ZyXEL Communications ZyXEL ZyWALL 2WE - Manual (Page 310)

ZyWALL 2 and ZyWALL 2WE
27-16 VPN/IPSec Setup
Table 27-8 Advanced IKE VPN Rule Setup
LABEL DESCRIPTION
Active Select this check box to activate this VPN/IPSec policy.
Keep Alive
Select this check box to turn on the Keep Alive feature for this SA.
Turn on Keep Alive to have the ZyWALL automatically reinitiate the SA after the SA
lifetime times out, even if there is no traffic. The remote IPSec router must also have
keep alive enabled in order for this feature to work.
NAT Traversal Select this check box to enable NAT traversal. NAT traversal allows you to set up a
VPN connection when there are NAT routers between the two IPSec routers.
The remote IPSec router must also have NAT traversal enabled.
You can use NAT traversal with ESP protocol using Transport or Tunnel mode, but not
with AH protocol nor with manual key management. In order for an IPSec router behind
a NAT router to receive an initiating IPSec packet, set the NAT router to forward UDP
port 500 to the IPSec router behind the NAT router.
IPSec Keying Mode
The advanced configuration page is only available with the IKE IPSec keying mode.
Click the Basic button below in order to be able to choose the Manual IPSec keying
mode.
Make sure the remote gateway has the same configuration in this field.
Protocol Number Enter 1 for ICMP, 6 for TCP, 17 for UDP, etc. 0 is the default and signifies any protocol.
Enable Replay
Detection
As a VPN setup is processing intensive, the system is vulnerable to Denial of Service
(DOS) attacks The IPSec receiver can detect and reject old or duplicate packets to
protect against replay attacks. Enable replay detection by setting this field to Yes.
Local Address
This is the IP address of the computer for which you are configuring the VPN
connection. This IP address must correspond to the remote secure gateway's
configured remote IP address in order for the remote secure gateway to initiate the VPN
connection.
Local Port Start
0 is the default and signifies any port. Type a port number from 0 to 65535. Some of the
most common IP ports are: 21, FTP; 53, DNS; 23, Telnet; 80, HTTP; 25, SMTP; 110,
POP3