Site-to-Site connection via Point-to-point wifi

baba

Hi all,

i've two Zyxel USG Flex 200 and two Mikrotik Cube 60Pro ac on Site A and B. What's the best way to realize a site to site connection via point-to-point wifi? Site A and Site B have both several VLANs that should be accessed from the other site by security policy rules. The Mikrotik Cube 60Pro's are in bridge mode and "act as a network cable".

Site A: vlan 50 10.50.0.0/16 as example
USG Flex vlan 50 10.10.50.1, vlan 70 10.70.70.1
Mikrotik Cube 60Pro vlan 70 10.70.70.10

Site B: vlan 60 10.60.0.0/16 as example
USG Flex vlan 60 10.10.60.1, vlan 70 10.70.70.2
Mikrotik Cube 60Pro vlan 70 10.70.70.20

1. Should I add the Mikrotik Cube 60Pro in a Transfer VLAN 10.70.70.0/24?
2. Both sites have it's own DSL connection. Could the dsl connection be used for backup on the other site?
3. Is a Site-to-Site VPN as Backup connection possible?
4. Do I need a static route in Site A USG Flex 10.10.60.0.0/16 → 10.70.70.2 and Site B USG Flex 10.10.50.0.0/16 → 10.70.70.1?
5. Do I need a static route for Mikrotik Cube 60Pro in the transfer VLAN 70? USG Flex Site A 10.70.70.0/24 →10.70.70.10, Site B 10.70.70.0/24 → 10.70.70.20)
6. Could I manage access via security policies in this setup?

Thanks!

Best,
baba

PeterUK

Not sure what the Mikrotik doing but VLAN70 can not work on the same IP subnet

You should not need static route but routing can be needed

so site A site to site

local policy 10.70.70.0/24

remote policy 10.70.80.0/24

routing

incoming VLAN70

destination 10.70.80.1/24

site B site to site

local policy 10.70.80.0/24

remote policy 10.70.70.0/24

routing

incoming VLAN70

destination 10.70.70.1/24

baba

@PeterUK  The Mikrotik Cube 60Pro's are in bridge mode and "act as a network cable".

Should I choose the WAN2 port or a LAN port on the USG Flex's? So that I can use the DSL connection of the other site, only WAN2 remains right?

baba

@PeterUK why two separated subnets for vlan70? both usg flex must be in the same subnet to communicate with each other. only the mikrotik's and the usg's are in vlan70

PeterUK

Well a device with 10.70.70.22 looking for 10.70.70.33 which is on the other site will never communicate with each because 10.70.70.2 will ARP in local subnet never go to the USG to gateway to the other site.

baba

@PeterUK i mean a setup like this:

PeterUK

Ok show me IPs of devices connected to each Flex 200.

baba

e.g. Switch A and Switch B1. this is only an example

PeterUK

so site A site to site

local policy 192.168.10.0/24

remote policy 192.168.30.0/24

site B site to site

local policy 192.168.30.0/24

remote policy 192.168.10.0/24

Or you could do routing with SNAT none and static route

site A

routing

incoming LAN

destination 192.168.30.0/24

Next hop gateway 192.168.20.2

SNAT none

site B

routing

incoming LAN

destination 192.168.10.0/24

Next hop gateway 192.168.20.1

SNAT none

that should work

baba

what is meant with local and remote policy? do you mean a direct route? there is no local and remote

baba

i would add one direct route in each usg, e.g. in my usg routing to my parents. ge4 is the network cable of the mkrotik