ZyXEL Communications ZyWALL USG 50 User Manual page 410

Chapter 23 IPSec VPN
If router A does NAT, it might change the IP addresses, port numbers, or both. If
router X and router Y try to establish a VPN tunnel, the authentication fails
because it depends on this information. The routers cannot establish a VPN tunnel.
Most routers like router A now have an IPSec pass-thru feature. This feature helps
router A recognize VPN packets and route them appropriately. If router A has this
feature, router X and router Y can establish a VPN tunnel as long as the active
protocol is ESP. (See Active Protocol on page 411 for more information about
active protocols.)
If router A does not have an IPSec pass-thru or if the active protocol is AH, you
can solve this problem by enabling NAT traversal. In NAT traversal, router X and
router Y add an extra header to the IKE SA and IPSec SA packets. If you configure
router A to forward these packets unchanged, router X and router Y can establish
a VPN tunnel.
You have to do the following things to set up NAT traversal.
• Enable NAT traversal on the ZyWALL and remote IPSec router.
• Configure the NAT router to forward packets with the extra header unchanged.
(See the field description for detailed information about the extra header.)
The extra header may be UDP port 500 or UDP port 4500, depending on the
standard(s) the ZyWALL and remote IPSec router support.
Extended Authentication
Extended authentication is often used when multiple IPSec routers use the same
VPN tunnel to connect to a single IPSec router. For example, this might be used
with telecommuters.
In extended authentication, one of the routers (the ZyWALL or the remote IPSec
router) provides a user name and password to the other router, which uses a local
user database and/or an external server to verify the user name and password. If
the user name or password is wrong, the routers do not establish an IKE SA.
You can set up the ZyWALL to provide a user name and password to the remote
IPSec router, or you can set up the ZyWALL to check a user name and password
that is provided by the remote IPSec router.
If you use extended authentication, it takes four more steps to establish an IKE
SA. These steps occur at the end, regardless of the negotiation mode (steps 7-10
in main mode, steps 4-7 in aggressive mode).
410
ZyWALL USG 50 User's Guide