ZyXEL 2WG 사용자 가이드

Chapter 15 IPSec VPN Screens

ZyWALL 2WG User’s Guide

Click SECURITY > VPN and the add network policy (

) icon in the VPN Rules (IKE) 

screen to display the VPN-Network Policy -Edit screen. Then, under Virtual Address 
Mapping Rule, select Many-to-One as the Type and click the Port Forwarding Rules 
button to open the following screen. Use this screen to configure port forwarding for your 
VPN tunnels to let the ZyWALL forward traffic coming in through the VPN tunnel to the 
appropriate IP address on the LAN. 

SA Life Time 

(Seconds)

Define the length of time before an IPSec SA automatically renegotiates in this 

field. The minimum value is 180 seconds.
A short SA Life Time increases security by forcing the two VPN gateways to 

update the encryption and authentication keys. However, every time the VPN 

tunnel renegotiates, all users accessing remote resources are temporarily 

disconnected.

Perfect Forward 

Secrecy (PFS)

Select whether or not you want to enable Perfect Forward Secrecy (PFS) and, if 

you do, which Diffie-Hellman key group to use for encryption. Choices are:
NONE - disable PFS
DH1 - enable PFS and use a 768-bit random number
DH2 - enable PFS and use a 1024-bit random number
DH5 - enable PFS and use a 1536-bit random number
PFS changes the root key that is used to generate encryption keys for each 

IPSec SA. The longer the key, the more secure the encryption, but also the 

longer it takes to encrypt and decrypt information. Both routers must use the 

same DH key group.

Enable Replay 

Detection 

As a VPN setup is processing intensive, the system is vulnerable to Denial of 

Service (DOS) attacks. The IPSec receiver can detect and reject old or 

duplicate packets to protect against replay attacks. Enable replay detection by 

selecting this check box. 

Enable Multiple 

Proposals 

Select this to allow the ZyWALL to use any of its phase 2 encryption and 

authentication algorithms when negotiating an IPSec SA. 
When you enable multiple proposals, the ZyWALL allows the remote IPSec 

router to select which phase 2 encryption and authentication algorithms to use 

for the IPSec SA, even if they are less secure than the ones you configure for 

the VPN rule.
Clear this to have the ZyWALL use only the configured phase 2 encryption and 

authentication algorithms when negotiating an IPSec SA.

Apply

Click Apply to save the changes. 

Cancel Click 

Cancel to discard all changes and return to the main VPN screen. 

Table 86   SECURITY > VPN > VPN Rules (IKE) > Edit Network Policy  (continued)