ZyXEL nbg-5715 Guia Do Utilizador

 Chapter 18 IPSec VPN

NBG5715 User’s Guide

A VPN tunnel is usually established in two phases. Each phase establishes a security association 
(SA), a contract indicating what security parameters the NBG5715 and the remote IPSec router will 
use. 

The first phase establishes an Internet Key Exchange (IKE) SA between the NBG5715 and remote 
IPSec router. The second phase uses the IKE SA to securely establish an IPSec SA through which 
the NBG5715 and remote IPSec router can send data between computers on the local network and 
remote network. The following figure illustrates this.

VPN: IKE SA and IPSec SA 

In this example, a computer in network A is exchanging data with a computer in network B. Inside 
networks A and B, the data is transmitted the same way data is normally transmitted in the 
networks. Between routers X and Y, the data is protected by tunneling, encryption, authentication, 
and other security features of the IPSec SA. The IPSec SA is established securely using the IKE SA 
that routers X and Y established first.

The IKE SA provides a secure connection between the NBG5715 and remote IPSec router.

It takes several steps to establish an IKE SA. The negotiation mode determines the number of steps 
to use. There are two negotiation modes--main mode and aggressive mode. Main mode provides 
better security, while aggressive mode is faster.

Both routers must use the same negotiation mode.

These modes are discussed in more detail in 

. Main mode is used in 

various examples in the rest of this section.

In the NBG5715, you have to specify the IP addresses of the NBG5715 and the remote IPSec router 
to establish an IKE SA.

You can usually provide a static IP address or a domain name for the NBG5715. Sometimes, your 
NBG5715 might also offer another alternative, such as using the IP address of a port or interface.