ZyXEL Communications FMG3024-D10A Manual De Usuario

 Chapter 17 VPN

FMG3024-D10A / FMG3025-D10A Series User’s Guide

Content

When you select IP in the Local ID field, type the IP address of your computer 
in the Content field. If you configure the Content field to 0.0.0.0 or leave it 
blank, the Device automatically uses the Pre-Share Key (refer to the Pre-
Share Key field description). 

It is recommended that you type an IP address other than 0.0.0.0 in the  
Content field or use the DNS or E-mail ID type in the following situations.

•

When there is a NAT router between the two IPSec routers. 

•

When you want the remote IPSec router to be able to distinguish between 

VPN connection requests that come in from IPSec routers with dynamic WAN 

IP addresses. 

When you select DNS or E-mail in the Local ID field, type a domain name or e-
mail address by which to identify this Device in the Content field. Use up to 31 
ASCII characters including spaces, although trailing spaces are truncated. The 
domain name or e-mail address is for identification purposes only and can be 
any string.

Remote ID 

Select IP to identify the remote IPSec router by its IP address.

Select DNS to identify the remote IPSec router by a domain name.

Select E-mail to identify the remote IPSec router by an e-mail address.

Content

The configuration of the remote content depends on the remote ID type.

For IP, type the IP address of the computer with which you will make the VPN 
connection. If you configure this field to 0.0.0.0 or leave it blank, the Device will 
use the address in the Secure Gateway Address field (refer to the Secure 
Gateway Address field description).

For DNS or E-mail, type a domain name or e-mail address by which to identify 
the remote IPSec router. Use up to 31 ASCII characters including spaces, 
although trailing spaces are truncated. The domain name or e-mail address is for 
identification purposes only and can be any string.

It is recommended that you type an IP address other than 0.0.0.0 or use the 
DNS or E-mail ID type in the following situations:

•

When there is a NAT router between the two IPSec routers. 

•

When you want the Device to distinguish between VPN connection requests 

that come in from remote IPSec routers with dynamic WAN IP addresses.

Security Protocol

Pre-Shared 

Key

Type your pre-shared key in this field. A pre-shared key identifies a 
communicating party during a phase 1 IKE negotiation. 

Type from 8 to 31 case-sensitive ASCII characters or from 16 to 62 hexadecimal 
("0-9", "A-F") characters. You must precede a hexadecimal key with a "0x” (zero 
x), which is not counted as part of the 16 to 62 character range for the key. For 
example, in "0x0123456789ABCDEF", “0x” denotes that the key is hexadecimal 
and “0123456789ABCDEF” is the key itself.

Advanced Setting - Phase 1

Encryption 

Algorithm

Select which key size and encryption algorithm to use in the IKE SA. Choices 
are:

3DES - a 168-bit key with the DES encryption algorithm

AES128 - a 128-bit key with the AES encryption algorithm

AES256 - a 256-bit key with the AES encryption algorithm

The Device and the remote IPSec router must use the same key size and 
encryption algorithm. Longer keys require more processing power, resulting in 
increased latency and decreased throughput.

IPSec VPN: Add