Home » ZyXEL Manuals » Networking » ZyXEL NBG420N » Manual Viewer

ZyXEL NBG420N User Guide - Page 178

Aggressive, Tunnel, Transport, Encryption Algorithm, Authentication Algorithm, LABEL, DESCRIPTION

Get ZyXEL NBG420N PDF manuals and user guides

Add to My Manuals
Save this manual to your list of manuals

Page 178 highlights

Chapter 15 IPSec VPN Table 64 Security > VPN > Rule Setup: IKE (Advanced) (continued) LABEL DESCRIPTION IKE Phase 1 Negotiation Mode Select Main or Aggressive from the drop-down list box. Multiple SAs connecting through a secure gateway must have the same negotiation mode. Encryption Algorithm Select which key size and encryption algorithm to use in the IKE SA. Choices are: DES - a 56-bit key with the DES encryption algorithm 3DES - a 168-bit key with the DES encryption algorithm The NBG420N and the remote IPSec router must use the same algorithms and keys. Longer keys require more processing power, resulting in increased latency and decreased throughput. Authentication Algorithm Select which hash algorithm to use to authenticate packet data in the IKE SA. Choices are SHA1 and MD5. SHA1 is generally considered stronger than MD5, but it is also slower. SA Life Time (Seconds) Key Group Define the length of time before an IKE SA automatically renegotiates in this field. It may range from 180 to 3,000,000 seconds (almost 35 days). A short SA Life Time increases security by forcing the two VPN gateways to update the encryption and authentication keys. However, every time the VPN tunnel renegotiates, all users accessing remote resources are temporarily disconnected. Select which Diffie-Hellman key group (DHx) you want to use for encryption keys. Choices are: DH1 - use a 768-bit random number DH2 - use a 1024-bit random number Pre-Shared Key Type your pre-shared key in this field. A pre-shared key identifies a communicating party during a phase 1 IKE negotiation. It is called "pre-shared" because you have to share it with another party before you can communicate with them over a secure connection. Type from 8 to 31 case-sensitive ASCII characters or from 16 to 62 hexadecimal ("0-9", "A-F") characters. You must precede a hexadecimal key with a "0x" (zero x), which is not counted as part of the 16 to 62 character range for the key. For example, in "0x0123456789ABCDEF", "0x" denotes that the key is hexadecimal and "0123456789ABCDEF" is the key itself. Both ends of the VPN tunnel must use the same pre-shared key. You will receive a "PYLD_MALFORMED" (payload malformed) packet if the same preshared key is not used on both ends. IKE Phase 2 Encapsulation Mode Select Tunnel mode or Transport mode. IPSec Protocol Select the security protocols used for an SA. Both AH and ESP increase processing requirements and communications latency (delay). If you select ESP here, you must select options from the Encryption Algorithm and Authentication Algorithm fields (described below). Encryption Algorithm Select which key size and encryption algorithm to use in the IKE SA. Choices are: DES - a 56-bit key with the DES encryption algorithm 3DES - a 168-bit key with the DES encryption algorithm The NBG420N and the remote IPSec router must use the same algorithms and keys. Longer keys require more processing power, resulting in increased latency and decreased throughput. 178 NBG420N User's Guide

