In main mode, the ZyXEL Device and remote IPSec router authenticate each other in steps 5 and 6, as illustrated below. Their identities are encrypted using the encryption algorithm and encryption key the ZyXEL Device and remote IPSec router selected in previous steps.
Figure 86 IKE SA: Main Negotiation Mode, Steps 5 - 6: Authentication
5
6
The ZyXEL Device and remote IPSec router use a
Note: The ZyXEL Device and the remote IPSec router must use the same
Router identity consists of ID type and ID content. The ID type can be IP address, domain name, or
The ZyXEL Device and the remote IPSec router each has its own identity, so each one must store two sets of information, one for itself and one for the other router. Local ID type and ID content refers to the ID type and ID content that applies to the router itself, and peer ID type and ID content refers to the ID type and ID content that applies to the other router in the IKE SA.
Note: The ZyXEL Device’s local and peer ID type and ID content must match the remote IPSec router’s peer and local ID type and ID content, respectively.
In the following example, the ID type and content match so the ZyXEL Device and the remote IPSec router authenticate each other successfully.
Table 49 VPN Example: Matching ID Type and Content
ZYXEL DEVICE | REMOTE IPSEC ROUTER |
Local ID type: | Local ID type: IP |
|
|
Local ID content: tom@yourcompany.com | Local ID content: 1.1.1.2 |
|
|
Peer ID type: IP | Peer ID type: |
|
|
Peer ID content: 1.1.1.2 | Peer ID content: tom@yourcompany.com |
|
|
In the following example, the ID type and content do not match so the authentication fails and the ZyXEL Device and the remote IPSec router cannot establish an IKE SA.
Table 50 VPN Example: Mismatching ID Type and Content
ZYXEL DEVICE | REMOTE IPSEC ROUTER |
Local ID type: | Local ID type: IP |
|
|
Local ID content: tom@yourcompany.com | Local ID content: 1.1.1.2 |
|
|
142 | Chapter 13 IPSec VPN |