ZyXEL Communications ZyWall USG20-VPN, Руководство пользователя

Страница: 359 / 683

Chapter 21 IPSec VPN
USG20(W)-VPN Series User’s Guide
359
The USG supports IKEv1 and IKEv2. See Section 21.1 on page 333 for more information.
IP Addresses of the USG and Remote IPSec Router
To set up an IKE SA, you have to specify the IP addresses of the USG and remote IPSec router. You
can usually enter a static IP address or a domain name for either or both IP addresses. Sometimes,
your USG might offer another alternative, such as using the IP address of a port or interface, as
well.
You can also specify the IP address of the remote IPSec router as 0.0.0.0. This means that the
remote IPSec router can have any IP address. In this case, only the remote IPSec router can initiate
an IKE SA because the USG does not know the IP address of the remote IPSec router. This is often
used for telecommuters.
IKE SA Proposal
The IKE SA proposal is used to identify the encryption algorithm, authentication algorithm, and
Diffie-Hellman (DH) key group that the USG and remote IPSec router use in the IKE SA. In main
mode, this is done in steps 1 and 2, as illustrated next.
Figure 233
IKE SA: Main Negotiation Mode, Steps 1 - 2: IKE SA Proposal
The USG sends one or more proposals to the remote IPSec router. (In some devices, you can only
set up one proposal.) Each proposal consists of an encryption algorithm, authentication algorithm,
and DH key group that the USG wants to use in the IKE SA. The remote IPSec router selects an
acceptable proposal and sends the accepted proposal back to the USG. If the remote IPSec router
rejects all of the proposals, the USG and remote IPSec router cannot establish an IKE SA.
Note: Both routers must use the same encryption algorithm, authentication algorithm,
and DH key group.
In most USGs, you can select one of the following encryption algorithms for each proposal. The
algorithms are listed in order from weakest to strongest.
• Data Encryption Standard (DES) is a widely used method of data encryption. It applies a 56-bit
key to each 64-bit block of data.
• Triple DES (3DES) is a variant of DES. It iterates three times with three separate keys, effectively
tripling the strength of DES.
• Advanced Encryption Standard (AES) is a newer method of data encryption that also uses a
secret key. AES applies a 128-bit key to 128-bit blocks of data. It is faster than 3DES.
One or more proposals, each one consisting of:
- encryption algorithm
- authentication algorithm
- Diffie-Hellman key group
1
2
X
Y