ZyXEL Communications USG110, Руководство пользователя

Страница: 615 / 1090

Chapter 30 IPSec VPN
ZyWALL USG Series User’s Guide
615
Application
Scenario
Select the scenario that best describes your intended VPN connection.
Site-to-site - Choose this if the remote IPSec router has a static IP address or a domain
name. This Zyxel Device can initiate the VPN tunnel.
Site-to-site with Dynamic Peer - Choose this if the remote IPSec router has a dynamic IP
address. Only the remote IPSec router can initiate the VPN tunnel.
Remote Access (Server Role) - Choose this to allow incoming connections from IPSec VPN
clients. The clients have dynamic IP addresses and are also known as dial-in users. Only
the clients can initiate the VPN tunnel.
Remote Access (Client Role) - Choose this to connect to an IPSec server. This Zyxel Device
is the client (dial-in user) and can initiate the VPN tunnel.
VPN Tunnel Interface - Choose this to set up a VPN tunnel interface to bind with a VPN
connection. The Zyxel Device can use the interface to do load balancing using a specific
Trunk. The remote IPSec router should have a static IP address or a domain name. See
Configuration > Network > Interface > VTI .
VPN Gateway Select the VPN gateway this VPN connection is to use or select Create Object to add
another VPN gateway for this VPN connection to use.
Policy
Local Policy Select the address corresponding to the local network. Use Create new Object if you
need to configure a new one.
Remote Policy Select the address corresponding to the remote network. Use Create new Object if you
need to configure a new one.
Enable GRE over
IPSec
Select this to allow traffic using the Generic Routing Encapsulation (GRE) tunneling
protocol through an IPSec tunnel.
Policy Enforcement Clear this to allow traffic with source and destination IP addresses that do not match the
local and remote policy to use the VPN tunnel. Leave this cleared for free access
between the local and remote networks.
Selecting this restricts who can use the VPN tunnel. The Zyxel Device drops traffic with
source and destination IP addresses that do not match the local and remote policy.
Mode Config This is visible when you select Remote Access (Server Role) and a VPN Gateway .
Enable Mode
Config
Select this to have the IPSec VPN client receive an IP address, DNS and WINS information
from the Zyxel Device.
IP Address Pool Select an address object from the drop-down list box.
First DNS Server
(Optional)
The Domain Name System (DNS) maps a domain name to an IP address and vice versa.
The Zyxel Device uses these (in the order you specify here) to resolve domain names for
VPN. Enter a DNS server's IP address.
Second DNS Server
(Optional)
Enter a secondary DNS server's IP address that is checked if the first one is unavailable.
First WINS Server
(Optional)
Type the IP address of the WINS (Windows Internet Naming Service) server that you want
to send to the DHCP clients. The WINS server keeps a mapping table of the computer
names on your network and the IP addresses that they are currently using.
Second WINS
Server (Optional)
Enter a secondary WINS server's IP address that is checked if the first one is unavailable.
Configuration Payload This is only available when you have created an IKEv2 Gateway and are using Remote
Access (Server Role) .
Enable Configuration
Payload Select this to have at least have the IP address pool included in the VPN setup data.
IP Address Pool: Select an address object from the drop-down list box.
Table 221 Configuration > VPN > IPSec VPN > VPN Connection > Add/Edit (continued)
LABEL DESCRIPTION