ZyXEL Communications UAG5100 User Manual page 293

Each field is described in the following table.
Table 132 Configuration > VPN > IPSec VPN > VPN Connection > Add/Edit
LABEL DESCRIPTION
Show Advanced Click this button to display a greater or lesser number of configuration fields.
Settings / Hide
Advanced Settings
Create new Object Use to configure any new settings objects that you need to use in this screen.
General Settings
Enable Select this check box to activate this VPN connection.
Connection Name Type the name used to identify this IPSec SA. You may use 1-31 alphanumeric
characters, underscores(
number. This value is case-sensitive.
Nailed-Up Select this if you want the UAG to automatically renegotiate the IPSec SA when the
SA life time expires.
Enable Replay Select this check box to detect and reject old or duplicate packets to protect against
Detection
Denial-of-Service attacks.
Enable NetBIOS Select this check box if you the UAG to send NetBIOS (Network Basic Input/Output
Broadcast over
System) packets through the IPSec SA.
IPSec
NetBIOS packets are TCP or UDP packets that enable a computer to connect to and
communicate with a LAN. It may sometimes be necessary to allow NetBIOS packets
to pass through IPSec SAs in order to allow local computers to find computers on the
remote network and vice versa.
MSS Adjustment Select Custom Size to set a specific number of bytes for the Maximum Segment Size
(MSS) meaning the largest amount of data in a single TCP segment or IP datagram
for this VPN connection.
Select Auto to have the UAG automatically set the MSS for this VPN connection.
VPN Gateway
Application This field is read-only and shows the scenario that the UAG supports.
Scenario
Site-to-site - The remote IPSec router needs to have a static IP address or a domain
name. This UAG can initiate the VPN tunnel.
VPN Gateway Select the VPN gateway this VPN connection is to use or select Create new Object
to add another VPN gateway for this VPN connection to use.
Policy
Local Policy Select the address corresponding to the local network. Use Create new Object if
you need to configure a new one.
Remote Policy Select the address corresponding to the remote network. Use Create new Object if
you need to configure a new one.
Policy Enforcement Clear this to allow traffic with source and destination IP addresses that do not match
the local and remote policy to use the VPN tunnel. Leave this cleared for free access
between the local and remote networks.
Selecting this restricts who can use the VPN tunnel. The UAG drops traffic with source
and destination IP addresses that do not match the local and remote policy.
Phase 2 Settings
SA Life Time Type the maximum number of seconds the IPSec SA can last. Shorter life times
provide better security. The UAG automatically negotiates a new IPSec SA before the
current one expires, if there are users who are accessing remote resources.
Chapter 30 IPSec VPN
), or dashes (-), but the first character cannot be a
_
UAG5100 User's Guide
293