ZyWALL 2 and ZyWALL 2WE

 

Table 27-7 Basic IKE VPN Rule Setup

LABEL

DESCRIPTION

 

 

 

When you select IP in the Peer ID Type field, type the IP address of the computer with

 

which you will make the VPN connection or leave the field blank to have the ZyWALL

 

automatically use the address in the Secure Gateway field.

 

When you select DNS in the Peer ID Type field, type a domain name (up to 31

 

characters) by which to identify the remote IPSec router.

Peer Content

When you select E-mailin the Peer ID Type field, type an e-mail address (up to 31

 

characters) by which to identify the remote IPSec router.

 

The domain name or e-mail address that you use in the Content field is used for

 

identification purposes only and does not need to be a real domain name or e-mail

 

address. The domain name also does not have to match the remote router's IP

 

address or what you configure in the Secure Gateway Addr field below.

 

 

Encapsulation Mode

Select Tunnel mode or Transport mode from the drop-down list box.

 

 

 

Select ESP if you want to use ESP (Encapsulation Security Payload). The ESP

 

protocol (RFC 2406) provides encryption as well as some of the services offered by

 

AH. If you select ESP here, you must select options from the Encryption Algorithm

 

and Authentication Algorithm fields (described next).

IPSec Protocol

Select AH if you want to use AH (Authentication Header Protocol). The AH protocol

 

(RFC 2402) was designed for integrity, authentication, sequence integrity (replay

 

resistance), and non-repudiation but not for confidentiality, for which the ESP was

 

designed. If you select AH here, you must select options from the Authentication

 

Algorithm field (described later).

 

 

 

Type your pre-shared key in this field. A pre-shared key identifies a communicating

 

party during a phase 1 IKE negotiation. It is called "pre-shared" because you have to

 

share it with another party before you can communicate with them over a secure

Pre-Shared Key

connection.

 

Both ends of the VPN tunnel must use the same pre-shared key. You will receive a

 

“PYLD_MALFORMED” (payload malformed) packet if the same pre-shared key is not

 

used on both ends.

 

 

VPN/IPSec Setup

27-11