ZyXEL Communications ZyWall ATP series - What Could Go Wrong

242/782
www.zyxel.com
What Could Go Wrong?
11 If you see below [info] or [error] log message, please check ZyWALL/USG Phase 1
Settings. Both ZyWALL/USG at the HQ and Branch sites must use the same Pre-
Shared Key, Encryption, Authentication method, DH key group and ID Type to
establish the IKE SA.
MONITOR > Log
12 If you see that Phase 1 IKE SA process done but still get below [info] log message,
please check ZyWALL/USG Phase 2 Settings. Both ZyWALL/USG at the HQ and
Branch sites must use the same Protocol, Encapsulation, Encryption,
Authentication method and PFS to establish the IKE SA.
MONITOR > Log
13 Make sure the both ZyWALL/USG at the HQ and Branch sites security policies
allow IPSec VPN traffic. IKE uses UDP port 500, AH uses IP protocol 51, and ESP uses
IP protocol 50.
14 Default NAT traversal is enable on ZyWALL/USG, please make sure the remote
IPSec device must also have NAT traversal enabled.