VPN Overview
P662 VPN
A VPN gives users a secure link to access corporate network over the Internet or other public or private networks without the expense of lease lines. A secure VPN is a combination of tunneling, encryption, authentication, access control and auditing technologies/services used to transport traffic over the Internet or any insecure network that uses the TCP/IP protocol suite for communication.
There are some reasons to use a VPN. The most common reasons are because of security
and cost.
Security
1). Authentication
With authentication, VPN receiver can verify the source of packets and guarantee the data
integrity.
2). Encryption
With encryption, VPN guarantees the confidentiality of the original user data.
Cost
1). Cut long distance phone charges
Because users typically dial the their local ISP for VPN, thus, long distance phone charge
is reduced than making a long direct connection to the remote office.
2).Reducing number of access lines
Many companies pay monthly charges for two types access lines: (1) high-speed links for
their Internet access and (2) frame relay, ISDN Primary Rate Interface or T1 lines to
carry data. A VPN may allow a company to carry the data traffic over its Internet
access lines, thus reducing the need for some installed lines.
3. What are most common VPN protocols?
There are currently three major tunneling protocols for VPNs. They are Point-to-Point Tunneling Protocol (PPTP), Layer 2 Tunneling Protocol (L2TP) and Internet Protocol Security (IPSec).
PPTP is a tunneling protocol defined by the PPTP forum that allows PPP packets to be encapsulated within Internet Protocol (IP) packets and forwarded over any IP network, including the Internet itself. The PPTP is supported in Windows NT and Windows 98 already. For Windows 95, it needs to be upgraded by the Dial-Up Networking 1.2 upgrade.
Layer Two Tunneling Protocol (L2TP) is an extension of the Point-to-Point Tunneling Protocol (PPTP) used by an Internet service provider (ISP) to enable the operation of a virtual private network (VPN) over the Internet.
IPSec is a set of IP extensions developed by IETF (Internet Engineering Task Force) to
provide security services compatible with the existing IP standard (IPv.4) and also the
upcoming one (IPv.6). In addition, IPSec can protect any protocol that runs on top
of IP, for instance TCP, UDP, and ICMP. The IPSec provides cryptographic security
services. These services allow for authentication, integrity, access control, and
confidentiality. IPSec allows for the information exchanged between remote sites to be
encrypted and verified. You can create encrypted tunnels (VPNs), or just do encryption
between computers. Since you have so many options, IPSec is truly the most extensible and
complete network security solution.
7.
What secure protocols does IPSec support?
There are two protocols provided by IPSec, they are AH (Authentication Header, protocol number 51) and ESP (Encapsulated Security Payload, protocol number 50).
8. What are the differences between 'Transport mode' and 'Tunnel mode?
The IPSec protocols (AH and ESP) can be used to protect either an entire IP payload or only the upper-layer protocols of an IP payload. Transport mode is mainly for an IP host to protect the data generated locally, while tunnel mode is for security gateway to provide IPSec service for other machines lacking of IPSec capability.
In this case, Transport mode only protects the upper-layer protocols of IP payload (user data). Tunneling mode protects the entire IP payload including user data.
There is no restriction that the IPSec hosts and the security gateway must be separate machines. Both IPSec protocols, AH and ESP, can operate in either transport mode and tunnel mode.
A Security Association (SA) is a contract between two parties indicating what security parameters, such as keys and algorithms they will use.
IKE is short for Internet Key Exchange. Key Management allows you to determine whether to use IKE (ISAKMP) or manual key configuration to set up a VPN.
There are two phases in every IKE negotiation- phase 1 (Authentication) and phase 2 (Key Exchange). Phase 1 establishes an IKE SA and phase 2 uses that SA to negotiate SAs for IPSec.
A pre-shared key identifies a communicating party during a phase 1 IKE negotiation. It is called 'Pre-shared' because you have to share it with another party before you can communicate with them over a secure connection.
12. What are the differences between IKE and manual key VPN?
The only difference between IKE and manual key is how the encryption keys and SPIs are determined.
IKE is more secure than manual key, because IKE negotiation can generate new keys and SPIs randomly for the VPN connection.
In IKE phase 1 negotiation, IP address of remote peer is treated as an
indicator to decide which VPN rule must be used to serve the incoming request.
However, in some application, remote VPN box or client software is using an
IP address dynamically assigned from ISP, so P662 needs additional information
to make the decision. Such additional information is what we call phase 1 ID. In
the IKE payload, there are local and peer ID field to achieve this.
FQDN(Fully Qualified Domain Name), IKE standard takes it as one type of Phase
1 ID.
As we mentioned, Phase 1 ID is an identification for each VPN peer. The type of
Phase 1 ID may be IP/FQDN(DNS)/Ueser FQDN(E-mail). The content of Phase 1 ID
depends on the Phase 1 ID type. The following is an example for how to
configure phase 1 ID.
ID type Content
------------------------------------
IP 202.132.154.1
DNS www.zyxel.com
E-mail support@zyxel.com.tw
Please note that, in P662, if "DNS" or "E-mail" type is
choosen, you can still use a random string as the content, such as "this_is_P662".
It's not neccessary to follow the format exactly.
By default, P662 takes IP as phase 1 ID type for itself and it's remote peer.
But if it's remote peer is using DNS or E-mail, you have to ajust the settings
to pass phase 1 ID checking.
If yoour VPN connection is P662 to P662, and both of them have static IP address, and there is no NAT router in between, you can ignore this option. Just leave Local/Peer ID type as IP, then skip this option.
