User manual AKAI GX-4000D PARTS LIST

[. . . ] Neither does it convey any license under its patent rights nor the patent rights of others. ZyXEL further reserves the right to make changes in any products described herein without notice. This publication is subject to change without notice. Trademarks ZyNOS (ZyXEL Network Operating System) is a registered trademark of ZyXEL Communications, Inc. Other trademarks mentioned in this publication are used for identification purposes only and may be properties of their respective owners. Copyright 3 GX-4000D/P-335U User's Guide Certifications Federal Communications Commission (FCC) Interference Statement This device complies with Part 15 of FCC rules. [. . . ] In the following example, the ID type and content match so the ZyXEL Device and the remote IPSec router authenticate each other successfully. Table 49 VPN Example: Matching ID Type and Content AKAI DEVICE Local ID type: E-mail Local ID content: tom@yourcompany. com Peer ID type: IP Peer ID content: 1. 1. 1. 2 REMOTE IPSEC ROUTER Local ID type: IP Local ID content: 1. 1. 1. 2 Peer ID type: E-mail Peer ID content: tom@yourcompany. com In the following example, the ID type and content do not match so the authentication fails and the ZyXEL Device and the remote IPSec router cannot establish an IKE SA. Table 50 VPN Example: Mismatching ID Type and Content AKAI DEVICE Local ID type: E-mail Local ID content: tom@yourcompany. com REMOTE IPSEC ROUTER Local ID type: IP Local ID content: 1. 1. 1. 2 142 Chapter 13 IPSec VPN GX-4000D/P-335U User's Guide Table 50 VPN Example: Mismatching ID Type and Content AKAI DEVICE Peer ID type: IP Peer ID content: 1. 1. 1. 15 REMOTE IPSEC ROUTER Peer ID type: E-mail Peer ID content: tom@yourcompany. com 13. 1. 2. 4 Negotiation Mode There are two negotiation modes: main mode and aggressive mode. Main mode provides better security, while aggressive mode is faster. Main mode takes six steps to establish an IKE SA. Steps 1-2: The ZyXEL Device sends its proposals to the remote IPSec router. The remote IPSec router selects an acceptable proposal and sends it back to the ZyXEL Device. Steps 3-4: The ZyXEL Device and the remote IPSec router participate in a Diffie-Hellman key exchange, based on the accepted DH key group, to establish a shared secret. Steps 5-6: Finally, the ZyXEL Device and the remote IPSec router generate an encryption key from the shared secret, encrypt their identities, and exchange their encrypted identity information for authentication. In contrast, aggressive mode only takes three steps to establish an IKE SA. Step 1: The ZyXEL Device sends its proposals to the remote IPSec router. It also starts the Diffie-Hellman key exchange and sends its (unencrypted) identity to the remote IPSec router for authentication. Step 2: The remote IPSec router selects an acceptable proposal and sends it back to the ZyXEL Device. It also specifies how much of each packet is protected by the encryption and authentication algorithms. IPSec VPN includes two IPSec protocols, AH (Authentication Header, RFC 2402) and ESP (Encapsulating Security Payload, RFC 2406). Note: The ZyXEL Device and remote IPSec router must use the same IPSec protocol. 144 Chapter 13 IPSec VPN GX-4000D/P-335U User's Guide Usually, you should select ESP. AH does not support encryption, and ESP is more suitable with NAT. 13. 1. 3. 3 Encapsulation There are two ways to encapsulate packets. Usually, you should use tunnel mode because it is more secure. Transport mode is only used when the IPSec SA is used for communication between the ZyXEL Device and remote IPSec router (for example, for remote management), not between computers on the local and remote networks. Note: The ZyXEL Device and remote IPSec router must use the same encapsulation. These modes are illustrated below. Figure 88 VPN: Transport and Tunnel Mode Encapsulation Original Packet IP Header TCP Header AH/ESP Header AH/ESP Header Data Transport Mode Packet IP Header TCP Header IP Header Data Tunnel Mode Packet IP Header TCP Header Data In tunnel mode, the ZyXEL Device uses the IPSec protocol to encapsulate the entire IP packet. As a result, there are two IP headers: · Outside header: The outside IP header contains the IP address of the ZyXEL Device or remote IPSec router, whichever is the destination. · Inside header: The inside IP header contains the IP address of the computer behind the ZyXEL Device or remote IPSec router. The header for the IPSec protocol (AH or ESP) appears between the IP headers. [. . . ] Some companies have more than one route to one or more ISPs. If the alternate gateway is on the LAN (and it's IP address is in the same subnet), the "triangle route" problem may occur. The steps below describe the "triangle route" problem. 1 A computer on the LAN initiates a connection by sending out a SYN packet to a receiving server on the WAN. [. . . ]