ZyXEL Communications USG Series User manual






VPN Configuration Guide
Zyxel
USG Series, USG Flex Series, ZyWALL VPN Firewalls, ZyWALL ATP Firewalls
 



© 2020 equinux AG and equinux USA, Inc. All rights reserved.
Under copyright law, this configuration guide may not be copied, in whole or in part, without the written consent of equinux AG or equinux USA, Inc. Your
rights to the software are governed by the accompanying software license agreement.
The equinux logo is a trademark of equinux AG and equinux USA, Inc., registered in the U.S. and other countries. Other product and company names
mentioned herein may be trademarks and/or registered trademarks of their respective companies.
equinux shall have absolutely no liability for any direct or indirect, special or other consequential damages in connection with the use of this document or
any change to the router in general, including without limitation, any lost profits, business, or data, even if equinux has been advised of the possibility of
such damages.
Every effort has been made to ensure that the information in this configuration guide is accurate. equinux is not responsible for printing or clerical errors.
Revised November 2020
Apple, the Apple logo, iBook, Mac, Mac OS, MacBook, PowerBook are trademarks of Apple Computer, Inc., registered in the U.S. and other countries.
www.equinux.com  
1


Contents

Introduction
My VPN Gateway Configuration Checklist
Task 1 – VPN Gateway Configuration
Task 2 – VPN Tracker Configuration
Step 1 – Add a Connection
Step 2 – Configure the VPN Connection
Task Three - Testing the VPN connection
Connect to your VPN
Troubleshooting
Technical Support

 
2


Introduction
My VPN Gateway Configuration Checklist
Throughout this guide, there are certain pieces of information that are needed later on for configuring VPN Tracker. This information is
marked with red numbers to make it easier to reference it later. You can print this checklist to help keep track of the various settings of
your ZyWALL USG VPN gateway device.

IP Addresses
(1) WAN IP Address:  . . .  (or hostname  )
(2) LAN (internal) IP Address / Subnet Mask:  . . .  /  . . . 
User Authentication (XAUTH)
(3) Username: _______________________________
(4) Password: _______________________________  
Pre-Shared Key
(5) Pre-Shared Key: _______________________________
 
3


Task 1 – VPN Gateway Configuration
We will first set up VPN on the VPN gateway. If you already have VPN in place, it’s helpful to follow this tutorial to see how settings on the
device fit together with VPN Tracker.
Step 1 – Retrieve Network Settings
➔Connect to your VPN gateway through its web configuration interface
➔Go to the CONFIGURATION tab to access the device’s settings
➔Go to Network > Interface and switch to the Ethernet tab:

➔Write down the IP address of the primary WAN network interface (here: wan1) as (1) on your Configuration Checklist. If your device has a DNS hostname (fixed or
DynDNS), write it down instead
➔Write down the IP address of the LAN network interface (here: lan1), including its subnet mask as (2) on your Configuration Checklist
 
4


Step 2 – Create a VPN User
➔Go to Object > User/Group and switch to the User tab. Then, click the Add button:

➔User Name: Enter a username for the new user (here: alice). Write down the user name as (3)
➔User Type: Choose user from the pop-up
➔Password: Enter a password for this new user. Make sure to remember the password, or write it down as (4) then click OK to add the user

To add more users, simply repeat this step. You might want to connect the device to an existing (LDAP or RADIUS) authentication server later (remember to select the
appropriate user type for the external authentication server in the User Type pop-up). We recommend using a local user for initial setup and testing.
5


Step 3 – Create an Authentication Method
➔Go to Object > Auth. Method and click the Add button:

➔Name: Enter a name for the new authentication method (here: vpn_auth)
➔Click the Add button and choose local from the pop-up

➔Click OK to save the authentication method 
6


Step 4 – Set up Phase 1
➔Go to VPN > IPsec VPN and switch to the VPN Gateway tab. Click the Add button:

➔Click the Show Advanced Settings button to be able to access all settings

General Settings

➔Select the Enable checkbox to enable the VPN gateway settings that you are about to configure
➔VPN Gateway Name: Enter a name for the phase 1 setup (here: vpn_tracker) 
7


Gateway Settings

➔My Address: Select Interface and select your primary WAN network interface (here: wan1) from the pop-up menu
➔Peer Gateway Address: Select Dynamic Address
Authentication

➔Enter a Pre-Shared Key (here: topsecret). Make sure to choose a good pre-shared key and remember it, or write it down as (5)
➔Local ID Type: Make sure IP is selected
➔Content: Leave the default of 0.0.0.0. This means that the IP address entered for My Address will automatically be used as the device’s identifier
➔Peer ID Type: Make sure Any is selected. This means that connecting VPN clients can use any identifier type
8


Phase 1 Settings

➔SA Life Time: Leave the default of 86400 seconds
➔Negotiation Mode: Leave the default of Main Mode
➔Proposal: For security reasons, we recommend changing the default proposal settings to use at least 3DES and SHA-1 (with the option of using AES-128 and SHA-1) as
shown here
➔Key Group: Choose DH2 from the pop-up
➔Select the NAT Traversal checkbox
➔Make sure the Dead Peer Detection (DPD) checkbox is selected
It is possible to use different phase 1 settings. Please note that any changes you make here must be matched in VPN Tracker (Advanced > Phase 1). We recommend using the
settings shown here for initial setup and testing. 
9