Инструкция для ZYXEL ZyWALL 2WG EE

(скачивание инструкции бесплатно)

Формат файла: PDF

Доступность: Бесплатно как и все руководства на сайте. Без регистрации и SMS.

Дополнительно: Чтение инструкции онлайн

Chapter 15 IPSec VPN Screens

ZyWALL 2WG User’s Guide

336

If router A does not have an IPSec pass-through or if the active protocol is AH, you can solve
this problem by enabling NAT traversal. In NAT traversal, router

and router

add an extra

header to the IKE SA and IPSec SA packets. If you configure router

to forward these

packets unchanged, router

and router

can establish a VPN tunnel.

You have to do the following things to set up NAT traversal.

• Enable NAT traversal on the ZyWALL and remote IPSec router.
• Configure the NAT router to forward packets with the extra header unchanged. (See the

field description for detailed information about the extra header.)

The extra header may be UDP port 500 or UDP port 4500, depending on the standard(s) the
ZyWALL and remote IPSec router support.

Additional IPSec VPN Topics

This section discusses other IPSec VPN topics that apply to either IKE SAs or IPSec SAs or
both. Relationships between the topics are also highlighted.

SA Life Time

SAs have a lifetime that specifies how long the SA lasts until it times out. When an SA times
out, the ZyWALL automatically renegotiates the SA in the following situations:

• There is traffic when the SA life time expires
• The IPSec SA is configured on the ZyWALL as nailed up (see below)

Otherwise, the ZyWALL must re-negotiate the SA the next time someone wants to send
traffic.

If the IKE SA times out while an IPSec SA is connected, the IPSec SA stays
connected.

An IPSec SA can be set to

nailed up

. Normally, the ZyWALL drops the IPSec SA when the

life time expires or after two minutes of outbound traffic with no inbound traffic. If you set the
IPSec SA to nailed up, the ZyWALL automatically renegotiates the IPSec SA when the SA life
time expires, and it does not drop the IPSec SA if there is no inbound traffic.

The SA life time and nailed up settings only apply if the rule identifies the
remote IPSec router by a static IP address or a domain name. If the

Primary

Remote Gateway

field is set to

0.0.0.0

, the ZyWALL cannot initiate the tunnel

(and cannot renegotiate the SA).