214

Chapter 15 IPSec VPN

15.4.3.3 Authentication and the Security Parameter Index (SPI)

For authentication, the NBG-460N and remote IPSec router use the SPI, instead of pre-shared keys, ID type and content. The SPI is an identification number.

Note: The NBG-460N and remote IPSec router must use the same SPI.

Figure 134 Security > VPN > General > Rule Setup: Manual

The following table describes the labels in this screen.

Table 70 Security > VPN > General > Rule Setup: Manual

LABEL

DESCRIPTION

Property

Active	Select this check box to activate this VPN policy.

NBG-460N User’s Guide

Page 214

Image 214

ZyXEL Communications wireless n gigbit router zyxel manual 214, Security VPN General Rule Setup Manual

Contents

NBG-460N Page Related Documentation About This Users GuideIntended Audience User Guide Feedback About This Users Guide Document Conventions Syntax Conventions NBG-460N Computer Server Telephone Switch Router ModemIcons Used in Figures Dslam Safety Warnings Safety Warnings NBG-460N User’s Guide Contents Overview Contents Overview NBG-460N User’s Guide Table of Contents Chapter Connection Wizard Part II Network WAN 177 Part IV Management 235 Part V Maintenance and Troubleshooting 261 Part VI Appendices and Index Table of Contents NBG-460N User’s Guide Part Page Overview Getting to Know Your NBG-460NApplications LAN Wireless ApplicationsRouter Mode NBG460N AP Mode 3 AP + Bridge Bridge AP + Bridge Application Bridge Application Bridge Loop Two Bridges Connected to Hub Ways to Manage the NBG-460N Features Available in Router Mode vs. AP ModeFeature Router AP Mode Bridge Router vs. AP vs. Bridge LEDs PowerGood Habits for Managing the NBG-460N Front Panel LEDs WAN Wireless LAN Off Wireless LAN is not ready or has failedThis feature Off Device is in normal power mode Wlan Getting to Know Your NBG-460N NBG-460N User’s Guide WPS Button WPS Button NBG-460N User’s Guide Web Configurator Overview Introducing the Web ConfiguratorAccessing the Web Configurator Change Password Screen Navigating the Web Configurator Resetting the NBG-460NProcedure to Use the Reset Button Status Screen Icon Key Status Screen in Router ModeIcon Description Dhcp Label DescriptionScheduler Is enabled and N/A when the Wlan is disabled Wlan is disabledWhen the line is disconnected Memory Usage Link TAB Function Navigation PanelScreens Summary LAN VPN NATDdns Mgmt Summary Bandwidth Management Monitor Mode As a Router or a Access Point LanguageSummary Any IP Table Logs View Log Summary Dhcp Table Summary BW Mgmt Monitor Summary Packet Statistics Host Name field Stop Click Stop to stop refreshing statistics Summary VPN MonitorIntervals field This is the security association index number Association Time Summary Wireless Station StatusThis is the index number of an associated wireless station NBG-460N’s Wlan network Introducing the Web Configurator NBG-460N User’s Guide Wizard Setup Connection Wizard Connection Wizard System Information System Name Domain Name Underscores are accepted This option is only available if WPS is not enabled Connection Wizard Wireless LANUse the same Ssid in order to access the network Ssid Basic WEP Security Wizard Basic WEP Security Ascii Extend WPA-PSK or WPA2-PSK SecurityWEP HEX Key Connection Wizard Internet ConfigurationPre-Shared Do this Connection Description Type Ethernet ConnectionPPPoE Connection Pptp ISP Parameter for Internet Access Pptp Connection ISP Parameters for Internet Access Wizard Pptp Connection Use fixed IP address Your IP AddressWAN IP Address Assignment Provided by your ISP Private IP Address Ranges IP Address and Subnet Mask10.0.0.0 172.16.0.0 192.168.0.0 DNS Server Address Assignment WAN IP and DNS Server Address Assignment WAN IP Address Assignment WAN MAC AddressChoose an IP address Connection Wizard Bandwidth management Wizard WAN MAC Address Connection Wizard Complete Wizard Bandwidth Management Connection Wizard Complete Connection Wizard NBG-460N User’s Guide Tutorials How to Connect to the Internet from an APInternet Push Button Configuration NBG460N Example WPS Process PIN Method WPA-PSK SSIDExample3Channel Security Pre-Shared Key ThisismyWPA-PSKpre-sharedkey Configure Your Notebook Tutorial Status AP Mode Connecting a Wireless Client to a Wireless Network Using AP + Bridge Mode and WDS Link Status Configuring Your Bridge Mode Settings WPA2-PSK Pre-Shared Key ThisismyWPA2-PSKpre-sharedkey Setting BOB’S NBG-460N