Vpn Advanced Wizard - Phase 2 - ZyXEL Communications ISG50-ISDN User Manual

Chapter 5 Quick Setup
• SA Life Time: Set how often the ISG50 renegotiates the IKE SA. A short SA life time increases
security, but renegotiation temporarily disconnects the VPN tunnel.
• NAT Traversal: Select this if the VPN tunnel must pass through NAT (there is a NAT router
between the IPSec devices).
Note: The remote IPSec device must also have NAT traversal enabled. See the help in the
main IPSec VPN screens or the User's Guide
390 for more information.
• Dead Peer Detection (DPD) has the ISG50 make sure the remote IPSec device is there before
transmitting data through the IKE SA. If there has been no traffic for at least 15 seconds, the
ISG50 sends a message to the remote IPSec device. If it responds, the ISG50 transmits the data.
If it does not respond, the ISG50 shuts down the IKE SA.
• Authentication Method: Select Pre-Shared Key to use a password or Certificate to use one
of the ISG50's certificates.

5.5.6 VPN Advanced Wizard - Phase 2

Phase 2 in an IKE uses the SA that was established in phase 1 to negotiate SAs for IPSec.
Figure 59 VPN Advanced Wizard: Step 4
• Active Protocol: ESP is compatible with NAT, AH is not.
• Encapsulation: Tunnel is compatible with NAT, Transport is not.
• Encryption Algorithm: 3DES and AES use encryption. The longer the AES key, the higher the
security (this may affect throughput). Null uses no encryption.
• Authentication Algorithm: MD5 gives minimal security. SHA-1 gives higher security. MD5
(Message Digest 5) and SHA1 (Secure Hash Algorithm) are hash algorithms used to authenticate
packet data. The SHA1 algorithm is generally considered stronger than MD5, but is slower.
• SA Life Time: Set how often the ISG50 renegotiates the IKE SA. A short SA life time increases
security, but renegotiation temporarily disconnects the VPN tunnel.
84
VPN, NAT, and NAT Traversal on page
ISG50 User's Guide