No traffic with VPN site-to-site with 2 USG behind router
All Replies
-
Post pic of the config for both ends with advanced view
Do you see anything blocked in logs0 -
Hi @s4it_federico
Could you share the site-to-site VPN behind NAT topology with IP address to us? as below:Site A LAN subnet<=>(LAN)USG40(WAN:private IP) <=>ISP A Router <=Internet=> ISP B Router => (WAN:private IP)ATP100(LAN) <=> Site B LAN subnetWhat are LAN subnet domains(with IP range) cannot transfer traffic between Site A and Site B? What kind of traffics do you transfer(such as FTP)? When the traffic cannot be transferred, are there any security policies or UTM features blocked messages that can be observed on the Monitor Log page?Thanks.See how you've made an impact in Zyxel Community this year!
0 -
Site A 192.168.0.0<=>(192.168.0.1)USG40(WAN:192.168.99.2) <=>192.168.99.1 (public 185....) <=Internet=> (public 93....) 192.168.5.1 => (WAN:192.168.99.2)ATP100(192.168.10.1) <=> Site B 192.168.10.0
VPN Connection ATP100
VPN Connection USG40
VPN Gateway ATP100
VPN Gateway USG40
0 -
For the ATP100 thats connected to a router doing NAT have you set DMZ to 192.168.5.2? or try nailed-up on the ATP100 with the USG40 connected router DMZ to 192.168.99.2
Have you enabled Policy Control for from WAN to zywall UDP 500 and 4500
Does the status show connected?
Is Use Policy Route to control dynamic IPSec rules unchecked?
0 -
The "Casa" side has a dynamic IP?0
-
s4it_federico said:Site A 192.168.0.0<=>(192.168.0.1)USG40(WAN:192.168.99.2) <=>192.168.99.1 (public 185....) <=Internet=> (public 93....) 192.168.5.1 => (WAN:192.168.99.2)ATP100(192.168.10.1) <=> Site B 192.168.10.0
You could add policy route and security policy on USG40, ATP100 sites, as below:USG40
(1). To create a policy route (Network > Routing > Policy Route)
Incoming: Interface
Member : lan
Source IP: 192.168.0.0/24
Destination IP: 192.168.10.0/24(Site ATP100)
Next-hop: VPN tunnel, select the VPN tunnel to Site ATP100
(2). To create a Security Policy (Security Policy > Policy Control)
From: 192.168.0.0/24
To: IPSec_VPN
Source IP: 192.168.0.0/24
Destination IP: 192.168.10.0/24(Site ATP100)
Action: allowATP100
(1). To create a policy route (Network > Routing > Policy Route)
Incoming : Interface
Member : lan
Source IP: 192.168.10.0/24
Destination IP: 192.168.0.0/24(Site USG40)
Next-hop: VPN tunnel, select the VPN tunnel to Site USG40
(2). To create a Security Policy (Security Policy > Policy Control)
From: 192.168.10.0/24
To: IPSec_VPN
Source IP: 192.168.0.0/24
Destination IP: 192.168.10.0/24(Site USG40)
Action: allowSee how you've made an impact in Zyxel Community this year!
0 -
s4it_federico said:Site A 192.168.0.0<=>(192.168.0.1)USG40(WAN:192.168.99.2) <=>192.168.99.1 (public 185....) <=Internet=> (public 93....) 192.168.5.1 => (WAN:192.168.99.2)ATP100(192.168.10.1) <=> Site B 192.168.10.0Are you sure about the bold part?WAN 192.168.99.2 cannot reach its gateway 192.168.5.1, if you don't set a large netmask.Another thing: ISP routers are forwarding needed ports to Zyxel devices?0
-
valerio_vanni said:s4it_federico said:Site A 192.168.0.0<=>(192.168.0.1)USG40(WAN:192.168.99.2) <=>192.168.99.1 (public 185....) <=Internet=> (public 93....) 192.168.5.1 => (WAN:192.168.99.2)ATP100(192.168.10.1) <=> Site B 192.168.10.0Are you sure about the bold part?WAN 192.168.99.2 cannot reach its gateway 192.168.5.1, if you don't set a large netmask.Another thing: ISP routers are forwarding needed ports to Zyxel devices?0
Categories
- All Categories
- 415 Beta Program
- 2.4K Nebula
- 151 Nebula Ideas
- 100 Nebula Status and Incidents
- 5.8K Security
- 284 USG FLEX H Series
- 278 Security Ideas
- 1.5K Switch
- 74 Switch Ideas
- 1.1K Wireless
- 42 Wireless Ideas
- 6.5K Consumer Product
- 251 Service & License
- 396 News and Release
- 85 Security Advisories
- 29 Education Center
- 10 [Campaign] Zyxel Network Detective
- 3.6K FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 86 About Community
- 75 Security Highlight