ZyXEL Communications VPN Series - VPN Advanced Wizard - Phase 2

Chapter 5 Quick Setup Wizards
ZyWALL/USG Series User’s Guide
144
• Key Group: DH5 is more secure than DH1 or DH2 (although it may affect throughput). DH1
(default) refers to Diffie-Hellman Group 1 a 768 bit random number. DH2 refers to Diffie-Hellman
Group 2 a 1024 bit (1Kb) random number. DH5 refers to Diffie-Hellman Group 5 a 1536 bit
random number.
• SA Life Time: Set how often the ZyWALL/USG renegotiates the IKE SA. A short SA life time
increases security, but renegotiation temporarily disconnects the VPN tunnel.
• NAT Traversal: Select this if the VPN tunnel must pass through NAT (there is a NAT router
between the IPSec devices).
Note: The remote IPSec device must also have NAT traversal enabled. See the help in the
main IPSec VPN screens for more information.
• Dead Peer Detection (DPD) has the ZyWALL/USG make sure the remote IPSec device is there
before transmitting data through the IKE SA. If there has been no traffic for at least 15 seconds,
the ZyWALL/USG sends a message to the remote IPSec device. If it responds, the ZyWALL/USG
transmits the data. If it does not respond, the ZyWALL/USG shuts down the IKE SA.
• Authentication Method: Select Pre-Shared Key to use a password or Certificate to use one
of the ZyWALL/USG’s certificates.
5.3.9 VPN Advanced Wizard - Phase 2
Phase 2 in an IKE uses the SA that was established in phase 1 to negotiate SAs for IPSec.
Figure 117 VPN Advanced Wizard: Phase 2 Settings
• Active Protocol: ESP is compatible with NAT, AH is not.
• Encapsulation: Tunnel is compatible with NAT, Transport is not.
• Encryption Algorithm: 3DES and AES use encryption. The longer the AES key, the higher the
security (this may affect throughput). Null uses no encryption.
• Authentication Algorithm: MD5 gives minimal security and SHA512 gives the highest
security. MD5 (Message Digest 5) and SHA (Secure Hash Algorithm) are hash algorithms used to
authenticate packet data. The stronger the algorithm the slower it is.
• SA Life Time: Set how often the ZyWALL/USG renegotiates the IKE SA. A short SA life time
increases security, but renegotiation temporarily disconnects the VPN tunnel.