ZyXEL Communications ZyWALL 300 User Manual

 Chapter 20 IPSec VPN

ZyWALL USG 300 User’s Guide

• Make sure the to-ZyWALL firewall rules allow IPSec VPN traffic to the ZyWALL. IKE 

uses UDP port 500, AH uses IP protocol 51, and ESP uses IP protocol 50.

• The ZyWALL supports UDP port 500 and UDP port 4500 for NAT traversal. If you 

enable this, make sure the to-ZyWALL firewall rules allow UDP port 4500 too.

• Make sure regular firewall rules allow traffic between the VPN tunnel and the rest of the 

network. Regular firewall rules check packets the ZyWALL sends before the ZyWALL 
encrypts them and check packets the ZyWALL receives after the ZyWALL decrypts 
them. This depends on the zone to which you assign the VPN tunnel and the zone from 
which and to which traffic may be routed.

• If you set up a VPN tunnel across the Internet, make sure your ISP supports AH or ESP.

If there are problems setting up a VPN tunnel, make sure both the ZyWALL and remote IPSec 
router have the same settings for the VPN tunnel. It is also helpful to have a way to look at the 
packets that are being sent and received by the ZyWALL and remote IPSec router (for 
example, packet sniffers).

You use the VPN Connection summary screen to look at the VPN connections you have set 
up, and you use the VPN Connection Add/Edit Manual Key and VPN Connection Add/
Edit Gateway screens to create or to edit VPN connections.

The VPN Connection summary screen displays the list of VPN connections, the associated 
VPN gateway(s), and various settings. In addition, it also lets you activate / deactivate and 
connect / disconnect each VPN connection (each IPSec SA).

To access this screen, click VPN > IPSec VPN. The following screen appears.

"

Each VPN connection requires a corresponding policy route. 

The VPN wizard automatically creates a corresponding policy route. If you create the VPN 
connection in the VPN > IPSec VPN screens, you need to manually create a corresponding 
policy route.

Figure 198   VPN > IPSec VPN > VPN Connection