Chapter 4 Create Secure Connections Across the Internet
ZyWALL USG 20-2000 User’s Guide
70
4.1.3 What Can Go Wrong
If the IPSec tunnel does not build properly, the problem is likely a configuration error at one of the
IPSec routers. Log into both IPSec routers and check the settings in each field methodically and
slowly. Make sure both the ZyWALL and remote IPSec router have the same security settings for
the VPN tunnel. It may help to display the settings for both routers side-by-side.
Here are some general suggestions.
• The system log can often help to identify a configuration problem.
• If you enable NAT traversal, the remote IPSec device must also have NAT traversal enabled.
• Both routers must use the same authentication method to establish the IKE SA.
• Both routers must use the same negotiation mode, encryption algorithm, authentication
algorithm, and DH key group.
• When using manual keys, both routers must use the same encryption key and authentication
key.
• When using pre-shared keys, both routers must use the same pre-shared key.
• The ZyWALL’s local and peer ID type and content must match the remote IPSec router’s peer and
local ID type and content, respectively.
• Both routers must use the same active protocol, encapsulation, and SPI.
• If the sites are/were previously connected using a leased line or ISDN router, physically
disconnect these devices from the network before testing your new VPN connection. The old
route may have been learnt by RIP and would take priority over the new VPN connection.
• To test whether or not a tunnel is working, ping from a computer at one site to a computer at the
other.
Before doing so, ensure that both computers have Internet access (via the IPSec routers).
• It is also helpful to have a way to look at the packets that are being sent and received by the
ZyWALL and remote IPSec router (for example, by using a packet analyzer such as Wireshark).
Check the configuration for the following ZyWALL features.
• Make sure the To-ZyWALL firewall rules allow IPSec VPN traffic to the ZyWALL. IKE uses UDP port
500, AH uses IP protocol 51, and ESP uses IP protocol 50.
• The ZyWALL supports UDP port 500 and UDP port 4500 for NAT traversal. If you enable this,
make sure the To-ZyWALL firewall rules allow UDP port 4500 too.
• Make sure regular firewall rules allow traffic between the VPN tunnel and the rest of the network.
Regular firewall rules check packets the ZyWALL sends before the ZyWALL encrypts them and
check packets the ZyWALL receives after the ZyWALL decrypts them. This depends on the zone
to which you assign the VPN tunnel and the zone from which and to which traffic may be routed.
• If you set up a VPN tunnel across the Internet, make sure your ISP supports AH or ESP
(whichever you are using).
• If you have the ZyWALL and remote IPSec router use certificates to authenticate each other, You
must set up the certificates for the ZyWALL and remote IPSec router first and make sure they
trust each other’s certificates. If the ZyWALL’s certificate is self-signed, import it into the remote
IPsec router. If it is signed by a CA, make sure the remote IPsec router trusts that CA. The
ZyWALL uses one of its
Trusted Certificates
to authenticate the remote IPSec router’s
certificate. The trusted certificate can be the remote IPSec router’s self-signed certificate or that
of a trusted CA that signed the remote IPSec router’s certificate.
• Multiple SAs connecting through a secure gateway must have the same negotiation mode.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
