ZyXEL NBG420N Manuel d'utilisateur télécharger pdf (Page 188)

Chapter 15 IPSec VPN

NBG420N User’s Guide

188

Figure 114 VPN/NAT Example

If router A does NAT, it might change the IP addresses, port numbers, or both. If router X and

router Y try to establish a VPN tunnel, the authentication fails because it depends on this

information. The routers cannot establish a VPN tunnel.

Most routers like router A now have an IPSec pass-through feature. This feature helps router A

recognize VPN packets and route them appropriately. If router A has this feature, router X and

router Y can establish a VPN tunnel as long as the IPSec protocol is ESP. (See IPSec Protocol

on page 188 for more information about active protocols.)

If router A does not have an IPSec pass-through or if the IPSec protocol is AH, you can solve

this problem by enabling NAT traversal. In NAT traversal, router X and router Y add an extra

header to the IKE SA and IPSec SA packets. If you configure router A to forward these

packets unchanged, router X and router Y can establish a VPN tunnel.

You have to do the following things to set up NAT traversal.

• Enable NAT traversal on the NBG420N and remote IPSec router.

• Configure the NAT router to forward packets with the extra header unchanged.

The extra header may be UDP port 500 or UDP port 4500, depending on the standard(s) the

NBG420N and remote IPSec router support.

IPSec Protocol

The IPSec protocol controls the format of each packet. It also specifies how much of each

packet is protected by the encryption and authentication algorithms. IPSec VPN includes two

IPSec protocols, AH (Authentication Header, RFC 2402) and ESP (Encapsulating Security

Payload, RFC 2406).

Note: The NBG420N and remote IPSec router must use the same IPSec protocol.

Usually, you should select ESP. AH does not support encryption, and ESP is more suitable

with NAT.

Encapsulation

There are two ways to encapsulate packets. Usually, you should use tunnel mode because it is

more secure. Transport mode is only used when the IPSec SA is used for communication

between the NBG420N and remote IPSec router (for example, for remote management), not

between computers on the local and remote networks.

Note: The NBG420N and remote IPSec router must use the same encapsulation.

1 2 ... 183 184 185 186 187 188 189 190 191 192 193 ... 339 340

Pas de commentaire

ZyXEL NBG420N Manuel d'utilisateur Page 188