ZyXEL Communications ZyWall ATP series - Page 388

Chapter 20 IPSec VPN
ZyWALL ATP Series User’s Guide
388
Each field is described in the following table.
Table 156 Configuration > VPN > IPSec VPN > VPN Connection > Add/Edit
LABEL DESCRIPTION
Show Advanced
Settings / Hide
Advanced Settings
Click this button to display a greater or lesser number of configuration fields.
Create new Object Use to configure any new settings objects that you need to use in this screen.
General Settings
Enable Select this check box to activate this VPN connection.
Connection Name Type the name used to identify this IPSec SA. You may use 1-31 alphanumeric characters,
underscores (
_), or dashes (-), but the first character cannot be a number. This value is
case-sensitive.
Nailed-Up Select this if you want the Zyxel Device to automatically renegotiate the IPSec SA when
the SA life time expires.
Enable Replay
Detection
Select this check box to detect and reject old or duplicate packets to protect against
Denial-of-Service attacks.
Enable NetBIOS
Broadcast over
IPSec
Select this check box if you the Zyxel Device to send NetBIOS (Network Basic Input/
Output System) packets through the IPSec SA.
NetBIOS packets are TCP or UDP packets that enable a computer to connect to and
communicate with a LAN. It may sometimes be necessary to allow NetBIOS packets to
pass through IPSec SAs in order to allow local computers to find computers on the remote
network and vice versa.
MSS Adjustment Select Custom Size to set a specific number of bytes for the Maximum Segment Size (MSS)
meaning the largest amount of data in a single TCP segment or IP datagram for this VPN
connection.
Some VPN clients may not be able to use a custom MSS size if it is set too small. In that
case those VPN clients will ignore the size set here and use the minimum size that they
can use.
Select Auto to have the Zyxel Device automatically set the MSS for this VPN connection.
Narrowed This is visible when you select any options in the VPN Gateway section except for VPN
Tunnel Interface.
If the IP range on the Zyxel Device (local policy) and the local IP range on the remote
IPSec router overlap in an IKEv2 SA, then you may select Narrowed to have the SA only
apply to the IP addresses in common.
Here are some examples.
Zyxel Device (local policy) Remote IPSec router
IKEv2 SA-1 192.168.20.0/24 192.168.20.1 ~ 192.168.20.20
Narrowed 192.168.20.1 ~ 192.168.20.20
IKEv2 SA- 2 192.168.30.50 ~ 192.168.30.70 192.168.30.60 ~ 192.168.30.80
Narrowed 192.168.30.60 ~ 192.168.30.70
VPN Gateway