Section	Page
NBG420N	1
About This User's Guide	3
Document Conventions	4
Safety Warnings	6
Contents Overview	9
Table of Contents	11
List of Figures	19
List of Tables	25
Introduction	29
Getting to Know Your NBG420N	31
1.1 Overview	31
1.2 Router Mode	31
1.3 AP Mode	32
1.4 Router Features vs. AP Features	32
1.5 Ways to Manage the NBG420N	33
1.6 Good Habits for Managing the NBG420N	33
1.7 LEDs	33
The WPS Button	35
2.1 Overview	35
Introducing the Web Configurator	37
3.1 Web Configurator Overview	37
3.2 Accessing the Web Configurator	37
3.3 Resetting the NBG420N	39
3.3.1 Procedure to Use the Reset Button	39
3.4 Navigating the Web Configurator	39
3.5 The Status Screen in Router Mode	39
3.5.1 Navigation Panel	42
3.5.2 Summary: Any IP Table	44
3.5.3 Summary: Bandwidth Management Monitor	44
3.5.4 Summary: DHCP Table	45
3.5.5 Summary: Packet Statistics	46
3.5.6 Summary: VPN Monitor	47
3.5.7 Summary: Wireless Station Status	47
Connection Wizard	49
4.1 Wizard Setup	49
4.2 Connection Wizard: STEP 1: System Information	50
4.2.1 System Name	50
4.2.2 Domain Name	51
4.3 Connection Wizard: STEP 2: Wireless LAN	51
4.3.1 Basic (WEP) Security	53
4.3.2 Extend (WPA-PSK or WPA2-PSK) Security	54
4.4 Connection Wizard: STEP 3: Internet Configuration	54
4.4.1 Ethernet Connection	55
4.4.2 PPPoE Connection	55
4.4.3 PPTP Connection	56
4.4.4 Your IP Address	58
4.4.5 WAN IP Address Assignment	58
4.4.6 IP Address and Subnet Mask	59
4.4.7 DNS Server Address Assignment	59
4.4.8 WAN IP and DNS Server Address Assignment	60
4.4.9 WAN MAC Address	61
4.5 Connection Wizard: STEP 4: Bandwidth management	62
4.6 Connection Wizard Complete	62
AP Mode	65
5.1 AP Mode Overview	65
5.2 Setting your NBG420N to AP Mode	65
5.3 The Status Screen in AP Mode	66
5.3.1 Navigation Panel	68
5.4 Configuring Your Settings	69
5.4.1 LAN Settings	69
5.4.2 WLAN and Maintenance Settings	71
5.5 Logging in to the Web Configurator in AP Mode	71
Tutorials	73
6.1 Wireless Tutorials	73
6.1.1 How to Connect to the Internet from an AP	73
6.1.2 Configure Wireless Security Using WPS on both your NBG420N and Wireless Client	73
6.1.2.1 Push Button Configuration (PBC)	74
6.1.2.2 PIN Configuration	75
6.1.3 Enable and Configure Wireless Security without WPS on your NBG420N	76
6.1.4 Configure Your Notebook	78
6.2 Site-To-Site VPN Tunnel Tutorial	80
6.2.1 Configuring Bob’s NBG420N VPN Settings	81
6.2.2 Configuring Jack’s NBG420N VPN Settings	83
6.2.3 Checking the VPN Connection	84
Network	87
Wireless LAN	89
7.1 Wireless Network Overview	89
7.2 Wireless Security Overview	90
7.2.1 SSID	90
7.2.2 MAC Address Filter	90
7.2.3 User Authentication	90
7.2.4 Encryption	91
7.3 Roaming	92
7.3.1 Requirements for Roaming	93
7.4 Quality of Service	93
7.4.1 WMM QoS	94
7.4.1.1 WMM QoS Priorities	94
7.5 General Wireless LAN Screen	94
7.5.1 No Security	96
7.5.2 WEP Encryption	96
7.5.3 WPA-PSK/WPA2-PSK	98
7.5.4 WPA/WPA2	99
7.6 MAC Filter	101
7.7 Wireless LAN Advanced Screen	102
7.8 Quality of Service (QoS) Screen	103
7.8.1 Application Priority Configuration	105
7.9 WiFi Protected Setup	106
7.9.1 WPS Screen	106
7.9.2 WPS Station Screen	107
7.9.3 Scheduling	107
7.10 iPod Touch Web Configurator	108
7.10.1 Login Screen	109
7.10.2 System Status	110
7.10.3 WPS in Progress	112
7.10.4 Port Forwarding	113
7.11 Accessing the iPod Touch Web Configurator	114
7.11.1 Accessing the iPod Touch Web Configurator	115
WAN	117
8.1 WAN Overview	117
8.2 WAN MAC Address	117
8.3 Multicast	117
8.4 Internet Connection	118
8.4.1 Ethernet Encapsulation	118
8.4.2 PPPoE Encapsulation	119
8.4.3 PPTP Encapsulation	122
8.5 Advanced WAN Screen	125
LAN	127
9.1 LAN Overview	127
9.1.1 IP Pool Setup	127
9.1.2 System DNS Servers	127
9.2 LAN TCP/IP	127
9.2.1 Factory LAN Defaults	127
9.2.2 IP Address and Subnet Mask	128
9.2.3 Multicast	128
9.2.4 Any IP	128
9.3 LAN IP Screen	130
9.4 LAN IP Alias	130
9.5 Advanced LAN Screen	131
DHCP	133
10.1 DHCP	133
10.2 DHCP General Screen	133
10.3 DHCP Advanced Screen	134
10.4 Client List Screen	135
Network Address Translation (NAT)	137
11.1 NAT Overview	137
11.2 Using NAT	137
11.2.1 Port Forwarding: Services and Port Numbers	137
11.2.2 Configuring Servers Behind Port Forwarding Example	138
11.3 General NAT Screen	138
11.4 NAT Application Screen	139
11.4.1 Game List Example	141
11.5 Trigger Port Forwarding	142
11.5.1 Trigger Port Forwarding Example	142
