these situations, use a different IP address, or use a different
Peer ID Type.
When multiple IPSec routers use the same VPN tunnel to connect to
a single VPN tunnel (telecommuters sharing a tunnel for example),
use extended authentication to enforce a user name and password
check. This way even though they all know the VPN tunnel's security
settings, each still has to provide a unique user name and password.
Select this if one of the routers (the ZyWALL or the remote IPSec
router) verifies a user name and password from the other router
using the local user database and/or an external server.
Select this if the ZyWALL authenticates the user name and password
from the remote IPSec router. You also have to select the
authentication method, which specifies how the ZyWALL
authenticates this information.
Vantage CNM User's Guide