ZyXEL VMG8324 User Guide - Page 224

Table 104, Label, Description

Page 224 highlights

Chapter 20 VPN Table 104 Security > IPSec VPN: Add/Edit LABEL IP Address for VPN IP Subnetmask Tunnel access from remote IP addresses IP Address for VPN DESCRIPTION If Single Address is selected, enter a (static) IP address on the LAN behind your Device. If Subnet is selected, specify IP addresses on a network by their subnet mask by entering a (static) IP address on the LAN behind your Device. Then enter the subnet mask to identify the network address. If Subnet is selected, enter the subnet mask to identify the network address. Select Single Address to have only one remote LAN IP address use the VPN tunnel. Select Subnet to specify remote LAN IP addresses by their subnet mask. If Single Address is selected, enter a (static) IP address on the LAN behind the remote IPSec's router. IP Subnetmask Protocol If Subnet is selected, specify IP addresses on a network by their subnet mask by entering a (static) IP address on the LAN behind the remote IPSec's router. Then enter the subnet mask to identify the network address. If Subnet is selected, enter the subnet mask to identify the network address. Select which protocol you want to use in the IPSec SA. Choices are: AH (RFC 2402) - provides integrity, authentication, sequence integrity (replay resistance), and non-repudiation but not encryption. If you select AH, you must select an Integraty Algorithm. ESP (RFC 2406) - provides encryption and the same services offered by AH, but its authentication is weaker. If you select ESP, you must select an Encryption Agorithm and Integraty Algorithm. Key Exchange Method Both AH and ESP increase processing requirements and latency (delay). The Device and remote IPSec router must use the same active protocol. Select the key exchange method: Auto(IKE) - Select this to use automatic IKE key management VPN connection policy. Manual - Select this option to configure a VPN connection policy that uses a manual key instead of IKE key management. This may be useful if you have problems with IKE key management. Authentication Method Pre-Shared Key Local ID Type Note: Only use manual key as a temporary solution, because it is not as secure as a regular IPSec SA. Select Pre-Shared Key to use a pre-shared key for authentication, and type in your preshared key. A pre-shared key identifies a communicating party during a phase 1 IKE negotiation. It is called "pre-shared" because you have to share it with another party before you can communicate with them over a secure connection. Select Certificate (X.509) to use a certificate for authentication. Type your pre-shared key in this field. A pre-shared key identifies a communicating party during a phase 1 IKE negotiation. Type from 8 to 31 case-sensitive ASCII characters or from 16 to 62 hexadecimal ("0-9", "A-F") characters. You must precede a hexadecimal key with a "0x" (zero x), which is not counted as part of the 16 to 62 character range for the key. For example, in "0x0123456789ABCDEF", "0x" denotes that the key is hexadecimal and "0123456789ABCDEF" is the key itself. Select IP to identify the Device by its IP address. Select E-mail to identify this Device by an e-mail address. Select DNS to identify this Device by a domain name. Select ASN1DN (Abstract Syntax Notation one - Distinguished Name) to this Device by the subject field in a certificate. This is used only with certificate-based authentication. 224 VMG8324-B10A / VMG8324-B30A Series User's Guide

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208
  • 209
  • 210
  • 211
  • 212
  • 213
  • 214
  • 215
  • 216
  • 217
  • 218
  • 219
  • 220
  • 221
  • 222
  • 223
  • 224
  • 225
  • 226
  • 227
  • 228
  • 229
  • 230
  • 231
  • 232
  • 233
  • 234
  • 235
  • 236
  • 237
  • 238
  • 239
  • 240
  • 241
  • 242
  • 243
  • 244
  • 245
  • 246
  • 247
  • 248
  • 249
  • 250
  • 251
  • 252
  • 253
  • 254
  • 255
  • 256
  • 257
  • 258
  • 259
  • 260
  • 261
  • 262
  • 263
  • 264
  • 265
  • 266
  • 267
  • 268
  • 269
  • 270
  • 271
  • 272
  • 273
  • 274
  • 275
  • 276
  • 277
  • 278
  • 279
  • 280
  • 281
  • 282
  • 283
  • 284
  • 285
  • 286
  • 287
  • 288
  • 289
  • 290
  • 291
  • 292
  • 293
  • 294
  • 295
  • 296
  • 297
  • 298
  • 299
  • 300
  • 301
  • 302
  • 303
  • 304
  • 305
  • 306
  • 307
  • 308
  • 309
  • 310
  • 311
  • 312
  • 313
  • 314
  • 315
  • 316
  • 317
  • 318
  • 319
  • 320
  • 321
  • 322
  • 323
  • 324
  • 325
  • 326
  • 327
  • 328
  • 329
  • 330
  • 331
  • 332
  • 333
  • 334
  • 335
  • 336
  • 337
  • 338
  • 339
  • 340
  • 341
  • 342
  • 343
  • 344
  • 345
  • 346
  • 347
  • 348
  • 349
  • 350
  • 351
  • 352
  • 353
  • 354
  • 355
  • 356
  • 357
  • 358
  • 359
  • 360
  • 361
  • 362
  • 363
  • 364
  • 365
  • 366
  • 367
  • 368
  • 369
  • 370
  • 371
  • 372
  • 373
  • 374
  • 375
  • 376
  • 377
  • 378
  • 379
  • 380
  • 381
  • 382
  • 383
  • 384
  • 385
  • 386
  • 387
  • 388
  • 389
  • 390
  • 391
  • 392
  • 393
  • 394
  • 395
  • 396
  • 397
  • 398
  • 399
  • 400
  • 401
  • 402
  • 403
  • 404
  • 405
  • 406
  • 407
  • 408
  • 409
  • 410
  • 411
  • 412

