ZyXEL Communications USG110, User Manual

Page: 634 / 1090

Chapter 30 IPSec VPN
ZyWALL USG Series User’s Guide
634
Figure 440 IKE SA: Main Negotiation Mode, Steps 5 - 6: Authentication (continued)
You have to create (and distribute) a pre-shared key. The Zyxel Device and remote IPSec router use it in
the authentication process, though it is not actually transmitted or exchanged.
Note: The Zyxel Device and the remote IPSec router must use the same pre-shared key.
Router identity consists of ID type and content. The ID type can be domain name, IP address, or e-mail
address, and the content is a (properly-formatted) domain name, IP address, or e-mail address. The
content is only used for identification. Any domain name or e-mail address that you enter does not have
to actually exist. Similarly, any domain name or IP address that you enter does not have to correspond
to the Zyxel Device’s or remote IPSec router’s properties.
The Zyxel Device and the remote IPSec router have their own identities, so both of them must store two
sets of information, one for themselves and one for the other router. Local ID type and content refers to
the ID type and content that applies to the router itself, and peer ID type and content refers to the ID
type and content that applies to the other router.
Note: The Zyxel Device’s local and peer ID type and content must match the remote IPSec
router’s peer and local ID type and content, respectively.
For example, in the next table, the Zyxel Device and the remote IPSec router authenticate each other
successfully. In contrast, in the following table, the Zyxel Device and the remote IPSec router cannot
authenticate each other and, therefore, cannot establish an IKE SA.
Step 5:
pre-shared key
Zyxel Device identity, consisting of
- ID type
- content
Step 6:
pre-shared key
Remote IPSec router identity, consisting of
- ID type
- content
Table 227 VPN Example: Matching ID Type and Content
ZYXEL DEVICE REMOTE IPSEC ROUTER
Local ID type: E-mail Local ID type: IP
Local ID content: tom@yourcompany.com Local ID content: 1.1.1.2
Peer ID type: IP Peer ID type: E-mail
Peer ID content: 1.1.1.2 Peer ID content: tom@yourcompany.com
5
6
X
Y