ZyXEL Communications ATP200, Руководство пользователя

Страница: 809 / 852

Chapter 43 Troubleshooting
ZyWALL ATP Series User’s Guide
809
Here are some general suggestions. See also Chapter 20 on page 379 .
• The system log can often help to identify a configuration problem.
• If you enable NAT traversal, the remote IPSec device must also have NAT traversal enabled.
• The Zyxel Device and remote IPSec router must use the same authentication method to establish the
IKE SA.
• Both routers must use the same negotiation mode.
• Both routers must use the same encryption algorithm, authentication algorithm, and DH key group.
• When using pre-shared keys, the Zyxel Device and the remote IPSec router must use the same pre-
shared key.
• The Zyxel Device’s local and peer ID type and content must match the remote IPSec router’s peer
and local ID type and content, respectively.
• The Zyxel Device and remote IPSec router must use the same active protocol.
• The Zyxel Device and remote IPSec router must use the same encapsulation.
• The Zyxel Device and remote IPSec router must use the same SPI.
• If the sites are/were previously connected using a leased line or ISDN router, physically disconnect
these devices from the network before testing your new VPN connection. The old route may have
been learned by RIP and would take priority over the new VPN connection.
• To test whether or not a tunnel is working, ping from a computer at one site to a computer at the
other.
Before doing so, ensure that both computers have Internet access (via the IPSec routers).
• It is also helpful to have a way to look at the packets that are being sent and received by the Zyxel
Device and remote IPSec router (for example, by using a packet sniffer).
Check the configuration for the following Zyxel Device features.
• The Zyxel Device does not put IPSec SAs in the routing table. You must create a policy route for each
VPN tunnel. See Chapter 10 on page 299 .
• Make sure the To-Zyxel Device security policies allow IPSec VPN traffic to the Zyxel Device. IKE uses
UDP port 500, AH uses IP protocol 51, and ESP uses IP protocol 50.
• The Zyxel Device supports UDP port 500 and UDP port 4500 for NAT traversal. If you enable this, make
sure the To-Zyxel Device security policies allow UDP port 4500 too.
• Make sure regular security policies allow traffic between the VPN tunnel and the rest of the network.
Regular security policies check packets the Zyxel Device sends before the Zyxel Device encrypts
them and check packets the Zyxel Device receives after the Zyxel Device decrypts them. This
depends on the zone to which you assign the VPN tunnel and the zone from which and to which
traffic may be routed.
• If you set up a VPN tunnel across the Internet, make sure your ISP supports AH or ESP (whichever you
are using).
• If you have the Zyxel Device and remote IPSec router use certificates to authenticate each other, You
must set up the certificates for the Zyxel Device and remote IPSec router first and make sure they trust
each other’s certificates. If the Zyxel Device’s certificate is self-signed, import it into the remote IPSec
router. If it is signed by a CA, make sure the remote IPSec router trusts that CA. The Zyxel Device uses
one of its Trusted Certificates to authenticate the remote IPSec router’s certificate. The trusted
certificate can be the remote IPSec router’s self-signed certificate or that of a trusted CA that signed
the remote IPSec router’s certificate.
• Multiple SAs connecting through a secure gateway must have the same negotiation mode.