Table 74 Vpn Rules (Ike): Gateway Policy: Edit - ZyXEL Communications ZyWall 35 User Manual

The following table describes the labels in this screen.

Table 74 VPN Rules (IKE): Gateway Policy: Edit

LABEL
Property
Name
NAT Traversal
Gateway Policy
Information
My ZyWALL
Remote Gateway
Address
Authentication Key
Chapter 14 VPN Screens
DESCRIPTION
Type up to 32 characters to identify this VPN gateway policy. You may use any
character, including spaces, but the ZyWALL drops trailing spaces.
Select this check box to enable NAT traversal. NAT traversal allows you to set up
a VPN connection when there are NAT routers between the two IPSec routers.
Note: The remote IPSec router must also have NAT traversal
enabled. See Section 14.6 on page 235
information.
You can use NAT traversal with ESP protocol using Transport or Tunnel mode,
but not with AH protocol nor with manual key management. In order for an IPSec
router behind a NAT router to receive an initiating IPSec packet, set the NAT
router to forward UDP port 500 to the IPSec router behind the NAT router.
This field identifies the WAN IP address or domain name of the ZyWALL. You can
select My Address and enter the ZyWALL's static WAN IP address (if it has one)
or leave the field set to 0.0.0.0.
The following applies if the My ZyWALL field is configured as 0.0.0.0:
• When the WAN port operation mode is set to Active/Passive, the ZyWALL
uses the IP address (static or dynamic) of the WAN port that is in use.
• When the WAN port operation mode is set to Active/Active, the ZyWALL
uses the IP address (static or dynamic) of the primary (highest priority) WAN
port to set up the VPN tunnel as long as the corresponding WAN1 or WAN2
connection is up. If the corresponding WAN1 or WAN2 connection goes down,
the ZyWALL uses the IP address of the other WAN port.
• If both WAN connections go down, the ZyWALL uses the dial backup IP
address for the VPN tunnel when using dial backup or the LAN IP address
when using traffic redirect. See the chapter on WAN for details on dial backup
and traffic redirect.
Otherwise you can select My Domain Name and choose one of the dynamic
domain names that you have configured (in the DDNS screen) to have the
ZyWALL use that dynamic domain name's IP address.
The VPN tunnel has to be rebuilt if the My ZyWALL IP address changes after
setup.
Type the WAN IP address or the domain name (up to 31 characters) of the IPSec
router with which you're making the VPN connection. Set this field to 0.0.0.0 if the
remote IPSec router has a dynamic WAN IP address.
In order to have more than one active rule with the Remote Gateway Address
field set to 0.0.0.0, the ranges of the local IP addresses cannot overlap between
rules.
If you configure an active rule with 0.0.0.0 in the Remote Gateway Address field
and the LAN's full IP address range as the local IP address, then you cannot
configure any other active rules with the Remote Gateway Address field set to
0.0.0.0.
ZyWALL 35 User's Guide
for more
245