Filter
Top Products
Chapter 14 IPSec VPN
ZyWALL 2 Plus User’s Guide
268
The following table describes the labels in this screen.
Table 72 SECURITY > VPN > Global Setting
LABEL DESCRIPTION
Output Idle Timer When traffic is sent to a remote IPSec router from which no reply is received
after the specified time period, the ZyWALL checks the VPN connectivity. If
the remote IPSec router does not reply, the ZyWALL automatically
disconnects the VPN tunnel.
Enter the time period (between 120 and 3600 seconds) to wait before the
ZyWALL checks all of the VPN connections to remote IPSec routers.
Enter 0 to disable this feature.
Input Idle Timer When no traffic is received from a remote IPSec router after the specified
time period, the ZyWALL checks the VPN connectivity. If the remote IPSec
router does not reply, the ZyWALL automatically disconnects the VPN
tunnel.
Enter the time period (between 30 and 3600 seconds) to wait before the
ZyWALL checks all of the VPN connections to remote IPSec routers.
Enter 0 to disable this feature.
Gateway Domain
Name Update Timer
This field is applicable when you enter a domain name to identify the
ZyWALL and/or the remote secure gateway.
Enter the time period (between 2 and 60 minutes) to wait before the ZyWALL
updates the domain name and IP address mapping through a DNS server.
The ZyWALL rebuilds the VPN tunnel if it finds that the domain name is now
using a different IP address (any users of the VPN tunnel will be temporarily
disconnected).
Enter 0 to disable this feature.
Adjust TCP Maximum
Segment Size
The TCP packets are larger after the ZyWALL encrypts them for VPN. The
ZyWALL fragments packets that are larger than a connection’s MTU
(Maximum Transmit Unit).
In most cases you should leave this set to Auto. The ZyWALL automatically
sets the Maximum Segment Size (MSS) of the TCP packets that are to be
encrypted by VPN based on the encapsulation type.
Select Off to not adjust the MSS for the encrypted TCP packets.
If your network environment causes fragmentation issues that are affecting
your throughput performance, you can manually set a smaller MSS for the
TCP packets that are to be encrypted by VPN. Select User-Defined and
specify a size from 0~1460 bytes. 0 has the ZyWALL use the auto setting.
VPN rules skip
applying to the overlap
range of local and
remote IP addresses
Select this check box to send packets destined for overlapping local and
remote IP addresses to the local network (you can access the local devices
but not the remote devices).
Clear this check box to send packets destined for overlapping local and
remote IP addresses to the remote network (you can access the remote
devices but not the local devices.)
If the remote IPSec router also supports NAT over IPSec, it is recommended
that you use NAT over IPSec (see Section 14.6.2 on page 252) if the local
and remote IP addresses overlap.
If a VPN rule’s local and remote network settings are both set to 0.0.0.0
(any), no traffic goes through the VPN tunnel if you select this check box.
Apply Click Apply to save your changes back to the ZyWALL.
Reset Click Reset to begin configuring this screen afresh.