ZyXEL Communications ZyWall USG 50-H Series, User Manual

Page: 326 / 704

Chapter 19 IPSec VPN
ZyWALL USG 50-H User’s Guide
326
19.4 The VPN Concentrator Screen
A VPN concentrator combines several IPSec VPN connections into one secure network.
Figure 242 VPN Topologies (Fully Meshed and Hub and Spoke)
In a fully-meshed VPN topology ( 1 in the figure), there is a VPN connection between every
pair of routers. In a hub-and-spoke VPN topology ( 2 in the figure), there is a VPN connection
between each spoke router ( B , C , D , and E ) and the hub router ( A ), which uses the VPN
concentrator. The VPN concentrator routes VPN traffic between the spoke routers and itself.
A VPN concentrator reduces the number of VPN connections that you have to set up and
maintain in the network. You might also be able to consolidate the policy routes in each spoke
router, depending on the IP addresses and subnets of each spoke.
However a VPN concentrator is not for every situation. The hub router is a single failure point,
so a VPN concentrator is not as appropriate if the connection between spoke routers cannot be
down occasionally (maintenance, for example). There is also more burden on the hub router. It
receives VPN traffic from one spoke, decrypts it, inspects it to find out to which spoke to route
it, encrypts it, and sends it to the appropriate spoke. Therefore, a VPN concentrator is more
suitable when there is a minimum amount of traffic between spoke routers.
Client Mode Select this radio button if the ZyWALL provides a username and password to the
remote IPSec router for authentication. You also have to provide the
User Name
and the Password .
User Name This field is required if the ZyWALL is in Client Mode for extended authentication.
Type the user name the ZyWALL sends to the remote IPSec router. The user
name can be 1-31 ASCII characters. It is case-sensitive, but spaces are not
allowed.
Password This field is required if the ZyWALL is in Client Mode for extended authentication.
Type the password the ZyWALL sends to the remote IPSec router. The password
can be 1-31 ASCII characters. It is case-sensitive, but spaces are not allowed.
OK Click OK to save your settings and exit this screen.
Cancel Click Cancel to exit this screen without saving.
Table 120 VPN > IPSec VPN > VPN Gateway > Edit (continued)
LABEL DESCRIPTION
1 2