Home » ZyXEL Manuals » Networking » ZyXEL P-661H-D1 » Manual Viewer

ZyXEL P-661H-D1 User Guide - Page 227

Security > VPN > Setup > Edit > Advanced Setup continued, Table 59

Get ZyXEL P-661H-D1 PDF manuals and user guides

Add to My Manuals
Save this manual to your list of manuals

Page 227 highlights

Chapter 16 VPN Table 59 Security > VPN > Setup > Edit > Advanced Setup (continued) LABEL DESCRIPTION DH You must choose a key group for phase 1 setup. DH2 refers to Diffie- Hellman Group 2, a 1024-bit random number. DH5 refers to Diffie- Hellman Group5, a 1536-bit random number, and DH14 refers to Diffie-Hellman Group 14, providing 2048 bits of key strength. SA Life Time (Seconds) Define the length of time before an IPSec SA automatically renegotiates in this field. It may range from 60 to 3,000,000 seconds (almost 35 days). Phase 2 Encryption Algorithm A short SA Life Time increases security by forcing the two VPN gateways to update the encryption and authentication keys. However, every time the VPN tunnel renegotiates, all users accessing remote resources are temporarily disconnected. Select 3DES, AES-128 or AES-256 from the drop-down list box. When you use one of these encryption algorithms for data communications, both the sending device and the receiving device must use the same secret key, which can be used to encrypt and decrypt the message or to generate and verify a message authentication code. The DES encryption algorithm uses a 56-bit key. Triple DES (3DES) is a variation on DES that uses a 168-bit key. As a result, 3DES is more secure than DES. It also requires more processing power, resulting in increased latency and decreased throughput. Authentication Algorithm SA Life Time (Seconds) This implementation of AES uses a 128-bit key and a 256-bit key. AES is faster than 3DES. Select MD5, SHA1, SHA2-256 or SHA2-512 from the drop-down list box. MD5 (Message Digest 5) and SHA1 (Secure Hash Algorithm) and SHA2 are hash algorithms used to authenticate packet data. The SHA1 algorithm is generally considered stronger than MD5, but is slower. Select MD5 for minimal security and SHA-1 for more security. SHA2-256 or SHA2-512 are part of the SHA2 set of cryptographic functions and they are considered even more secure than MD5 and SHA1. Define the length of time before an IKE SA automatically renegotiates in this field. It may range from 60 to 3,000,000 seconds (almost 35 days). Perfect Forward Secrecy (PFS) A short SA Life Time increases security by forcing the two VPN gateways to update the encryption and authentication keys. However, every time the VPN tunnel renegotiates, all users accessing remote resources are temporarily disconnected. Perfect Forward Secrecy (PFS) is disabled (NONE) by default in phase 2 IPSec SA setup. This allows faster IPSec setup, but is not so secure. Choose DH2, DH5 or DH14 from the drop-down list box to enable PFS. DH2 refers to Diffie-Hellman Group 2, a 1024-bit random number. DH5 refers to Diffie-Hellman Group5, a 1536-bit random number, and DH14 refers to Diffie-Hellman Group 14, providing 2048 bits of key strength. P-661HNU-Fx User's Guide 227

