ZyXEL Communications VMG1312-B10C, Руководство пользователя

Страница: 212 / 294

Chapter 19 VPN
VMG1312-B10C User’s Guide
212
This screen contains the following fields:
Table 92
IPSec VPN: Add
LABEL DESCRIPTION
IPSec Setup
IPSec
Connection
Name
Enter the name of the VPN connection.
Tunnel Mode Select which protocol you want to use in the IPSec SA. Choices are:
AH (RFC 2402) - provides integrity, authentication, sequence integrity (replay
resistance), and non-repudiation but not encryption. If you select AH , you must select
an Authentication algorithm.
ESP (RFC 2406) - provides encryption and the same services offered by AH , but its
authentication is weaker. If you select ESP , you must select an Encryption algorithm
and Authentication algorithm.
Both AH and ESP increase processing requirements and latency (delay). The Device
and remote IPSec router must use the same active protocol.
Remote IPSec
Gateway
Address
Enter the IP address of the remote IPSec router in the IKE SA.
Local
Local Address
Type
Select Single to have only one local LAN IP address use the VPN tunnel. Select Subnet
to specify local LAN IP addresses by their subnet mask.
IP Address for
VPN
If Single is selected, enter a (static) IP address on the LAN behind your Device.
If Subnet is selected, specify IP addresses on a network by their subnet mask by
entering a (static) IP address on the LAN behind your Device. Then enter the subnet
mask to identify the network address.
IP Subnetmask If Subnet is selected, enter the subnet mask to identify the network address.
Remote
Remote Address
Type
Select Single to have only one remote LAN IP address use the VPN tunnel. Select
Subnet to specify remote LAN IP addresses by their subnet mask.
IP Address for
VPN
If Single is selected, enter a (static) IP address on the LAN behind the remote IPSec’s
router.
If Subnet is selected, specify IP addresses on a network by their subnet mask by
entering a (static) IP address on the LAN behind the remote IPSec’s router. Then enter
the subnet mask to identify the network address.
IP Subnetmask If Subnet is selected, enter the subnet mask to identify the network address.
Security Protocol - Auto
Key Exchange
Method
Select the key exchange method:
Auto(IKE) - Select this to use automatic IKE key management VPN connection policy.
Manual - Select this option to configure a VPN connection policy that uses a manual key
instead of IKE key management. This may be useful if you have problems with IKE key
management.
Note: Only use manual key as a temporary solution, because it is not as secure as a
regular IPSec SA.
Authentication
Method
Select Pre-Shared Key to use a pre-shared key for authentication, and type in your
pre-shared key. A pre-shared key identifies a communicating party during a phase 1 IKE
negotiation. It is called "pre-shared" because you have to share it with another party
before you can communicate with them over a secure connection.
Select Certificate to use a certificate for authentication.