ZyXEL 793H Betriebsanweisung
Chapter 11 IPSec VPN
P-793H User’s Guide
157
In the following example, the authentication fails, so they cannot establish an IKE SA.
It is also possible to configure the ZyXEL Device to ignore the identity of the remote IPSec
router. In this case, you usually set the peer ID type to Any. This is not as secure as other peer
ID types, however.
router. In this case, you usually set the peer ID type to Any. This is not as secure as other peer
ID types, however.
11.1.2 Additional Topics for IKE SA
This section provides more information about IKE SA.
11.1.2.1 Negotiation Mode
There are two negotiation modes: main mode and aggressive mode. Main mode provides
better security, while aggressive mode is faster.
Main mode takes six steps to establish an IKE SA.
Steps 1-2: The ZyXEL Device sends its proposals to the remote IPSec router. The remote
IPSec router selects an acceptable proposal and sends it back to the ZyXEL Device.
Steps 3-4: The ZyXEL Device and the remote IPSec router participate in a Diffie-Hellman key
exchange, based on the accepted DH key group, to establish a shared secret.
Steps 5-6: Finally, the ZyXEL Device and the remote IPSec router generate an encryption key
from the shared secret, encrypt their identities, and exchange their encrypted identity
information for authentication.
In contrast, aggressive mode only takes three steps to establish an IKE SA.
Step 1: The ZyXEL Device sends its proposals to the remote IPSec router. It also starts the
Diffie-Hellman key exchange and sends its (unencrypted) identity to the remote IPSec router
for authentication.
Step 2: The remote IPSec router selects an acceptable proposal and sends it back to the ZyXEL
Device. It also finishes the Diffie-Hellman key exchange, authenticates the ZyXEL Device,
and sends its (unencrypted) identity to the ZyXEL Device for authentication.
Step 3: The ZyXEL Device authenticates the remote IPSec router and confirms that the IKE
SA is established.
better security, while aggressive mode is faster.
Main mode takes six steps to establish an IKE SA.
Steps 1-2: The ZyXEL Device sends its proposals to the remote IPSec router. The remote
IPSec router selects an acceptable proposal and sends it back to the ZyXEL Device.
Steps 3-4: The ZyXEL Device and the remote IPSec router participate in a Diffie-Hellman key
exchange, based on the accepted DH key group, to establish a shared secret.
Steps 5-6: Finally, the ZyXEL Device and the remote IPSec router generate an encryption key
from the shared secret, encrypt their identities, and exchange their encrypted identity
information for authentication.
In contrast, aggressive mode only takes three steps to establish an IKE SA.
Step 1: The ZyXEL Device sends its proposals to the remote IPSec router. It also starts the
Diffie-Hellman key exchange and sends its (unencrypted) identity to the remote IPSec router
for authentication.
Step 2: The remote IPSec router selects an acceptable proposal and sends it back to the ZyXEL
Device. It also finishes the Diffie-Hellman key exchange, authenticates the ZyXEL Device,
and sends its (unencrypted) identity to the ZyXEL Device for authentication.
Step 3: The ZyXEL Device authenticates the remote IPSec router and confirms that the IKE
SA is established.
Peer ID type: IP
Peer ID type: E-mail
Peer ID content: 1.1.1.2
Peer ID content: tomasz@yourcompany.com
Table 50 VPN Example: Mismatching ID Type and Content
ZYXEL DEVICE
REMOTE IPSEC ROUTER
Local ID type: E-mail
Local ID type: IP
Local ID content: tom@yourcompany.com
Local ID content:
1.1.1.2
Peer ID type: IP
Peer ID type: E-mail
Peer ID content:
1.1.1.15
Peer ID content: tom@yourcompany.com
Table 49 VPN Example: Matching ID Type and Content
ZYXEL DEVICE
REMOTE IPSEC ROUTER