Section	Page
P-661HNU-Fx	1
About This User's Guide	3
Document Conventions	5
Safety Warnings	7
Contents Overview	9
Table of Contents	11
User’s Guide	19
Introduction	21
1.1 Overview	21
1.2 Applications for the ZyXEL Device	21
1.2.1 Internet Access	22
1.2.2 Wireless Connection	23
1.2.3 ZyXEL Device’s USB and Print Server Support	23
1.3 The WPS/WLAN Button	24
1.4 Ways to Manage the ZyXEL Device	25
1.5 Good Habits for Managing the ZyXEL Device	26
1.6 LEDs (Lights)	26
1.7 The RESET Button	27
Introducing the Web Configurator	29
2.1 Overview	29
2.1.1 Accessing the Web Configurator	29
2.2 The Web Configurator Layout	32
2.2.1 Title Bar	32
2.2.2 Main Window	33
2.2.3 Navigation Panel	33
Tutorials	37
3.1 Overview	37
3.2 Setting Up Your DSL Connection	37
3.3 How to Set up a Wireless Network	40
3.3.1 Example Parameters	41
3.3.2 Configuring the AP	41
3.3.3 Configuring the Wireless Client using the ZyXEL Utility	42
3.3.4 Configuring the Wireless Client using the WPS PIN number	49
3.4 Setting Up NAT Port Forwarding	50
3.5 Using the File Sharing Feature	52
3.5.1 Set Up File Sharing	52
3.5.2 Access Your Shared Files From a Computer	55
3.6 Using the Print Server Feature	55
3.7 Configuring the MAC Address Filter	70
3.8 Configuring Static Route for Routing to Another Network	71
3.9 Configuring QoS Queue and Class Setup	73
3.10 Access the ZyXEL Device Using DDNS	76
3.10.1 Registering a DDNS Account on www.dyndns.org	77
3.10.2 Configuring DDNS on Your ZyXEL Device	78
3.10.3 Testing the DDNS Setting	78
Technical Reference	79
Connection Status and System Info Screens	81
4.1 Overview	81
4.2 The Connection Status Screen	81
4.3 The System Info Screen	83
Broadband	87
5.1 Overview	87
5.1.1 What You Can Do in this Chapter	88
5.1.2 What You Need to Know	88
5.1.3 Before You Begin	89
5.2 The Broadband Screen	89
5.2.1 Add/Edit Internet Connection	90
5.3 The 3G Backup Screen	102
5.4 Technical Reference	104
Wireless	111
6.1 Overview	111
6.1.1 What You Can Do in this Chapter	111
6.1.2 Wireless Network Overview	111
6.1.3 Before You Begin	113
6.2 The Wireless General Screen	113
6.2.1 No Security	115
6.2.2 Basic (Static WEP/Shared WEP Encryption)	116
6.2.3 More Secure (WPA(2)-PSK)	118
6.2.4 WPA(2) Authentication	119
6.3 The More AP Screen	121
6.3.1 Edit More AP	122
6.4 The WPS Screen	123
6.5 The WMM Screen	125
6.6 Scheduling Screen	127
6.7 Technical Reference	127
6.7.1 Additional Wireless Terms	128
6.7.2 Wireless Security Overview	128
6.7.3 Signal Problems	131
6.7.4 BSS	131
6.7.5 MBSSID	132
6.7.6 WiFi Protected Setup (WPS)	132
Home Networking	141
7.1 Overview	141
7.1.1 What You Can Do in this Chapter	141
7.1.2 What You Need To Know	142
7.2 The LAN Setup Screen	145
7.3 The Static DHCP Screen	146
7.3.1 Before You Begin	146
7.4 The UPnP Screen	148
7.5 The File Sharing Screen	149
7.5.1 Before You Begin	149
7.5.2 Add/Edit File Sharing	151
7.5.3 Add New User	152
7.6 The Print Server Screen	153
7.6.1 Before You Begin	153
7.7 Technical Reference	154
7.8 Installing UPnP in Windows Example	158
7.9 Using UPnP in Windows XP Example	162
Routing	169
8.1 Overview	169
8.2 Configuring Static Route	170
8.2.1 Add/Edit Static Route	171
DNS Route	173
9.1 Overview	173
9.1.1 What You Can Do in this Chapter	174
9.2 The DNS Route Screen	174
9.2.1 Add/Edit DNS Route Edit	175
Quality of Service (QoS)	177
10.1 Overview	177
10.1.1 What You Can Do in this Chapter	177
10.1.2 What You Need to Know	178
10.2 The QoS General Screen	178
10.3 The Queue Setup Screen	180
10.3.1 Add/Edit a QoS Queue	181
10.4 The Class Setup Screen	181
10.4.1 Add/Edit QoS Class	183
10.5 The QoS Monitor Screen	186
10.6 QoS Technical Reference	187
10.6.1 IP Precedence	187
10.6.2 DiffServ	187
Network Address Translation (NAT)	189
11.1 Overview	189
11.1.1 What You Can Do in this Chapter	189
11.1.2 What You Need To Know	189
11.2 The Port Forwarding Screen	190
11.2.1 The Port Forwarding Screen	191
11.2.2 The Port Forwarding Edit Screen	192
11.3 The Sessions Screen	193
11.4 Technical Reference	194
11.4.1 NAT Definitions	194
11.4.2 What NAT Does	195
11.4.3 How NAT Works	195
Dynamic DNS	197
12.1 Overview	197
12.1.1 What You Need To Know	197
12.2 The Dynamic DNS Screen	198
Firewall	199
13.1 Overview	199
13.1.1 What You Can Do in this Chapter	199
13.1.2 What You Need to Know	200
13.2 The General Screen	201
13.3 The Services Screen	201
13.4 Firewall Technical Reference	203
13.4.1 Guidelines For Enhancing Security With Your Firewall	203
13.4.2 Security Considerations	203
MAC Filter	205
14.1 Overview	205
14.1.1 What You Need to Know	205
14.2 The MAC Filter Screen	206
Certificates	207
15.1 Overview	207
15.1.1 What You Can Do in this Chapter	207
15.1.2 What You Need to Know	207
15.1.3 Verifying a Certificate	209
15.2 Local Certificates	210
15.2.1 Trusted CAs	212
15.2.2 Trusted CA Import	213
15.2.3 View Certificate	213
15.3 VPN Certificates	215
15.3.1 Import Certificate	216
VPN	217
16.1 Overview	217
16.1.1 What You Can Do in the VPN Screens	217
16.1.2 What You Need to Know About IPSec VPN	218
16.1.3 Before You Begin	219
16.2 VPN Setup Screen	220
16.3 The VPN Edit Screen	222
16.4 Configuring Advanced Settings	226
16.5 Viewing SA Monitor	228
16.6 IPSec VPN Technical Reference	229
16.6.1 IPSec Architecture	229
16.6.2 IPSec and NAT	230
16.6.3 VPN, NAT, and NAT Traversal	231
16.6.4 Encapsulation	232
16.6.5 IKE Phases	233
16.6.6 Negotiation Mode	234
16.6.7 Remote DNS Server	234
16.6.8 ID Type and Content	235
16.6.9 Pre-Shared Key	237
16.6.10 Diffie-Hellman (DH) Key Groups	237
16.6.11 Telecommuter VPN/IPSec Examples	237
System Monitor	241
17.1 Overview	241
17.1.1 What You Can Do in this Chapter	241
17.2 The WAN Status Screen	241
17.3 The LAN Status Screen	242
17.4 The NAT Status Screen	243
17.5 The 3G Backup Status Screen	244
User Account	245
18.1 Overview	245
18.2 The User Account Screen	245
Remote MGMT	247
19.1 Overview	247
19.1.1 What You Need to Know	247
19.2 The Remote MGMT Screen	248
System	249
20.1 Overview	249
20.1.1 What You Need to Know	249
20.2 The System Screen	249
Time Setting	251
21.1 Overview	251
21.2 The Time Setting Screen	251
Log Setting	253
22.1 Overview	253
22.2 The Log Setting Screen	253
Firmware Upgrade	255
23.1 Overview	255
23.2 The Firmware Screen	255
Backup/Restore	257
24.1 Overview	257
24.2 The Backup/Restore Screen	257
24.3 The Reboot Screen	259
Diagnostic	261
25.1 Overview	261
25.1.1 What You Can Do in this Chapter	261
25.2 The Ping Screen	261
25.3 The DSL Line Screen	262
Troubleshooting	265
26.1 Overview	265
26.2 Power, Hardware Connections, and LEDs	265
26.3 ZyXEL Device Access and Login	266
26.4 Internet Access	268
26.5 Wireless Internet Access	270
26.6 USB Device Connection	271
26.7 UPnP	272
Product Specifications	273
IP Addresses and Subnetting	283
Setting Up Your Computer’s IP Address	295
Pop-up Windows, Java Script and Java Permissions	325
Wireless LANs	335
Common Services	359
Open Software Announcements	363
Legal Information	393

