ZyXEL Communications Prestige 202H Series, Руководство пользователя

Страница: 272 / 309

Prestige 202H User’s Guide
26-8 VPN/IPSec Setup
Table 26-2 Menu 27.1 IPSec Summary
FIELD DESCRIPTION EXAMPLE
Select Rule Type the VPN rule index number you wish to edit or delete and then
press [ENTER]. 3
When you have completed this menu, press [ENTER] at the prompt “Press ENTER to Confirm…” to save
your configuration, or press [ESC] at any time to cancel.
26.6 Keep Alive
When you initiate an IPSec tunnel with keep alive enabled, the Prestige automatically renegotiates the tunnel
when the IPSec SA lifetime period expires. In effect, the IPSec tunnel becomes an “always on” connection
after you initiate it. Both IPSec routers must have a Prestige -compatible keep alive feature enabled in order
for this feature to work. The Prestige has a maximum of 2 IPSec tunnels.
When there is outbound traffic with no inbound traffic, the Prestige automatically
drops the tunnel after two minutes.
26.7 ID Type and Content
With aggressive negotiation mode (see section 26.10.1 ), the Prestige identifies incoming SAs by ID type and
content since this identifying information is not encrypted. This enables the Prestige to distinguish between
multiple rules for SAs that connect from remote IPSec routers that have dynamic WAN IP addresses.
Telecommuters can use separate passwords to simultaneously connect to the Prestige from IPSec routers with
dynamic IP addresses (see
section 26.13.2 for a telecommuter configuration example).
With main mode (see
section 26.10.1 ), the ID type and content are encrypted to provide identity protection.
In this case the Prestige can only distinguish between up to eight different incoming SAs that connect from
remote IPSec routers that have dynamic WAN IP addresses. The Prestige can distinguish up to eight
incoming SAs because you can select between two encryption algorithms (DES and 3DES), two
authentication algorithms (MD5 and SHA1) and two key groups (DH1 and DH2) when you configure a VPN
rule. The ID type and content act as an extra level of identification for incoming SAs.
The type of ID can be a domain name, an IP address or an e-mail address. The content is the IP address,
domain name, or e-mail address.