ZyXEL ZyWALL 5 User Guide - Page 382
Telecommuter VPN/IPSec Examples - mtu setting
View all ZyXEL ZyWALL 5 manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 382 highlights
Chapter 19 IPSec VPN Table 108 SECURITY > VPN > Global Setting (continued) LABEL DESCRIPTION Gateway Domain Name Update Timer If you use dynamic domain names in VPN rules to identify the ZyWALL and/ or the remote IPSec router, the IP address mapped to the domain name can change. The VPN tunnel stops working after the IP address changes. Any users of the VPN tunnel are disconnected until the ZyWALL gets the new IP address from a DNS server and rebuilds the VPN tunnel. Enter the time period (between 2 and 60 minutes) to set how often the ZyWALL queries a DNS server to update the IP address and domain name mapping. If the query returns a new IP address for a dynamic domain name, the ZyWALL disconnects the VPN tunnel. The ZyWALL rebuilds the VPN tunnel (using the new IP address) immediately if the IPSec SA is set to nailed up. Otherwise the ZyWALL rebuilds the VPN tunnel when there are packets for it or you manually dial it. If the ZyWALL and all of the remote IPSec routers use static IP addresses or regular domain names, you can enter 0 to disable this feature. Adjust TCP Maximum Segment Size The TCP packets are larger after the ZyWALL encrypts them for VPN. The ZyWALL fragments packets that are larger than a connection's MTU (Maximum Transmit Unit). In most cases you should leave this set to Auto. The ZyWALL automatically sets the Maximum Segment Size (MSS) of the TCP packets that are to be encrypted by VPN based on the encapsulation type. Select Off to not adjust the MSS for the encrypted TCP packets. If your network environment causes fragmentation issues that are affecting your throughput performance, you can manually set a smaller MSS for the TCP packets that are to be encrypted by VPN. Select User-Defined and specify a size from 0~1460 bytes. 0 has the ZyWALL use the auto setting. Local and Remote IP Address Conflict Resolution Select The Local Network to send packets destined for overlapping local and remote IP addresses to the local network (you can access the local devices but not the remote devices). Select The Remote Network (via VPN Tunnel) to send packets destined for overlapping local and remote IP addresses to the remote network (you can access the remote devices but not the local devices.) If the remote IPSec router also supports NAT over IPSec, it is recommended that you use NAT over IPSec (see Section 19.14 on page 388) if the local and remote IP addresses overlap. If a VPN rule's local and remote network settings are both set to 0.0.0.0 (any), no traffic goes through the VPN tunnel if you select The Local Network. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. 19.11 Telecommuter VPN/IPSec Examples The following examples show how multiple telecommuters can make VPN connections to a single ZyWALL at headquarters. The telecommuters use IPSec routers with dynamic WAN IP addresses. The ZyWALL at headquarters has a static public IP address. 382 ZyWALL 5/35/70 Series User's Guide