ZyXEL Communications vantage cnm ユーザーズマニュアル

Chapter 12 VPN Community

Vantage CNM User’s Guide

Perfect Forward 

Secret (PFS)

Select whether or not you want to enable Perfect Forward Secrecy (PFS) 

and, if you do, which Diffie-Hellman key group to use for encryption. Choices 

are:
NONE - disable PFS
DH1 - enable PFS and use a 768-bit random number
DH2 - enable PFS and use a 1024-bit random number
PFS changes the root key that is used to generate encryption keys for each 

IPSec SA. It is more secure but takes more time.

Enable Replay 

Detection 

As a VPN setup is processing intensive, the system is vulnerable to Denial of 

Service (DOS) attacks. The IPSec receiver can detect and reject old or 

duplicate packets to protect against replay attacks. Enable replay detection 

by selecting this check box. 

Enable Multiple 

Proposals 

Select this to allow the ZyWALL to use any of its phase 2 encryption and 

authentication algorithms when negotiating an IPSec SA. 
When you enable multiple proposals, the ZyWALL allows the remote IPSec 

router to select which phase 2 encryption and authentication algorithms to 

use for the IPSec SA, even if they are less secure than the ones you 

configure for the VPN rule.
Clear this to have the ZyWALL use only the configured phase 2 encryption 

and authentication algorithms when negotiating an IPSec SA.

Apply

Click Apply to save the changes. 

Cancel Click 

Cancel to discard all changes and return to the previous screen. 

Table 124   VPN Management > VPN Community > Add/Edit (continued)