JACK’S NBG-460N Site-To-Site VPN Tunnel SettingsSite-To-Site VPN Tunnel Tutorial Configuring Bob’s NBG-460N VPN Settings Tutorial Property Configuring Jack’s NBG-460N VPN Settings Tutorial Authentication Method Tutorial Property Tutorial Authentication Method Checking the VPN Connection Pinging Jack’s Local IP Address Configuring Bandwidth Management by Application Bandwidth Management for your Network Configuring Bandwidth Management by Custom Application Configuring Bandwidth Allocation by IP or IP Range Fields Services Real Audio Rtsp VDO Live FTP Refer to Appedix F on the Bandwidth Mgnt AP Mode Setting your NBG-460N to AP Mode Status AP Mode Status Screen This shows the LAN port’s Dhcp role Client or None Display Network Wireless LAN WPS screenSystem Setting Configuration Mode Schedules Menu AP Mode Or connected Reset the factory defaults to your NBG-460N Maintenance System GeneralSetting Logs View Log Mask or to get the LAN IP address from a Dhcp server LAN Settings Configuring Your SettingsSys OP General Wlan and Maintenance Settings Table below describes the labels in the screen Logging in to the Web Configurator in AP Mode Network Page Wireless LAN Example of a Wireless Network What You Can Do Wireless Security OverviewWhat You Should Know Ssid 100 Types of Encryption for Each Type of AuthenticationNo Authentication Radius Server Weakest Stronges t Printable 7-bit Ascii characters for the wireless LAN General Wireless LAN Screen101 WPA-PSK and WPA2-PSK are available in this field No Security102 Select Static WEP , WPA-PSK , WPA , WPA2-PSK or WPA2 to add WEP Encryption 103 104 Select 64-bit WEP or 128-bit WEP to enable data encryptionWEP keys and displays them in the Key fields below Correct WEP key 105AP or peer computer Hex 106 Server, the reauthentication timer on the Radius server hasSecurity Mode field Priority 4 WPA/WPA2 107 108 Server, the reauthentication timer on the Radius serverHas priority MAC Filter Screen 109 110 MAC 111 Wireless LAN Advanced ScreenQuality of Service QoS Screen RTS/CTS WMM QoS Policy 112On page 123 for more information You want to apply WMM QoS Configuration screen Application Priority Configuration113 Mail 114User-Defined WPS Screen 115 116 WPS Station ScreenScheduling Screen Push Button Following times fields 117Whole day Day WDS Screen 118 Between the NBG-460N and any wireless clients Security Mode Static WEP119 120 ASCII/HEX Roaming Security Mode WPA2-PSKTechnical Reference 121 122 Roaming Example Quality of Service 123 124 WiFi Protected SetupIPod Touch Web Configurator WMM QoS Priorities Login Screen 125 System Status 126 127 WAN connection is not working 128 MBM Port Forwarding WPS in Progress129 Rule is turned on 130Turn the rule OFF Accessing the iPod Touch Web Configurator Accessing the iPod Touch Web Configurator131 132 133 LAN and WAN What You Need To Know Configuring Your Internet Connection134 135 MulticastWAN MAC Address Iptv STB Port 136 You have two STBs 137You have one STB 192.168.1.20 Auto-Bridge NetBIOS over TCP/IP138 Ethernet Encapsulation Internet Connection139 Defined changes to None after you click Apply 140Address WAN MAC 141 Setting or upload a different ROM filePPPoE Encapsulation Select Clone the computers MAC address IP Address and enter All of the LANs computers will have access 142 Computer’s 143DNS Servers First DNS Different ROM file Pptp Encapsulation 144 145 Pptp connection 146 Advanced WAN ScreenSelect Clone the computers MAC address IP Address 147 Select Igmp V-1,IGMP V-2 or None Igmp When the NBG-460N gets a WAN IP address that is notTo be in Router Mode for the Iptv STB port to work 148 LAN 149 LAN TCP/IP IP Pool SetupLAN IP Screen 150 151 LAN IP AliasLAN TCP/IP 152 Any IP SetupAdvanced LAN Screen IP address that you assign. Unless you are implementing LANs, WANs and the ZyXEL Device 153 Any IP 154 155 156 Dhcp 157 Dhcp Advanced Screen Dhcp General Screen158 Must have their DNS server addresses manually configured Select the Enable Dhcp Server check box. When you clear159 160 NBG-460Ns system DNS server configured in the WAN InternetClient List Screen Select DNS Relay to have the NBG-460N act as a DNS proxy. Host names. After you click Apply, the MAC address and IP 161This is the index number of the host computer Them 162 Network Address Translation NAT 163 Default Server Setup Enable NetworkSelect the check box to enable NAT General NAT Screen NAT Application Screen 165 