Chapter 5 Quick Setup Wizards
ZyWALL/USG Series User’s Guide
145
• Perfect Forward Secrecy (PFS): Disabling PFS allows faster IPSec setup, but is less secure.
Select DH1, DH2 or DH5 to enable PFS. DH5 is more secure than DH1 or DH2 (although it may
affect throughput). DH1 refers to Diffie-Hellman Group 1 a 768 bit random number. DH2 refers to
Diffie-Hellman Group 2 a 1024 bit (1Kb) random number. DH5 refers to Diffie-Hellman Group 5 a
1536 bit random number (more secure, yet slower).
• Local Policy (IP/Mask): Type the IP address of a computer on your network. You can also
specify a subnet. This must match the remote IP address configured on the remote IPSec device.
• Remote Policy (IP/Mask): Type the IP address of a computer behind the remote IPSec device.
You can also specify a subnet. This must match the local IP address configured on the remote
IPSec device.
• Nailed-Up: This displays for the site-to-site and remote access client role scenarios. Select this
to have the ZyWALL/USG automatically renegotiate the IPSec SA when the SA life time expires.
5.3.10 VPN Advanced Wizard - Summary
This is a read-only summary of the VPN tunnel settings.
Figure 118 VPN Advanced Wizard: Summary
• Rule Name: Identifies the VPN connection (and the VPN gateway).
• Secure Gateway: IP address or domain name of the remote IPSec device.
• Pre-Shared Key: VPN tunnel password.
• Certificate: The certificate the ZyWALL/USG uses to identify itself when setting up the VPN
tunnel.
• Local Policy: IP address and subnet mask of the computers on the network behind your
ZyWALL/USG that can use the tunnel.
• Remote Policy: IP address and subnet mask of the computers on the network behind the
remote IPSec device that can use the tunnel.
• Copy and paste the Configuration for Remote Gateway commands into another ZLD-based
ZyWALL/USG’s command line interface.
To Next Page
Loading...
