Site-to-Site connection via Point-to-point wifi

Options
baba
baba Posts: 280  Master Member
First Anniversary 10 Comments Friend Collector

Hi all,

i've two Zyxel USG Flex 200 and two Mikrotik Cube 60Pro ac on Site A and B. What's the best way to realize a site to site connection via point-to-point wifi? Site A and Site B have both several VLANs that should be accessed from the other site by security policy rules. The Mikrotik Cube 60Pro's are in bridge mode and "act as a network cable".

Site A: vlan 50 10.50.0.0/16 as example
USG Flex vlan 50 10.10.50.1, vlan 70 10.70.70.1
Mikrotik Cube 60Pro vlan 70 10.70.70.10

Site B: vlan 60 10.60.0.0/16 as example
USG Flex vlan 60 10.10.60.1, vlan 70 10.70.70.2
Mikrotik Cube 60Pro vlan 70 10.70.70.20

  1. Should I add the Mikrotik Cube 60Pro in a Transfer VLAN 10.70.70.0/24?
  2. Both sites have it's own DSL connection. Could the dsl connection be used for backup on the other site?
  3. Is a Site-to-Site VPN as Backup connection possible?
  4. Do I need a static route in Site A USG Flex 10.10.60.0.0/16 → 10.70.70.2 and Site B USG Flex 10.10.50.0.0/16 → 10.70.70.1?
  5. Do I need a static route for Mikrotik Cube 60Pro in the transfer VLAN 70? USG Flex Site A 10.70.70.0/24 →10.70.70.10, Site B 10.70.70.0/24 → 10.70.70.20)
  6. Could I manage access via security policies in this setup?

Thanks!

Best,
baba

«1

All Replies

  • PeterUK
    PeterUK Posts: 2,878  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer
    edited July 2023
    Options

    Not sure what the Mikrotik doing but VLAN70 can not work on the same IP subnet

    You should not need static route but routing can be needed

    so site A site to site

    local policy 10.70.70.0/24

    remote policy 10.70.80.0/24

    routing

    incoming VLAN70

    destination 10.70.80.1/24

    site B site to site

    local policy 10.70.80.0/24

    remote policy 10.70.70.0/24

    routing

    incoming VLAN70

    destination 10.70.70.1/24

  • baba
    baba Posts: 280  Master Member
    First Anniversary 10 Comments Friend Collector
    Options

    @PeterUK  The Mikrotik Cube 60Pro's are in bridge mode and "act as a network cable".

    Should I choose the WAN2 port or a LAN port on the USG Flex's? So that I can use the DSL connection of the other site, only WAN2 remains right?

  • baba
    baba Posts: 280  Master Member
    First Anniversary 10 Comments Friend Collector
    edited August 2023
    Options

    @PeterUK why two separated subnets for vlan70? both usg flex must be in the same subnet to communicate with each other. only the mikrotik's and the usg's are in vlan70

  • PeterUK
    PeterUK Posts: 2,878  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer
    edited August 2023
    Options

    Well a device with 10.70.70.22 looking for 10.70.70.33 which is on the other site will never communicate with each because 10.70.70.2 will ARP in local subnet never go to the USG to gateway to the other site.

  • baba
    baba Posts: 280  Master Member
    First Anniversary 10 Comments Friend Collector
    Options

    @PeterUK i mean a setup like this:

  • PeterUK
    PeterUK Posts: 2,878  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer
    edited August 2023
    Options

    Ok show me IPs of devices connected to each Flex 200.

  • baba
    baba Posts: 280  Master Member
    First Anniversary 10 Comments Friend Collector
    edited August 2023
    Options

    e.g. Switch A and Switch B1. this is only an example

  • PeterUK
    PeterUK Posts: 2,878  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer
    edited August 2023
    Options

    so site A site to site

    local policy 192.168.10.0/24

    remote policy 192.168.30.0/24

    site B site to site

    local policy 192.168.30.0/24

    remote policy 192.168.10.0/24

    Or you could do routing with SNAT none and static route

    site A

    routing

    incoming LAN

    destination 192.168.30.0/24

    Next hop gateway 192.168.20.2

    SNAT none

    site B

    routing

    incoming LAN

    destination 192.168.10.0/24

    Next hop gateway 192.168.20.1

    SNAT none

    that should work

  • baba
    baba Posts: 280  Master Member
    First Anniversary 10 Comments Friend Collector
    Options

    what is meant with local and remote policy? do you mean a direct route? there is no local and remote

  • baba
    baba Posts: 280  Master Member
    First Anniversary 10 Comments Friend Collector
    Options

    i would add one direct route in each usg, e.g. in my usg routing to my parents. ge4 is the network cable of the mkrotik

Security Highlight