Additional Topics For Ike Sa; Table 50 Vpn Example: Mismatching Id Type And Content - ZyXEL Communications G.SHDSL.bis 4-port Security Gateway P-793H User Manual

Table 49 VPN Example: Matching ID Type and Content
ZYXEL DEVICE
Peer ID type: IP
Peer ID content: 1.1.1.2
In the following example, the authentication fails, so they cannot establish an IKE SA.

Table 50 VPN Example: Mismatching ID Type and Content

ZYXEL DEVICE
Local ID type: E-mail
Local ID content: tom@yourcompany.com
Peer ID type: IP
Peer ID content:
It is also possible to configure the ZyXEL Device to ignore the identity of the remote IPSec
router. In this case, you usually set the peer ID type to Any. This is not as secure as other peer
ID types, however.

11.1.2 Additional Topics for IKE SA

This section provides more information about IKE SA.
11.1.2.1 Negotiation Mode
There are two negotiation modes: main mode and aggressive mode. Main mode provides
better security, while aggressive mode is faster.
Main mode takes six steps to establish an IKE SA.
Steps 1-2: The ZyXEL Device sends its proposals to the remote IPSec router. The remote
IPSec router selects an acceptable proposal and sends it back to the ZyXEL Device.
Steps 3-4: The ZyXEL Device and the remote IPSec router participate in a Diffie-Hellman key
exchange, based on the accepted DH key group, to establish a shared secret.
Steps 5-6: Finally, the ZyXEL Device and the remote IPSec router generate an encryption key
from the shared secret, encrypt their identities, and exchange their encrypted identity
information for authentication.
In contrast, aggressive mode only takes three steps to establish an IKE SA.
Step 1: The ZyXEL Device sends its proposals to the remote IPSec router. It also starts the
Diffie-Hellman key exchange and sends its (unencrypted) identity to the remote IPSec router
for authentication.
Step 2: The remote IPSec router selects an acceptable proposal and sends it back to the ZyXEL
Device. It also finishes the Diffie-Hellman key exchange, authenticates the ZyXEL Device,
and sends its (unencrypted) identity to the ZyXEL Device for authentication.
Step 3: The ZyXEL Device authenticates the remote IPSec router and confirms that the IKE
SA is established.
P-793H User's Guide
1.1.1.15
Chapter 11 IPSec VPN
REMOTE IPSEC ROUTER
Peer ID type: E-mail
Peer ID content: tomasz@yourcompany.com
REMOTE IPSEC ROUTER
Local ID type: IP
Local ID content: 1.1.1.2
Peer ID type: E-mail
Peer ID content: tom@yourcompany.com
157