Open "Configuration > VPN > IPSec VPN" VPN Gateway tab. Create a new IKE connection to a peer with "Add".

Click "Show Advanced Settings" to see all of the necessary fields.

Enter the IP or DNS name of the Intra2net system as the peer gateway address. Even if the Intra2net system uses a dynamic IP with DynDNS, you must select "Static Address".

Specify the authentication on certificates and select the previously created certificate for the ZyWALL.

Select AES128 and SHA1 as Proposal, the matching "Key Group" is DH2.

If the Zywall or Intra2net system is located behind a NAT router, you need to enable "NAT Traversal".

Go to "Configuration > VPN > IPSec VPN" VPN Connection tab. Create a new IPSec connection with "Add".

Create a network object for the network of the peer. Use the "Create new Object > Address" menu. Use SUBNET as type and enter the network address and netmask.

Click "Show Advanced Settings" to see all of the necessary fields.

Set the connection to Nailed Up so that ZyWALL keeps the connection open automatically.

Select Site-to-site and select the newly created IKE connection to the Intra2net system as gateway.

Select the network to be connected behind the Zywall as "Local policy". As "Remote Policy" select the network object you just created with the network of the Intra2net system.

Activate "Policy Enforcement" to ensure that the connection is secure against network manipulation.

Select "Proposal" AES128 and SHA1, set " Perfect Forward Secrecy (PFS)" to DH2.