ZyXEL Communications ZyWALL 1100 User Manual page 353

Each field is described in the following table.
Table 147 Configuration > VPN > IPSec VPN > VPN Connection > Edit
LABEL DESCRIPTION
Show Advanced Click this button to display a greater or lesser number of configuration fields.
Settings / Hide
Advanced Settings
Create new Object Use to configure any new settings objects that you need to use in this screen.
General Settings
Enable Select this check box to activate this VPN connection.
Connection Name Type the name used to identify this IPSec SA. You may use 1-31 alphanumeric
characters, underscores (
number. This value is case-sensitive.
Nailed-Up Select this if you want the ZyWALL/USG to automatically renegotiate the IPSec SA
when the SA life time expires.
Enable Replay Select this check box to detect and reject old or duplicate packets to protect against
Detection
Denial-of-Service attacks.
Enable NetBIOS Select this check box if you the ZyWALL/USG to send NetBIOS (Network Basic Input/
Broadcast over
Output System) packets through the IPSec SA.
IPSec
NetBIOS packets are TCP or UDP packets that enable a computer to connect to and
communicate with a LAN. It may sometimes be necessary to allow NetBIOS packets
to pass through IPSec SAs in order to allow local computers to find computers on the
remote network and vice versa.
MSS Adjustment Select Custom Size to set a specific number of bytes for the Maximum Segment Size
(MSS) meaning the largest amount of data in a single TCP segment or IP datagram
for this VPN connection.
Some VPN clients may not be able to use a custom MSS size if it is set too small. In
that case those VPN clients will ignore the size set here and use the minimum size
that they can use.
Select Auto to have the ZyWALL/USG automatically set the MSS for this VPN
connection.
Narrowed If the IP range on the ZyWALL/USG (local policy) and the local IP range on the
remote IPSec router overlap in an IKEv2 SA, then you may select Narrowed to have
the SA only apply to the IP addresses in common.
Here are some examples.
ZyWALL/USG (local policy)
IKEv2 SA-1
Narrowed
IKEv2 SA- 2
Narrowed
VPN Gateway
Chapter 20 IPSec VPN
), or dashes (-), but the first character cannot be a
_
192.168.20.0/24
192.168.20.1 ~ 192.168.20.20
192.168.30.50 ~ 192.168.30.70
192.168.30.60 ~ 192.168.30.70
ZyWALL/USG Series User's Guide
353
Remote IPSec router
192.168.20.1 ~ 192.168.20.20
192.168.30.60 ~ 192.168.30.80