ZyWall vti trunk, don't work some sites

alexey
alexey Posts: 188  Master Member
First Comment Friend Collector Fifth Anniversary
edited April 2021 in Security
Hello.
Build ipsec vti trunk beetween 2 ZyWall USG 1100 like this instruction https://kb.zyxel.ru/hc/ru/articles/115002596454-%D0%9F%D1%80%D0%B8%D0%BC%D0%B5%D1%80-%D0%BD%D0%B0%D1%81%D1%82%D1%80%D0%BE%D0%B9%D0%BA%D0%B8-%D0%B1%D0%B0%D0%BB%D0%B0%D0%BD%D1%81%D0%B8%D1%80%D0%BE%D0%B2%D0%BA%D0%B8-IPSec-VPN-%D1%82%D1%83%D0%BD%D0%BD%D0%B5%D0%BB%D0%B5%D0%B9-%D0%B2-%D1%83%D1%81%D1%82%D1%80%D0%BE%D0%B9%D1%81%D1%82%D0%B2%D0%B0%D1%85-%D1%81%D0%B5%D1%80%D0%B8%D0%B8-ZyWALL-USG
After that users from second area can't connect to some sites in Internet, like vk.com or sberbank.ru via vti.
If I add policy route to this sites direct via WAN interface, not vti trunk, they work correctly.
What could be the problem?
Don't fragmentation enable, via simple ipsec vpn all work perfectly


Accepted Solution

All Replies

  • Zyxel_Emily
    Zyxel_Emily Posts: 1,417  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Sales Associate 100 Answers 1000 Comments

    Hi @alexey,

    The vti trunk you created in Trunk > User Configuration is only used for VPN load balancing, so we use the vti trunk in policy route to achieve VPN failover.

    You don't have to replace the SYSTEM_DEFAULT_WAN_TRUNK with vti_trunk.

    In this way, PCs in LAN can still access the Internet via its own WAN trunk, not via the vti_trunk.

    Here is the configuration in Trunk for your reference.


  • alexey
    alexey Posts: 188  Master Member
    First Comment Friend Collector Fifth Anniversary
    No, we need that site B goes to Internet via vti trunk with site A. And add policy route with all from local on site B to vti trunk with site A. Some sites don't open from site B. Early was simple ipsec with reserved gateways from sites, site B goes to internet perfectly. Ipsec vpn and vti trunk in ipsec zone. Its not problem with firewall rules.
  • alexey
    alexey Posts: 188  Master Member
    First Comment Friend Collector Fifth Anniversary
    It sounds great! Thanks. I'm waiting new firmware.
  • Zyxel_Emily
    Zyxel_Emily Posts: 1,417  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Sales Associate 100 Answers 1000 Comments

    The firmware is ready. 
    Check your inbox for the firmware download link.

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）