Pre-Shared Key; Diffie-Hellman (Dh) Key Groups - ZyXEL Communications eir F1000 User Manual

Chapter 18 VPN
The type of ID can be a domain name, an IP address or an e-mail address. The content is the IP
address, domain name, or e-mail address.
Table 98 Local ID Type and Content Fields
LOCAL ID TYPE= CONTENT=
IP
DNS
E-mail
18.5.7.1 ID Type and Content Examples
Two IPSec routers must have matching ID type and content configuration in order to set up a VPN
tunnel.
The two Devices in this example can complete negotiation and establish a VPN tunnel.
Table 99 Matching ID Type and Content Configuration Example
Device A
Local ID type: E-mail
Local ID content: tom@yourcompany.com
Remote ID type: IP
Remote ID content: 1.1.1.2
The two Devices in this example cannot complete their negotiation because Device B's Local ID
Type is IP, but Device A's Remote ID Type is set to E-mail. An "ID mismatched" message
displays in the IPSEC LOG.
Table 100 Mismatching ID Type and Content Configuration Example
DEVICE A
Local ID type: IP
Local ID content: 1.1.1.10
Remote ID type: E-mail
Remote ID content: aa@yahoo.com

18.5.8 Pre-Shared Key

A pre-shared key identifies a communicating party during a phase 1 IKE negotiation (see
18.5.3 on page 220
with another party before you can communicate with them over a secure connection.

18.5.9 Diffie-Hellman (DH) Key Groups

Diffie-Hellman (DH) is a public-key cryptography protocol that allows two parties to establish a
shared secret over an unsecured communications channel. Diffie-Hellman is used within IKE SA
setup to establish session keys. Upon completion of the Diffie-Hellman exchange, the two peers
have a shared secret, but the IKE SA is not authenticated. For authentication, use pre-shared keys.
224
Type the IP address of your computer.
Type a domain name (up to 31 characters) by which to identify this Device.
Type an e-mail address (up to 31 characters) by which to identify this Device.
The domain name or e-mail address that you use in the Local ID Content field is used
for identification purposes only and does not need to be a real domain name or e-mail
address.
for more on IKE phases). It is called "pre-shared" because you have to share it
Device B
Local ID type: IP
Local ID content: 1.1.1.2
Remote ID type: E-mail
Remote ID content: tom@yourcompany.com
DEVICE B
Local ID type: IP
Local ID content: 1.1.1.2
Remote ID type: IP
Remote ID content: 1.1.1.0
eir F1000 Modem User's Guide
Section