If either side of VPN tunneling end point is using dynamic IP address, you may need to configure ID for the one with dynamic IP address. And in this case, "Aggressive mode" is recommended to be applied in phase 1 negotiation .
1. How do I configure P662 VPN?
You can configure P662 for VPN using SMT or Web configurator. P662 1 supports Web only.
2.
What VPN protocols are supported by P662?
All P662 series support ESP (protocol number 50) and AH (protocol number
51).
3. What types of
encryption does P662 VPN support?
P662 supports 56-bit DES and 168-bit 3DES.
4.
What types of authentication does P662 VPN support?
VPN vendors support a number of different authentication methods. P662 VPN supports both SHA1 and MD5.
AH provides authentication, integrity, and replay protection (but not confidentiality).
Its main difference with ESP is that AH also secures parts of the IP header of the packet
(like the source/destination addresses), but ESP does not.
ESP can provide authentication, integrity, replay protection, and confidentiality of the
data (it secures everything in the packet that follows the header). Replay protection
requires authentication and integrity (these two go always together). Confidentiality
(encryption) can be used with or without authentication/integrity. Similarly, one could
use authentication/integrity with or without confidentiality.
5. I am planning my
P662-to-P662 VPN configuration. What do I need to
know?
First of all, both P662 must have VPN capabilities.
If your P662 is capable of VPN, you can find the VPN options in Advanced>VPN tab.
For configuring a 'box-to-box VPN', there are some tips:
6. Does P662 support dynamic secure gateway IP?
If the remote VPN gateways uses dynamic IP, we enter 0.0.0.0 as the Secure Gateway IP Address in P662. In this case, the VPN connection can only be initiated from dynamic side to fixed side in order to update its dynamic IP to the fixed side. However, if both gateways use dynamic IP addresses, it is no way to establish VPN connection at all.
7. What VPN gateway that has been tested with P662 successfully?
We have tested P662 successfully with the following third party VPN gateways.
8. What VPN software that has been tested with
P662 successfully?
We have tested P662 successfully with the following third party VPN software.
9.Will
ZyXEL support Secure Remote Management?
Yes, we will support it and we are working on it
currently.
10. What are the difference between the 'My IP Address' and
'Secure Gateway IP Address' in Menu 27.1.1?
'My IP Adderss' is the Internet IP address of the local P662. The 'Secure
Gateway IP Address' is the Internet IP address of the remote IPSec gateway.
11. Is the host behind NAT allowed to use IPSec?
NAT Condition | Supported IPSec Protocol |
VPN Gateway embedded NAT | AH tunnel mode, ESP tunnel mode |
VPN client/gateway behind NAT* | ESP tunnel mode |
NAT in Transport mode | None |
* The NAT router must support IPSec pass through. For example, for P662 SUA/NAT routers. The default port and the client IP have to be specified in menu 15-SUA Server Setup.
12. Why does VPN throughput decrease when staying in SMT menu 24.1?
If P662 stays in menu 24.1, 24.8 and 27.3 a certain of memory is allocated to generate the required statistics. So, we do not suggest to stay in menu 24.1, 27.3 and 24.8 when VPN is in use.
13. How do I configure P662 with NAT for internal servers?
Generally, without IPSec, to configure an internal server for outside access, we need to configure the server private IP and its service port in SUA/NAT Server Table.
However, if both NAT and IPSec is enabled in P662, the edit of the table is necessary only if the connection is a non-secure connections. For secure connections, none SUA server settings are required since private IP is reachable in the VPN case.
For example:
host----P662(NAT)----ADSL Modem----Internet----Secure host
\
\
Non-secure host
14. I am planning my P662 behind a NAT router. What do I need to know?
Some tips for this:
For example:
host----P662----NAT Router----Internet----Secure host
\
\
Non-secure host
15. How can I keep a tunnel alive?
To keep a tunnel alive, you can check "keep alive" option
when configuring your VPN tunnel. With this option, whenever phase 2 SA lifetime
is due, IKE negotiation procedure will be invoked automatically even without
traffic to make the connection stay.
But to reduce the consumption of system resource, if VPN tunnels get
disconnected either manually, by idle timer, or because of power cycle, packet
triggering is still necessary to make the tunnel up.
16. Single, Range, Subnet, which types of IP address do P662 support in VPN/IPSec?
The mentioned P662 series support all of the types. In other words, you can specify a single PC, a range of PCs or even a network of PCs to utilize the VPN/IPSec service.
17. Can P662 support IPSec passthrough?
Yes, P662 can support IPSec passthrough. P662 series don't only support IPSec/VPN gateway, it can also be a NAT router supporting IPSec passthrough.
If the VPN connection is initiated from the security gateway behind P662, no configuration is necessary for NAT nor Firewall.
If the VPN connection is initiated from the security gateway outside of P662, NAT port forwarding and Firewall forwarding are necessary.
To configure NAT port forwarding, please go to WEB interface, Setup/ "SUA/NAT", put the secure gateway's IP address in default server.
To configure Firewall forwarding, please go to WEB interface, Setup/Firewall, select Packet Direction to WAN to LAN, and create a firewall rule the forwards IKE(UDP:500).
No, P662 can't support them simultaneously. You need to choose either one. If P662 is to support IPSec passthrough, you have to disable the VPN function on P662. To disable it, you can either deactivate each VPN rule or issue a CI command, "ipsec switch off" from SMT menu 24.8. You can get into SMT menu via either telnet or console connection.