ZyXEL Communications USG40 User Manual page 368

Figure 240 IKE SA: Main Negotiation Mode, Steps 5 - 6: Authentication (continued)
X
You have to create (and distribute) a pre-shared key. The ZyWALL/USG and remote IPSec router
use it in the authentication process, though it is not actually transmitted or exchanged.
Note: The ZyWALL/USG and the remote IPSec router must use the same pre-shared key.
Router identity consists of ID type and content. The ID type can be domain name, IP address, or e-
mail address, and the content is a (properly-formatted) domain name, IP address, or e-mail
address. The content is only used for identification. Any domain name or e-mail address that you
enter does not have to actually exist. Similarly, any domain name or IP address that you enter does
not have to correspond to the ZyWALL/USG's or remote IPSec router's properties.
The ZyWALL/USG and the remote IPSec router have their own identities, so both of them must
store two sets of information, one for themselves and one for the other router. Local ID type and
content refers to the ID type and content that applies to the router itself, and peer ID type and
content refers to the ID type and content that applies to the other router.
Note: The ZyWALL/USG's local and peer ID type and content must match the remote
IPSec router's peer and local ID type and content, respectively.
For example, in Table 150 on page
each other successfully. In contrast, in
IPSec router cannot authenticate each other and, therefore, cannot establish an IKE SA.
Table 150 VPN Example: Matching ID Type and Content
ZYWALL/USG
Local ID type: E-mail
Local ID content: tom@yourcompany.com
Peer ID type: IP
Peer ID content: 1.1.1.2
Chapter 19 IPSec VPN
Step 5:
pre-shared key
ZyWALL/USG identity, consisting of
- ID type
- content
Step 6:
pre-shared key
Remote IPSec router identity, consisting of
- ID type
- content
5
6
368, the ZyWALL/USG and the remote IPSec router authenticate
Table 151 on page
REMOTE IPSEC ROUTER
Local ID type: IP
Local ID content: 1.1.1.2
Peer ID type: E-mail
Peer ID content: tom@yourcompany.com
ZyWALL/USG Series User's Guide
368
Y
369, the ZyWALL/USG and the remote