ZyXEL Communications wireless n gigbit router zyxel User Manual

Chapter 15 IPSec VPN

NBG-460N User’s Guide

IPSec router use in the IKE SA. In main mode, this is done in steps 1 and 2, as 
illustrated below.

Figure 137   IKE SA: Main Negotiation Mode, Steps 1 - 2: IKE SA Proposal

The NBG-460N sends a proposal to the remote IPSec router. Each proposal 
consists of an encryption algorithm, authentication algorithm, and DH key group 
that the NBG-460N wants to use in the IKE SA. The remote IPSec router sends the 
accepted proposal back to the NBG-460N. If the remote IPSec router rejects the 
proposal (for example, if the VPN tunnel is not configured correctly), the NBG-
460N and remote IPSec router cannot establish an IKE SA.

Note: Both routers must use the same encryption algorithm, authentication algorithm, 

and DH key group.

See the field descriptions for information about specific encryption algorithms, 
authentication algorithms, and DH key groups. See 

 

for more information about DH key groups.

The NBG-460N and the remote IPSec router use a DH key exchange to establish a 
shared secret, which is used to generate encryption keys for IKE SA and IPSec SA. 
In main mode, the DH key exchange is done in steps 3 and 4, as illustrated below.

Figure 138   IKE SA: Main Negotiation Mode, Steps 3 - 4: DH Key Exchange

The DH key exchange is based on DH key groups. Each key group is a fixed 
number of bits long. The longer the key, the more secure the encryption keys, but 
also the longer it takes to encrypt and decrypt information. For example, DH2 
keys (1024 bits) are more secure than DH1 keys (768 bits), but DH2 encryption 
keys take longer to encrypt and decrypt.