ZyXEL Communications UAG Series, Reference Manual

Page: 200 / 361

Chapter 40 IPSec VPN
UAG CLI Reference Guide
200
set security-association lifetime seconds
<180..3000000>
Sets the IPSec SA life time.
set pfs {group1 | group2 | group5 | none}
Enables Perfect Forward Secrecy group.
local-policy address_name
Sets the address object for the local policy (local network).
remote-policy address_name
Sets the address object for the remote policy (remote network).
[no] policy-enforcement
Drops traffic whose source and destination IP addresses do not
match the local and remote policy. This makes the IPSec SA more
secure. The
no
command allows traffic whose source and
destination IP addresses do not match the local and remote policy.
Note: You must allow traffic whose source and destination IP
addresses do not match the local and remote policy, if you
want to use the IPSec SA in a VPN concentrator.
[no] nail-up
Automatically re-negotiates the SA as needed. The
no
command
does not.
[no] replay-detection
Enables replay detection. The
no
command disables it.
[no] netbios-broadcast
Enables NetBIOS broadcasts through the IPSec SA. The
no
command disables NetBIOS broadcasts through the IPSec SA.
[no] out-snat activate
Enables out-bound traffic SNAT over IPSec. The
no
command
disables out-bound traffic SNAT over IPSec.
out-snat source address_name destination
address_name snat address_name
Configures out-bound traffic SNAT in the IPSec SA.
[no] in-snat activate
Enables in-bound traffic SNAT in the IPSec SA. The
no
command
disables in-bound traffic SNAT in the IPSec SA.
in-snat source address_name destination
address_name snat address_name
Configures in-bound traffic SNAT in the IPSec SA.
[no] in-dnat activate
Enables in-bound traffic DNAT in the IPSec SA. The
no
command
disables in-bound traffic DNAT in the IPSec SA.
in-dnat delete <1..10>
Deletes the specified rule for in-bound traffic DNAT in the specified
IPSec SA.
in-dnat move <1..10> to <1..10>
Moves the specified rule (first rule number) to the specified
location (second rule number) for in-bound traffic DNAT.
in-dnat append protocol {all | tcp | udp}
original-ip address_name <0..65535>
<0..65535> mapped-ip address_name
<0..65535> <0..65535>
Maps the specified IP address and port range (original-ip) to the
specified IP address and port range (mapped-ip) and appends this
rule to the end of the rule list for in-bound traffic DNAT.
in-dnat insert <1..10> protocol {all |
tcp | udp} original-ip address_name
<0..65535> <0..65535> mapped-ip
address_name <0..65535> <0..65535>
Maps the specified IP address and port range (original-ip) to the
specified IP address and port range (mapped-ip) and inserts this
rule before the specified rule.
in-dnat <1..10> protocol {all | tcp |
udp} original-ip address_name <0..65535>
<0..65535> mapped-ip address_name
<0..65535> <0..65535>
Creates or revises the specified rule and maps the specified IP
address and port range (original-ip) to the specified IP address and
port range (mapped-ip).
[no] stop-rekeying
Stops the UAG from generating a new key after tunnel
renegotiation.
The
no
command enables the rekeying function.
Table 122
crypto Commands: IPSec SAs (continued)
COMMAND DESCRIPTION