166 167 Wake On LAN is enabledFields under Add Application Rule Game List Example Configuring Servers Behind Port Forwarding Example168 NAT Advanced Screen 169 170 Users may not be able to access the InternetCan establish through the NBG-460N 171 LAN that requested the serviceTrigger Port Forwarding Example Traffic to a server on the WAN Two Points To Remember About Trigger Ports 172 DynDNS Wildcard Dynamic DNS173 Dynamic DNS Screen Enable Dynamic Select this check box to use dynamic DNS174 175 WAN IP address 176 Part 177 178 Firewall 179 Triangle Routes About the NBG-460N Firewall180 Triangle Routes and IP Alias 181 General Firewall Screen Services Screen182 183 Icmp 184 Add Firewall Rule screen Pool Add Firewall Rule Screen185 Single IP is selected as the Address Type 186 Click Clear All to empty the Blocked ServicesAddress Type 187 188 Content Filtering Profiles Content Filtering189 Keyword Blocking URL Checking Restrict Web Features190 Days and Times Filter Screen 191 Web Proxy 192Cookies Allowed 193 Which content filtering will be enforcedSchedule Screen Not affected Domain Name or IP Address URL Checking Customizing Keyword Blocking URL Checking194 Full Path URL Checking IPSec VPN 195 IKE SA IKE Phase 1 Overview 196 IP Addresses of the NBG-460N and Remote IPSec Router IPSec SA IKE Phase 2 Overview197 Local Network and Remote Network General Screen 198 VPN Rule Setup Basic 199 Feature to work 200 201 EnabledSecure Gateway Address field set to 202 203 Your computer in the Local Content field. The NBG-460NWith dynamic WAN IP addresses 204 Address field refer to the Secure Gateway Address field VPN Rule Setup Advanced 205 Security VPN General Rule Setup IKE Advanced 206 Select No to disable it 207 208 209 210 211 212 213 VPN Rule Setup ManualEach IPSec SA. It is more secure but takes more time Security VPN General Rule Setup Manual 214 215 216 Secure 217SPI 218 SA Monitor ScreenTrailing spaces are truncated IKE SA Proposal VPN and Remote Management219 Diffie-Hellman DH Key Exchange 220 221 AuthenticationVPN Example Matching ID Type and Content Remote Ipsec Router VPN Example Mismatching ID Type and Content Negotiation Mode222 15.6.6 VPN, NAT, and NAT Traversal 223 Encapsulation IPSec Protocol224 225 IPSec SA Proposal and Perfect Forward SecrecyAdditional IPSec VPN Topics SA Life Time 226 Encryption and Authentication AlgorithmsPrivate DNS Server 227 Private DNS Server Example 228 Management 229 230 231 Static RouteLanwan IP Static Route Screen 232 Static Route Setup Screen 233 234 FTP Bandwidth Management235 Chat, Email General Configuration Screen 236 Management check box 237Mbps Connected to the WAN port has an upstream speed of 10 Mbps Advanced Configuration238 Wlan Bandwidth 239 Low Wlan to WAN Rule Configuration with the Pre-defined Service240 To Wlan Rule Configuration User Defined Service Rule Configuration 241 Monitor Screen 242 Service Description Predefined Bandwidth Management ServicesMedia Bandwidth Management Setup Services Technical References 244 Default Bandwidth Management Classes and PrioritiesBandwidth Management Priority with Default Classes Class Type Priority 245 Bandwidth Management PrioritiesBandwidth Management Priorities 246 Remote Management 247 Remote Management and NAT System TimeoutRemote Management Limitations 248 249 Specify to access the NBG-460N using this serviceWWW Screen Remote management FTP Screen Telnet Screen250 DNS Screen 251 252 You specify to send DNS queries to the NBG-460N NAT Traversal Universal Plug-and-Play UPnP253 UPnP Screen 254 Using UPnP in Windows XP Example 255 256 Network Connections Internet Connection Properties Advanced Settings 257 Web Configurator Easy Access 258 259 Network Connections My Network Places 260 Network Connections My Network Places Properties Example Maintenance Troubleshooting 261 262 System General Screen System263 264 Time Setting Screen 265 266 Select User Defined Time Server Address and enter the IP 267 268 Logs 269 270 Log categories that you selected in the Log SettingsView Log Screen Display 271 Log SettingsTime and date 272 Mail Log Settings Mail ServerMessages will not be sent via e-mail Sent via e-mail 273Smtp 274 System Maintenance LogsLog Descriptions LOG Message Description System Error Logs 275 276 Access Control LogsTCP Reset Logs Firewall Attack Alerts screen 277 Packet Filter Logs 278 Icmp Logs 279 Content Filtering LogsUPnP packets can pass through the