P-335WT to ZyWALL Tunneling

1. Setup P-335WT
2. Setup ZyWALL
3. Troubleshooting
4. View Log

This page guides us to setup a VPN connection between P-335WT and ZyWALL router. Please note that, in addition to P-335WT to ZyWALL, P-335WT can also talk to other VPN hardwards. The tested VPN hardware are shown below.

- Cisco 1720 Router, IOS 12.2(2)XH, IP/ADSL/FW/IDS PLUS IPSEC 3DES
- NetScreen 5, ScreenOS 2.6.0r6
- SonicWALL SOHO 2
- WatchGuard Firebox II
- ZyXEL ZyWALL
- Avaya VPN
- Netopia VPN
- III VPN

As the figure shown below, the tunnel between P-335WT and ZyWALL ensures the packets flow between PC 1 and PC 2 are secure. Because the packets go through the IPSec tunnel are encrypted. To achieve this VPN tunnel, the settings required for each P-335WT and ZyWALL are explained in the following sections.

The IP addresses we use in this example are as shown below.

PC 1 | P-335WT | ZyWALL | LAN 2
192.168.1.33 | LAN: 192.168.1.1 WAN: 202.132.154.1 | LAN: 192.168.2.1 WAN: 168.10.10.66 | 192.168.2.0/24

Note:

1. The following configurations are supposed both two VPN gateways have fixed IP addresses. If one of VPN gateways uses dynamic IP, we enter 0.0.0.0 as the secure gateway IP address. In this case, the VPN connection can only be initiated from dynamic side to fixed side to update its dynamic IP to the fixed side. However, if both gateways use dynamic IP addresses, it is no way to establish VPN connection at all.
2. In this example, we presume that P-335WT's model name is P-335WT. And since it's P-335WT, so only 1 PC can use the tunnel.
3. In this example, we presume that ZyWALL's model name is ZyWALL10W.

1. Setup P-335WT

1. Using a web browser, login P-335WT by giving the LAN IP address of P-335WT in URL field. Default LAN IP is 192.168.1.1, default password to login web configurator is 1234.
2. Click Advanced, and click VPN tab on the left.
3. On the SUMMARY menu, Select a policy to edit by clicking Edit.
4. On the Rule-Setup menu, check Active check box and give a name to this policy.
5. Local Address is PC1's IP address.
6. Remote Address Start is
7. Destination IP Address Start and Destination IP Address End are PC 2 IP in this example. (the secure remote host)
8. My IP Addr is the WAN IP of P-335WT.
9. Secure Gateway IP Addr is the remote secure gateway IP, that is ZyWALL WAN IP in this example.
10. Select Encapsulation Mode to Tunnel.
11. Check the ESP check box. (AH can not be used in SUA/NAT case)
12. Select Encryption Algorithm to DES and Authentication Algorithm to MD5, as we configured in ZyWALL.
13. Enter the key string 12345678 in the Preshared Key text box, and click Apply.

See the screen shot:

2. Setup ZyWALL

Similar to the settings for P-335WT, ZyWALL is configured in the same way.

1. Using a web browser, login ZyWALL by giving the LAN IP address of ZyWALL in URL field.
2. Click Advanced, and click VPN tab on the left.
3. On the SUMMARY menu, Select a policy to edit by clicking Edit.
4. On the CONFIGURE-IKE menu, check Active check box and give a name to this policy.
5. Select IPSec Keying Mode to IKE and Negotiation Mode to Main, as we configured in P-335WT.
6. Source IP Address Start and Source IP Address End are PC 2 IP in this example. (the secure host behind ZyWALL)
7. Destination IP Address Start and Destination IP Address End are PC 1 IP in this example. (the secure remote host) Note: You may assign a range of Local/Remote IP addresses for multiple VPN sessions`.`
8. My IP Addr is the WAN IP of ZyWALL.
9. Secure Gateway IP Addr is the remote secure gateway IP, that is P-335WT's WAN IP in this example.
10. Select Encapsulation Mode to Tunnel.
11. Check the ESP check box. (AH can not be used in SUA/NAT case)
12. Select Encryption Algorithm to DES and Authentication Algorithm to MD5, as we configured in P-335WT.
13. Enter the key string 12345678 in the Preshared Key text box, and click Apply.

See the screen shot:

3. Troubleshooting

Q: How do we know the above tunnel works?

A: If the connection between PC 1 and PC 2 is ok, we know the tunnel works.

Please try to ping from PC 1 to PC 2 (or PC 2 to PC 1). If PC 1 and PC 2 can ping to each other, it means that the IPSec tunnel has been established successfully. If the ping fail, there are two methods to troubleshoot IPSec in P-335WT.

- Menu 27.2, SA Monitor

Through menu 27.2, you can monitor every IPSec connections running in P-335WT presently. The second column of each entry indicates the IPSec rule name. So, if you can't see the name of your IPSec rule, it means that the SA establishment fails. Please go back Menu 27 to check your settings.

`Menu 27.2 - SA Monitor` `# Name Encap. IPSec ALgorithm` `-- -------------------------------------------------- ---------- -------------------------` `1 ZyWALL ca24f1eb6616b7c4 732c211ae9b01a0f Tunnel ESP DES-SHA1` `2` `3` `4` `5` `6` `7` `8` `9` `10` `Select Command= Refresh` `Select Connection= N/A` `Press ENTER to Confirm or ESC to Cancel:`

``

- Using CI command 'ipsec debug 1'

Please enter 'ipsec debug 1' in Menu 24.8. There should be lots of detailed messages printed out to show how negotiations are taken place. If IPSec connection fails, please dump 'ipsec debug 1' for our analysis. The following shows an example of dumped messages.

`P-335WT> ipsec debug 1 IPSEC debug level 1 P-335WT> catcher(): recv pkt numPkt<1> get_hdr nxt_payload<1> exchMode<2> m_id<0> len<80> f76af206 b187aae3 00000000 00000000 01100200 00000000 00000050 00000034 00000001 00000001 00000028 01010001 00000020 01010000 80010001 80020001 80040001 80030001 800b0001 800c0e10 In isadb_get_entry, nxt_pyld=1, exch=2 New SA In responder isadb_create_entry(): RESPONSOR: ##entering spGetPeerByAddr... <deleted>`

4. View Log
To view the log for IPSec and IKE connections, please enter menu 27.3, View IPSec Log. The log menu is also useful for troubleshooting please capture to us if necessary. The example shown below is a successful IPSec connection.

Index: Date/Time: Log: ------------------------------------------------------------ 001 01 Jan 10:23:22 !! Cannot find outbound SA for rule <1> 002 01 Jan 10:23:22 Send Main Mode request to <168.10.10.66> 003 01 Jan 10:23:22 Send:<SA> 004 01 Jan 10:23:22 Recv:<SA> 005 01 Jan 10:23:24 Send:<KE><NONCE> 006 01 Jan 10:23:24 Recv:<KE><NONCE> 007 01 Jan 10:23:26 Send:<ID><HASH> 008 01 Jan 10:23:26 Recv:<ID><HASH> 009 01 Jan 10:23:26 Phase 1 IKE SA process done 010 01 Jan 10:23:26 Start Phase 2: Quick Mode 011 01 Jan 10:23:26 Send:<HASH><SA><NONCE><ID><ID> 012 01 Jan 10:23:26 Recv:<HASH><SA><NONCE><ID><ID> 013 01 Jan 10:23:26 Send:<HASH> Clear IPSec Log (y/n):