Chapter 14 IPSec VPN
ZyWALL 2WG User’s Guide
309
Step 2: The remote IPSec router selects an acceptable proposal and sends it back to the
ZyWALL. It also finishes the Diffie-Hellman key exchange, authenticates the ZyWALL, and
sends its (unencrypted) identity to the ZyWALL for authentication.
Step 3: The ZyWALL authenticates the remote IPSec router and confirms that the IKE SA is
established.
Aggressive mode does not provide as much security as main mode because the identity of the
ZyWALL and the identity of the remote IPSec router are not encrypted. It is usually used
when the address of the initiator is not known by the responder and both parties want to use
pre-shared keys for authentication (for example, telecommuters).
14.3.1.5 VPN, NAT, and NAT Traversal
In the following example, there is another router (
A
) between router
X
and router
Y
.
Figure 197
VPN/NAT Example
If router
A
does NAT, it might change the IP addresses, port numbers, or both. If router
X
and
router
Y
try to establish a VPN tunnel, the authentication fails because it depends on this
information. The routers cannot establish a VPN tunnel.
Most routers like router
A
now have an IPSec pass-through feature. This feature helps router
A
recognize VPN packets and route them appropriately. If router
A
has this feature, router
X
and
router
Y
can establish a VPN tunnel as long as the active protocol is ESP. (See
for more information about active protocols.)
If router A does not have an IPSec pass-through or if the active protocol is AH, you can solve
this problem by enabling NAT traversal. In NAT traversal, router
X
and router
Y
add an extra
header to the IKE SA and IPSec SA packets. If you configure router
A
to forward these
packets unchanged, router
X
and router
Y
can establish a VPN tunnel.
You have to do the following things to set up NAT traversal.
• Enable NAT traversal on the ZyWALL and remote IPSec router.
• Configure the NAT router to forward packets with the extra header unchanged. (See the
field description for detailed information about the extra header.)
The extra header may be UDP port 500 or UDP port 4500, depending on the standard(s) the
ZyWALL and remote IPSec router support.
14.4 Additional IPSec VPN Topics
This section discusses other IPSec VPN topics that apply to either IKE SAs or IPSec SAs or
both. Relationships between the topics are also highlighted.
Summary of Contents for ZYWALL 2 WG
Page 2: ......
Page 8: ...Safety Warnings ZyWALL 2WG User s Guide 8 ...
Page 42: ...List of Figures ZyWALL 2WG User s Guide 42 ...
Page 50: ...List of Tables ZyWALL 2WG User s Guide 50 ...
Page 52: ...52 ...
Page 80: ...Chapter 2 Introducing the Web Configurator ZyWALL 2WG User s Guide 80 ...
Page 100: ...Chapter 3 Wizard Setup ZyWALL 2WG User s Guide 100 ...
Page 140: ...Chapter 4 Tutorial ZyWALL 2WG User s Guide 140 ...
Page 146: ...146 ...
Page 158: ...Chapter 6 LAN Screens ZyWALL 2WG User s Guide 158 ...
Page 171: ...Chapter 8 WAN Screens ZyWALL 2WG User s Guide 171 Figure 108 NETWORK WAN General ...
Page 200: ...Chapter 8 WAN Screens ZyWALL 2WG User s Guide 200 ...
Page 238: ...238 ...
Page 300: ...Chapter 13 Content Filtering Reports ZyWALL 2WG User s Guide 300 ...
Page 348: ...Chapter 14 IPSec VPN ZyWALL 2WG User s Guide 348 ...
Page 378: ...Chapter 15 Certificates ZyWALL 2WG User s Guide 378 ...
Page 384: ...384 ...
Page 426: ...Chapter 20 Bandwidth Management ZyWALL 2WG User s Guide 426 ...
Page 479: ...479 PART V Logs and Maintenance Logs Screens 481 Maintenance 511 ...
Page 480: ...480 ...
Page 485: ...Chapter 26 Logs Screens ZyWALL 2WG User s Guide 485 Figure 304 LOGS Log Settings ...
Page 510: ...Chapter 26 Logs Screens ZyWALL 2WG User s Guide 510 ...
Page 530: ...530 ...
Page 558: ...Chapter 30 WAN and Dial Backup Setup ZyWALL 2WG User s Guide 558 ...
Page 564: ...Chapter 31 LAN Setup ZyWALL 2WG User s Guide 564 ...
Page 570: ...Chapter 32 Internet Access ZyWALL 2WG User s Guide 570 ...
Page 574: ...Chapter 33 DMZ Setup ZyWALL 2WG User s Guide 574 ...
Page 578: ...Chapter 34 Route Setup ZyWALL 2WG User s Guide 578 ...
Page 582: ...Chapter 35 Wireless Setup ZyWALL 2WG User s Guide 582 ...
Page 594: ...Chapter 37 IP Static Route Setup ZyWALL 2WG User s Guide 594 ...
Page 614: ...Chapter 38 Network Address Translation NAT ZyWALL 2WG User s Guide 614 ...
Page 632: ...Chapter 40 Filter Configuration ZyWALL 2WG User s Guide 632 ...
Page 668: ...Chapter 44 System Maintenance Menus 8 to 10 ZyWALL 2WG User s Guide 668 ...
Page 672: ...Chapter 45 Remote Management ZyWALL 2WG User s Guide 672 ...
Page 680: ...Chapter 46 IP Policy Routing ZyWALL 2WG User s Guide 680 ...
Page 686: ...686 ...
Page 692: ...Chapter 48 Troubleshooting ZyWALL 2WG User s Guide 692 ...
Page 702: ...Chapter 49 Product Specifications ZyWALL 2WG User s Guide 702 ...
Page 704: ...704 ...
Page 712: ...Appendix A Pop up Windows JavaScripts and Java Permissions ZyWALL 2WG User s Guide 712 ...
Page 740: ...Appendix D Common Services ZyWALL 2WG User s Guide 740 ...
Page 768: ...Appendix G Legal Information ZyWALL 2WG User s Guide 768 ...
Page 774: ...Appendix H Customer Support ZyWALL 2WG User s Guide 774 ...