Site-to-Site connection via Point-to-point wifi

baba
baba Posts: 280  Master Member
First Comment Friend Collector First Anniversary

Hi all,

i've two Zyxel USG Flex 200 and two Mikrotik Cube 60Pro ac on Site A and B. What's the best way to realize a site to site connection via point-to-point wifi? Site A and Site B have both several VLANs that should be accessed from the other site by security policy rules. The Mikrotik Cube 60Pro's are in bridge mode and "act as a network cable".

Site A: vlan 50 10.50.0.0/16 as example
USG Flex vlan 50 10.10.50.1, vlan 70 10.70.70.1
Mikrotik Cube 60Pro vlan 70 10.70.70.10

Site B: vlan 60 10.60.0.0/16 as example
USG Flex vlan 60 10.10.60.1, vlan 70 10.70.70.2
Mikrotik Cube 60Pro vlan 70 10.70.70.20

  1. Should I add the Mikrotik Cube 60Pro in a Transfer VLAN 10.70.70.0/24?
  2. Both sites have it's own DSL connection. Could the dsl connection be used for backup on the other site?
  3. Is a Site-to-Site VPN as Backup connection possible?
  4. Do I need a static route in Site A USG Flex 10.10.60.0.0/16 → 10.70.70.2 and Site B USG Flex 10.10.50.0.0/16 → 10.70.70.1?
  5. Do I need a static route for Mikrotik Cube 60Pro in the transfer VLAN 70? USG Flex Site A 10.70.70.0/24 →10.70.70.10, Site B 10.70.70.0/24 → 10.70.70.20)
  6. Could I manage access via security policies in this setup?

Thanks!

Best,
baba

«1

All Replies

  • PeterUK
    PeterUK Posts: 3,326  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited July 2023

    Not sure what the Mikrotik doing but VLAN70 can not work on the same IP subnet

    You should not need static route but routing can be needed

    so site A site to site

    local policy 10.70.70.0/24

    remote policy 10.70.80.0/24

    routing

    incoming VLAN70

    destination 10.70.80.1/24

    site B site to site

    local policy 10.70.80.0/24

    remote policy 10.70.70.0/24

    routing

    incoming VLAN70

    destination 10.70.70.1/24

  • baba
    baba Posts: 280  Master Member
    First Comment Friend Collector First Anniversary

    @PeterUK  The Mikrotik Cube 60Pro's are in bridge mode and "act as a network cable".

    Should I choose the WAN2 port or a LAN port on the USG Flex's? So that I can use the DSL connection of the other site, only WAN2 remains right?

  • baba
    baba Posts: 280  Master Member
    First Comment Friend Collector First Anniversary
    edited August 2023

    @PeterUK why two separated subnets for vlan70? both usg flex must be in the same subnet to communicate with each other. only the mikrotik's and the usg's are in vlan70

  • PeterUK
    PeterUK Posts: 3,326  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited August 2023

    Well a device with 10.70.70.22 looking for 10.70.70.33 which is on the other site will never communicate with each because 10.70.70.2 will ARP in local subnet never go to the USG to gateway to the other site.

  • baba
    baba Posts: 280  Master Member
    First Comment Friend Collector First Anniversary

    @PeterUK i mean a setup like this:

  • PeterUK
    PeterUK Posts: 3,326  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited August 2023

    Ok show me IPs of devices connected to each Flex 200.

  • baba
    baba Posts: 280  Master Member
    First Comment Friend Collector First Anniversary
    edited August 2023

    e.g. Switch A and Switch B1. this is only an example

  • PeterUK
    PeterUK Posts: 3,326  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited August 2023

    so site A site to site

    local policy 192.168.10.0/24

    remote policy 192.168.30.0/24

    site B site to site

    local policy 192.168.30.0/24

    remote policy 192.168.10.0/24

    Or you could do routing with SNAT none and static route

    site A

    routing

    incoming LAN

    destination 192.168.30.0/24

    Next hop gateway 192.168.20.2

    SNAT none

    site B

    routing

    incoming LAN

    destination 192.168.10.0/24

    Next hop gateway 192.168.20.1

    SNAT none

    that should work

  • baba
    baba Posts: 280  Master Member
    First Comment Friend Collector First Anniversary

    what is meant with local and remote policy? do you mean a direct route? there is no local and remote

  • baba
    baba Posts: 280  Master Member
    First Comment Friend Collector First Anniversary

    i would add one direct route in each usg, e.g. in my usg routing to my parents. ge4 is the network cable of the mkrotik

Security Highlight