ZyXEL Communications P-2602 Manuel D’Utilisation

P-2602H(W)(L)-DxA Series User’s Guide

Chapter 17 VPN Screens

227

Y* - This is supported in the ZyXEL Device if you enable NAT traversal.

In cases where you want to use domain names to access Intranet servers on a remote network 
that has a DNS server, you must identify that DNS server. You cannot use DNS servers on the 
LAN or from the ISP since these DNS servers cannot resolve domain names to private IP 
addresses on the remote network

The following figure depicts an example where three VPN tunnels are created from ZyXEL 
Device A; one to branch office 2, one to branch office 3 and another to headquarters. In order 
to access computers that use private domain names on the headquarters (HQ) network, the 
ZyXEL Device at branch office 1 uses the Intranet DNS server in headquarters. The DNS 
server feature for VPN does not work with Windows 2000 or Windows XP.

Figure 123   VPN Host using Intranet DNS Server Example

If you do not specify an Intranet DNS server on the remote network, then the VPN host must 
use IP addresses to access the computers on the remote network.

With aggressive negotiation mode (see

), the ZyXEL Device 

identifies incoming SAs by ID type and content since this identifying information is not 
encrypted. This enables the ZyXEL Device to distinguish between multiple rules for SAs that 
connect from remote IPSec routers that have dynamic WAN IP addresses. Telecommuters can 
use separate passwords to simultaneously connect to the ZyXEL Device from IPSec routers 
with dynamic IP addresses (see

 for a telecommuter configuration 

example).