Match case Limit results 1 per page

Chapter 16 VPN

P-661HNU-Fx User’s Guide

227

You must choose a key group for phase 1 setup.

DH2

refers to Diffie-

Hellman Group 2, a 1024-bit random number.

DH5

refers to Diffie-

Hellman Group5, a 1536-bit random number, and

DH14

refers to

Diffie-Hellman Group 14, providing 2048 bits of key strength.

SA Life Time

(Seconds)

Define the length of time before an IPSec SA automatically

renegotiates in this field. It may range from 60 to 3,000,000 seconds

(almost 35 days).

A short SA Life Time increases security by forcing the two VPN

gateways to update the encryption and authentication keys. However,

every time the VPN tunnel renegotiates, all users accessing remote

resources are temporarily disconnected.

Phase 2

Encryption

Algorithm

Select

3DES,

AES-128

AES-256

from the drop-down list box.

When you use one of these encryption algorithms for data

communications, both the sending device and the receiving device

must use the same secret key, which can be used to encrypt and

decrypt the message or to generate and verify a message

authentication code. The

DES

encryption algorithm uses a 56-bit key.

Triple DES (

3DES

) is a variation on

DES

that uses a 168-bit key. As a

result,

3DES

is more secure than

DES

. It also requires more

processing power, resulting in increased latency and decreased

throughput.

This implementation of AES uses a

128

-bit key and a

256

-bit key.

AES

is faster than

3DES

Authentication

Algorithm

Select

MD5

SHA1

SHA2-256

SHA2-512

from the drop-down list

box.

MD5

(Message Digest 5) and

SHA1

(Secure Hash Algorithm) and

SHA2

are hash algorithms used to authenticate packet data. The

SHA1

algorithm is generally considered stronger than

MD5

, but is

slower. Select

MD5

for minimal security and

SHA-1

for more security.

SHA2-256

SHA2-512

are part of the SHA2 set of cryptographic

functions and they are considered even more secure than

MD5

and

SHA1

SA Life Time

(Seconds)

Define the length of time before an IKE SA automatically renegotiates

in this field. It may range from 60 to 3,000,000 seconds (almost 35

days).

A short SA Life Time increases security by forcing the two VPN

gateways to update the encryption and authentication keys. However,

every time the VPN tunnel renegotiates, all users accessing remote

resources are temporarily disconnected.

Perfect Forward

Secrecy (PFS)

Perfect Forward Secrecy (PFS) is disabled (

NONE

) by default in phase

2 IPSec SA setup. This allows faster IPSec setup, but is not so secure.

Choose

DH2

DH5

DH14

from the drop-down list box to enable

PFS.

DH2

refers to Diffie-Hellman Group 2, a 1024-bit random number.

DH5

refers to Diffie-Hellman Group5, a 1536-bit random number, and

DH14

refers to Diffie-Hellman Group 14, providing 2048 bits of key

strength.

Table 59

Security > VPN > Setup > Edit > Advanced Setup (continued)

LABEL

DESCRIPTION