Chapter 20 IPSec VPN

Each field is described in the following table.

Table 107 Configuration > VPN > IPSec VPN > VPN Connection > Edit

LABEL

DESCRIPTION

Show Advanced

Click this button to display a greater or lesser number of configuration fields.

Settings / Hide

 

Advanced Settings

 

 

 

Create new Object

Use to configure any new settings objects that you need to use in this screen.

 

 

General Settings

 

 

 

Enable

Select this check box to activate this VPN connection.

 

 

Connection Name

Type the name used to identify this IPSec SA. You may use 1-31 alphanumeric

 

characters, underscores(_), or dashes (-), but the first character cannot be a

 

number. This value is case-sensitive.

Nailed-Up

Select this if you want the ZyWALL to automatically renegotiate the IPSec SA when

 

the SA life time expires.

 

 

Enable Replay

Select this check box to detect and reject old or duplicate packets to protect against

Detection

Denial-of-Service attacks.

 

 

Enable NetBIOS

Select this check box if you the ZyWALL to send NetBIOS (Network Basic Input/

Broadcast over

Output System) packets through the IPSec SA.

IPSec

 

 

NetBIOS packets are TCP or UDP packets that enable a computer to connect to and

 

communicate with a LAN. It may sometimes be necessary to allow NetBIOS packets

 

to pass through IPSec SAs in order to allow local computers to find computers on the

 

remote network and vice versa.

 

 

MSS Adjustment

Select Custom Size to set a specific number of bytes for the Maximum Segment Size

 

(MSS) meaning the largest amount of data in a single TCP segment or IP datagram

 

for this VPN connection.

 

Select Auto to have the ZyWALL automatically set the MSS for this VPN connection.

 

 

VPN Gateway

 

 

 

Application

Select the scenario that best describes your intended VPN connection.

Scenario

Site-to-site- Choose this if the remote IPSec router has a static IP address or a

 

 

domain name. This ZyWALL can initiate the VPN tunnel.

 

Site-to-site with Dynamic Peer - Choose this if the remote IPSec router has a

 

dynamic IP address. Only the remote IPSec router can initiate the VPN tunnel.

 

Remote Access (Server Role) - Choose this to allow incoming connections from

 

IPSec VPN clients. The clients have dynamic IP addresses and are also known as dial-

 

in users. Only the clients can initiate the VPN tunnel.

 

Remote Access (Client Role) - Choose this to connect to an IPSec server. This

 

ZyWALL is the client (dial-in user) and can initiate the VPN tunnel.

 

 

VPN Gateway

Select the VPN gateway this VPN connection is to use or select Create Object to add

 

another VPN gateway for this VPN connection to use.

 

 

Manual Key

Select this option to configure a VPN connection policy that uses a manual key

 

instead of IKE key management. This may be useful if you have problems with IKE

 

key management. See Section 20.2.2 on page 292 for how to configure the manual

 

key fields.

 

Note: Only use manual key as a temporary solution, because it is not as secure as a

 

regular IPSec SA.

 

 

Policy

 

 

 

Local Policy

Select the address corresponding to the local network. Use Create new Object if

 

you need to configure a new one.

 

 

288

 

ZyWALL 110/310/1100 Series User’s Guide