ZyXEL Communications ZyXEL ZyWALL USG-1000, User Manual

Page: 359 / 986

Chapter 21 IPSec VPN
ZyWALL USG 2000 User’s Guide
359
You can also specify the IP address of the remote IPSec router as 0.0.0.0. This
means that the remote IPSec router can have any IP address. In this case, only
the remote IPSec router can initiate an IKE SA because the ZyWALL does not
know the IP address of the remote IPSec router. This is often used for
telecommuters.
IKE SA Proposal
The IKE SA proposal is used to identify the encryption algorithm, authentication
algorithm, and Diffie-Hellman (DH) key group that the ZyWALL and remote IPSec
router use in the IKE SA. In main mode, this is done in steps 1 and 2, as
illustrated next.
Figure 221 IKE SA: Main Negotiation Mode, Steps 1 - 2: IKE SA Proposal
The ZyWALL sends one or more proposals to the remote IPSec router. (In some
devices, you can only set up one proposal.) Each proposal consists of an
encryption algorithm, authentication algorithm, and DH key group that the
ZyWALL wants to use in the IKE SA. The remote IPSec router selects an
acceptable proposal and sends the accepted proposal back to the ZyWALL. If the
remote IPSec router rejects all of the proposals, the ZyWALL and remote IPSec
router cannot establish an IKE SA.
Note: Both routers must use the same encryption algorithm, authentication algorithm,
and DH key group.
In most ZyWALLs, you can select one of the following encryption algorithms for
each proposal. The algorithms are listed in order from weakest to strongest.
• Data Encryption Standard (DES) is a widely used method of data encryption. It
applies a 56-bit key to each 64-bit block of data.
• Triple DES (3DES) is a variant of DES. It iterates three times with three
separate keys, effectively tripling the strength of DES.
One or more proposals, each one consisting of:
- encryption algorithm
- authentication algorithm
- Diffie-Hellman key group
1
2
X
Y