Chapter 18 IPSec VPN
ZyWALL 5/35/70 Series User’s Guide
371
These modes are illustrated below.
In tunnel mode, the ZyWALL uses the active protocol to encapsulate the entire IP packet. As a
result, there are two IP headers:
• Outside header: The outside IP header contains the IP address of the ZyWALL or remote
IPSec router, whichever is the destination.
• Inside header: The inside IP header contains the IP address of the computer behind the
ZyWALL or remote IPSec router. The header for the active protocol (AH or ESP) appears
between the IP headers.
In transport mode, the encapsulation depends on the active protocol. With AH, the ZyWALL
includes part of the original IP header when it encapsulates the packet. With ESP, however,
the ZyWALL does not include the IP header when it encapsulates the packet, so it is not
possible to verify the integrity of the source IP address.
18.6.5 IPSec SA Proposal and Perfect Forward Secrecy
An IPSec SA proposal is similar to an IKE SA proposal (see
Section 18.3.1 on page 355
),
except that you also have the choice whether or not the ZyWALL and remote IPSec router
perform a new DH key exchange every time an IPSec SA is established. This is called Perfect
Forward Secrecy (PFS).
If you enable PFS, the ZyWALL and remote IPSec router perform a DH key exchange every
time an IPSec SA is established, changing the root key from which encryption keys are
generated. As a result, if one encryption key is compromised, other encryption keys remain
secure.
If you do not enable PFS, the ZyWALL and remote IPSec router use the same root key that
was generated when the IKE SA was established to generate encryption keys.
The DH key exchange is time-consuming and may be unnecessary for data that does not
require such security.
Figure 212
VPN: Transport and Tunnel Mode Encapsulation
Original Packet
IP Header
TCP
Header
Data
Transport Mode Packet
IP Header
AH/ESP
Header
TCP
Header
Data
Tunnel Mode Packet
IP Header
AH/ESP
Header
IP Header
TCP
Header
Data
Содержание ZyWALL 35 Series
Страница 2: ......
Страница 8: ...Safety Warnings ZyWALL 5 35 70 Series User s Guide 8 ...
Страница 52: ...List of Tables ZyWALL 5 35 70 Series User s Guide 52 ...
Страница 54: ...54 ...
Страница 60: ...Chapter 1 Getting to Know Your ZyWALL ZyWALL 5 35 70 Series User s Guide 60 ...
Страница 86: ...Chapter 2 Introducing the Web Configurator ZyWALL 5 35 70 Series User s Guide 86 ...
Страница 126: ...Chapter 4 Tutorials ZyWALL 5 35 70 Series User s Guide 126 Figure 57 SECURITY VPN VPN Rules IKE Add Network Policy ...
Страница 140: ...Chapter 4 Tutorials ZyWALL 5 35 70 Series User s Guide 140 ...
Страница 146: ...Chapter 5 Registration ZyWALL 5 35 70 Series User s Guide 146 ...
Страница 147: ...147 PART II Network LAN Screens 149 Bridge Screens 161 WAN Screens 167 DMZ Screens 203 WLAN 213 ...
Страница 148: ...148 ...
Страница 160: ...Chapter 6 LAN Screens ZyWALL 5 35 70 Series User s Guide 160 ...
Страница 173: ...Chapter 8 WAN Screens ZyWALL 5 35 70 Series User s Guide 173 Figure 93 NETWORK WAN General ...
Страница 202: ...Chapter 8 WAN Screens ZyWALL 5 35 70 Series User s Guide 202 ...
Страница 212: ...Chapter 9 DMZ Screens ZyWALL 5 35 70 Series User s Guide 212 ...
Страница 242: ...242 ...
Страница 262: ...Chapter 11 Firewall ZyWALL 5 35 70 Series User s Guide 262 Figure 146 SECURITY FIREWALL Rule Summary Edit ...
Страница 274: ...Chapter 11 Firewall ZyWALL 5 35 70 Series User s Guide 274 ...
Страница 294: ...Chapter 13 Configuring IDP ZyWALL 5 35 70 Series User s Guide 294 ...