Chapter 20 VPN
VMG8324-B10A / VMG8324-B30A Series User’s Guide
224
IP Address for
VPN
If
Single Address
is selected, enter a (static) IP address on the LAN behind your Device.
If
Subnet
is selected, specify IP addresses on a network by their subnet mask by entering
a (static) IP address on the LAN behind your Device.
Then enter the subnet mask to
identify the network address.
IP Subnetmask
If
Subnet
is selected, enter the subnet mask to identify the network address.
Tunnel access
from remote IP
addresses
Select
Single Address
to have only one remote LAN IP address use the VPN tunnel.
Select
Subnet
to specify remote LAN IP addresses by their subnet mask.
IP Address for
VPN
If
Single Address
is selected, enter a (static) IP address on the LAN behind the remote
IPSec’s router.
If
Subnet
is selected, specify IP addresses on a network by their subnet mask by entering
a (static) IP address on the LAN behind the remote IPSec’s router.
Then enter the subnet
mask to identify the network address.
IP Subnetmask
If
Subnet
is selected, enter the subnet mask to identify the network address.
Protocol
Select which protocol you want to use in the IPSec SA. Choices are:
AH
(RFC 2402) - provides integrity, authentication, sequence integrity (replay
resistance), and non-repudiation but not encryption. If you select
AH
, you must select an
Integraty
Algorithm
.
ESP
(RFC 2406) - provides encryption and the same services offered by
AH
, but its
authentication is weaker. If you select
ESP
, you must select an
Encryption Agorithm
and
Integraty Algorithm
.
Both
AH
and
ESP
increase processing requirements and latency (delay). The Device and
remote IPSec router must use the same active protocol.
Key Exchange
Method
Select the key exchange method:
Auto(IKE)
- Select this to use automatic IKE key management VPN connection policy.
Manual
- Select this option to configure a VPN connection policy that uses a manual key
instead of IKE key management. This may be useful if you have problems with IKE key
management.
Note: Only use manual key as a temporary solution, because it is not as secure as a regular
IPSec SA.
Authentication
Method
Select
Pre-Shared Key
to use a pre-shared key for authentication, and type in your pre-
shared key. A pre-shared key identifies a communicating party during a phase 1 IKE
negotiation. It is called "pre-shared" because you have to share it with another party
before you can communicate with them over a secure connection.
Select
Certificate (X.509)
to use a certificate for authentication.
Pre-Shared Key
Type your pre-shared key in this field. A pre-shared key identifies a communicating party
during a phase 1 IKE negotiation.
Type from 8 to 31 case-sensitive ASCII characters or from 16 to 62 hexadecimal ("0-9",
"A-F") characters. You must precede a hexadecimal key with a "0x” (zero x), which is not
counted as part of the 16 to 62 character range for the key. For example, in
"0x0123456789ABCDEF", “0x” denotes that the key is hexadecimal and
“0123456789ABCDEF” is the key itself.
Local ID Type
Select
IP
to identify the Device by its IP address.
Select
E-mail
to identify this Device by an e-mail address.
Select
DNS
to identify this Device by a domain name.
Select
ASN1DN
(Abstract Syntax Notation one - Distinguished Name) to this Device by
the subject field in a certificate. This is used only with certificate-based authentication.
Table 104
Security > IPSec VPN: Add/Edit
LABEL
DESCRIPTION