User manual ZYXEL P-2602HW

[. . . ] Prestige 2602H Series ADSL VoIP IAD Prestige 2602HW Series 802. 11g Wireless ADSL VoIP IAD User's Guide Version 3. 40 5/2005 Prestige 2602H/HW Series User's Guide Copyright Copyright © 2005 by ZyXEL Communications Corporation. The contents of this publication may not be reproduced in any part or as a whole, transcribed, stored in a retrieval system, translated into any language, or transmitted in any form or by any means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the prior written permission of ZyXEL Communications Corporation. Published by ZyXEL Communications Corporation. All rights reserved. Disclaimer ZyXEL does not assume any liability arising out of the application or use of any products, or software described herein. [. . . ] In the previous figure, IPSec router A sends an IPSec packet in an attempt to initiate a VPN. The NAT router changes the IPSec packet's header so it does not match the header for which IPSec router B is checking. Therefore, IPSec router B does not respond and the VPN connection cannot be built. NAT traversal solves the problem by adding a UDP port 500 header to the IPSec packet. The NAT router forwards the IPSec packet with the UDP port 500 header unchanged. IPSec router B checks the UDP port 500 header and responds. IPSec routers A and B build a VPN connection. 218 Chapter 17 VPN Screens Prestige 2602H/HW Series User's Guide 17. 8. 1 NAT Traversal Configuration For NAT traversal to work you must: · Use ESP security protocol (in either transport or tunnel mode). · Enable NAT traversal on both IPSec endpoints. In order for IPSec router A (see Figure 94 on page 218) to receive an initiating IPSec packet from IPSec router B, set the NAT router to forward UDP port 500 to IPSec router A. 17. 9 ID Type and Content With aggressive negotiation mode (see Section 17. 12. 1 on page 228), the Prestige identifies incoming SAs by ID type and content since this identifying information is not encrypted. This enables the Prestige to distinguish between multiple rules for SAs that connect from remote IPSec routers that have dynamic WAN IP addresses. Telecommuters can use separate passwords to simultaneously connect to the Prestige from IPSec routers with dynamic IP addresses (see Section 17. 18 on page 237 for a telecommuter configuration example). Regardless of the ID type and content configuration, the Prestige does not allow you to save multiple active rules with overlapping local and remote IP addresses. With main mode (see Section 17. 12. 1 on page 228), the ID type and content are encrypted to provide identity protection. In this case the Prestige can only distinguish between up to 12 different incoming SAs that connect from remote IPSec routers that have dynamic WAN IP addresses. The Prestige can distinguish up to 12 incoming SAs because you can select between three encryption algorithms (DES, 3DES and AES), two authentication algorithms (MD5 and SHA1) and two key groups (DH1 and DH2) when you configure a VPN rule (see Section 17. 13 on page 228). The ID type and content act as an extra level of identification for incoming SAs. The type of ID can be a domain name, an IP address or an e-mail address. The content is the IP address, domain name, or e-mail address. Chapter 17 VPN Screens 219 Prestige 2602H/HW Series User's Guide Table 68 Local ID Type and Content Fields LOCAL ID TYPE= CONTENT= IP DNS E-mail Type the IP address of your computer or leave the field blank to have the Prestige automatically use its own IP address. Type a domain name (up to 31 characters) by which to identify this Prestige. Type an e-mail address (up to 31 characters) by which to identify this Prestige. The domain name or e-mail address that you use in the Content field is used for identification purposes only and does not need to be a real domain name or e-mail address. Table 69 Peer ID Type and Content Fields PEER ID TYPE= CONTENT= IP Type the IP address of the computer with which you will make the VPN connection or leave the field blank to have the Prestige automatically use the address in the Secure Gateway field. Type a domain name (up to 31 characters) by which to identify the remote IPSec router. [. . . ] The "cat" is the same as the category in the router's logs. Table 205 SIP Logs LOG MESSAGE SIP Registration Success by SIP:SIP Phone Number SIP Registration Fail by SIP:SIP Phone Number SIP UnRegistration Success by SIP:SIP Phone Number SIP UnRegistration Fail by SIP:SIP Phone Number DESCRIPTION The listed SIP account was successfully registered with a SIP register server. An attempt to register the listed SIP account with a SIP register server was not successful. The listed SIP account's registration was deleted from the SIP register server. An attempt to delete the listed SIP account's registration from the SIP register server failed. 532 Appendix K Log Descriptions Prestige 2602H/HW Series User's Guide Table 206 RTP Logs LOG MESSAGE Error, RTP init fail Error, Call fail: RTP connect fail Error, RTP connection cannot close DESCRIPTION The initialization of an RTP session failed. [. . . ]