ZyXEL Communications ZyWall USG20-VPN, Руководство пользователя

Страница: 642 / 683

Chapter 36 Troubleshooting
USG20(W)-VPN Series User’s Guide
642
Check the configuration for the following USG features.
• The USG does not put IPSec SAs in the routing table. You must create a policy route for each VPN
tunnel. See Chapter 10 on page 227 .
• Make sure the To-USG security policies allow IPSec VPN traffic to the USG. IKE uses UDP port
500, AH uses IP protocol 51, and ESP uses IP protocol 50.
• The USG supports UDP port 500 and UDP port 4500 for NAT traversal. If you enable this, make
sure the To-USG security policies allow UDP port 4500 too.
• Make sure regular security policies allow traffic between the VPN tunnel and the rest of the
network. Regular security policies check packets the USG sends before the USG encrypts them
and check packets the USG receives after the USG decrypts them. This depends on the zone to
which you assign the VPN tunnel and the zone from which and to which traffic may be routed.
• If you set up a VPN tunnel across the Internet, make sure your ISP supports AH or ESP
(whichever you are using).
• If you have the USG and remote IPSec router use certificates to authenticate each other, You
must set up the certificates for the USG and remote IPSec router first and make sure they trust
each other’s certificates. If the USG’s certificate is self-signed, import it into the remote IPsec
router. If it is signed by a CA, make sure the remote IPsec router trusts that CA. The USG uses
one of its
Trusted Certificates to authenticate the remote IPSec router’s certificate. The trusted
certificate can be the remote IPSec router’s self-signed certificate or that of a trusted CA that
signed the remote IPSec router’s certificate.
• Multiple SAs connecting through a secure gateway must have the same negotiation mode.
The VPN connection is up but VPN traffic cannot be transmitted through the VPN tunnel.
If you have the Configuration > VPN > IPSec VPN > VPN Connection screen’s Use Policy
Route to control dynamic IPSec rules option enabled, check the routing policies to see if they
are sending traffic elsewhere instead of through the VPN tunnels.
I uploaded a logo to show in the SSL VPN user screens but it does not display properly.
The logo graphic must be GIF, JPG, or PNG format. The graphic should use a resolution of 103 x 29
pixels to avoid distortion when displayed. The USG automatically resizes a graphic of a different
resolution to 103 x 29 pixels. The file size must be 100 kilobytes or less. Transparent background is
recommended.
I logged into the SSL VPN but cannot see some of the resource links.
Available resource links vary depending on the SSL application object’s configuration.
I changed the LAN IP address and can no longer access the Internet.