Страница 320: ...Chapter 15 Anti Spam ZyWALL 5 35 70 Series User s Guide 320 ...
Страница 342: ...Chapter 16 Content Filtering Screens ZyWALL 5 35 70 Series User s Guide 342 ...
Страница 350: ...Chapter 17 Content Filtering Reports ZyWALL 5 35 70 Series User s Guide 350 ...
Страница 363: ...Chapter 18 IPSec VPN ZyWALL 5 35 70 Series User s Guide 363 Figure 210 SECURITY VPN VPN Rules IKE Edit Gateway Policy ...
Страница 373: ...Chapter 18 IPSec VPN ZyWALL 5 35 70 Series User s Guide 373 Figure 213 SECURITY VPN VPN Rules IKE Edit Network Policy ...
Страница 424: ...Chapter 19 Certificates ZyWALL 5 35 70 Series User s Guide 424 ...
Страница 430: ...430 ...
Страница 448: ...Chapter 21 Network Address Translation NAT ZyWALL 5 35 70 Series User s Guide 448 ...
Страница 474: ...Chapter 24 Bandwidth Management ZyWALL 5 35 70 Series User s Guide 474 ...
Страница 514: ...Chapter 26 Remote Management ZyWALL 5 35 70 Series User s Guide 514 ...
Страница 533: ...533 PART V Reports Logs and Maintenance Reports 535 Logs Screens 547 Maintenance 575 ...
Страница 534: ...534 ...
Страница 551: ...Chapter 31 Logs Screens ZyWALL 5 35 70 Series User s Guide 551 Figure 334 LOGS Log Settings ...
Страница 592: ...Chapter 32 Maintenance ZyWALL 5 35 70 Series User s Guide 592 ...
Страница 594: ...594 Troubleshooting 751 Product Specifications 757 ...
Страница 602: ...Chapter 33 Introducing the SMT ZyWALL 5 35 70 Series User s Guide 602 ...
Страница 622: ...Chapter 35 WAN and Dial Backup Setup ZyWALL 5 35 70 Series User s Guide 622 ...
Страница 628: ...Chapter 36 LAN Setup ZyWALL 5 35 70 Series User s Guide 628 ...
Страница 634: ...Chapter 37 Internet Access ZyWALL 5 35 70 Series User s Guide 634 ...
Страница 638: ...Chapter 38 DMZ Setup ZyWALL 5 35 70 Series User s Guide 638 ...
Страница 642: ...Chapter 39 Route Setup ZyWALL 5 35 70 Series User s Guide 642 ...
Страница 658: ...Chapter 41 Remote Node Setup ZyWALL 5 35 70 Series User s Guide 658 ...
Страница 662: ...Chapter 42 IP Static Route Setup ZyWALL 5 35 70 Series User s Guide 662 ...
Страница 700: ...Chapter 45 Filter Configuration ZyWALL 5 35 70 Series User s Guide 700 ...
Страница 738: ...Chapter 50 Remote Management ZyWALL 5 35 70 Series User s Guide 738 ...
Страница 746: ...Chapter 51 IP Policy Routing ZyWALL 5 35 70 Series User s Guide 746 ...
Страница 766: ...766 ...
Страница 770: ...Appendix A Hardware Installation ZyWALL 5 35 70 Series User s Guide 770 ...
Страница 778: ...Appendix B Pop up Windows JavaScripts and Java Permissions ZyWALL 5 35 70 Series User s Guide 778 ...
Страница 780: ...Appendix C Removing and Installing a Fuse ZyWALL 5 35 70 Series User s Guide 780 ...
Страница 802: ...Appendix D Setting up Your Computer s IP Address ZyWALL 5 35 70 Series User s Guide 802 ...
Страница 816: ...Appendix F Common Services ZyWALL 5 35 70 Series User s Guide 816 ...
Страница 852: ...Appendix J Importing Certificates ZyWALL 5 35 70 Series User s Guide 852 ...
Страница 856: ...Appendix K Legal Information ZyWALL 5 35 70 Series User s Guide 856 ...
Страница 862: ...Appendix L Customer Support ZyWALL 5 35 70 Series User s Guide 862 ...