firewall 280 Attack Logs 281 IPSec Logs 282 IKE Logs 283 284 PKI Logs 285802.1X Logs Packet Direction Description ACL Setting Notes286 Type Code Description Icmp Notes 287Syslog Logs RFC-2408 Isakmp Payload Types 288LOG Display Payload Type Firmware Upload Screen Tools289 Maintenance Tools Firmware 290 Upload Error Message Network Temporarily Disconnected Restore Configuration Configuration ScreenBackup Configuration Maintenance Restore Configuration Configuration Restore Successful 293 Restart Screen Back to Factory Defaults294 Green Indicate either Ready or MAC Address errorWake On LAN 295 Maintenance Tools Green 296 Configuration Mode 297 298 Advanced Configuration OptionsCategory Link TAB Sys Op Mode 299 300 Router Maintenance Sys OP Mode General 301 302 Firewall or bandwidth management Language Screen Language303 304 Power, Hardware Connections, and LEDs Troubleshooting305 NBG-460N Access and Login 306 307 Advanced Suggestions Internet Access 308 309 Internet connection is slow or intermittent Resetting the NBG-460N to Its Factory Defaults 310 Wireless Router/AP Troubleshooting 311 Advanced Features 312 313 Product Specifications and Wall- Mounting InstructionsHardware Features PWR, LAN1-4, WAN, WLAN, WPS Bluetooth enabled devices, and other wireless LANs Firmware FeaturesSuch as microwave ovens, wireless phones 314 315 316 Feature SpecificationsFeature Specification Standards Supported 317 Wall-mounting InstructionsProtocol MBM Media Bandwidth Management 318 Masonry Plug and M4 Tap Screw Appendices Index 319 320 Internet Explorer Pop-up Blockers Disable pop-up Blockers321 Enable pop-up Blockers with Exceptions 322 Select Settings…to open the Pop-up Blocker Settings screen 323 JavaScripts 324 325 Internet Options Security Java Permissions 326 327 Java Sun 328 Java Sun Structure Introduction to IP Addresses329 Subnet Mask Identifying Network Number Subnet Masks330 1ST 2ND 3RD 4TH Octet Subnet Masks 331Network Size Binary 1ST 2ND 3RD 4TH Decimal Octet Maximum Host Numbers Notation332 Alternative Subnet Mask Notation Subnetting 333 Example Four Subnets 334 335 IP/SUBNET Mask Network Number Last Octet BIT Value Subnet Planning Example Eight Subnets336 16-bit Network Number Subnet Planning Configuring IP Addresses337 NO. Borrowed Subnet Mask NO. Hosts PER Host Bits Subnets 338 Private IP Addresses Setting up Your Computer’s IP Address 339 Windows 95/98/Me Installing Components340 Configuring 341 Verifying Settings 342 Windows 2000/NT/XP 343 344 Windows XP Control Panel 345 Windows XP Local Area Connection Properties 346 Windows XP Internet Protocol TCP/IP Properties 347 Windows XP Advanced TCP/IP Properties 348 Macintosh OS 8/9 349 350 Macintosh OS 8/9 TCP/IP Macintosh OS 351 Linux Using the K Desktop Environment KDE352 353 Red Hat 9.0 KDE Ethernet Device General Using Configuration Files 354 Red Hat 9.0 Static IP Address Setting in ifconfig-eth0 Red Hat 9.0 DNS Settings in resolv.conf Verifying Settings 356 Ad-hoc Wireless LAN Configuration Wireless LAN Topologies357 Basic Service Set 358 Channel 359 360 RTS/CTS Preamble Type Ieee 802.11g Wireless LANFragmentation Threshold 361 Ieee 802.11g Ieee362 Data Rate Modulation Mbps Types of Radius Messages Types of Authentication363 EAP-MD5 Message-Digest Algorithm EAP-TLS Transport Layer Security EAP-TTLS Tunneled Transport Layer Service364 Peap Protected EAP 365 Comparison of EAP Authentication TypesWPA2 Encryption User Authentication 366 27.0.3 WPA2 with Radius Application Example 27.0.2 WPA2-PSK Application Example367 Security Parameters Summary Wireless Security Relational MatrixAuthentication Encryptio Enter METHOD/ KEY 368 Services 369 370 Examples of ServicesName Protocol Ports Description 371 372 373 CopyrightCertifications Disclaimer 374 FCC Radiation Exposure Statement 375 ZyXEL Limited WarrantyViewing Certifications 376 Registration Classes and priorities Index377 CTS Clear to Send Essid 378Encapsulating Security Payload. See ESP Ethernet PPPoE. see also PPP over Ethernet 379IKE SA Language Link type 40 MAC 380Mbssid 381 QoS QoS priorities Quality of Service QoSRadius Wireless security 98 overview 382 383 Xbox Live ZyNOS 39 384

ZyXEL Communications wireless n gigbit router zyxel 214, Security VPN General Rule Setup Manual

Models: wireless n gigbit router zyxel

15.4.3.3 Authentication and the Security Parameter Index (SPI)

Figure 134 Security > VPN > General > Rule Setup: Manual

LABEL

214