Figure 133 Vpn/Nat Example; Negotiation Mode - ZyXEL Communications ZYWALL P1 User Manual

13.3.1.4 Negotiation Mode

There are two negotiation modes: main mode and aggressive mode. Main mode provides
better security, while aggressive mode is faster.
Main mode takes six steps to establish an IKE SA.
Steps 1-2: The ZyWALL sends its proposals to the remote IPSec router. The remote IPSec
router selects an acceptable proposal and sends it back to the ZyWALL.
Steps 3-4: The ZyWALL and the remote IPSec router participate in a Diffie-Hellman key
exchange, based on the accepted DH key group, to establish a shared secret.
Steps 5-6: Finally, the ZyWALL and the remote IPSec router generate an encryption key from
the shared secret, encrypt their identities, and exchange their encrypted identity information
for authentication.
In contrast, aggressive mode only takes three steps to establish an IKE SA.
Step 1: The ZyWALL sends its proposals to the remote IPSec router. It also starts the Diffie-
Hellman key exchange and sends its (unencrypted) identity to the remote IPSec router for
authentication.
Step 2: The remote IPSec router selects an acceptable proposal and sends it back to the
ZyWALL. It also finishes the Diffie-Hellman key exchange, authenticates the ZyWALL, and
sends its (unencrypted) identity to the ZyWALL for authentication.
Step 3: The ZyWALL authenticates the remote IPSec router and confirms that the IKE SA is
established.
Aggressive mode does not provide as much security as main mode because the identity of the
ZyWALL and the identity of the remote IPSec router are not encrypted. It is usually used
when the address of the initiator is not known by the responder and both parties want to use
pre-shared keys for authentication (for example, telecommuters).
13.3.1.5 VPN, NAT, and NAT Traversal
In the following example, there is another router (A) between router X and router Y.

Figure 133 VPN/NAT Example

If router A does NAT, it might change the IP addresses, port numbers, or both. If router X and
router Y try to establish a VPN tunnel, the authentication fails because it depends on this
information. The routers cannot establish a VPN tunnel.
Most routers like router A now have an IPSec pass-through feature. This feature helps router A
recognize VPN packets and route them appropriately. If router A has this feature, router X and
router Y can establish a VPN tunnel as long as the active protocol is ESP. (See
on page 221
ZyWALL P1 User's Guide
for more information about active protocols.)
Chapter 13 IPSec VPN
Section 13.6.3
209