Additional Ipsec Vpn Topics; Dynamic Ipsec Rule; Full Feature Nat Mode; Sa Life Time - ZyXEL Communications ZYWALL P1 User Manual

Chapter 13 IPSec VPN
If router A does not have an IPSec pass-through or if the active protocol is AH, you can solve
this problem by enabling NAT traversal. In NAT traversal, router X and router Y add an extra
header to the IKE SA and IPSec SA packets. If you configure router A to forward these
packets unchanged, router X and router Y can establish a VPN tunnel.
You have to do the following things to set up NAT traversal.
• Enable NAT traversal on the ZyWALL and remote IPSec router.
• Configure the NAT router to forward packets with the extra header unchanged. (See the
field description for detailed information about the extra header.)
The extra header may be UDP port 500 or UDP port 4500, depending on the standard(s) the
ZyWALL and remote IPSec router support.

13.4 Additional IPSec VPN Topics

This section discusses other IPSec VPN topics that apply to either IKE SAs or IPSec SAs or
both. Relationships between the topics are also highlighted.

13.4.1 Dynamic IPSec Rule

Create a dynamic rule by setting the Remote Gateway Address to '0.0.0.0'. A single dynamic
rule can support multiple simultaneous incoming IPSec connections.
All users of a dynamic rule have the same pre-shared key. You may need to change the pre-
shared key if one of the users leaves. See the support notes at http://www.zyxel.com for
configuration examples for software VPN clients.

13.4.2 Full Feature NAT Mode

With Full Feature NAT mode, you must map the intended VPN rule's local policy addresses
as the Inside Local Address (ILA) to a public IP address assigned by the ISP (an Inside Global
Address or IGA) before you can configure the VPN rule. For example, you could create a
One-to-One address mapping rule that maps the VPN rule's local policy addresses as the ILA
to the VPN rule's my IP address as the IGA.
You may have to specify the public IP address in the My ZyWALL field of the local IPSec
rule. If you have not configured the address mapping properly, a "SPD doesn't match
configuration of NAT" message displays when you try to save the IPSec rule.

13.4.3 SA Life Time

SAs have a lifetime that specifies how long the SA lasts until it times out. When an SA times
out, the ZyWALL automatically renegotiates the SA in the following situations:
• There is traffic when the SA life time expires
• The IPSec SA is configured on the ZyWALL as nailed up (see below)
Otherwise, the ZyWALL must re-negotiate the SA the next time someone wants to send
traffic.
210
ZyWALL P1 User's Guide