ZyWALL 5/35/70 Series User’s Guide

AP PE N D I X K

VPN Setup

This appendix will help you to quickly create a IPSec/VPN connection between two ZyXEL IPSec routers. It should be considered a quick reference for experienced users.

General Notes

•The private networks behind the IPSec routers must be on different subnets. For example, 192.168.10.0/24 and 192.168.20.0/24.

•If the sites are/were previously connected using a leased line or ISDN router, physically disconnect these devices from the network before testing your new VPN connection. The old route may have been learnt by RIP and would take priority over the new VPN connection.

•To test whether or not a tunnel is working, ping from a computer at one site to a computer at the other.

Before doing so, ensure that both computers have Internet access (via the IPSec routers).

•You can use the “E-MAIL”Peer Type and the “SUBNET” Local and Remote Address Type to simplify the configuration.

•Do not manually create any static IP routes for the remote VPN site. They are not required.

Dynamic IPSec Rule

Create a dynamic rule by setting the Remote Gateway Address to ‘0.0.0.0’. A single dynamic rule can support multiple simultaneous incoming IPSec connections.

All users of a dynamic rule have the same pre-shared key. You may need to change the pre- shared key if one of the users leaves. See the support notes at http://www.zyxel.com for configuration examples for software VPN clients.

Full Feature NAT Mode

With Full Feature NAT mode, you must map the intended VPN rule’s local policy addresses as the Inside Local Address (ILA) to a public IP address assigned by the ISP (an Inside Global Address or IGA) before you can configure the VPN rule. For example, you could create a One-to-One address mapping rule that maps the VPN rule’s local policy addresses as the ILA to the VPN rule’s my IP address as the IGA.

You may have to specify the public IP address in the My ZyWALL field of the local IPSec rule. If you have not configured the address mapping properly, a “SPD doesn’t match configuration of NAT” message displays when you try to save the IPSec rule.

Appendix K VPN Setup

726