ZyXEL SBG3300-N Series User Guide - Page 209
Connection Name, NAT Traversal NAT-T, Application Scenario, Remote, Access, Site-to-Site, Site-to-
View all ZyXEL SBG3300-N Series manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 209 highlights
Chapter 19 IPSec VPN Table 91 VPN > IPSec VPN > Setup > Edit (continued) LABEL DESCRIPTION Connection Name Enter a name to identify this VPN policy. If you are editing an existing policy, this field is not editable. Nailed-up Note: The Connection Name of an IPsec rule must be unique and cannot be changed once it has been created. Select this if you want the Device to automatically renegotiate the IPSec SA when the VPN connection is down. This feature is only applicable if you set the Application Scenario to Site-to-Site. NAT Traversal (NATT) When Nailed-up is enabled, you cannot disconnect the specified IPsec VPN tunnel in the VPN > IPSec VPN > Monitor screen. Select this check box to enable NAT traversal. NAT traversal allows you to set up a VPN connection when there are NAT routers between the two IPSec routers. The remote IPSec router must also have NAT traversal enabled. You can use NAT traversal with ESP protocol using Transport or Tunnel mode, but not with AH protocol nor with manual key management. In order for an IPSec router behind a NAT router to receive an initiating IPSec packet, set the NAT router to forward UDP ports 500 and 4500 to the IPSec router behind the NAT router. Note: It is suggested to always enable the NAT Traversal (NAT-T) feature if you are not sure if a NAT device is connected to your VPN gateway. Once this feature is enabled, it will automatically detect connected NAT devices for you. Application Scenario Select the scenario that best describes your intended VPN connection. Site-to-Site - Choose this if the remote IPSec router has a static IP address or a domain name. This Device can initiate the VPN tunnel. Site-to-Site with Dynamic Peer - Choose this if the remote IPSec router has a dynamic IP address. Only the remote IPSec router can initiate the VPN tunnel. My Address Remote Access - Choose this to allow incoming connections from IPSec VPN clients. The clients have dynamic IP addresses and are also known as dial-in users. Only the clients can initiate the VPN tunnel. Select an interface from the drop-down list and its IP address will be shown. The IP address of the Device is the IP address of the interface. Primary Peer Gateway Address Secondary Peer Gateway Address Fall Back to Primary Peer Gateway when possible Authentication Note: Only choose Any when the Application Scenario is configured as Remote Access. It is not applicable to Site-to-Site and Site-to-Site with Dynamic Peer. The primary peer gateway address is applicable (and required) when you choose Siteto-Site in the Application Scenario field. The Device primarily attempts to establish the VPN tunnel with this remote address. The peer gateway address can be either an IP address or FQDN. The secondary peer gateway IP address is applicable (and optional) if you choose Siteto-Site in the Application Scenario field. The Device attempts to establish the VPN tunnel with this remote address if it fails to connect to the primary peer gateway address. The secondary peer gateway address can be either an IP address or FQDN. When checked, the Device attempts to connect to the primary peer gateway address if the connection to secondary peer gateway address is dropped. Note: The Device and remote IPSec router must use the same authentication method to establish the IKE SA. Key Exchange Mode When this field is set to Manual, the specified IPsec VPN tunnel will be considered as connected at any time. You cannot disconnect the specified IPsec VPN tunnel in the IPsec Monitor screen. SBG3300-N Series User's Guide 209