11.5.2 Two Points To Remember About Trigger Ports	143
11.6 NAT Advanced Screen	143
Dynamic DNS	147
12.1 Dynamic DNS Introduction	147
12.1.1 DynDNS Wildcard	147
12.2 Dynamic DNS Screen	147
Security	151
Firewall	153
13.1 Introduction to ZyXEL’s Firewall	153
13.1.1 What is a Firewall?	153
13.1.2 Stateful Inspection Firewall	153
13.1.3 About the NBG420N Firewall	153
13.1.4 Guidelines For Enhancing Security With Your Firewall	154
13.2 Triangle Routes	154
13.2.1 Triangle Routes and IP Alias	154
13.3 General Firewall Screen	155
13.4 Services Screen	156
13.4.1 The Add Firewall Rule Screen	157
Content Filtering	161
14.1 Introduction to Content Filtering	161
14.2 Restrict Web Features	161
14.3 Days and Times	161
14.4 Filter Screen	161
14.5 Schedule	163
14.6 Customizing Keyword Blocking URL Checking	164
14.6.1 Domain Name or IP Address URL Checking	164
14.6.2 Full Path URL Checking	164
14.6.3 File Name URL Checking	164
IPSec VPN	165
15.1 IPSec VPN Overview	165
15.1.1 What You Can Do in the IPSec VPN Screens	165
15.1.2 What You Need To Know About IPSec VPN	166
15.1.3 IKE SA (IKE Phase 1) Overview	166
15.1.3.1 IP Addresses of the NBG420N and Remote IPSec Router	166
15.1.4 IPSec SA (IKE Phase 2) Overview	167
15.1.4.1 Local Network and Remote Network	167
15.2 The General Screen	167
15.2.1 VPN Rule Setup (Basic)	168
15.2.2 VPN Rule Setup (Advanced)	173
15.2.3 VPN Rule Setup (Manual)	179
15.2.3.1 IPSec SA Using Manual Keys	179
15.2.3.2 IPSec SA Proposal Using Manual Keys	179
15.2.3.3 Authentication and the Security Parameter Index (SPI)	180
15.3 The SA Monitor Screen	183
15.4 VPN and Remote Management	184
15.5 IPSec VPN Technical Reference	185
Management	193
Static Route Screens	195
16.1 Static Route Overview	195
16.2 IP Static Route Screen	195
16.2.1 Static Route Setup Screen	196
Bandwidth Management	199
17.1 Bandwidth Management Overview	199
17.2 Application-based Bandwidth Management	199
17.3 Subnet-based Bandwidth Management	199
17.4 Application and Subnet-based Bandwidth Management	200
17.5 Bandwidth Management Priorities	200
17.6 Predefined Bandwidth Management Services	201
17.6.1 Services and Port Numbers	201
17.7 Default Bandwidth Management Classes and Priorities	202
17.8 Bandwidth Management General Configuration	202
17.9 Bandwidth Management Advanced Configuration	203
17.9.1 Rule Configuration with the Pre-defined Service	205
17.9.2 Rule Configuration: User Defined Service Rule Configuration	205
17.10 Bandwidth Management Monitor	206
Remote Management	209
18.1 Remote Management Overview	209
18.1.1 Remote Management Limitations	209
18.1.2 Remote Management and NAT	210
18.1.3 System Timeout	210
18.2 WWW Screen	210
18.3 Telnet	211
18.4 Telnet Screen	211
18.5 FTP Screen	212
18.6 DNS Screen	212
Universal Plug-and-Play (UPnP)	215
19.1 Introducing Universal Plug and Play	215
19.1.1 How do I know if I'm using UPnP?	215
19.1.2 NAT Traversal	215
19.1.3 Cautions with UPnP	215
19.2 UPnP and ZyXEL	216
19.3 UPnP Screen	216
19.4 Installing UPnP in Windows Example	217
19.4.0.1 Installing UPnP in Windows Me	217
19.4.0.2 Using UPnP in Windows XP Example	220
Maintenance and Troubleshooting	227
System	229
20.1 System Overview	229
20.2 System General Screen	229
20.3 Time Setting Screen	230
Logs	233
21.1 View Log	233
21.2 Log Settings	234
21.3 Log Descriptions	237
Tools	251
22.1 Firmware Upload Screen	251
22.2 Configuration Screen	252
22.2.1 Backup Configuration	253
22.2.2 Restore Configuration	253
22.2.3 Back to Factory Defaults	254
22.3 Restart Screen	254
22.4 Wake On LAN	255
Configuration Mode	257
Sys Op Mode	259
24.1 Overview	259
24.1.1 Router	259
24.1.2 AP	259
24.2 Selecting System Operation Mode	260
Language	263
25.1 Language Screen	263
Troubleshooting	265
26.1 Power, Hardware Connections, and LEDs	265
26.2 NBG420N Access and Login	266
26.3 Internet Access	268
26.4 Resetting the NBG420N to Its Factory Defaults	269
26.5 Wireless Router/AP Troubleshooting	269
26.6 Advanced Features	270
Appendices and Index	271
Product Specifications and Wall- Mounting Instructions	273
Pop-up Windows, JavaScripts and Java Permissions	279
IP Addresses and Subnetting	285
Setting up Your Computer’s IP Address	293
26.6.1 Verifying Settings	308
Wireless LANs	309
26.6.2 WPA(2)-PSK Application Example	318
26.6.3 WPA(2) with RADIUS Application Example	318
Services	321
Legal Information	325
Customer Support	329

