ZyXEL Communications ZyWALL 5 User Manual page 194

ZyWALL 5 Internet Security Appliance
LABEL
My IP Address Enter the WAN IP address of your ZyWALL. The VPN tunnel has to be rebuilt if this IP
address changes.
The following applies if this field is configured as 0.0.0.0:
Secure Gateway Type the WAN IP address or the URL (up to 31 characters) of the IPSec router with
Address which you're making the VPN connection. Set this field to 0.0.0.0 if the remote IPSec
router has a dynamic WAN IP address (the Key Management field must be set to IKE).
In order to have more than one active rule with the Secure Gateway Address field set to
0.0.0.0, the ranges of the local IP addresses cannot overlap between rules.
If you configure an active rule with 0.0.0.0 in the Secure Gateway Address field and the
LAN's full IP address range as the local IP address, then you cannot configure any other
active rules with the Secure Gateway Address field set to 0.0.0.0.
IPSec Algorithm
ESP Select ESP if you want to use ESP (Encapsulation Security Payload). The ESP protocol
(RFC 2406) provides encryption as well as some of the services offered by AH. If you
select ESP here, you must select options from the Encryption Algorithm and
Authentication Algorithm fields (described below).
Select DES, 3DES, AES or NULL from the drop-down list box.
Encryption
Algorithm
When you use one of these encryption algorithms for data communications, both the
sending device and the receiving device must use the same secret key, which can be
used to encrypt and decrypt the message or to generate and verify a message
authentication code. The DES encryption algorithm uses a 56-bit key. Triple DES (3DES)
is a variation on DES that uses a 168-bit key. As a result, 3DES is more secure than
DES. It also requires more processing power, resulting in increased latency and
decreased throughput. This implementation of AES uses a 128-bit key. AES is faster
than 3DES.
Select NULL to set up a tunnel without encryption. When you select NULL, you do not
enter an encryption key.
Authentication Select SHA1 or MD5 from the drop-down list box. MD5 (Message Digest 5) and SHA1
Algorithm (Secure Hash Algorithm) are hash algorithms used to authenticate packet data. The
SHA1 algorithm is generally considered stronger than MD5, but is slower. Select MD5 for
minimal security and SHA-1 for maximum security.
AH Select AH if you want to use AH (Authentication Header Protocol). The AH protocol (RFC
2402) was designed for integrity, authentication, sequence integrity (replay resistance),
and non-repudiation but not for confidentiality, for which the ESP was designed. If you
select AH here, you must select options from the Authentication Algorithm field
(described below).
Authentication Select SHA1 or MD5 from the drop-down list box. MD5 (Message Digest 5) and SHA1
Algorithm (Secure Hash Algorithm) are hash algorithms used to authenticate packet data. The
SHA1 algorithm is generally considered stronger than MD5, but is slower. Select MD5 for
minimal security and SHA-1 for maximum security.
Advanced Click Advanced to configure more detailed settings of your IKE key management.
Apply Click Apply to save your changes back to the ZyWALL.
13-14
Table 13-7 Edit VPN Rule
The ZyWALL uses the current ZyWALL WAN IP address (static or dynamic) to
set up the VPN tunnel.
If the WAN connection goes down, the ZyWALL uses the dial backup IP address
for the VPN tunnel when using dial backup or the LAN IP address when using
traffic redirect. See the chapter on WAN for details on dial backup and traffic
redirect.
DESCRIPTION
VPN Screens