ZyXEL Communications ZyWALL 110 User Manual page 404

Table 167 Configuration > VPN > IPSec VPN > VPN Gateway > Add/Edit (continued)
LABEL DESCRIPTION
Add Click this to create a new entry.
Edit Select an entry and click this to be able to modify it.
Remove Select an entry and click this to delete it.
# This field is a sequential value, and it is not associated with a specific proposal. The
sequence of proposals should not affect performance significantly.
Encryption Select which key size and encryption algorithm to use in the IKE SA. Choices are:
DES - a 56-bit key with the DES encryption algorithm
3DES - a 168-bit key with the DES encryption algorithm
AES128 - a 128-bit key with the AES encryption algorithm
AES192 - a 192-bit key with the AES encryption algorithm
AES256 - a 256-bit key with the AES encryption algorithm
The ZyWALL/USG and the remote IPSec router must use the same key size and
encryption algorithm. Longer keys require more processing power, resulting in
increased latency and decreased throughput.
Authentication Select which hash algorithm to use to authenticate packet data in the IPSec SA.
Choices are SHA1, SHA256, SHA512 and MD5. SHA is generally considered stronger
than MD5, but it is also slower.
The remote IPSec router must use the same authentication algorithm.
Key Group Select which Diffie-Hellman key group (DHx) you want to use for encryption keys.
Choices are:
DH1 - use a 768-bit random number
DH2 - use a 1024-bit random number
DH5 - use a 1536-bit random number
The longer the key, the more secure the encryption, but also the longer it takes to
encrypt and decrypt information. Both routers must use the same DH key group.
NAT Traversal Select this if any of these conditions are satisfied.
•
•
The remote IPSec router must also enable NAT traversal, and the NAT routers have to
forward packets with UDP port 500 and UDP 4500 headers unchanged.
This field applies for IKEv1 only. NAT Traversal is always performed when you use
IKEv2.
Dead Peer Select this check box if you want the ZyWALL/USG to make sure the remote IPSec
Detection (DPD)
router is there before it transmits data through the IKE SA. The remote IPSec router
must support DPD. If there has been no traffic for at least 15 seconds, the ZyWALL/
USG sends a message to the remote IPSec router. If the remote IPSec router responds,
the ZyWALL/USG transmits the data. If the remote IPSec router does not respond, the
ZyWALL/USG shuts down the IKE SA.
If the remote IPSec router does not support DPD, see if you can use the VPN connection
connectivity check (see
This field applies for IKEv1 only. Dead Peer Detection (DPD) is always performed when
you use IKEv2.
Chapter 22 IPSec VPN
This IKE SA might be used to negotiate IPSec SAs that use ESP as the active
protocol.
There are one or more NAT routers between the ZyWALL/USG and remote IPSec
router, and these routers do not support IPSec pass-thru or a similar feature.
Section 22.2.1 on page
ZyWALL/USG Series User's Guide
404
391).