Match case Limit results 1 per page

Chapter 15 IPSec VPN

NBG420N User’s Guide

178

IKE Phase 1

Negotiation Mode

Select

Main

Aggressive

from the drop-down list box. Multiple SAs

connecting through a secure gateway must have the same negotiation mode.

Encryption Algorithm

Select which key size and encryption algorithm to use in the IKE SA. Choices

are:

DES

- a 56-bit key with the DES encryption algorithm

3DES

- a 168-bit key with the DES encryption algorithm

The NBG420N and the remote IPSec router must use the same algorithms and

keys. Longer keys require more processing power, resulting in increased

latency and decreased throughput.

Authentication

Algorithm

Select which hash algorithm to use to authenticate packet data in the IKE SA.

Choices are

SHA1

and

MD5

SHA1

is generally considered stronger than

MD5

but it is also slower.

SA Life Time

(Seconds)

Define the length of time before an IKE SA automatically renegotiates in this

field. It may range from 180 to 3,000,000 seconds (almost 35 days).

A short SA Life Time increases security by forcing the two VPN gateways to

update the encryption and authentication keys. However, every time the VPN

tunnel renegotiates, all users accessing remote resources are temporarily

disconnected.

Key Group

Select which Diffie-Hellman key group (DH

) you want to use for encryption

keys. Choices are:

DH1

- use a 768-bit random number

DH2

- use a 1024-bit random number

Pre-Shared Key

Type your pre-shared key in this field. A pre-shared key identifies a

communicating party during a phase 1 IKE negotiation. It is called "pre-shared"

because you have to share it with another party before you can communicate

with them over a secure connection.

Type from 8 to 31 case-sensitive ASCII characters or from 16 to 62

hexadecimal ("0-9", "A-F") characters. You must precede a hexadecimal key

with a "0x” (zero x), which is not counted as part of the 16 to 62 character range

for the key. For example, in "0x0123456789ABCDEF", “0x” denotes that the key

is hexadecimal and “0123456789ABCDEF” is the key itself.

Both ends of the VPN tunnel must use the same pre-shared key. You will

receive a “PYLD_MALFORMED” (payload malformed) packet if the same pre-

shared key is not used on both ends.

IKE Phase 2

Encapsulation Mode

Select

Tunnel

mode or

Transport

mode.

IPSec Protocol

Select the security protocols used for an SA.

Both

and

ESP

increase processing requirements and communications

latency (delay).

If you select

ESP

here, you must select options from the

Encryption Algorithm

and

Authentication Algorithm

fields (described below).

Encryption Algorithm

Select which key size and encryption algorithm to use in the IKE SA. Choices

are:

DES

- a 56-bit key with the DES encryption algorithm

3DES

- a 168-bit key with the DES encryption algorithm

The NBG420N and the remote IPSec router must use the same algorithms and

keys. Longer keys require more processing power, resulting in increased

latency and decreased throughput.

Table 64

Security > VPN > Rule Setup: IKE (Advanced)

(continued)

LABEL

DESCRIPTION