ZyXEL Communications ZyXEL ZyWALL P1, User Manual

Page: 306 / 369

ZyWALL P1 User’s Guide
Appendix G VPN Setup 305
Appendix G
VPN Setup
This appendix will help you to quickly create a IPSec/VPN connection between two ZyXEL
IPSec routers. It should be considered a quick reference for experienced users.
General Notes
• The private networks behind the IPSec routers must be on different subnets.
For example, 192.168. 10 .0/24 and 192.168. 20 .0/24.
• If the sites are/were previously connected using a leased line or ISDN router, physically
disconnect these devices from the network before testing your new VPN connection. The
old route may have been learnt by RIP and would take priority over the new VPN
connection.
• To test whether or not a tunnel is working, ping from a computer at one site to a computer
at the other.
• Before doing so, ensure that both computers have Internet access (via the IPSec routers).
• You can use the “
E-MAIL ” Peer Type and the “ SUBNET ” Local and Remote Address
Type to simplify the configuration.
• Do not manually create any static IP routes for the remote VPN site. They are not
required.
Dynamic IPSec Rule
Create a dynamic rule by setting the Secure Gateway Address to ‘0.0.0.0’. A single dynamic
rule can support multiple simultaneous incoming IPSec connections.
All users of a dynamic rule have the same pre-shared key. You may need to change the pre-
shared key if one of the users leaves. See the support notes at http://www.zyxel.com for
configuration examples for software VPN clients.
Full Feature NAT Mode
With Full Feature NAT mode, you must map the intended VPN rule’s local policy addresses
as the Inside Local Address (ILA) to a public IP address assigned by the ISP (an Inside Global
Address or IGA) before you can configure the VPN rule. For example, you could create a
One-to-One address mapping rule that maps the VPN rule’s local policy addresses as the ILA
to the VPN rule’s my IP address as the IGA.
You may have to specify the public IP address in the My IP Addr field of the local IPSec rule.
If you have not configured the address mapping properly, a “SPD doesn’t match configuration
of NAT” message displays when you try to save the IPSec rule.