ZyXEL Communications 5 Series - Manual (Page 804)

ZyWALL 5/35/70 Series User’s Guide
804 Appendix K Command Interpreter
Figure 530 Managing the Bandwidth of an IPSec SA
Use on with this command to set the ZyWALL to use the outer source and destination IP
addresses of VPN packets in managing the bandwidth of the VPN traffic. These are the IP
addresses of the ZyWALL and the remote IPSec router. The following figure shows an
example of this. The ZyWALL uses the IP addresses of the ZyWALL (X in the figure) and
remote IPSec router (Y) to manage the bandwidth of the VPN traffic for the IKE SA.
Figure 531 Managing the Bandwidth of an IKE SA
How you configure this command affects how you can implement bandwidth management as
follows.
• Leave this command set to off to be able to create bandwidth management groups for
individual phase 2 IPSec SAs that are connecting through the same remote IPSec router.
With this setting you can also specify the type of traffic either using the service list (like
SIP or FTP) or by specifying port numbers.
• Use bm vpnTraffic to be able to create a single bandwidth management group that
includes all of the phase 2 IPSec SAs that are connecting through the same remote IPSec
router. With this setting the bandwidth management applies to ESP or AH packets so you
can only specify IP addresses. You cannot specify a service or port numbers.