ZyXEL Communications ZyWALL 5 User Manual page 454

ZyWALL 5 Internet Security Appliance
FIELD
Peer ID type Press [SPACE BAR] to choose IP, DNS, or E-mail and press [ENTER].
Select IP to identify the remote IPSec router by its IP address.
Select DNS to identify the remote IPSec router by a domain name.
Select E-mail to identify the remote IPSec router by an e-mail address.
Content
Peer ID
Type
IP
DNS or
E-Mail
It is recommended that you type an IP address other than 0.0.0.0 or use the
DNS or E-mail Peer ID Type with the following situations:
With either Authentication Method (Pre-Shared Key or Certificate) in menu
27.1.1.1, if you use IP as the peer ID type and configure the content as 0.0.0.0
(or blank) and the Secure Gateway Address is also configured as 0.0.0.0, the
ZyWALL does not check the peer's ID content.
Regardless of how you configure the ID Type and Content fields, active rules
cannot have overlapping local and remote IP address ranges.
Secure Type the IP address or the domain name (up to 31 characters) of the IPSec
Gateway router with which you're making the VPN connection.
Address
Set this field to 0.0.0.0 if the remote IPSec router has a dynamic WAN IP
address (the Key Management field must be set to IKE, see later).
Protocol Enter 1 for ICMP, 6 for TCP, 17 for UDP, etc. 0 is the default and signifies any
protocol.
DNS Server If there is a private DNS server that services the VPN, type its IP address here.
The ZyWALL assigns this additional DNS server to the ZyWALL's DHCP clients
that have IP addresses in this IPSec rule's range of local addresses.
A DNS server allows clients on the VPN to find other computers and servers on
the VPN by their (private) domain names.
39-6
Table 39-2 Menu 27.1.1: IPSec Setup
DESCRIPTION
Peer ID Content when you set Authentication Method to
Pre-Shared Key.
Type the IP address of the computer with which you will
make the VPN connection. If you configure this field to
0.0.0.0 or leave it blank, the ZyWALL will use the address in
the Secure Gateway Address field.
Type a domain name or e-mail address by which to identify
the remote IPSec router. Use up to 31 ASCII characters
including spaces, although trailing spaces are truncated. The
domain name or e-mail address is for identification purposes
only and can be any string.
There is a NAT router between the two IPSec routers.
You want the ZyWALL to distinguish between VPN connection
requests coming in from remote IPSec routers with dynamic WAN IP
addresses.
EXAMPLE
Zw50test.com
.tw
0
VPN/IPSec Setup